Their rules come with a different license, hence the note "for non-commercial use". More information about the ruleset and license https://github.com/ptresearch/AttackDetection