Collection of example YARA-L rules for use within Google Security Operations
Python · active 2023-08-19 → 2026-08-06 (UTC)
Activity over time
Daily event counts in the loaded window
Line chart, 1084 days from 2023-08-19 to 2026-08-06. Pushes: 296 total, peak 13 in a day. Pull requests: 192 total, peak 8 in a day. Issues: 44 total, peak 5 in a day. Comments: 182 total, peak 13 in a day. Stars: 254 total, peak 4 in a day.
- Pushes
- Pull requests
- Issues
- Comments
- Stars
Stars, PRs, issues and forks are under-captured in the later part of this window. GH Archive progressively stopped capturing non-push events during 2026 — −95% or worse by the end of the window. Every series here except Pushes fades for that reason, so a decline above reflects the archive, not this repository. Pushes stay reliable throughout, so read them, and the contributor counts derived from them, as the real signal. Data health has the measurements.
Top contributors
Pushes, PRs, issues, reviews and comments — stars and forks excluded, so this is contribution rather than popularity
| Contributor | Contributions | Pushes | PRs | Comments |
|---|---|---|---|---|
| copybara-service[bot] | 402 | 269 | 131 | 0 |
| threat-punter | 212 | 22 | 26 | 122 |
| barnabys-drew | 24 | 0 | 5 | 12 |
| dandye | 14 | 2 | 5 | 5 |
| google-cla[bot] | 10 | 0 | 0 | 10 |
| snippray | 8 | 0 | 3 | 0 |
| palramp | 8 | 0 | 0 | 4 |
| Bacon-404 | 8 | 0 | 0 | 6 |
| jshlbrd | 7 | 0 | 0 | 6 |
| SimaoC359 | 4 | 0 | 0 | 2 |
| Phemix | 4 | 0 | 0 | 3 |
| madret | 4 | 0 | 2 | 0 |
| sat-tp | 4 | 0 | 0 | 2 |
| shamo0 | 3 | 0 | 3 | 0 |
| the2dl | 3 | 0 | 0 | 2 |
| Koifman | 3 | 0 | 1 | 1 |
| MasonMasoff | 3 | 0 | 0 | 2 |
| curiousghost | 3 | 0 | 0 | 1 |
| Rommel-J | 3 | 0 | 3 | 0 |
| jshlbrddd | 2 | 0 | 0 | 0 |
Recent activity
Latest issues, pull requests and releases
- Issue comment#170google-cla[bot]2026-02-27 03:13Secops dev branch
- Pull request#170sitckmancyber2026-02-27 03:13
- Pull request#170sitckmancyber2026-02-27 03:13
- Pull request#168copybara-service[bot]2025-11-12 16:42
- Issue comment#155threat-punter2025-09-29 19:37[Update Rule] Rename rule ttp_windows_potential_sharpyshell_webshell_execution
- Issue#155threat-punter2025-09-29 19:37[Update Rule] Rename rule ttp_windows_potential_sharpyshell_webshell_execution
- Pull request#165copybara-service[bot]2025-09-29 19:25
- Pull request#162threat-punter2025-09-29 17:18
- Pull request#162copybara-service[bot]2025-09-29 16:37
- Issue comment#159threat-punter2025-09-29 16:08Add support to manually set the ROOT_DIR Fixes #158
- Pull request#156muhammadumerk12025-09-29 13:46
- Issue comment#157threat-punter2025-09-24 19:34Build Support to Validate Reference Lists and Data Tables
- Issue comment#151dandye2025-09-24 13:38Slight tweaks to sharepoint rules v3
- Pull request#151dandye2025-09-24 13:38
- Issue comment#160google-cla[bot]2025-09-16 18:02Beat 11197 determine why sec ops is tagging internal users as external users and creating cases from them
- Pull request#160erikgrunner-beatdapp2025-09-16 18:02
- Pull request#151threat-punter2025-09-16 15:55
- Pull request#151threat-punter2025-09-16 15:55
- Issue comment#100threat-punter2025-09-11 19:39Support Rule Exclusions via CLI
- Issue comment#159dandye2025-09-09 17:49Add support to manually set the ROOT_DIR Fixes #158
- Pull request#159chlima882025-09-02 20:32
- Issue comment#146MasonMasoff2025-09-02 15:43Efficiency improvements on GitHub action "verify all rules"
- Issue comment#146threat-punter2025-09-02 15:36Efficiency improvements on GitHub action "verify all rules"
- Issue#157JohnPortClear2025-09-02 13:37Build Support to Validate Reference Lists and Data Tables
- Pull request#156muhammadumerk12025-08-25 07:39
Totals cover only the window loaded into ClickHouse and count events, not GitHub's lifetime totals — 254 stars here means stars gained during the window, not the repo's star count.