Signatures

A TLP:CLEAR repository of detection rules licensed under the Detection Rule License (DRL) 1.1 (Why this license?).

YARA

All YARA rules (except those identifying weird properties, sometimes found in legitimate software) are ran through VirusTotal's YARA Continious Integration pipeline to rule out false positives.