All my detection rules live in a public GitHub repo, where CI compiles every YARA rule and validates every Sigma rule against the spec on each push:
→ github.com/TurkiPro/detections
Rules are organized by type:
| Directory | Contents | Validated with |
|---|---|---|
yara/ | YARA rules for file/memory scanning | yara --fail-on-warning |
sigma/ | Sigma rules for SIEM detection | sigma check (sigma-cli) |
Most rules come out of an analysis write-up — when they do, the rule’s reference metadata links back to the post, and the post links to the rule. See the posts section for the analysis behind them.