Inquiry About YARA and Sigma Rule Support in UTMStack

[bb0rges]

Dear UTMStack Support Team,

I hope this message finds you well. I am currently exploring UTMStack's capabilities and would like to inquire about the integration of external detection rules. Specifically, I am interested in whether UTMStack supports the use of YARA or Sigma rules for detection purposes.

Could you kindly clarify:

1 - If YARA rules can be imported and utilized within UTMStack?
2 - Whether Sigma rules are supported, and if so, what conversion steps (if any) are necessary to ensure compatibility?

Your guidance would be greatly appreciated, as it will help us determine the best approach for leveraging custom detection capabilities within UTMStack.

Thank you in advance for your assistance. I look forward to your response.

[c3s4rfred]

Hi, @bb0rges, actually UTMStack doesn't support YARA or SIGMA rules.

Best regards

[bb0rges]

@c3s4rfred

I noticed on the Rules folder there are a few of them. But on the documentation says "With a vast pool of over 128,000 rules, ranging in complexity" is there a sparely repository or something?

[c3s4rfred]

Hi @bb0rges thanks for the feed back, I've open an issue to update the readme. UTMStack's rules have changed over time, so, the number needs to be updated.

Best regards