Static validation
How each rule file is classified before it is measured.
States
rulecheck.py assigns every examined file one of four final states: VALIDATED, QUARANTINED, REJECTED or DEPRECATED. Only VALIDATED can be published.
Drawing the diagram…
flowchart TD
F["rule file"]:::src --> H{"hard criteria?<br/>binary, empty, no rules,<br/>over 1 MB, rejected before"}:::val
H -->|yes| REJ["REJECTED"]:::qua
H -->|no| T{"truncated, corrupt,<br/>compile error?"}:::val
T -->|yes| QUA["QUARANTINED"]:::qua
T -->|no| J{"judgement findings?<br/>blocked module, costly regex,<br/>filesize loop, licence changed,<br/>needs a non validated file"}:::val
J -->|yes| QUA
J -->|no| DEP{"deprecated in its metadata?"}:::val
DEP -->|yes| DE["DEPRECATED"]:::qua
DEP -->|no| OK["VALIDATED"]:::sec
classDef src fill:#cfe3ff,stroke:#2f6df0,color:#0b1b33
classDef val fill:#ffe9b8,stroke:#b8860b,color:#2b1d00
classDef sec fill:#cdeedd,stroke:#1b6e3c,color:#08210f
classDef pub fill:#e4d7ff,stroke:#6a3fd1,color:#1b0b3b
classDef qua fill:#ffd4cc,stroke:#c0392b,color:#33100b
classDef gate fill:#ffffff,stroke:#111111,stroke-width:3px,color:#111111Diagram description
Each file is read as text and compiled. Hard criteria (binary, empty, no rules, oversized, identical content rejected before) reject it. Truncation, corruption, a compile error, a blocked or unknown module, a costly regular expression, a loop over the whole file, a changed licence or a dependency that is not validated send it to quarantine. A file that is deprecated by its own metadata is marked deprecated. Everything else is validated.
Mermaid code
flowchart TD
F["rule file"]:::src --> H{"hard criteria?<br/>binary, empty, no rules,<br/>over 1 MB, rejected before"}:::val
H -->|yes| REJ["REJECTED"]:::qua
H -->|no| T{"truncated, corrupt,<br/>compile error?"}:::val
T -->|yes| QUA["QUARANTINED"]:::qua
T -->|no| J{"judgement findings?<br/>blocked module, costly regex,<br/>filesize loop, licence changed,<br/>needs a non validated file"}:::val
J -->|yes| QUA
J -->|no| DEP{"deprecated in its metadata?"}:::val
DEP -->|yes| DE["DEPRECATED"]:::qua
DEP -->|no| OK["VALIDATED"]:::sec
classDef src fill:#cfe3ff,stroke:#2f6df0,color:#0b1b33
classDef val fill:#ffe9b8,stroke:#b8860b,color:#2b1d00
classDef sec fill:#cdeedd,stroke:#1b6e3c,color:#08210f
classDef pub fill:#e4d7ff,stroke:#6a3fd1,color:#1b0b3b
classDef qua fill:#ffd4cc,stroke:#c0392b,color:#33100b
classDef gate fill:#ffffff,stroke:#111111,stroke-width:3px,color:#111111Criteria
| Outcome | Reason |
|---|---|
| REJECTED | Hard criteria: binary, empty, no rules, over 1 MB or content rejected before. |
| QUARANTINED | Truncated, corrupt, compile error, blocked (cuckoo, magic, androguard) or unknown module, costly regular expression, loop over the whole file, changed licence or a dependency that is not validated. |
| DEPRECATED | The file is marked deprecated in its own metadata. |
| VALIDATED | None of the criteria above applies. |
Allowed modules: pe, elf, macho, math, hash, dotnet, time, string. The cuckoo module needs a sandbox report that MacGuard does not produce, so it has no use in the channel. Thresholds live in config/policy.json.
Dependencies between files
Many files use rules from others (include or rule names). The candidate keeps that relation as signed depends_on; every file is compiled in its own namespace with its dependencies, because 227 files repeat rule names and a single namespace would not compile.
LIMIT "Validated" is not an assessment of detection quality. False positives are not measured beyond the benign-corpus tests and the canaries.