The 57,000-Rule Illusion: What Changed in Public Detection Content

Public detection repos grew by 643 rules between September 8 and October 28, 2026, reaching 57,602 total rules across 25 sources. But nearly half of the upstream repos did not add a single rule, and growth was concentrated in just a few projects.

When detection engineering teams import public rule collections, they often treat total rule count as a proxy for platform maturity. Measuring the corpus ingested by Threat Detection Labs Marketplace shows why that assumption fails in production.

Growth Is Concentrated in Seven Upstream Repositories

Between the September 8, 2026 snapshot and the October 28, 2026 run, the aggregate rule count across all 25 tracked sources increased from 56,959 to 57,602. Eleven of the 25 upstream projects recorded zero rule additions over those 50 days.

Total Rules Measured:  57,602
Active Sources:        25
Valid Rules:           57,602 (100%)
Schema Failures:       0 (0%)
Net Growth (50 Days):  +643 rules

The table below summarizes rule counts, internal pipeline baselines, and net shifts across all 25 public sources tracked in stats.csv.

Source	Format	Current Count (Oct 28)	HEAD Baseline	Oct 27 Baseline	Sep 8 Baseline	Net Change (vs Sep 8)
anvilogic	anvilogic	1,897	1,897	1,897	1,897	0
bertjanp	kql-markdown	452	452	452	446	+6
car	car	102	102	102	102	0
chronicle	chronicle	953	953	953	922	+31
elastic	elastic	2,590	2,590	2,590	2,363	+227
elastic-protections	elastic-protections	1,339	1,339	1,339	1,324	+15
falco	falco	96	96	96	95	+1
falconforce	kql-markdown	60	60	60	59	+1
hayabusa	sigma	4,534	4,534	4,534	4,503	+31
loldrivers	sigma	1,362	1,362	1,362	1,195	+167
mdecrevoisier	sigma	337	337	337	337	0
panther	panther	1,077	1,077	1,077	1,077	0
rapid7	sigma	6	6	6	6	0
reversinglabs	yara	1,240	1,240	1,240	1,240	0
sagan	sagan	9,863	9,863	9,863	9,854	+9
sekoia	yara	756	756	756	756	0
sekoia-rules	sekoia-rules	30	30	30	30	0
sentinel	sentinel	2,506	2,506	2,505	2,438	+68
sigma	sigma	3,779	3,779	3,779	3,760	+19
signature-base	yara	5,911	5,911	5,911	5,910	+1
splunk	splunk	2,177	2,174	2,174	2,166	+11
sublime	sublime	1,387	1,385	1,385	1,331	+56
synacktiv	sigma	16	16	16	16	0
wazuh	wazuh	2,693	2,693	2,693	2,693	0
yara	yara	12,439	12,439	12,439	12,439	0
TOTAL	25 sources	57,602	57,597	57,596	56,959	+643

The marketplace baseline file baselines.json records each repository’s last known healthy run state. Because the baseline file updates only when sources pass guardrail checks, the baseline total lags live updates. The commit HEAD baseline sum of 57,597 trails the live October 28 ingest run of 57,602 by five rules (consisting of three new rules in Splunk and two in Sublime Security).

Growth over this period occurred primarily across seven projects: Elastic Detection Rules (+227), LOLDrivers (+167), Azure Sentinel (+68), Sublime Security (+56), Hayabusa (+31), Chronicle (+31), and SigmaHQ (+19).

By language format, YARA represents 35.3% of the total corpus (20,346 rules across four repos). Sigma format rules represent 17.4% (10,034 rules across six repos), while Sagan accounts for 17.1% (9,863 rules). Three signature repositories (Yara-Rules, Sagan, and Signature-Base) hold 49.0% of all rules in the public index.

ATT&CK Coverage Is Bounded at 79% and Driven by Revoked Tags

Evaluating the corpus against MITRE ATT&CK Enterprise STIX data shows that the 57,602 rules cover 558 out of 706 distinct active Enterprise techniques (79.0%). Measured against technique-tactic catalogue pairs, the rules touch 558 of 881 catalogue rows (63.3%).

Live Enterprise Techniques Covered: 558 / 706 (79.0%)
Technique-Tactic Catalogue Rows:    558 / 881 (63.3%)
Unmapped Rules (No Technique):      38,425 (66.7%)
Revoked or Non-Catalogue Tag IDs:   199 IDs (1,574 tag instances)

Two-thirds of the corpus (38,425 rules, or 66.7%) carry no MITRE ATT&CK technique tag. Unmapped rules are concentrated in signature sets like YARA and Sagan, as well as driver catalogs like LOLDrivers, which flag specific file structures or hashes rather than operational techniques.

The ingest parser extracted 757 distinct technique IDs from rule metadata, but 199 of those IDs are missing from the current live Enterprise catalogue. Retired or revoked technique references account for 1,574 out of 34,363 tag instances (4.6%).

The primary driver of dead tags is revoked technique T1562 (Impair Defenses), which appears 470 times, alongside its sub-technique T1562.001 (256 instances). While zero tags were malformed and zero tactics were invalid, legacy technique tags introduce inflated coverage metrics if imported without validation.

Whole-Rule Duplicates Are Zero, but Metadata Is Missing

A whole-rule hash check using the hashRule string function yielded zero duplicate rules across all 57,602 files. No rule file is byte-for-byte identical to another across the 25 repos.

Schema Validation Failures:        0
Whole-Rule Content Duplicates:     0 groups
Detection Logic Match Groups:      1,098 groups (15,598 extra copies)
Largest Logic Group (YARA):        6,459 rules (condition reuse)
Missing Platform Metadata:         3 rules (all in mitre-attack/car)
Empty Detection Content Blocks:    112 rules
Rules Missing dateModified:        49,453 (85.9%)

Grouping rules by normalized detection content identified 1,098 matching condition groups containing 15,598 extra copies (27.08% of the total corpus). However, this content match figure requires context: for YARA rules, stored content is isolated to the rule condition block. As a result, 6,459 YARA rules share a single short 20-character condition string. This reflects shared condition syntax across distinct rule definitions rather than identical duplicate rules.

Metadata completeness varies across upstream repos:

• Severity Ratings: 24,194 rules overall carry no severity rating, but 20,960 of those belong to signature collections that do not use severity fields. Among severity-rated rule formats, 3,234 out of 36,642 rules (8.8%) lack a rating, maintaining 91.2% severity coverage.
• Platforms: Only 3 rules across the 57,602 corpus lack platform metadata, all within the CAR repository.
• Empty Logic Blocks: 112 rules contain empty detection content blocks (106 in Elastic, 4 in Panther, and 2 in Signature-Base).
• Rule Age: 49,453 rules (85.9%) carry no dateModified field. Among the 8,149 rules with date metadata, 2,448 were updated within 90 days of October 28, 2026; 532 were updated between 90 days and 1 year ago; 731 between 1 and 2 years; 4,375 between 2 and 5 years; and 63 are over 5 years old.

Three Operational Changes for Borrowed Detections

I recommend three adjustments when ingesting open-source detection rules into production environments:

1. Remap revoked ATT&CK tags before building coverage models. Strip or update tags like T1562 and T1562.001 to active sub-techniques before publishing SIEM heatmaps or calculating technique gaps.
2. Isolate signature collections from behavioral rules. Do not treat YARA indicator rules or LOLDrivers file entries as behavioral detection coverage. Two-thirds of public rules (66.7%) carry no technique mapping because they are static indicators, not behavioral analytics.
3. Validate detection logic against test telemetry instead of timestamps. Because 85.9% of public rules lack modification dates, metadata cannot prove freshness. Run detection rules against simulated logs to confirm efficacy regardless of source metadata.

Next month’s brief will re-evaluate these same 25 repositories using the same metrics: tracking live technique counts against the 706-technique Enterprise catalogue, monitoring baseline shifts, and measuring condition reuse across updated upstream releases.