Home

wrg-sigma-rules

A public Sigma detection corpus for observed ransomware and threat actors, shipped as a versioned release and usable three ways: as raw rules, as a Claude Code plugin, or as an MCP server.

Every rule here is bound to an actor with at least one recorded incident. The prefix observed_ is a commitment, not decoration.

Pages

Page	What it answers
Rule Corpus	How the corpus is organised, what observed_ guarantees, and the checks that keep it honest
MCP Tools	The three tools — draft_rule, validate_rule, convert_rule — with their real schemas
Container	Pulling and running the MCP server, including an offline session

Quick start

git clone https://github.com/WRG-11/wrg-sigma-rules.git
docker pull ghcr.io/wrg-11/wrg-sigma-rules-mcp:latest

A note on numbers

This wiki avoids live counts in prose. Rule counts change every few days, and a wiki page is not covered by the CI stamp that keeps README and DEMO honest — so a number written here would go stale silently. Where a table gives a distribution it carries the date it was measured, so it reads as a dated observation rather than a standing claim. For a current figure read the repository: the README badge and INDEX.json are both generated from the corpus.