wrg-sigma-rulesBLOCK
Sigma rules for ransomware, threat actors and vulnerabilities disclosed in AI/LLM apps and MCP servers, with multi-backend conversion and an MCP server for Claude Code, Codex and Cursor. CI-pinned claims.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/WRG-11/wrg-sigma-rules/actions/workflows/tests.yml) [](https://github.com/WRG-11/wrg-sigma-rules/releases) [](https://github.com/WRG-11/wrg-sigma-rules/commits/main) [](resources/examples/INDEX.json) [](LICENSE) [](requirements.txt)
Sigma detection-rule authoring, validation and multi-backend conversion, delivered as a Model Context Protocol (MCP) server with a published rule corpus. It runs under Claude Code, Codex, Cursor and any MCP-capable client.
What it does
- Three MCP tools.
draft_ruleturns a natural-language description into a Sigma
YAML scaffold. validate_rule checks a rule against pySigma plus a best-practice linter. convert_rule compiles a rule to a Splunk, Elastic, OpenSearch or Kibana query; its wazuh target returns Elasticsearch Lucene output with a warning, because pySigma has no Wazuh backend.
- Three Claude Code skills:
sigma-rule-writer,sigma-rule-reviewerand
threat-coverage-gap-analyzer. The packaged Codex variants retain the same evidence boundaries: coverage counts do not establish missing ATT&CK scope, conversion does not establish deployed semantics, and observed_* public contributions require the sourcing bar in CONTRIBUTING.md.
- A published corpus of 294
rules in 16 categories: one directory per MITRE ATT&CK Enterprise tactic (v19 names) plus code_review for source-cod
55a714411e3dOBSERVED · 2026-10-11Exposed tools (3)
3 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
convert_rule | read | Convert a sigma YAML rule into a SIEM-native query string. |
draft_rule | read | Draft a sigma detection YAML rule from a natural-language threat description. |
validate_rule | read | Validate a sigma YAML rule for schema correctness, pySigma compatibility, and best-practices linting. |
Trust audit
BLOCKgrade F · trust 41/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- none-observed
- Shell
- declared (4 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
- Dataset-card pretext jailbreak frame in an LLM gateway prompt log.
Detection/defense only, no malware code or jailbreak payload reproduced.
# Detecting Hosted-LLM Abuse: Malware That Calls Gemini at Runtime, and a Dataset-Card Jailbreak Frame
Two of these rules cover malware that uses a hosted LLM as a runtime capability instead of shipping its evasion logic statically. The third covers a prompt-side jailbreak framing seen in an LLM gatewa
*Detection content from WinstonRedGuard (WRG-11). References: [GTIG AI Threat Tracker, November 2025](https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools), [GTIG AI
module = importlib.import_module(module_name)
module = importlib.import_module(module_name)
module = importlib.import_module(module_name)
module = importlib.import_module(module_name)
.coveragerc
.rsigma-lint.yml
01-command-line-encoded-payload.md
04-c2-beaconing-network-signal.md
01-command-line-encoded-payload.md
04-c2-beaconing-network-signal.md
title: Miasma npm worm -- T1195.002 Bun-runtime fetch/exec (base)
- eval(
title: Miasma npm worm -- T1195.002 Bun-runtime fetch/exec (base)
- eval(
title: Template -- RC4 Kerberos service ticket request
using RC4 encryption for a non-KRBTGT service. This is a triage signal, not
RC4. Synthetic exemplar from the WinstonRedGuard threat-intel corpus -- no
- Legacy service accounts that are intentionally configured to support RC4
title: Template -- RC4 Kerberos service ticket request
/proc/, .ssh, id_rsa, .env, .aws, credentials, shadow, passwd, .pem,
Gates applied: instruction_override, no_behavioural_pass.
55a714411e3dfull audit observations/trust-audit/mcp-server/wrg-11__wrg-sigma-rules.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 55a714411e3d | BLOCK | F | 41 | first audit |
Questions
What is the wrg-sigma-rules MCP server?
Sigma rules for ransomware, threat actors and vulnerabilities disclosed in AI/LLM apps and MCP servers, with multi-backend conversion and an MCP server for Claude Code, Codex and Cursor. CI-pinned claims.
What tools does wrg-sigma-rules expose?
3 in total: 3 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is wrg-sigma-rules safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (41/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does wrg-sigma-rules need?
No credential environment variables were found in its source, so it appears to need none.
How current is this page?
The grade is for one exact copy of the source (55a714411e3d), read on 2026-10-11. The repository is watched and re-audited when it changes.