majiayu000 Custom Signatures Skill
Goal: Help users create, format, and deploy custom detection content for THOR.
Overview
THOR processes all files in the ./custom-signatures folder. The file extension and filename tags determine how each file is interpreted:
| Extension | Type | Description |
|---|---|---|
.txt |
Simple IOCs | CSV-style IOC files (hashes, filenames, C2s, etc.) |
.dat |
Encrypted IOCs | Encrypted simple IOCs (via thor-util) |
.yar |
YARA rules | Plain text YARA rules |
.yas |
Encrypted YARA | Encrypted YARA rules |
.yml |
Sigma rules | Log detection rules |
.yms |
Encrypted Sigma | Encrypted Sigma rules |
.json |
STIX v2 | STIXv2 JSON indicators |
.jsos |
Encrypted STIX | Encrypted STIX indicators |
Simple IOCs
Filename tags determine IOC type. Tag is detected via regex \Wc2\W (word boundary match).
| Tag in Filename | Purpose | Example Filename |
|---|---|---|
c2 or domains |
IPs, hostnames, CIDR ranges | case22-c2-iocs.txt |
filename or filenames |
Regex-based path/name IOCs | apt-filename-iocs.txt |
hash or hashes |
MD5, SHA1, SHA256, Imphash | misp-hashes.txt |
keyword or keywords |
String-based keywords | incident-keywords.txt |
trusted-hash |
Whitelist hashes (reduce score) | my-trusted-hashes.txt |
handles |
Mutex/Event values | malware-handles.txt |
pipes |
Named pipes | c2-pipes.txt |
Rules
YARA Rules
Critical: The filename determines how THOR initializes the rule. See YARA Rules Reference for full details.
| Filename Contains | Rule Type | Applied To |
|---|---|---|
(none), process |
Generic rules | Files, process memory, DeepDive chunks |
meta |
Meta rules | All files (first 64KB + externals) |
keyword |
Keyword rules | THOR module output (tasks, services, etc.) |
registry |
Registry rules | Registry keys/values |
log |
Log rules | Log lines, event log entries |
Common mistake: Using limit = "ScheduledTasks" without keyword in the filename. This causes the rule to be initialized as a generic rule (file/memory scanner), which won't match module output like scheduled task names.
Sigma Rules
Applied to Windows Eventlogs and log files. By default only high and critical levels shown.
STIX v2
Supports file observables (name, path, hashes, size, timestamps) and registry key observables.
THOR-Specific YARA Enhancements
Score Attribute
meta:
score = 80 // Default is 75 if not specified
External Variables
Available in generic and meta YARA rules:
| Variable | Description | Example |
|---|---|---|
filename |
File name only | cmd.exe |
filepath |
Path without filename | C:\temp |
extension |
Extension with dot, lowercase | .exe |
filetype |
Magic header type | EXE, ZIP, PDF |
filesize |
Size in bytes | (YARA built-in) |
owner |
File owner | NT-AUTHORITY\SYSTEM |
filemode |
POSIX-style file mode | |
unpack_parent |
Immediate container | ZIP |
unpack_source |
Full unpack chain | EMAIL>ZIP |
Restriction Attributes
meta:
type = "memory" // or "file" - restrict to memory/file only
limit = "Mutex" // Restrict to specific module
nodeepdive = 1 // Exclude from DeepDive
falsepositive = 1 // Reduce score instead of add
Reference Documentation
- Simple IOCs - Hash, filename, C2, keyword IOC formats
- YARA Rules - Generic and specific YARA rules for THOR
- Sigma Rules - Log detection with Sigma
- STIX IOCs - STIX v2 indicator format
Examples
- examples/hash-iocs.md - Hash IOC file examples
- examples/filename-iocs.md - Filename/path IOC patterns
- examples/yara-enhanced.md - YARA rules with THOR externals
Quick Reference
File Naming
# Good - tag detected
case22-c2-domains.txt ✓ (c2 tag)
misp-export-hashes.txt ✓ (hashes tag)
incident-filename-iocs.txt ✓ (filename tag)
# Bad - tag not detected
myc2iocs.txt ✗ (no word boundary)
filenameiocs.txt ✗ (no word boundary)
Deployment
# Place files in custom-signatures folder
cp my-hashes.txt /path/to/thor/custom-signatures/
# For YARA rules, use yara subfolder
cp my-rules.yar /path/to/thor/custom-signatures/yara/
# Encrypt sensitive IOCs (optional)
thor-util encrypt --file my-c2-domains.txt
# Creates my-c2-domains.dat
Testing
# Run with custom signatures only
./thor-macosx --customonly -p /target/path
# Verify IOC loading in startup
./thor-macosx 2>&1 | grep -i "custom\|ioc\|signature"