Custom & Community Rules

Every detection code lives in one authoritative, uniqueness-enforced catalog. You can extend it with a few lines of TOML — no rebuild required. Built-in detections can’t be replaced or weakened: a rule whose id is already used by a built-in, an analyzer code, or an earlier file is rejected with a warning, so a file dropped into rules.d/ can add detections but never lower one.

Where rules live

Drop .toml files into any of these:

Rule format

[[rule]]
id = "ACME-001"                 # must be UNIQUE across the whole catalog
name = "Flags the ACME backdoor marker"
description = "Detects the marker string left by the ACME backdoor."
severity = "critical"           # critical | high | medium | low | info
category = "malicious_code"
recommendation = "Do not build; report the package."
file_types = ["pkgbuild", "install_script"]

[[rule.patterns]]
type = "regex"
pattern = "acme_backdoor_[0-9a-f]{8}"

Use an org-specific prefix (e.g. ACME-…) to avoid collisions with built-in codes. Ids must look like ACME-001 (letters, then hyphen-separated parts). They are trimmed and uppercased before the collision check, so shell-001 is the same id as SHELL-001.

file_types accepts pkgbuild, install_script, and source_file (local scripts shipped next to the PKGBUILD).

What the loader rejects

The loader rejects, one rule or file at a time, unknown keys, rules with no patterns, and patterns that don’t compile; the rest of the directory still loads.

As root (the pacman hook runs as root), only /usr/share/aur-scanner/rules.d/ and /etc/aur-scanner/rules.d/ are read. A shipped example lives at /usr/share/aur-scanner/example-rule.toml, outside rules.d/, so it is never loaded (2.x loaded it as EXAMPLE-001). Copy it into one of the directories above to start your own rule.

To confirm a rule loaded:

aur-scan codes            # confirm your rule is in the index
aur-scan explain ACME-001 # view it

Categories

command_injection, privilege_escalation, network_security, data_exfiltration, malicious_code, cryptography, configuration, dependencies, obfuscation, credential_theft, persistence, cryptomining, suspicious_metadata.

Want a rule shared with everyone? Open a PR on GitHub.