0.9

Adjusted Signal

0.9

Raw Pattern Score

100%

Time Factor

2026-10-21

Last Push

11.4K

Stars

Python

Language

227.6K

Lines of Code

5.1K

Files

203

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 3.9/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 189 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.1/100 · LOW

Are imports declared and package/API names verified? 7 finding(s).

Agent Over-Engineering Ratio 1.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 43 finding(s).

PR Review Velocity Impact 5.4/100 · LOW

Which changes need focused human review? 203 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 1MEDIUM 22LOW 180

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 203 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block92 hits · 60 pts

Severity	File	Line	Snippet	Context
LOW	other/godmode_sigma_rule.yml	1	# _____ __ __ ___ __	COMMENT
LOW	tests/test_rules.py	21		COMMENT
LOW	tests/test_rules.py	41	# MITRE_TACTICS = [	COMMENT
LOW	tests/test_rules.py	141	# ): # Covers both "base64" and "base64offset" modifiers, and "re" modifier	COMMENT
LOW	tests/test_rules.py	161	# i	COMMENT
LOW	tests/test_rules.py	181	# check_list_or_recurse_on_dict(detection, 1, False)	COMMENT
LOW	tests/test_rules.py	201		COMMENT
LOW	tests/test_rules.py	221		COMMENT
LOW	tests/test_rules.py	421	)	COMMENT
LOW	tests/test_rules.py	441	# print("TypeError Exception for rule {}".format(file))	COMMENT
LOW	tests/test_rules.py	461	# for typo in common_typos:	COMMENT
LOW	tests/test_rules.py	501	self.assertEqual(	COMMENT
LOW	tests/test_rules.py	521	# Fore.YELLOW	COMMENT
LOW	tests/test_rules.py	541	# # Reference field doesn't exist	COMMENT
LOW	tests/test_rules.py	761	[],	COMMENT
LOW	tests/test_rules.py	781	# "by",	COMMENT
LOW	tests/test_rules.py	801	# file	COMMENT
LOW	tests/test_rules.py	821	# and not "_" in word	COMMENT
LOW	tests/test_rules.py	941	# if key[:3].lower() == "sel":	COMMENT
LOW	tests/test_rules.py	961	# Fore.RED	COMMENT
LOW	tests/test_rules.py	981	# wildcard_selections = re.compile(r"\sof\s([\w\*]+)(?:$\|\s\|\))")	COMMENT
LOW	tests/test_rules.py	1001	# .replace(")", "")	COMMENT
LOW	tests/test_rules.py	1021	# + "Rule {} has an unused selection '{}'".format(file, selection)	COMMENT
LOW	tests/test_rules.py	1041	# print(	COMMENT
LOW	tests/test_rules.py	1061	# for key, value in dict.items():	COMMENT
LOW	tests/test_rules.py	1081	# # multiple item selection	COMMENT
LOW	tests/test_rules.py	1101	# valid = True	COMMENT
LOW	tests/test_rules.py	1301	# files_with_incorrect_extensions.append(file)	COMMENT
LOW	tests/test_rules.py	1321		COMMENT
LOW	tests/test_rules.py	1341	# + "Rule {} has the duplicate tag {}".format(file, tag)	COMMENT
LOW	tests/test_rules.py	1361	# for reference in references:	COMMENT
LOW	tests/test_rules.py	1381	# faulty_rules = []	COMMENT
LOW	tests/test_rules.py	1401	# faulty_rules.append(file)	COMMENT
LOW	tests/test_rules.py	1421	# file	COMMENT
LOW	tests/test_rules.py	1441		COMMENT
LOW	tests/test_rules.py	1461	# faulty_rules.append(file)	COMMENT
LOW	tests/test_rules.py	1481	# )	COMMENT
LOW	tests/test_rules.py	1501	# def test_optional_tlp(self):	COMMENT
LOW	tests/test_rules.py	1521	# Fore.YELLOW	COMMENT
LOW	tests/test_rules.py	1541	# print(	COMMENT
LOW	tests/test_rules.py	1561	# )	COMMENT
LOW	tests/test_rules.py	1581		COMMENT
LOW	tests/test_rules.py	1601	# Fore.RED + "Rule {} has a logsource with an invalid field ({})".format(file, key))	COMMENT
LOW	tests/test_rules.py	1621	# logsource = self.get_rule_part(file_path=file, part_name="logsource").values()	COMMENT
LOW	tests/test_rules.py	1641		COMMENT
LOW	tests/test_rules.py	1661	# faulty_rules = []	COMMENT
LOW	tests/test_rules.py	1681	# faulty_rules.append(file)	COMMENT
LOW	tests/test_rules.py	1701	# print(	COMMENT
LOW	tests/test_rules.py	1721	# # it exists but isn't a list	COMMENT
LOW	tests/test_rules.py	1741	# )	COMMENT
LOW	tests/test_rules.py	1761	# self.get_rule_part(file_path=file, part_name="relatde")	COMMENT
LOW	tests/test_rules.py	1781	# sigma error validators date_existence	COMMENT
LOW	tests/test_rules.py	1801	# file	COMMENT
LOW	tests/test_rules.py	1821	# sigma validators description_existence description_length	COMMENT
LOW	tests/test_rules.py	1841	# Fore.YELLOW	COMMENT
LOW	tests/test_rules.py	1861	# "medium",	COMMENT
LOW	tests/test_rules.py	1881	# + "There are rules with missing or malformed 'level' fields. (check https://github.com/SigmaHQ/sigma-speci	COMMENT
LOW	tests/test_rules.py	1901	# Fore.RED	COMMENT
LOW	tests/test_rules.py	1921	# faulty_rules.append(file)	COMMENT
LOW	tests/test_rules.py	1941	# + "Rule {} has a 'author' field that isn't a string.".format(	COMMENT
32 more matches not shown…

Hyper-Verbose Identifiers36 hits · 34 pts

Severity	File	Line	Snippet	Context
LOW	documentation/tools/sigma-logsource-checker.py	111	def yield_next_rule_file_path(path_to_rules: str) -> str:	CODE
LOW	documentation/tools/sigma-logsource-checker.py	152	def test_invalid_logsource_attributes(path_to_rules):	CODE
LOW	tests/sigma-package-release.py	101	def yield_next_rule_file_path(rule_path: str) -> str:	CODE
LOW	tests/regression_tests_runner.py	758	def check_rule_id_consistency(rules_with_tests: List[Dict]) -> List[Dict]:	CODE
LOW	tests/reference-archiver.py	31	def yield_next_rule_file_path(path_to_rules: list) -> Generator[str, None, None]:	CODE
LOW	tests/test_rules.py	133	# def test_look_for_duplicate_filters(self):	COMMENT
LOW	tests/test_rules.py	134	# def check_list_or_recurse_on_dict(item, depth: int, special: bool) -> None:	COMMENT
LOW	tests/test_rules.py	146	# def check_if_list_contain_duplicates(	COMMENT
LOW	tests/test_rules.py	190	# def test_field_name_with_space(self):	COMMENT
LOW	tests/test_rules.py	215	# def test_single_named_condition_with_x_of_them(self):	COMMENT
LOW	tests/test_rules.py	424	# def test_optional_falsepositives_capital(self):	COMMENT
LOW	tests/test_rules.py	453	# def test_optional_falsepositives_blocked_content(self):	COMMENT
LOW	tests/test_rules.py	536	# def test_references_in_description(self):	COMMENT
LOW	tests/test_rules.py	934	# def test_selection_start_or_and(self):	COMMENT
LOW	tests/test_rules.py	1030	# def test_all_value_modifier_single_item(self):	COMMENT
LOW	tests/test_rules.py	1059	# def test_field_user_localization(self):	COMMENT
LOW	tests/test_rules.py	1096	# def test_condition_operator_casesensitive(self):	COMMENT
LOW	tests/test_rules.py	78	def yield_next_rule_file_path(self, path_to_rules: list) -> "collections.abc.Iterator[str]":	CODE
LOW	tests/test_rules.py	114	def test_legal_trademark_violations(self):	CODE
LOW	tests/test_rules.py	240	def test_duplicate_detections(self):	CODE
LOW	tests/test_rules.py	339	def test_event_id_instead_of_process_creation(self):	CODE
LOW	tests/test_rules.py	399	def test_sysmon_rule_without_eventid(self):	CODE
LOW	tests/test_rules.py	869	def test_selection_list_one_value(self):	CODE
LOW	tests/test_rules.py	1128	def test_broken_thor_logsource_config(self):	CODE
LOW	tests/test_rules.py	1224	def check_list_or_recurse_on_dict(item, depth: int, special: bool) -> None:	STRING
LOW	tests/test_rules.py	1244	def check_item_for_bad_escapes(item):	STRING
LOW	tests/test_rules.py	1293	# def test_confirm_extension_is_yml(self):	STRING
LOW	tests/test_rules.py	1306	# def test_confirm_correct_mitre_tags(self):	STRING
LOW	tests/test_rules.py	1354	# def test_duplicate_references(self):	STRING
LOW	tests/test_rules.py	1412	# def test_optional_date_modified(self):	STRING
LOW	tests/test_rules.py	1484	# def test_all_of_them_condition(self):	STRING
LOW	tests/test_rules.py	1582	# def test_invalid_logsource_attributes(self):	STRING
LOW	tests/test_rules.py	1645	# def test_unknown_value_modifier(self):	STRING
LOW	tests/test_rules.py	1906	# def test_optional_falsepositives_listtype(self):	STRING
LOW	tests/test_logsource.py	45	def yield_next_rule_file_path(self, path_to_rules: list) -> "collections.abc.Iterator[str]":	CODE
LOW	tests/test_logsource.py	183	def test_invalid_logsource_attributes(self):	CODE

AI Slop Vocabulary13 hits · 32 pts

Severity	File	Line	Snippet	Context
MEDIUM	…og_execution/d042284c-a296-4988-9be5-f424fadcc28c.json	62	"ParentCommandLine": "\"powershell.exe\" & {# Import the required test harness function, Invoke-BuildAndInvokeInst	CODE
MEDIUM	…-22893/web_cve_2021_22893_pulse_secure_rce_exploit.yml	6	- https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-	CODE
LOW	…xploits/ProxyShell-Exploit/web_exchange_proxyshell.yml	32	# since we don't know how it will appear in the log files, we'll just use all versions	COMMENT
MEDIUM	…nection/net_connection_win_susp_azurefd_connection.yml	9	- https://medium.com/r3d-buck3t/red-teaming-in-cloud-leverage-azure-frontdoor-cdn-for-c2-redirectors-79dd9ca98178	CODE
MEDIUM	…ile_event/file_event_win_creation_system_dll_files.yml	24	# Note: It is recommended to use a more robust filter instead of this generic one, to avoid false negatives.	COMMENT
MEDIUM	…ile/file_event/file_event_win_creation_system_file.yml	95	# Note: It is recommended to use a more robust filter instead of this generic one, to avoid false negatives.	COMMENT
MEDIUM	…wershell_classic/posh_pc_remote_powershell_session.yml	29	# Note: Increase the level to "medium" in environments that do not leverage PowerShell remoting	COMMENT
MEDIUM	rules/windows/image_load/image_load_side_load_wazuh.yml	29	# Note: Many third party apps installed in "AppData" or "ProgramData" and leverage "mingw64" make use of "libwin	COMMENT
MEDIUM	…process_creation/proc_creation_win_csc_susp_parent.yml	63	# Note: this is a generic filter. You could baseline execution in your env for a more robust rule	COMMENT
MEDIUM	…remote_access_tools_screenconnect_remote_execution.yml	29	# Note: Increase the level if you don't leverage ScreenConnect	COMMENT
MEDIUM	…ion/proc_creation_win_csc_susp_dynamic_compilation.yml	46	# Note: this is a generic filter. You could baseline execution in your env for a more robust rule	COMMENT
MEDIUM	…/proc_creation_win_powershell_script_engine_parent.yml	6	- https://www.securitynewspaper.com/2017/03/20/attackers-leverage-excel-powershell-dns-latest-non-malware-attack/	CODE
LOW	rules/windows/sysmon/sysmon_config_modification.yml	17	# To avoid FP just add	COMMENT

Deep Nesting30 hits · 24 pts

Severity	File	Line	Context
LOW	documentation/tools/sigma-logsource-checker.py	135	CODE
LOW	documentation/tools/sigma-logsource-checker.py	152	CODE
LOW	documentation/tools/sigma-logsource-checker.py	183	CODE
LOW	documentation/tools/sigma-logsource-checker.py	202	CODE
LOW	documentation/tools/sigma-logsource-checker.py	256	CODE
LOW	documentation/tools/sigma-logsource-checker.py	265	CODE
LOW	tests/regression_tests_runner.py	210	CODE
LOW	tests/regression_tests_runner.py	254	CODE
LOW	tests/regression_tests_runner.py	518	CODE
LOW	tests/regression_tests_runner.py	758	CODE
LOW	tests/reference-archiver.py	31	CODE
LOW	tests/reference-archiver.py	59	CODE
LOW	tests/reference-archiver.py	72	CODE
LOW	tests/test_rules.py	68	CODE
LOW	tests/test_rules.py	78	CODE
LOW	tests/test_rules.py	114	CODE
LOW	tests/test_rules.py	339	CODE
LOW	tests/test_rules.py	399	CODE
LOW	tests/test_rules.py	568	CODE
LOW	tests/test_rules.py	869	CODE
LOW	tests/test_rules.py	1128	CODE
LOW	tests/test_rules.py	1166	CODE
LOW	tests/test_rules.py	884	CODE
LOW	tests/test_rules.py	1224	CODE
LOW	tests/test_rules.py	1244	CODE
LOW	tests/test_logsource.py	35	CODE
LOW	tests/test_logsource.py	45	CODE
LOW	tests/test_logsource.py	80	CODE
LOW	tests/test_logsource.py	183	CODE
LOW	tests/test_logsource.py	251	CODE

Excessive Try-Catch Wrapping6 hits · 15 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	tests/regression_tests_runner.py	498	print(f"Error: evtx-sigma-checker not found at {args.evtx_checker}")	CODE
MEDIUM⚡	tests/regression_tests_runner.py	503	print(f"Error: Thor config not found at {args.thor_config}")	CODE
MEDIUM⚡	tests/regression_tests_runner.py	508	print(f"Error: json_checker not found at {args.json_checker}")	CODE
LOW	tests/reference-archiver.py	123	except Exception as e:	CODE
MEDIUM	tests/reference-archiver.py	124	print(f"Error sorting references: {e}")	CODE
MEDIUM	tests/test_rules.py	442	# print("Error: {}".format(err))	COMMENT

Redundant / Tautological Comments9 hits · 13 pts

Severity	File	Line	Snippet	Context
LOW	…_hktl_rubeus/3245cd30-e015-40ff-a31d-5cadd5f377ec.json	47	"ScriptBlockText": "# Global TLS Setting for all functions. If TLS12 isn't suppported you will get an exception w	CODE
LOW	…unblock_file/5947497f-1aa4-41dd-9693-c9848d58727d.json	47	"ScriptBlockText": "<#\n.SYNOPSIS\n Checks for common issues that may prevent the 'DSInternals' module from wor	CODE
LOW	tests/regression_tests_runner.py	76	# Check if test file exists	COMMENT
LOW	tests/regression_tests_runner.py	142	# Check if rule status requires regression tests	COMMENT
LOW	tests/regression_tests_runner.py	145	# Check if rule has regression_tests_path	COMMENT
LOW⚡	tests/regression_tests_runner.py	496	# Check if evtx-sigma-checker exists	COMMENT
LOW⚡	tests/regression_tests_runner.py	501	# Check if THOR config exists	COMMENT
LOW	tests/regression_tests_runner.py	809	# Check if the filename (without extension) matches the rule ID	COMMENT
LOW	tests/test_rules.py	1260	# Check if character after \ is not in escape_allow_list and also not already found	STRING

Slop Phrases3 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW	…in_security_susp_possible_shadow_credentials_added.yml	30	# Don't forget to add it to the condition section below	COMMENT
MEDIUM	…cation/msiinstaller/win_builtin_remove_application.yml	26	# Level is low as it can be very verbose, you can use the top or less 10 "Product Name" to have a quick overview	COMMENT
MEDIUM	…cation/mssqlserver/win_mssql_xp_cmdshell_audit_log.yml	23	# You can modify this to include specific commands	COMMENT

Modern AI Meta-Vocabulary3 hits · 7 pts

Severity	File	Line	Snippet	Context
MEDIUM	…in/proc_creation_lnx_malware_tanstack_supply_chain.yml	30	# observed on guardrails-ai@0.10.1 compromise	COMMENT
MEDIUM	.github/latest_archiver_output.md	191	- https://blog.lukaszolejnik.com/supply-chain-risk-of-agentic-ai-infecting-infrastructures-via-skill-worms/	CODE
MEDIUM	…/proc_creation_win_node_new_agent_skills_installed.yml	13	- https://blog.lukaszolejnik.com/supply-chain-risk-of-agentic-ai-infecting-infrastructures-via-skill-worms/	CODE

Empty Error Handlers1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	tests/test_rules.py	1150	except:	CODE

Unused Imports5 hits · 4 pts

Severity	File	Line	Context
LOW	documentation/tools/sigma-logsource-checker.py	9	CODE
LOW	documentation/tools/sigma-logsource-checker.py	10	CODE
LOW	documentation/tools/sigma-logsource-checker.py	11	CODE
LOW	tests/test_rules.py	20	CODE
LOW	tests/test_logsource.py	13	CODE

Fake / Example Data2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	…ud_indicator/540703fb-a874-4385-a9d6-7cd1bfab268c.json	51	"CommandLine": "\"C:\\Users\\xodih\\.dev-env\\bin\\Runner.Listener.exe\" configure --url https://github.com/test-	CODE
LOW	…ud_indicator/540703fb-a874-4385-a9d6-7cd1bfab268c.json	62	"ParentCommandLine": "C:\\WINDOWS\\system32\\cmd.exe /c \"\"C:\\Users\\xodih\\.dev-env\\config.cmd\" --url https:/	CODE

Self-Referential Comments1 hit · 2 pts

Severity	File	Line	Snippet	Context
MEDIUM	…ps_timestomp/c6438007-e081-42ce-9483-b067fbef33c3.json	47	"ScriptBlockText": "r:'\n $username = Get-Credential\n $group = Read-Host -Prompt 'P	CODE

Verbosity Indicators2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	…l_script/posh_ps_invoke_obfuscation_obfuscated_iex.yml	4	description: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framewo	CODE
LOW	…hktl_invoke_obfuscation_obfuscated_iex_commandline.yml	4	description: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framewo	CODE

SigmaHQ/sigma

Open-Source Code Quality, Security and Technical Debt Review