sigma-writing

Use when the user asks for a SIGMA detection rule, "write a SIGMA rule for X", or /hash-investigation / /malware-analysis surfaces behaviour worth a vendor-agnostic detection. Format spec + writing guide.