Integrate signatures from unprotect.it

[mlodic]

extract Yara and Capa rules from here periodically and add to the respective tools:
https://unprotect.it/api/detection_rules/

[github-actions]

This issue has been marked as stale because it has had no activity for 10 days. If you are still working on this, please provide some updates.

[mlodic]

This is a simple task, we need to integrate this in the already existing Capa and Yara analyzers

[Gagan144-blip]

Hi @mlodic,

Thanks for clarifying that this is a simple task.

Before starting implementation, I’d like to first study how the existing Capa and Yara analyzers currently load and manage rules, and then propose a minimal and safe way to integrate rules from unprotect.it without affecting existing behavior.

My plan is:

1. Inspect current Capa and Yara analyzers to understand rule loading flow
2. Review the unprotect.it detection_rules API structure
3. Propose where and how the integration should happen (initially without scheduling, if acceptable)
4. Share the approach before writing the full implementation

If this approach sounds good, I’d be happy to work on it.
Please let me know if you’d like me to focus on Yara or Capa first.

Thanks!
— Gaganpreet Kaur