Sigma & YARA rules, curated, signed, ready to ship.
A commercial detection feed for your SIEM or stack. The best open-source projects aggregated and deduplicated, enriched with our proprietary rules, every rule tested against a real engine, cryptographically signed, continuously updated.
Two standard formats. Zero lock-in.
The open standard for detection. .yml files ready to convert to Splunk, Elastic, Microsoft Sentinel, QRadar… MITRE ATT&CK coverage, mapped per technique. Built from multiple permissively-licensed open-source sources + our own rules.
Raw .yar files to scan binaries, memory and artifacts. Malware families, packers, abused signing certs, campaigns. Resale-filtered and compile-checked, no broken rules.
IOC, KEV, EPSS and MITRE are ThreatClaw agent data packs, a separate offering. This feed focuses on Sigma & YARA detection rules.
Sigma, already converted for your SIEM.
No conversion to do. Every Sigma rule is also delivered in your SIEM’s query language, mapped to its field schema. Copy, paste, done.
Image="*\\powershell.exe"
CommandLine IN ("*-enc*","*-EncodedCommand*")DeviceProcessEvents
| where FolderPath endswith "\\powershell.exe"
| where ProcessCommandLine has_any ("-enc","-EncodedCommand")process.executable:*\\powershell.exe AND (process.command_line:*-enc* OR process.command_line:*-EncodedCommand*)
SELECT * FROM events WHERE
"Process Path" ILIKE '%\\powershell.exe' AND
("Process CommandLine" ILIKE '%-enc%' OR
"Process CommandLine" ILIKE '%-EncodedCommand%')You choose what you pull: raw Sigma for your own pipeline, the ready-to-use SIEM variants, or both. One key, everything included.
Not just a mirror of public repos.
Every manifest is Ed25519-signed with a pinned public key. A compromised mirror or CDN cannot push you poisoned rules. The script verifies before applying.
Every rule passes a firing test on the real engine: no dead rules, no catch-all rules drowning your SOC in false positives.
We aggregate the best sources, strip duplicates and noise, and add our own proprietary rules forged in-house. You get signal, not a raw dump.
Only permissive sources (CC0, MIT, Apache, BSD, DRL). Filtered for MSSP use and redistribution, no GPL/NC surprises.
New rules land as research and campaigns emerge. The feed is versioned: the script only pulls the delta.
Sigma is the pivot format: convert to your SIEM with pySigma / sigma-cli. YARA plugs into any scanner. You’re not tied to our product.
Live in three minutes.
Secure Stripe checkout. You get a subscription key instantly.
One dependency-free bash script, cron-ready. It verifies the signature first.
Rules land in a local folder, versioned. Wire it into your SIEM or scanner.
Built for detection teams.
A sample of our in-house rules across every engine we run (Sigma, YARA, osquery, Velociraptor, Falco, network, policy), each detection with its investigation playbook in the CACAO 2.0 standard, importable into your SOAR. The Sigma rules come already converted for 6 SIEMs: Splunk, Sentinel, Elastic, QRadar, CrowdStrike and Panther. A NIS2 compliance-coverage sample is included. Generated without AI.
↓ Download the demo pack .zipFrequently asked questions
What formats do I get exactly?
Raw Sigma (.yml) and raw YARA (.yar) files, in standard format. Nothing proprietary: convert the Sigma to your SIEM with pySigma, load the YARA into any scanner.
Which SIEMs does it work with?
Any that Sigma targets: Splunk, Elastic/ELK, Microsoft Sentinel, QRadar, Chronicle and many more via pySigma / sigma-cli. YARA works anywhere a YARA scanner runs (endpoints, sandbox, DFIR).
How often is it updated?
Continuously, as research and new campaigns emerge. The feed is versioned, so the sync script only pulls what changed. Run it as often as you like (a daily cron is common).
Are the rules really signed?
Yes. The manifest is Ed25519-signed and the script verifies it with a pinned public key before applying anything. Forging a feed would need our private key, which we never share.
Can I resell it / use it as an MSSP?
The feed only aggregates permissively licensed sources (CC0, MIT, Apache, BSD, DRL), built for MSSP use and redistribution to your clients. Non-resalable sources (GPL, fair-use) are excluded.
Does the feed include IOCs / threat intel?
No, this feed focuses on Sigma & YARA detection rules. IOCs, CISA KEV, EPSS and MITRE ATT&CK are data packs consumed by the ThreatClaw agent, a separate offering.
Do I have to convert the rules myself (pySigma)?
No, unless you want to. On top of raw Sigma, we ship the rules already converted for Splunk (SPL), Microsoft Sentinel (KQL), Elastic (ECS), CrowdStrike (LogScale), Panther and QRadar (AQL), mapped to each SIEM’s field schema (CIM, ECS, Defender XDR). Copy, paste, done. Raw Sigma stays available for your own pipeline.
Ready to power your detection?
Annual subscription. Instant key. Cancel anytime.