EvadeLint

The adversarial Sigma linter — score your detection rules by how easily an attacker can evade them.

Most Sigma tools check whether a rule is well-formed (valid syntax, maps to ATT&CK, no duplicates). EvadeLint asks the question an attacker asks:

"Given this exact rule, how would I bypass it — and does the rule survive known evasion techniques?"

EvadeLint statically analyzes your Sigma detection rules for evasion weaknesses drawn from published, documented attacker tradecraft (MITRE ATT&CK Defense Evasion, LOLBAS, known obfuscation methods) and gives each rule an Evasion-Resistance Score (0–100) plus concrete, actionable hardening advice.

It is a defensive tool: it helps blue teams and detection engineers write rules that hold up against a thinking adversary. It performs static analysis only — it never executes anything or attacks any system.

Why EvadeLint is different

Existing tools	EvadeLint
"Is this rule well-formed?" (quality)	"Can an attacker walk right past it?" (robustness)
Lints for correctness	Lints for evasion-resistance
Maps to ATT&CK for coverage	Maps weaknesses to ATT&CK evasion sub-techniques

EvadeLint is the missing adversarial complement to quality linters like sigmalint.

What it detects

• Brittle string matches an attacker can trivially obfuscate (e.g. whoami → who^ami, w"h"oami)
• Case-sensitivity gaps that alias-swaps or casing tricks defeat
• Hardcoded paths bypassed by copying a binary elsewhere (LOLBAS relocation)
• Full-path process matches defeated by renaming the binary
• Missing anchoring that lets padding / whitespace injection slip through
• Single-indicator rules with no correlation, easy to evade one dimension at a time All checks live in evadelint/checks.py — each one is a plain function, so adding a new evasion pattern is a small PR.

Quick start

pip install git+https://github.com/drkemp187/evadelint   # or clone and run in place
evadelint scan examples/whoami_recon.yml
evadelint scan examples/ --format json

From a clone, python3 -m evadelint scan … works without installing.

Example output

examples/whoami_recon.yml
  Evasion-Resistance Score: 34/100  (WEAK)

  [HIGH]  Brittle CommandLine substring 'whoami'
          An attacker can evade with: who^ami, w"h"oami, set c=whoami&&%c%
          ATT&CK: T1140 (Deobfuscate), T1027 (Obfuscated Files or Info)
          Fix: match on parent/child process + multiple independent indicators,
               not a single obfuscatable substring.

License

MIT