// the take
signature-base is the public YARA rule and IOC collection behind Florian Roth's LOKI and THOR Lite scanners, covering hundreds of named APT campaigns, crimeware families, and webshells. It's for DFIR analysts and threat hunters who want a free, high-volume rule set to run against disk images or live hosts, not for YARA beginners looking for a tidy starter pack.
The rule set is actively maintained with entries added within days of recent campaigns (e.g. the Cisco ASA LINEVIPER and virtualizor compromise rules from this year), so it tracks real threat intel rather than sitting stale. CI runs a syntax check on every YARA file via GitHub Actions before merge, which catches broken rules before they ship. IOCs are split out into plain CSV files (hashes, C2, filenames) so you can consume them without a YARA engine at all. There are also MISP/OTX receiver scripts for pulling threat intel directly into the rule format.
A chunk of rules reference external variables that only LOKI/THOR define, so running them through a stock `yara` CLI or another engine throws undefined-identifier errors until you manually delete the files listed in external-variable-rules.txt. The license switched to the Detection Rule License 1.1 in 2021, which is not a standard permissive or copyleft license and has restrictions worth reading before pulling this into a commercial pipeline. The README is upfront that this is the cut-down free version — the author sells a commercial feed with 20x the rules and presumably fewer false positives, so what's here is intentionally the subset, not the best Roth has. There's no tagging or changelog for the rule set itself, so pinning to a known-good version for a production pipeline is on you.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →