Add YAML linting configuration and update Sigma rule validation paths for Mimikatz detection

Author: rahul0216

.github/.yamllint

@@ -0,0 +1,17 @@
+# https://yamllint.readthedocs.io/en/latest/configuration.html
+extends: default
+
+ignore:
+    - .github/
+
+rules:
+    comments:
+        require-starting-space: true
+        min-spaces-from-content: 1
+    comments-indentation: disable
+    document-start: {present: false}
+    empty-lines: {max: 2, max-start: 2, max-end: 2}
+    indentation: {spaces: 4, indent-sequences: whatever}
+    line-length: disable
+    new-line-at-end-of-file: enable
+    trailing-spaces: {}

.github/workflows/sigma-tests.yaml

@@ -20,6 +20,7 @@ jobs:
     - name: yaml-lint
       uses: ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c # v3
       with:
+        config_file: .github/.yamllint
         strict: true # fail on warnings as well
 
   test-sigma-logsource:

.github/workflows/sigma-validation.yaml

@@ -19,6 +19,5 @@ jobs:
       - name: Validate Sigma rules
         uses: SigmaHQ/sigma-rules-validator@66a5abe3fb6d13ac203ded42045580845c9c5534 # v1
         with:
-          paths: |-
-            **/sigma-rules/*.yaml
+          paths: ./mimikatz-tool/sigma-rules
           schemaURL: https://raw.githubusercontent.com/SigmaHQ/sigma-specification/refs/tags/${{ env.SIGMA_RULE_SCHEMA_VERSION }}/json-schema/sigma-detection-rule-schema.json

mimikatz-tool/sigma-rules/lsa_authentication_package_change.yml

@@ -28,4 +28,4 @@ detection:
     condition: selection_value
 falsepositives:
     - Approved authentication products, smart-card middleware, password filters, security software, or operating-system servicing
-level: high
+level: high

mimikatz-tool/sigma-rules/lsa_protection_registry_change.yml

@@ -25,4 +25,4 @@ detection:
     condition: selection_value
 falsepositives:
     - Authorized security policy deployment, operating-system servicing, troubleshooting, or compatibility testing
-level: medium
+level: medium

mimikatz-tool/sigma-rules/mimikatz_names_or_commands.yml

@@ -33,4 +33,4 @@ detection:
 falsepositives:
     - Authorized security testing, malware analysis, or training activity
     - Detection engineering that executes representative command lines in an isolated lab
-level: high
+level: high

mimikatz-tool/sigma-rules/mimikatz_powershell_content.yml

@@ -29,4 +29,4 @@ detection:
 falsepositives:
     - Authorized security testing, malware analysis, or training activity
     - Documentation or detection content processed as PowerShell script text
-level: high
+level: high

mimikatz-tool/sigma-rules/script_host_access_to_lsass.yml

@@ -33,4 +33,4 @@ detection:
 falsepositives:
     - Authorized security testing or administrative frameworks that intentionally inspect LSASS
     - Endpoint security or diagnostic tooling hosted by a listed script interpreter
-level: high
+level: high

mimikatz-tool/sigma-rules/sensitive_registry_hive_export.yml

@@ -33,4 +33,4 @@ detection:
     condition: selection_image and selection_action and selection_hive
 falsepositives:
     - Authorized backup, recovery, migration, forensic, or endpoint-management activity
-level: high
+level: high

mimikatz-tool/sigma-rules/user_writable_dll_loaded_by_lsass.yml

@@ -31,4 +31,4 @@ detection:
 falsepositives:
     - Approved authentication, identity, or endpoint-security software installed from a listed path
     - Authorized security testing or support activity
-level: high
+level: high