Custom Signatures Skill

Goal: Help users create, format, and deploy custom detection content for THOR.

Overview

THOR processes all files in the ./custom-signatures folder. The file extension and filename tags determine how each file is interpreted:

Extension	Type	Description
`.txt`	Simple IOCs	CSV-style IOC files (hashes, filenames, C2s, etc.)
`.dat`	Encrypted IOCs	Encrypted simple IOCs (via thor-util)
`.yar`	YARA rules	Plain text YARA rules
`.yas`	Encrypted YARA	Encrypted YARA rules
`.yml`	Sigma rules	Log detection rules
`.yms`	Encrypted Sigma	Encrypted Sigma rules
`.json`	STIX v2	STIXv2 JSON indicators
`.jsos`	Encrypted STIX	Encrypted STIX indicators

Installs

Source

First Seen

Apr 17, 2026