Are virus signatures different between antiviruses?
For example, can a virus signature in Kaspersky differ from the signature associated to the same virus in Avast?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Yes, signatures vary as they are developed by the antivirus vendors independently of one another. One vendor's product may catch malware that another misses, or get a false positive that another would not find.
You may end up with multiple vendors having identical signatures for the same piece of malware because of malware's traits have few, or one signature options, but they are arrived at independently.
There is some licensing going on, but generally, I'd say AV-vendors all have their own engines, and these engines may not be even able to understand the signatures/rulesets of other engines.
Having people on staff (maybe even around the clock) that can extract useful signatures from a set/family of malware is expensive. So the individual signatures are prized intellectual property.
It's for the same reason, that the actual on-disk-format of how a signature is constructed is something that is generally kept secret for commercial AV-software. (Correct me if I'm wrong.)
On the other hand, there are documented several Open-Source approaches for AV-signatures. One of the more known ones are "YARA" rules. (Article archived here.)