Skip to content

CONTRIBUTING.md

Latest commit

 

History

History
62 lines (46 loc) · 1.71 KB

CONTRIBUTING.md

File metadata and controls

62 lines (46 loc) · 1.71 KB
Raw

Contributing

This repo covers detection rules for AI agent threats. The Claude Code leak (March 31, 2026) is the starting point, but any documented CVE or incident involving AI coding agents (Copilot, Cursor, Gemini CLI, etc.) is in scope.

Adding a rule

Open an issue or submit a PR. Each Sigma rule needs:

  • A unique ID following the SC-XXX sequence
  • At least one reference (CVE, blog post, incident report)
  • A falsepositives field that is actually filled out
  • A corresponding test file in tests/events/

File naming:

rules/sigma/SC-XXX_short_description.yml
rules/splunk/SC-XXX_short_description.spl
rules/elastic/SC-XXX_short_description.eql
rules/yara/SC-XXX_short_description.yar
tests/events/SC-XXX_short_description.json

Test format

Each test file in tests/events/ must include at least one true positive and one false positive case:

{
  "rule_id": "SC-XXX",
  "events": [
    {
      "id": "SC0XX-TP-001",
      "expected": "MATCH",
      "description": "what the malicious event looks like",
      "event": { }
    },
    {
      "id": "SC0XX-FP-001",
      "expected": "NO_MATCH",
      "description": "legitimate event that should not trigger",
      "event": { }
    }
  ]
}

Run the test suite:

python3 tests/validate_rules.py --verbose

Scope

In scope: detection rules targeting AI agents (Claude Code, Copilot, Cursor, Gemini CLI), npm/pip supply chain attacks on AI dependencies, prompt injection, MCP abuse, agentic lateral movement, AI agent persistence mechanisms.

Out of scope: generic detection rules not related to AI agents (use SigmaHQ for those), offensive exploits or attack payloads.

Author

Jean Koumou — github.com/Kjean13