VALIDATION SCOPE CPython 3.14.8 on macOS/ARM64. Windows and Linux were not executed in this validation environment. Synthetic path checks do not replace target-OS tests. CODE AUDIT 136 tests passed with Python warnings treated as errors in 37.031 seconds. Strict mypy passed for 37 source files. Ruff lint and format checks passed for 38 files. The enabled lint families are E, F, I, UP, B, SIM, RUF and PERF; this is not a claim that every optional rule from every analyzer is enabled. Reproduce from the source directory: uv sync --locked uv run python -W error -m unittest discover -s tests uv run mypy uv run ruff check src tests typing_stubs uv run ruff format --check src tests typing_stubs Tests cover archive preparation, encrypted and nested archives, original file preservation, multi-appliance parsing, time ambiguity, update evidence, bounded decoding, defanging, rule packs, correlations, incomplete results, interruption and release hygiene. Sigma tests exercise supported semantics, decoded views, explicit unsupported-feature rejection and local matching limits. A separate sequential CLI matrix passed all 21 invocations with warnings fatal: common and advanced help, scan/extract/decode/indicators/inventory, JSON output, implicit folder and archive inputs, current-folder discovery of multiple archives, encrypted 7z input, URL decoding and Base64 decoding. RELEASE INSTALLATION A wheel and source distribution were built. Locked runtime requirements were exported with hashes and installed into a fresh virtual environment outside the source tree, followed by the wheel without dependency resolution. Installed-package verification is repeated after changes to code or bundled intelligence. Source metadata is included so the packaging allowlist test remains active. CLI help, bundled Sigma matching and the 246-entry public IOC catalog passed. The wheel includes 47 public Sigma rules and the attributed public reference catalog. Private packs are opt-in, gitignored and excluded from both release formats. Artifact inventories and text contents were checked for private case indicators, identities, home paths, logs, evidence and runtime directories. Tests and examples use synthetic documentation addresses. Runtime versions checked: pySigma 1.5.1, regex 2026.9.29, PyYAML 6.0.3, py7zr 1.1.3, pyzipper 0.4.0, rich 15.0.0, rich-argparse 1.8.0, tzdata 2026.4. The lockfile records all dependency versions. INTERPRETING RESULTS No private incident data is required to run these software tests. Independent real-dataset findings are retained in separate customer case folders in their BERICHT.txt reports, outside this shared tool and its release. Original inputs are hashed before and after analysis. Forensic coverage limits are retained even when software tests and code checks pass: binary logs, ambiguous timestamps, invalid UTF-8 and failed decoding are not silently fixed. A match, decoded command or correlation is not proof of execution or compromise. Passing software tests does not establish investigation completeness. The local Sigma evaluator implements the subset documented in RULES.txt, not every Sigma feature or a Splunk query exporter. Scanning is sequential with buffered input/output, bounded decoding caches and an approximately 8 MiB SQLite page cache. File inventory, archive metadata, custom rule packs and result volume still affect total process memory. There is no hard process-wide CPU or RAM quota and no automatic parallel worker pool. INTELLIGENCE REFRESH CHECKS All 37 requested public URLs were retrieved or attempted and recorded, including access errors, application-only responses and verified alternate source URLs. The inventory has 52 sources, 246 unique indicators and 41 behavior patterns, expressed as 47 Sigma rules. All source/indicator/rule joins are checked. Every catalog indicator has a literal positive test; 245 have raw and decoded Sigma positives. The legitimate customsnmpd pathname is deliberately excluded from standalone Sigma matching and retains its contextual catalog occurrence. All IPv4 values are checked against prefix/suffix overmatching. HTTP tests cover percent encoding, Base64, no padding, nesting, Referer and additional headers. Original raw text and decoding spans remain verified. The preceding frozen baseline completed two independent real datasets: 2,405 files and 4,043,139 records, with every original/reference hash preserved. That full run predates this intelligence refresh and decoding-gate change. Its counts and timings must not be presented as a full-run test of the updated rule pack. Updated bounded real-data findings are retained in the corresponding customer BERICHT.txt reports. Temporary verification outputs are not required runtime inputs. A separate frozen-baseline, warm-cache repeated-sample experiment used the same 30,720 records per mode: one/two/four processes took 12.555/6.230/3.913 seconds. All twelve per-job outputs were semantically equivalent. Four processes used a conservative aggregate peak sum of 262.9 MiB. This is a throughput experiment, not an implemented parallel scanner, hard memory cap or full-archive forecast. The final gate also checks every public IOC encoded as padded and unpadded Base64, including all-uppercase tokens and four-character encodings. Canonical short/full-field decoding requires a printable UTF-8 roundtrip and is bounded to 4-4096 characters. This does not attempt to decode every ordinary word. PREVIOUS INSTALLATION AND RUNTIME SMOKE CHECK The previous installed wheel passed all 106 tests with warnings treated as errors in 28.839 seconds in a fresh environment outside the source tree. Locked runtime installation used 33 dependencies. CLI help, default Sigma matching and uppercase-only Base64 decoding passed. After relocating the interpreter into the shared tool directory, the same 106 tests passed in 29.001 seconds and CLI help passed again. Python imports and module paths no longer depend on an obsolete analysis checkout. These checks validate software operation, not customer-specific compromise conclusions. EXTENSIBLE RULE PACK REGRESSION The current source passes 134 tests, including recursive pack loading, offline validation, typed indicator boundaries, overlapping references, contextual Sigma conditions, numeric selectors, limits and encoded command probes. Catalog metadata cannot bypass a Sigma condition. The release was rebuilt after these changes. The older installed-wheel result above is not a test of this revision. A bounded private regression verified 19,625 original referenced log lines from two separate investigations, including all 94 recorded finding families in the earlier investigation. Public-rule matching completed without matching errors. The case-IOC run recorded one literal matching timeout; an independent retry of that original record completed with a finding and no matching error. The initial partial coverage remains recorded; decoding-candidate errors are reported separately and are not silently treated as successful decoding. The bounded regression is not a repeat of the earlier full 4,043,139-record run. A subsequent Unicode literal-lookup guard has synthetic regression coverage, but the entire private fixture set was not rerun after that guard. These checks validate known examples and important negative cases, not zero false positives or complete detection of all future attacks. Private evidence is not shipped. CLI RESULT PRESENTATION CLI scans produce SUMMARY.txt, matched-event FINDINGS.csv and IOCS.csv at the result root. Complete machine-readable evidence is retained under details/; prepared inputs remain under inputs/. Tests cover separation of context from matches, preservation of JSON evidence, authorized-test labels, spreadsheet formula protection and no-matches wording. Direct engine.scan callers retain the flat layout. A synthetic CLI smoke check confirmed the new directory layout. REAL-DATA OUTPUT PRESENTATION CHECK — 2026-10-05 The CLI was run against 19,625 referenced original lines from two independent private datasets, with each dataset's own IOC pack. Source files were verified against their recorded hashes before and after processing. This was a bounded presentation regression, not a new full-dataset scan. The runs produced 14,633 and 2,461 matched-event CSV rows respectively. Every CSV event ID, source reference, indicator status and defanged indicator was checked against the full JSON event. Summary counts and partial status agreed with the JSON summary. The JSON retained 123 and 1,448 additional context/error events excluded from the matched-event CSV. Decoding output was present in 13,019 and 344 matched events; authorized-test labels were preserved. Both runs exited 2 with partial coverage: 12,510 and 1,584 failed decoding candidates remain reported. No matching errors occurred in these runs. Private source mapping and validation results remain outside the public release. A subsequent presentation correction exposes original-file SHA-256 matches in SUMMARY.txt even without an event match. Three focused presentation tests passed, including this separate hash-only case; Ruff, formatting and strict mypy passed. DEPENDENCY COMPATIBILITY FIX — 2026-10-05 Version 1.0.0 was installed in an isolated environment with pySigma 2.0.0. The bundled-rule validation reproduced the reported RE2 rejection of lookahead syntax. Version 1.0.1 constrains pySigma to >=1.5.1,<2, keeping the existing detection patterns and timeout-protected matching unchanged. Reinstalling the corrected package in that same environment automatically replaced pySigma 2.0.0 with 1.5.1. All 47 bundled Sigma rules validated, with 246 explicit active indicators. All 138 tests passed against the installed package with Python warnings treated as errors. A new regression checks the reported lookahead pattern against raw and decoded text, including negative cases. Ruff lint, formatting and strict mypy across source and tests passed. This verification did not rerun the complete private forensic datasets. 2026-10-05: Abgeschlossene Erweiterung der Dateisystemanalyse TAR.GZ und entpackte Exportverzeichnisse; Inhaltsmuster, bekannte SHA-256, Netzwerk-IOCs, zusätzliche Fall-IOC.csv, Metadaten und Artefakt-Prüfliste. Elf zusätzliche quellendokumentierte Regeln. Exportbefehl und paralleler Batch-Aufruf im README, CLI-Hilfe einschließlich Grenzen aktualisiert. 149 Tests erfolgreich, darunter elf Dateisystemtests. Ruff/Mypy geprüft. Die Erweiterung verarbeitet Archive ohne Ausführung enthaltener Programme. Unvollständige gzip-Streams werden als Verarbeitungsfehler ausgewiesen. Zusätzliche strukturierte Logkorrelation ist optional; der Batch-Helfer aktiviert sie nicht. Erkennungsgrenzen: FILESYSTEM_COVERAGE.txt. Validierung ist keine Clean-Garantie. SUPPLEMENTAL REVIEW CHECKS — 2026-10-05 Version 1.0.2 adds ten low-severity Sigma review rules and eleven filesystem content checks, plus candidate web-tree file names and BLX configuration paths. The default Sigma catalog validates with 57 rules; public indicators remain 246. Unverified additional indicators are kept in an optional private pack. All 151 tests passed with warnings treated as errors. Ruff lint, formatting and strict mypy passed. Positive and negative controls exercise each new Sigma rule on raw and decoded views. Filesystem tests cover original anomalous bytes, configuration path restrictions and suppression of an error-message lookalike inside a binary package. Eleven filesystem tests passed after increasing the stream overlap to 8 KiB for bounded patterns spanning a block boundary. An isolated installed package also validated all 57 rules. All 25 supplemental private indicator values matched raw and Base64-decoded text in a separate private check. This demonstrates matching behavior, not malicious attribution. Two existing configuration/program exports were rescanned: 5,361 and 5,319 regular files, with no read errors and no hits from the added checks. Existing heuristic candidates remain separate from newly added checks. A retained larger snapshot inventory was compared against all 12 supplemental SHA-256 values: 53,696 file hashes, no match. This inventory comparison did not reread the original larger archive and does not prove current system integrity. RELATIVE OUTPUT REGRESSION A real-data run completed analysis but failed while finalizing a relative output path. Preparation resolves paths internally; the CLI now resolves its preparation root before constructing relative provenance references. A regression verifies SUMMARY.txt and each manifest input root when --output is relative. All 152 tests then passed with warnings treated as errors; Ruff and strict mypy passed. The completed run's output was recovered only after every one of its 851 input inventory entries matched a freshly prepared copy. It processed 1,117,532 records: two missing-file review events, no supplemental IOC or file-hash hit. Status remains partial: ten binary-file read stops and 106,842 decoding failures, with no matching or inventory errors. These counts are not compromise indicators. A separate supplemental log recheck completed over 4,604,594 records in 1,711 files using four triage-library workers. Original and working-copy SHA-256 inventories matched. No supplemental rule, indicator or original-file hash hit was found. Coverage remains partial: 788 text read stops (776 database files, 12 binary login/scoreboard files) and 1,338,016 decoding failures. No matching errors occurred. This focused recheck did not repeat unchanged public rules or perform another correlation pass. A failed earlier database run was excluded. The streaming recheck agreed with the standard engine on raw, Base64, URL-encoded, process-list and benign fixtures. Saved process/permission collection records were reviewed separately. Private rules, indicators, records and evidence remain outside the public repository. These results do not establish absence of compromise. PUBLIC INDICATOR UPDATE 1.0.3 - 2026-10-05 Added seven IPv4 addresses and nine SHA-256 search candidates to the default catalog and Sigma selectors. Nine duplicate supplied indicators retain their existing metadata. New entries are reference_only with explicitly empty source lists; no malicious attribution is asserted. Total: 262 indicators, 57 rules. Validation: 152 tests passed with warnings treated as errors. Full catalog matching tests cover raw and decoded views and IP boundaries. Ruff check, Ruff format check and mypy passed. Wheel and source distribution built successfully; the wheel contains all 262 indicators. Added lines were checked for customer identifiers, local user paths and common secret markers. No case evidence or private files were included. Existing source records remain unchanged.