custom-signatures

Orchestrates deployment of Threat Intelligence signatures for the Threathunter platform.

12|2|Updated Jan 17, 2026

Search Tags:#thor #ioc #sigma #yara #custom-signatures #stix #signature-deployment

Ready to run

npx skills add https://github.com/NextronSystems/thor-skill --skill custom-signatures

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: custom-signatures
Source: https://github.com/NextronSystems/thor-skill/tree/main/custom-signatures
Command: npx skills add https://github.com/NextronSystems/thor-skill --skill custom-signatures

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

THOR users often need to tailor detection content by adding IOCs, YARA rules, Sigma rules, and STIX indicators. This skill provides a structured workflow to create, organize, and deploy custom signatures that integrate with THOR’s custom-signatures folder.

Core Features & Use Cases

Supports multiple content types: simple IOCs, encrypted IOCs, YARA rules, Sigma rules, and STIX indicators.
Enables versioned deployment and automated loading of custom signatures during THOR scans.
Real-world use case: security teams share tailored indicators across environments to detect organization-specific threats and reduce false positives.

Quick Start

Place your IOCs, YARA rules, Sigma rules, and STIX indicators in the custom-signatures folder to enable THOR to load and deploy your signatures.

Frequently Asked Questions about custom-signatures

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I create custom THOR detection signatures for organization-specific threats?▼

To create custom THOR detection signatures, aggregate IOCs, YARA rules, Sigma rules, and STIX indicators into the custom-signatures folder for automated loading and deployment during THOR scans.

What types of detection rules can I deploy using the THOR custom-signatures folder?▼

The THOR custom-signatures folder supports deploying simple IOCs, encrypted IOCs, YARA rules, Sigma rules, and STIX indicators to tailor your threat detection capabilities.

Can I use STIX indicators and YARA rules together in a single THOR scan?▼

Yes, you can use STIX indicators and YARA rules together by placing them in the custom-signatures folder, which aggregates multiple content types for comprehensive THOR detection scans.

Does deploying custom signatures in THOR require specific metadata or formatting?▼

Deploying custom signatures requires YAML frontmatter with name and description fields. The system supports optional dependencies and components while enforcing safety checks against prompt injection.

What is the best way to share tailored indicators across multiple THOR environments?▼

The best way to share tailored indicators is using versioned deployment within the custom-signatures folder, enabling security teams to distribute organization-specific threat detection content across environments.