YARA and Sigma Rule Feed

Boost your detection capabilities with the power of thousands of hand-crafted high-quality YARA and Sigma rules.

Fact Sheet
Get Started
VALHALLA supercharges your detection with 22,000+ YARA and 4,000+ Sigma rules – hand crafted, curated and high quality.

The database grows by 1,000 to 1,500 rules every year. A subscription includes the curation of old rules. We change and improve around 500 old rules every year.

Our team curates YARA rules in 8 different categories: APT, Hack Tools, Malware, Web Shells, Exploits, Threat Hunting, Anomalies and Third Party. The first five of them can be subscribed, the other three are only used in a compiled and encrypted form in our scanner THOR.

With access to VALHALLA, you can boost your detection by adding most of our highly successful THOR scanners’ signatures to your own scan engines.

All rules are performance optimised and quality tested against terabytes of goodware and other data.

22,000+

quality tested YARA rules

4,000+

handcrafted Sigma rules

1,000+

new rules every year

~500

changed and improved old rules every year

Growth

The rule set grows by 1,000 to 1,500 hand-written and quality tested rules per year.

Delivery

You can download the full subscribed set via web browser or use our public API client written in Python to get a customized rule set that fits your scan engine.

Subscription

We offer subscriptions for each of our rule set categories or the whole curated rule set. Each subscription includes improvements, fixes and updates on the subscribed categories for 12 months.

Performance Optimization

All rules are used in our scanners and therefore optimized for performance. The planned version 1.1 of the API will allow you to pull less strict rule sets that are more effective for in-memory detection and the detection in data streams.

Curation

We improve around 500 old rules per year. These improvements include false positive reductions and the tightening or extension of existing rules.

Trial

We cannot offer a trial of our rule set. However, the public API allows you to retrieve and test a streamlined demo rule set, which is an equivalent of the public signature-base that is integrated in our free scanner THOR Lite.

Rich Meta Data

Valhalla provides rich meta data that adds valuable context to each match, such as a web reference, related threat group campaigns, hashes of samples for which the rule was initially created and a list of  public samples on which the rule has matched so far.

Each rule contains information about the required YARA version and modules to run that rule.

The API client allows you to retrieve only those rules that your product supports.

The rule’s score and tags indicate its reliability and scope. Both can be used to select the perfect rule set for your application.

Web Frontend

The website allows you to immediately retrieve your subscribed rules using nothing but a web browser.

Just insert your API key and click on “Get Rules”.

You can also select the “JSON” checkbox to get them in JSON format or select “DEMO” to test drive this feature with a demo API key, which allows you to retrieve all public YARA or Sigma rules in the selected format.

The website also contains statistics about the current rule set.

View Website

Smart API

The Python module allows you download the subscribed categories as text or JSON object. It even has presets for well-known products like FireEye’s appliances, Tenable, Tanium, CarbonBlack or Symantec MAA.

It requires no more than 3 lines of code to retrieve the subscribed rule set:

from valhallaAPI.valhalla import ValhallaAPI

v = ValhallaAPI(api_key="Your API Key")
response = v.get_rules_text(product="FireEyeEX")

Integration

The web API allows you to retrieve the perfect set that integrates seamlessly with the platform you use. 
Depending on your use case, we recommend subscriptions for different rule categories.

Note: The feed cannot be downloaded or used on Microsoft Windows or macOS systems.

Command Line Client

The comfortable command line client ‘valhalla-cli’ helps to integrate the rule retrieval into your deployment process.

It’s really as simple as it gets.

It can be installed running the following command:

pip3 install valhallaAPI

The next command retrieves all subscribed rules:

valhalla-cli -k APIKEY

The command line client supports proxy servers and allows you to apply numerous filters, e.g.

  • Exclude rules with low scores
    (e.g. threat hunting rules with scores lower than 75)
  • Exclude rules that wouldn’t work on your scan engine (e.g. “Tanium”)
  • Retrieve only rules with certain tags
    (e.g. “CHINA”, “APT”)
Learn More

(note: the API key shown in the animated GIF is not valid anymore)

“I have been given the opportunity to evaluate Nextron’s VALHALLA feed. The handcrafted high quality detections with literally zero false-positive rate are an unmatched capability that does not only enable your detection technologies to stay ahead of the latest advanced threats but also is an extension of your own security team. Given the high quality and value the feed provides I can highly recommend VALHALLA.”

Markus Neis
Swisscom Schweiz AG

YARA Categories:
Subscribable

This category contains all kinds of tools used for hacking purposes and often classified as “Potentially Unwanted Application (PUA)” like port scanners, password dumpers, privilege escalation, lateral movement or tunneling tools. It also contains rules for output or temporary files of the mentioned hacktools that adversaries sometimes forget to remove from the compromised systems.

Special Strengths:

  • Rules to detect a variety of offensive security tools and frameworks
  • Rules cover the tool itself, output, helper files and special command line parameters to detect their use in log files
It contains all kinds of hacktools or malware related to threat actor activity. Rules with this tag often have references to certain threat actor reports. This category has many overlaps to the “Hacktool” and “Malware” categories.

Special Strengths:

  • High grade rules for malware and tools used by threat groups
  • Based on public reports, our own undisclosed threat intel work, threat intel partners, threat exchanges and active incident response cases (mainly Europe, Asia and the Middle East)
This category contains web shells written in PHP, JSP(X), ASP(X) that attackers drop on web servers to persist and pivot to other systems in the network. It also has many rules for obfuscated web shells.

Special Strengths:

  • Often very low Antivirus detection ratio
  • One of the things most EDRs are unable to detect
This category contains all types of commodity malware, credential stealer, worms, ransomware, cryptocoin miner and all other types of common malware.
This is the smallest category for rules that detect exploit codes, weaponized documents and tools to exploit local and remote exploits. The rules typically contain links to research and CVE numbers as references.

YARA Categories:
Only Available in THOR Scanner

The threat hunting category contains the most extraordinary set of rules for anomaly, obfuscation and suspicious indicator detection. The rules are often highly generic and able to detect yet unknown threats. It contains rules for casing anomalies, many rules for differently encoded keywords, rare executable packers, PE header data anomalies and other obfuscation techniques.

Special Strengths:

  • Generic rules / heuristic detection methods focus on methods and obfuscation instead of specific threats
  • Highly effective in detecting new, yet unknown threats
Anomaly detection rules are special rules that make use of external variables passed into the rule matching process by the scanner. We use anomaly detection rules to report modified system files, uncommon process characteristics and suspicious combinations (e.g. RARSFX file with Microsoft copyright)
Rules provided by our threat intelligence and incident response partners cannot be provided in clear text form.

YARA Categories:
Quantity Comparison

* only in THOR scanner

Frequently Asked Questions

Nextron Sigma Feed

What is the Nextron Sigma Feed?

The Nextron Sigma Feed is a curated commercial feed of Sigma detection rules maintained by Nextron’s Research Team.

It is separate from SigmaHQ. SigmaHQ is a public community project. The Nextron Sigma Feed is focused on curated, operationally useful Sigma detection logic for security monitoring, threat hunting and alerting workflows.

Is the Nextron Sigma Feed the same as SigmaHQ?

No, SigmaHQ is a public community repository that has grown over many years. A significant number of SigmaHQ rules were contributed by Nextron employees over time, but SigmaHQ also contains many rules from external contributors.

The Nextron Sigma Feed is a separate curated feed. It is maintained by Nextron and follows our internal quality, testing and maintenance process.

Why should I use the Nextron Sigma Feed if many Sigma rules are public?

Public Sigma rules are useful, but they vary a lot in style, quality, age, metadata and operational relevance.

The Nextron Sigma Feed focuses on curated Sigma detection logic. The value is not just the number of Sigma rules. The value is in rule quality, maintenance, useful metadata, reduced noise and detection logic that is written with real operational use in mind.

How does Nextron decide which Sigma rules go into the private Sigma Feed?

We mainly include Sigma rules where we see long-term operational value.

This includes behavior-based Sigma rules, carefully researched detection logic, rules with useful metadata and rules that fit our own detection engineering standards.

Some Sigma detections may also be shared publicly, especially when they support community defense against a major current threat. The private Sigma Feed is where we maintain our curated commercial Sigma coverage.

Are private Nextron Sigma rules more complex than public Sigma rules?

Not necessarily, a good Sigma rule is not better because it is longer or more complex. In many cases, unnecessary complexity is a problem.

Private Nextron Sigma rules are intended to be better curated, better documented, tested more carefully and written with operational use in mind. Some valuable Sigma rules are technically simple, but they detect the right behavior with the right constraints and useful context.

What makes a good Sigma rule?

A good Sigma rule should usually meet several criteria:

  • it detects meaningful behavior
  • it performs well
  • it avoids unnecessary false positives
  • it includes useful metadata and references
  • it is understandable for analysts
  • where possible, it detects a technique or behavior pattern, not just a single IOC

For high-confidence Sigma rules, especially High or Critical rules, we expect a much lower false-positive rate than for lower-level hunting or informational rules.

Are Nextron Sigma rules based on public threat reports?

Some are, yes. Many good Sigma detections start from public information: threat reports, blog posts, vendor documentation, incident write-ups or public malware analysis.

The added value is the research work after that: understanding the broader technique, checking how it appears in telemetry, identifying variants, reducing false positives and turning it into Sigma logic that is not limited to one narrow IOC.

Other Sigma rules come from Nextron’s own research, incident response experience, product telemetry, malware analysis and detection engineering work.

Are Nextron Sigma rules only IOC-based?

No, we avoid building a Sigma feed that mostly consists of IOC-style rules.

It would be easy to turn every filename, hash or domain into a Sigma rule and inflate the feed. That usually creates poor long-term value.

Our focus is on behavior-based Sigma detections where possible. IOC-like Sigma rules can still make sense for short-lived emerging threats, but they should not be the foundation of a high-quality Sigma feed.

What is an example of a long-lasting Sigma detection?

A typical example is a Sigma rule that detects suspicious child processes spawned by web server processes.

The exact vulnerability, exploit payload or web application may change. The post-exploitation behavior often stays similar: a web server process unexpectedly starts command shells, scripting engines or administrative tools.

That kind of Sigma rule is not tied to one CVE, filename, hash or threat actor. It can detect variants of a broader attack pattern and therefore remains useful longer.

How often is the Nextron Sigma Feed updated?

We usually release Sigma rule updates twice per week.

For important threats, we can react faster when needed. In many cases, existing generic Sigma rules already cover parts of a newly described attack chain before a new threat-specific Sigma rule is created.

How quickly does Nextron react to new threats with Sigma rules?

It depends on the threat and on the available information.

If a new vulnerability has very specific exploit patterns, a new Sigma rule may require additional research. That can take some time, especially if public information is incomplete or noisy.

However, many attacks include behavior that is already covered by existing generic Sigma rules, for example suspicious process trees, PowerShell abuse, credential access behavior or unusual execution chains.

So the question is not only “how fast can we write a new Sigma rule”, but also “how much of the behavior is already covered by existing generic Sigma logic”.

What do Sigma levels like Critical, High, Medium, Low and Informational mean?

Sigma levels indicate the expected severity and handling of a match.

In general:

  • Critical Sigma rules should be very high confidence and should not produce regular false positives
  • High Sigma rules should usually be monitored closely, sometimes with environment-specific baselining
  • Medium Sigma rules often require more context or correlation
  • Low and Informational Sigma rules are often useful for dashboards, hunting, trend analysis, correlation or volume-based monitoring

The level should always be interpreted together with the data source, environment, expected volume and rule context.

What does “experimental” mean for a Nextron Sigma rule?

“Experimental” does not mean that a Nextron Sigma rule is unused, uncurated or unsuitable for production use.

The status is currently handled very conservatively. Some Sigma rules may remain marked as experimental for a long time even though they are already included in the feed and have not shown notable false-positive issues in practice.

We are improving the lifecycle process around Sigma rule status handling so that telemetry and field feedback can be reflected more consistently over time.

How should I evaluate the value of the Nextron Sigma Feed?

A Sigma feed should not be evaluated only by rule count.

Better criteria are:

  • detection relevance
  • false-positive behavior
  • metadata quality
  • coverage of useful techniques
  • update frequency
  • maintenance quality
  • analyst context
  • operational fit for your telemetry and SIEM

A smaller set of well-maintained Sigma rules is usually more useful than a very large set of noisy or mass-generated rules.

How many Sigma rules are in the Nextron Sigma Feed?

The current number is shown on the Valhalla statistics page.

We also provide statistics that show the Sigma Feed distribution by level, category, log source and metadata. This gives a better view of the feed than a single total number.

How fast is the Nextron Sigma Feed growing?

Growth varies over time. As a rough reference, Nextron’s Research Team wrote or updated more than 300 Sigma rules in 2025.

We prefer controlled growth over mass generation. The goal is not to add the largest possible number of Sigma rules, but to maintain useful detection logic that analysts can actually work with.

Can we review example Sigma rules before subscribing?

Selected Sigma examples can be provided for review.

We prefer curated examples over simply sharing the last few rules chronologically. The last three Sigma rules may be narrow, random or not representative of the feed.

A better sample set usually includes different types of Sigma detections, for example a high-confidence behavior rule, an emerging-threat-style rule and a generic long-lasting detection rule.

Is the Nextron Sigma Feed related to the Valhalla YARA Feed?

Both can be delivered through Valhalla, but they are different feeds for different detection use cases.

The Sigma Feed contains Sigma rules for log and event-based detection.

The YARA Feed contains YARA rules for file, memory and artifact scanning.

Customers should evaluate them separately depending on their use case, telemetry and detection platform.