chore: align project branding with MalForge

Author: rootverdict

README.md

@@ -145,7 +145,7 @@ Suggested lab layout for a portfolio demo:
 - `Wazuh VM`: receives generated XML only in later manual lab stages
 - `Windows 10 endpoint`: source of log format assumptions such as Sysmon-style process, file, registry, and network telemetry
 
-Generated Wazuh rule `116767` fired successfully in the lab from `MBDG-Win10` Sysmon Event ID `1` using parent rule `61603`.
+Generated Wazuh rule `116767` fired successfully in the lab from a Windows endpoint Sysmon Event ID `1` using parent rule `61603`.
 
 The current project does not automate any deployment to those systems.
 

RUNBOOK.md

@@ -1,10 +1,10 @@
-# MBDG Runbook
+# MalForge Runbook
 
 Single reference file for setup, usage, testing, outputs, and troubleshooting.
 
 ## Project
 
-`malware-behavior-detection-generator`
+`malforge`
 
 Local pipeline that:
 - reads sandbox JSON reports only
@@ -282,7 +282,7 @@ VirusTotal and MISP credentials currently enable local lookup descriptors only;
 
 Validated lab proof:
 
-`Generated Wazuh rule 116767 fired successfully in the lab from MBDG-Win10 Sysmon Event ID 1 using parent rule 61603.`
+`Generated Wazuh rule 116767 fired successfully in the lab from a Windows endpoint Sysmon Event ID 1 using parent rule 61603.`
 
 ## Troubleshooting
 

core/models.py

@@ -62,7 +62,7 @@ class SigmaRule:
     detection: dict[str, Any]
     level: str = "medium"
     status: str = "experimental"
-    author: str = "malware-behavior-detection-generator"
+    author: str = "MalForge"
     tags: list[str] = field(default_factory=list)
     references: list[str] = field(default_factory=list)
     falsepositives: list[str] = field(default_factory=list)

pyproject.toml

@@ -3,9 +3,9 @@ requires = ["setuptools>=68", "wheel"]
 build-backend = "setuptools.build_meta"
 
 [project]
-name = "malware-behavior-detection-generator"
+name = "malforge"
 version = "0.1.0"
-description = "Scaffold for a malware behavior to detection rule generator."
+description = "Local sandbox JSON to detection artifact pipeline."
 readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [

reporting/summary.py

@@ -16,7 +16,7 @@
     WazuhRule,
 )
 
-TOOL_NAME = "malware-behavior-detection-generator"
+TOOL_NAME = "MalForge"
 TOOL_VERSION = "0.1.0"
 
 

review/versioner.py

@@ -10,7 +10,7 @@
 
 from core.models import SigmaRule, WazuhRule
 
-TOOL_NAME = "malware-behavior-detection-generator"
+TOOL_NAME = "MalForge"
 TOOL_VERSION = "0.1.0"
 
 

tests/test_review.py

@@ -85,7 +85,7 @@ def test_version_metadata_contains_expected_keys() -> None:
     wazuh_version = versioned_wazuh.options["version"]
 
     for payload in (sigma_version, wazuh_version):
-        assert payload["tool_name"] == "malware-behavior-detection-generator"
+        assert payload["tool_name"] == "MalForge"
         assert payload["tool_version"] == "0.1.0"
         assert payload["rule_version"] == "2.1.0"
         assert payload["generated_at"] == timestamp