Next free-source hunt
We check for new free data every weekday.
Datasets / Cyber Threat
github.com/

Neo23x0 Signature-Base

Freemiumauth: noneCustom#cyber-threat#threat-intel#vulnerabilities✓ verified Nov 1, 2026

Neo23x0 Signature-Base

Signature-Base is a keyless repository of YARA detection rules and simple IOC files used by the LOKI and THOR Lite scanners. YARA files carry rule logic and metadata, while the IOC directory separates hashes, filenames and C2 indicators; a semicolon-delimited rule index includes names, descriptions, references, dates, scores, authors, tags and hashes.

Required Attribution:

When sharing a rule, retain supplied "identification of the authors(s) ("author" field)" and a practical URI to the rule or rule set; match messages must also retain supplied author identification.

Coverage

The repository tree checked on 2026-11-01 contained 752 .yar or .yara files plus five files under iocs. The provider describes the repository as actively developed but states no fixed update schedule or historical coverage period.

Verdict

This is defensive data for scanning files, enriching alerts and matching known threat artefacts with YARA and IOC patterns. Rules may require LOKI or THOR Lite external variables, and the README says other tools can report undefined identifiers unless affected files are removed or variables are supplied. False positives and rule-specific licence overrides need to be handled per file, while repository changes can alter detection behaviour. Do not visit or fetch IOC URLs, domains or hosts; download only the repository files and scan data you are authorized to inspect.

Get the free weekly email

Free weekly email of newly verified free data. Unsubscribe by emailing us.

By entering your email and clicking Subscribe, you agree to receive the Signal Lab weekly email from Quantum Data Technologies Ltd., 3200-650 West Georgia Street, Vancouver, BC V6B 4P7, Canada (signal-lab@qdt.ai). You can unsubscribe at any time: reply "unsubscribe" to any email or write to signal-lab@qdt.ai. See our Privacy Policy.

Use in your agent

Load the Signature-Base rule index into pandas and Parquet. Checked against the provider's documentation on Nov 1, 2026.

Raw skill file (/skills/neo23x0-signature-base.md)Also in our MCP server: call get_ingestion_skill with {"slug": "neo23x0-signature-base"}.

Access

  • No account or key. Raw repository files are public downloads.
  • Detection Rule License 1.1 applies except where a YARA rule explicitly states another licence.

Request

bash
curl -O 'https://raw.githubusercontent.com/Neo23x0/signature-base/master/sig-base-rules.csv'

Format

Semicolon-delimited rule index. The ingestion keeps the rule name separate and preserves the remainder of each record because some free-text fields contain extra semicolons.

Load into pandas and Parquet

Needs Python 3 with requests, pandas and pyarrow.

python
"""Signature-Base rule index -> pandas -> Parquet. No key."""
import requests
import pandas as pd

URL = "https://raw.githubusercontent.com/Neo23x0/signature-base/master/sig-base-rules.csv"
r = requests.get(URL, headers={"User-Agent": "SignalLabCheck/1.0"}, timeout=30)
r.raise_for_status()
rows = []
for line in r.text.splitlines():
    if line.strip():
        rule, _, record = line.partition(";")
        rows.append({"rule": rule, "record": record})
df = pd.DataFrame(rows)
df.to_parquet("signature_base_rule_index.parquet", index=False)
print(len(df), "rule index rows", df["rule"].nunique(), "distinct rule names")

Run by us on 2026-11-01 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: 3216 rule index rows 3216 distinct rule names

Limits

  • Rate limit: Not stated.
  • The public repository is smaller than the separate commercial rule set advertised by the provider.
  • Rule-specific YARA metadata can override the repository-level licence.

Quirks

  • The semicolon-delimited index has no header and some free-text records contain extra semicolons; this example preserves the unparsed remainder.
  • Some rules use external variables supplied by LOKI or THOR Lite and can fail in other YARA tools unless those variables are defined.
  • Do not connect to IOC URLs, domains or hosts; ingest the IOC text only.

Terms and attribution

  • Detection Rule License 1.1 permits broad reuse, including commercial use, subject to retained attribution, source-link and licence information when rules are shared.
  • Messages produced from matches must retain supplied rule-author identification.
  • A YARA rule can declare a different licence in its metadata.

Sources

Information and education only. Not financial, investment, legal or tax advice. Listings can be inaccurate, incomplete or out of date and are provided "as is". Free tiers, limits and licenses belong to each provider and can change, so check the provider's own terms before you rely on them. Terms & Disclaimer

Related entries