YARA Rule Feeds

Stairwell maintains and licenses several rule sets that run alongside the rules you write, and they are not all for the same purpose. Two of them are built to be trusted on their own. The rest are built to narrow a large pile of files down to the ones worth a person's time, and treating those as detections is the fastest way to make your matches unreadable. This page covers which is which and how to use each.

You see every rule set you have access to in the Rules screen, in the Rule set column. Use the filter to include or exclude specific sets.

Which rule sets does Stairwell provide?

Which rule sets should I treat as detections?

Stairwell Research and Pro Rules. Those two are the detection-grade sets: they are written and vetted to be acted on, and a match from either one is a finding you follow up rather than a filter you apply. They are also the only rule sets whose matches feed the automated verdict on a file.

Everything else in the table is a hunting signal. A match tells you something about the file worth knowing, and it does not tell you the file is bad. That distinction is the whole point of the table above, and getting it backwards is what produces a team that ignores rule matches.

Even for the detection-grade sets, a match is evidence rather than a verdict. A rule that fires on a legitimate remote administration tool has produced a match, and the file is still a legitimate remote administration tool.

Why can I not see the body of a Pro Rules rule?

Licensing. The rules are licensed from a commercial provider on terms that do not include redistributing the rule text, so Stairwell shows you the matches and not the rule. You get the rule name, the match, and everything the platform knows about the matched file, which is what you need in order to act. You cannot read the condition or copy it into a rule of your own.

What are methodology rules for?

For sorting, not for alerting. A methodology rule describes a capability or a technique rather than a family: an encryption constant, direct physical disk access rather than ordinary file operations, function names resolved by hash instead of by name, a reference to an onion service, the creation of a single-character Windows service.

Those are all things that legitimate software occasionally does and that malicious software does constantly. So a methodology match on its own means very little, and a methodology match on a file that only three machines in the world have ever seen means quite a lot. The value is in the combination, which is why these rules are worth having enabled and not worth alerting on.

How do I hunt with methodology matches?

Combine a methodology match with rarity. That pairing is the highest-yield hunt available with these rules, and it takes three steps.

1. Open Rules and filter the list to the Stairwell Methodology rule set. Sort by My objects to see which of these rules your own files are matching, and pick one whose subject is interesting for your estate.
2. Click that rule's My objects count. The matching files open in search, with the query already written for you.
3. Narrow by rarity. Add the rarity conditions to the query:

rule.name == r"Methodology_Example_Rule_Name" && asset.count >= 1 && asset.global_count < 5

asset.count is how many of your own assets hold the file, and asset.global_count is how widely it is seen everywhere Stairwell can see. Requiring at least one of yours and fewer than five globally leaves you with files that are both present in your environment and close to unique in the world, which is the shape of early-stage tooling, a targeted build, or a component that was never meant to be shared. See Prevalence for what those numbers mean and CEL Query Language for the rest of the fields.

The second pairing worth knowing needs no query at all. Open a file's panel and read its YARA section, which lists every rule that matched it. A file carrying both a detection-grade match and several methodology matches is the highest-signal combination these rule sets produce, and it belongs at the front of the queue.

How do I scope a search to one rule set?

Every shared rule set is its own environment, so you scope to it by environment. The environment IDs for Stairwell's shared rule sets are the same for every customer and are listed in CEL Query Language.

For interactive work, the Rule set filter in the Rules list is faster than typing an ID.

Can I edit or copy these rules?

You can read them, and you cannot edit them. Every Stairwell-maintained rule set is read-only to you: the rules are maintained centrally and update without your involvement, which is the point of subscribing to them.

For any set whose bodies are visible, you can copy a rule's text into a new rule of your own and change it from there. That is the supported way to adapt one of these rules to your estate, and it is a good way to learn: the Research and Methodology rules are worked examples of most of YARA Rule Best Practices. Pro Rules bodies are not visible and cannot be copied.

Your copy is a separate rule with its own name, version history, and match counts, and it will not track later changes to the original.

What should I read next?

• YARA Rule Best Practices, for what makes the Research rules narrow and the Methodology rules deliberately broad.
• Import YARA Rules from GitHub, for adding a rule set of your own from a repository.
• Hunting and Search, for the rest of what the search bar accepts alongside these queries.