I am uncertain about how public malware detection rulesets are? By a "ruleset" I mean the rules, usually written in Yara, that malware detection engines use to determine whether a file or memory sequence is potentially malware.

I know that different detectors definitely use different rulesets, because if you use Virus Total or some similar service, you can see that for a given binary some of the vendors will flag the binary and others will not. I would expect a vendor's ruleset to be "secret sauce" that they would not release publicly.

Nevertheless, I can't see how it would be secret. For example, I have Symantec Endpoint running on my desktop, so in theory it has a file somewhere it is reading which has the ruleset in it. Therefore, getting the rules should be as simple as finding that file. Of course, there is the possibility that the ruleset on my desktop is different than the one Symantec has on its servers. So, on the desktop I might just be getting the "old" stuff that everybody knows, and all the really valuable rules are only on their servers and thus inaccessible.

So, are these rulesets considered "secret" or are they publicly available or somewhere in between?