Signed rules, hot-reloaded.

Rules are supplemental by design

ZeroWrite's core detection is behavioural: the engine scores what an executable intends to do. YARA rules and hash reputation add corroborating evidence on top. This ordering matters — it is why an unknown, never-before-seen binary still gets a meaningful verdict, and why a stale rule pack degrades detection rather than disabling it.

Why a rule pack is security-critical

A rule can cause a file to be quarantined or deleted. That means a hostile rule pack is an arbitrary-file-deletion primitive: an attacker who could feed us rules could write one matching, say, your bootloader. A compromised CDN or a machine-in-the-middle must not be able to do that.

So packs are protected two separate ways:

• Encryption gives confidentiality — it keeps the rule set out of casual reach.
• Ed25519 signatures give authenticity. The signing key lives in our release infrastructure; the matching public key is compiled into the protection service. The client rejects any pack whose signature does not verify.

Encryption alone would not have helped: it proves nobody read the pack, not that we wrote it.

Delivery

The service polls a small manifest frequently — the manifest is a few hundred bytes, so checking often costs almost nothing and lets an emergency rule reach the fleet quickly rather than on a six-hour cycle.

When the manifest advertises something newer, the client:

1. downloads the pack,
2. verifies its SHA-256 and its signature,
3. writes it to a temporary path,
4. atomically renames it over the current pack,
5. hot-reloads the engine — no service restart, no reboot.

The previous pack is kept. If a new pack fails to load, the client rolls back to it and reports the failure. An update failure never disables protection — the engine keeps running on the last known-good pack indefinitely.

What is in a pack

Packs are compiled from a pinned YARA Forge release — a curated aggregation of well-maintained public rule sets — together with rules we write ourselves. Pinning the upstream release means a rule-set change is a deliberate, reviewable commit rather than something that silently shifts under you.

Freshness is visible

The current pack version and the time it was last updated are shown in Settings and on the dashboard. For a security product, being able to check that your defences are current is part of the product.

Channels

A stable channel is what everyone receives today. A beta channel uses the same format and verification, selectable in Settings, for people who want new rules earlier and accept a higher chance of a false positive.

Seeing a rule fire on something you trust? Report the false positive — the hash and rule name from the alert are all we need, and those reports are what drive rule quality.