skills.rest
Nextron-Labs
Nextron-LabsOFFICIAL
Explore all skills by this author →
GitHub

custom-signatures

Generate and deploy custom THOR IOCs, YARA rules, Sigma rules, and STIX indicators.

12|2|Updated Jan 17, 2026
Search Tags:#thor#ioc#sigma#yara#custom-signatures#stix
One-click install
npx skills add https://github.com/Nextron-Labs/thor-skill --skill custom-signatures-nextron-labs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: custom-signatures
Source: https://github.com/Nextron-Labs/thor-skill/tree/main/custom-signatures
Command: npx skills add https://github.com/Nextron-Labs/thor-skill --skill custom-signatures-nextron-labs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Create and deploy custom detection content for THOR to accelerate incident response and standardize detections across teams.

Core Features & Use Cases

  • Generate and format IOCs, YARA rules, Sigma rules, and STIX indicators for THOR.
  • Deploy these signatures to THOR's custom-signatures workflow and ensure consistent updates across environments.
  • Use cases include rapid content creation for new campaigns, versioned releases, and reproducible detections in investigations.

Quick Start

Place your custom THOR signatures in the custom-signatures folder and run THOR to load and apply them during scans.

Frequently Asked Questions about custom-signatures

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create custom THOR signatures for incident response?▼

To create custom THOR signatures, generate and format IOCs, YARA rules, Sigma rules, and STIX indicators. Place these detection contents in the custom-signatures folder so THOR can load and apply them during scans and investigations.

What types of detection rules can I deploy using custom-signatures?▼

You can deploy multiple detection rule formats including YARA rules, Sigma rules, IOCs, and STIX indicators. These custom signatures are applied across THOR deployments to standardize detections for scans and reporting.

How do I deploy YARA and Sigma rules to THOR scans?▼

Deploy YARA and Sigma rules by placing them in the custom-signatures folder and running THOR. The system loads and applies these formatted detection contents during active scan investigations.

Can I standardize detection content across multiple THOR deployments?▼

Yes, you can standardize detection content across multiple THOR deployments. The custom-signatures workflow generates, formats, and publishes detection content to ensure consistent updates and reproducible detections across environments.

Do I need a specific folder structure to apply custom IOCs in THOR?▼

You need to place your custom IOCs in the custom-signatures folder for THOR to load them. The Skill also supports optional directories like scripts, references, and assets for extended content management.

Related Skills

Explore More Software Engineering Skills→
noklip-ionoklip-io
1

base-ui

Locate Base UI component references and API documentation from SKILL.md metadata.

Official
Basic
NextronSystemsNextronSystems
12

thor-maintenance

Automates THOR maintenance tasks including signature updates, repackaging binaries, generating reports, and managing licenses.

Official
Advanced
NextronSystemsNextronSystems
12

custom-signatures

Orchestrates deployment of Threat Intelligence signatures for the Threathunter platform.

Official
Intermediate
XerrionXerrion

rev-malware

Extract IoCs, map MITRE ATT&CK, and author YARA/Sigma rules.

Community
Advanced