skills.rest
NextronSystems
NextronSystemsOFFICIAL
Explore all skills by this author →
WebsiteGitHub

custom-signatures

Orchestrates deployment of Threat Intelligence signatures for the Threathunter platform.

12|2|Updated Jan 17, 2026
Search Tags:#thor#ioc#sigma#yara#custom-signatures#stix#signature-deployment
One-click install
npx skills add https://github.com/NextronSystems/thor-skill --skill custom-signatures
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: custom-signatures
Source: https://github.com/NextronSystems/thor-skill/tree/main/custom-signatures
Command: npx skills add https://github.com/NextronSystems/thor-skill --skill custom-signatures

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

THOR users often need to tailor detection content by adding IOCs, YARA rules, Sigma rules, and STIX indicators. This skill provides a structured workflow to create, organize, and deploy custom signatures that integrate with THOR’s custom-signatures folder.

Core Features & Use Cases

  • Supports multiple content types: simple IOCs, encrypted IOCs, YARA rules, Sigma rules, and STIX indicators.
  • Enables versioned deployment and automated loading of custom signatures during THOR scans.
  • Real-world use case: security teams share tailored indicators across environments to detect organization-specific threats and reduce false positives.

Quick Start

Place your IOCs, YARA rules, Sigma rules, and STIX indicators in the custom-signatures folder to enable THOR to load and deploy your signatures.

Frequently Asked Questions about custom-signatures

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create custom THOR detection signatures for organization-specific threats?▼

To create custom THOR detection signatures, aggregate IOCs, YARA rules, Sigma rules, and STIX indicators into the custom-signatures folder for automated loading and deployment during THOR scans.

What types of detection rules can I deploy using the THOR custom-signatures folder?▼

The THOR custom-signatures folder supports deploying simple IOCs, encrypted IOCs, YARA rules, Sigma rules, and STIX indicators to tailor your threat detection capabilities.

Can I use STIX indicators and YARA rules together in a single THOR scan?▼

Yes, you can use STIX indicators and YARA rules together by placing them in the custom-signatures folder, which aggregates multiple content types for comprehensive THOR detection scans.

Does deploying custom signatures in THOR require specific metadata or formatting?▼

Deploying custom signatures requires YAML frontmatter with name and description fields. The system supports optional dependencies and components while enforcing safety checks against prompt injection.

What is the best way to share tailored indicators across multiple THOR environments?▼

The best way to share tailored indicators is using versioned deployment within the custom-signatures folder, enabling security teams to distribute organization-specific threat detection content across environments.

Related Skills

Explore More Software Engineering Skills→
Nextron-LabsNextron-Labs
12

custom-signatures

Generate and deploy custom THOR IOCs, YARA rules, Sigma rules, and STIX indicators.

Official
Intermediate
ojiudezueojiudezue
1

ura-presence-reliability-campaign

Diagnose URA presence-fusion reliability issues and implement fixes.

Community
Advanced
Nextron-LabsNextron-Labs
12

thor-skills

Route user requests to the appropriate THOR sub-skill for execution.

Official
Advanced
copyleftdevcopyleftdev

roth-detection-engineering

Create portable YARA and Sigma threat detection rules for malware hunting.

Community
Intermediate