detections

YARA and Sigma detection rules by Turki Almalki. Most rules come out of analysis write-ups published at turkisecurity.com — where they do, the rule's reference metadata links to the post.

Layout

Directory	Contents
yara/	YARA rules for file/memory scanning
sigma/	Sigma rules for SIEM detection

CI

Every push runs two checks:

• YARA — each .yar file is compiled with yara --fail-on-warning; a rule that doesn't compile (or warns) fails the build.
• Sigma — sigma check (from sigma-cli) validates every rule against the Sigma specification.

Conventions

• One rule (or tight rule family) per file, named after the rule.
• YARA rule names: SUSP_/MAL_/HUNT_ prefix, PascalCase.
• Sigma filenames follow SigmaHQ style: <category>_<product>_<description>.yml.
• Every rule carries author, date, description, and a reference where one exists.

License

Detection Rule License (DRL) 1.1 — free to use with attribution.