RULEOPS

Most teams run password recovery against oversized, unoptimized rulesets: thousands of rules ranked only by raw hit-frequency, with heavy overlap between them. The result is wasted GPU-hours and weaker real-world recovery for the same compute budget — the ruleset looks comprehensive on paper but a large share of its rules are redundant, cracking passwords other rules already caught.

• Generates candidate rules tailored to your wordlists, hash sets or case-specific password policy.
• Ranks rules by actual unique coverage, not just hit count or frequency.
• Uses a greedy CELF selection algorithm to pick the subset of rules with maximum marginal, non-overlapping coverage.
• Delivers better recovery with fewer rules and less GPU time — the same crack rate for a fraction of the ruleset size, or materially higher recovery at the same budget.

Holding the rule budget fixed (~50,000 rules) isolates how much each selection method squeezes out of the same GPU spend. Three RULEOPS-family outputs — CELF-ranked a1131_50000.rule and heaped_top50000.rule, alongside heap-greedy rulest_hashmob_th3.50000.rule — are shown against five widely-used public rulesets at the same size, on the same hashmob-derived benchmark corpus.

At this specific 50k checkpoint, several mature public sets (HashMob.50k, concentrator_MT_50000, sapphire_medium) edge out these particular RULEOPS outputs on both recovery and efficiency — an honest result worth stating plainly. The RULEOPS advantage shows up differently: these are general-purpose benchmark runs, not tuned to a specific wordlist or case, and the gain compounds at the budgets DFIR engagements actually use (90k–150k rules, where CELF-ranked a1131_30_90k_r2.rule reaches 0.437 efficiency vs 0.22–0.26 for comparable public sets of that size). A Custom Ruleset Service engagement tunes selection to your corpus specifically, which is where CELF's unique-coverage objective pulls ahead of general-purpose rulesets of any kind.

Full interactive benchmark data (232 rulesets, all tiers) → rules_efficiency.html

After payment, send the transaction ID and your preferred customer name. You receive a signed offline license.lic for activation. Custom ruleset work and lab-wide deals on request.