WRG Sigma Rules — Claude Code Plugin
Status
Production — actively maintained rule corpus. Not yet submitted to a plugin marketplace — install directly from this repo (see Installation).
Production-grade sigma detection rule writing, validation, and conversion for SOC analysts, threat-intel teams, and detection engineers using Claude Code.
TL;DR
- 3 MCP tools:
draft_rule(NL → sigma YAML) +validate_rule(pySigma + best-practice linter) +convert_rule(sigma → Splunk/Elastic/Wazuh/Kibana query) - 3 Claude Code skills: sigma-rule-writer + sigma-rule-reviewer + threat-coverage-gap-analyzer
- 73 production sigma rule corpus: 12 ATT&CK tactic categories (templates + observed campaign rules)
- Multi-backend conversion: Splunk SPL, Elastic Lucene, Wazuh, Kibana verified (pySigma 1.x + 2 backend packages)
- WRG ecosystem anchor: 6+ months threat-intel discipline + 100+ actor TTP corpus + observed_* rules (Mini Shai-Hulud npm worm, Nx campaign 4-vector cluster, SOCKS5 silent-fix, ClawHavoc Claude Skills, Lazarus, LockBit, LAPSUS, AI-fingerprint)
- Live demo: see
DEMO.mdfor end-to-end tool invocation on Mini Shai-Hulud rule (pySigma 1.x + Splunk + Elastic real output)
