Nine Years of SigmaHQ Show Detection Exclusions Added 5.4x More Often Than They Are Withdrawn, and 86.7% Persist Past Three Years

arXiv 2608.31062·medium signalXBlueskyLinkedInCopy link

Measuring 8,234 revisions of the SigmaHQ detection-rule corpus over nine years, suppression is detected semantically as growth in predicates held under negation without matching coverage growth, validated against blinded hand labelling at 0.828 precision and 0.911 recall. Exclusions were added 1,642 times and withdrawn 304, a 5.4-to-1 ratio that climbs to 13-to-1 per individual rule, and Kaplan-Meier estimates 86.7% still in force three years later, independent of whether the rule is the sole coverage for its ATT&CK technique. Worse, 31% of the narrowing is invisible to structural diff so prior accounts undercount it, and 64.1% of path-valued exclusions can be satisfied by an unprivileged process simply choosing a filename.