Signature-Base is a YARA signature and IOC database designed for threat detection and incident response.
The project addresses the need for high-quality detection rules and indicators of compromise in security scanning workflows. It maintains a curated collection of YARA rules and IOC files organized into clear directory structures: IOCs stored as simple CSV files, YARA rules in a dedicated directory, threat intelligence integrations for MISP and OTX feeds, and miscellaneous supporting files. The approach prioritizes minimal false positives, consistent rule formatting, and structural clarity to make the signatures practical for real-world use.
The tool is built primarily for integration with LOKI and THOR Lite scanners, though the YARA rules can be adapted for use in other tools. Developers should be aware that some rules use external variables specific to those scanners; rules relying on undefined identifiers are documented in a separate file and should be removed if using the signatures elsewhere. The project accepts community contributions through pull requests for both bug fixes and new rules, with false positive reports handled through the issue tracker. A commercial rule set with significantly expanded coverage is available separately for organizations requiring more comprehensive detection capabilities.
The project maintains an active approach to community feedback, with documented processes for reporting issues and contributing improvements. Pull requests are accepted for rule additions and corrections, and the maintainers engage with the community through documented contribution guidelines.
