🛠️ Tool: SigmaLineage MCP
Sigma hits without context are noise. SigmaLineage MCP is a FastMCP server that wraps three capabilities into a single AI-callable interface, designed to solve the false-positive problem that plagues detection engineering.
What it does
- Sigma Hunt (run_sigma) — runs Chainsaw against an EVTX folder with the full SigmaHQ rule set.
- Process Lineage Tracing (run_sigma_lineage) — for every Sigma hit, automatically traces the parent→child execution tree up to 5+ generations, building a full kill-chain view.
- Rarity Baseline Engine (rare_events_baseline) — statistically surfaces anomalous process-to-port connections, suspicious user-log event combinations, and unusual URL lookups that don't fit the baseline.
The false positive problem
regsvr32.exe spawning a child process matches 40 Sigma rules and also matches every legitimate COM registration. wmic.exe executing a command could be lateral movement or your asset management tool. cmd.exe spawned by mmc.exe looks terrifying until you realize it is normal DCOM-based remote management. The alert alone tells you nothing. The parent chain tells you everything.
How lineage tracing works
SigmaLineage uses the Rust-backed evtx Python parser to build an in-memory process graph from Sysmon Event ID 1 (process creation) and Security Event ID 4688 in your EVTX corpus. It resolves ancestry using ProcessGuid strings for Sysmon events, and uses a PID + timestamp closest-fit algorithm for Security events that lack GUIDs. The result: for every Sigma hit, you get the full execution tree rendered in markdown.
Real example from EVTX-Attack-Samples — impacket wmiexec:
[WmiPrvSE.exe (PID: 836)]
└─ [cmd.exe (PID: 2828)] (HIT)
cmd.exe /Q /c whoami /all 1> \127.0.0.1\ADMIN$__1556656369.7 2>&1
└─ [whoami.exe (PID: 3328)] (HIT)
whoami /all
One look and you know: cmd.exe spawned by WmiPrvSE.exe, writing output to the ADMIN$ share via a UNC path. Textbook WMI exec pattern. Not a false positive.
Compare to a surface-identical alert where lineage shows [services.exe] → [PSEXESVC.exe]. Same alert, different root cause (PsExec), instantly disambiguated.
The rarity engine solves anomaly discovery rather than false positive reduction. It statistically surfaces unusual process-to-port connections, suspicious user-log event combinations, and URL lookups without needing a predefined rule.
Plug into any MCP-compatible AI client (Cursor, Claude Desktop, Antigravity, OpenCode). Describe what you want to investigate in plain English, get structured analysis back.
Note: haven't tested personally.
🔹 SigmaLineage #tool #DetectionEngineering #Sigma #MCP
🔗 Source: https://mohitdabas.in/blog/sigmalineage-mcp-evtx-hunting-lineage-first-triage/
