Phase 2 — YARA rule library bundling (CFReDS gap G-004)

[Juwon1405]

Source

Opened from CFReDS Hacking Case integration (case-08).

Gap

sift_yara_run adapter exists but no YARA rules ship with dart-mcp. Without rules the adapter is a no-op.

Blocks

• F-CFR-009 (AV positive on Mr. Evil's hacking tools)

Proposal

Partial duplicate of #10 (dart-synth). Recommend:

1. Bundle community YARA rules (Florian Roth signature-base subset, MIT-licensed) in examples/yara-rules/
2. Document rule directory path convention
3. Cross-link with Phase 2 — Sigma rule synthesis from observed evidence #10 — long-term: dart-synth synthesizes; short-term: bundle community rules

Cross-references

• case-08 README — gap G-004
• Phase 2 — Sigma rule synthesis from observed evidence #10 (dart-synth)