Add z_score Metadata Field to Sigma Rules

[ziedehg]

As detection engineers, we often consolidate multiple behaviors into a single rule for efficiency — but this creates a challenge when reporting to stakeholders who still focus on raw rule counts.

To address this, I propose introducing a new metadata field:
z_score – a numeric value that indicates how many logically distinct use cases are represented within a single rule.

It helps:

• Communicate the true detection coverage of consolidated rules
• Normalize engineering value across teams and environments
• Improve reporting accuracy without inflating rule count

Use Case Example: Remote Code Execution Techniques

Description: This detection rule consolidates five common techniques seen in initial access and hands-on-keyboard activity:

• wmic process call create ...
• powershell Invoke-WebRequest http://...
• certutil -urlcache -split -f ...
• mshta http://malicious[.]domain
• rundll32 javascript execution

`title: Suspicious Remote Code Execution via Scripting Tools
z_score: 5
tags:

• z_score.5
  description: >
  This rule detects five common remote code execution techniques using built-in
  system utilities. `

Instead of writing five separate rules, they’re consolidated into one — and the Z-Score reflects that.

This is extremely beneficial because it introduces a simple, standardized way to measure detection coverage, not just volume. Additionally, It enables:

• More meaningful detection metrics
• Better justification for optimized engineering work
• Consistency in how teams define and report use case coverage

It’s vendor-neutral enhancement that fits naturally into Sigma’s metadata model — and could be a valuable addition for the broader detection engineering community.

Would love to hear your thoughts.