Introduction to SIGMA

SIGMA is an open standard for writing detection rules in a vendor-agnostic format. Think of it as "YARA for logs" - one rule format that can be converted to any SIEM.

Why SIGMA?

Before SIGMA, detection rules were written in proprietary formats:

• Splunk SPL
• Elastic Query DSL
• Microsoft KQL
• Sumo Logic queries

This created problems:

• Rules couldn't be shared across tools
• Changing SIEMs meant rewriting everything
• Community rules were fragmented

SIGMA solves this with a universal format.

SIGMA Rule Structure

Every SIGMA rule has the same basic structure:

title: Suspicious PowerShell Download
status: experimental
description: Detects PowerShell downloading files from the internet
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'wget'
            - 'curl'
            - 'DownloadFile'
        Image|endswith: '\powershell.exe'
    condition: selection
level: medium
tags:
    - attack.execution
    - attack.t1059.001

Key Components

Title & Status

• title: Clear, descriptive name
• status: experimental, test, stable, or deprecated

Description

Explain what the rule detects and why it matters.

Logsource

Defines what logs this rule applies to:

• category: process_creation, network_connection, file_event, etc.
• product: windows, linux, macos, aws, etc.
• service: sysmon, security, powershell, etc.

Detection

The actual detection logic:

• selection: Define patterns to match
• filter: Define patterns to exclude
• condition: Combine selections and filters with AND/OR/NOT

Modifiers

SIGMA supports modifiers to match patterns:

• |contains: Field contains the value
• |endswith: Field ends with the value
• |startswith: Field starts with the value
• |re: Regular expression match

Level

Severity of the detection:

• low: Informational, might be interesting
• medium: Worth investigating
• high: Likely malicious
• critical: Almost certainly an attack

Tags

Reference to MITRE ATT&CK and other frameworks.

Converting SIGMA Rules

The power of SIGMA is conversion. The sigma-cli tool converts rules to:

• Splunk SPL
• Elastic Query DSL
• Microsoft Sentinel KQL
• Chronicle YARA-L
• And many more...

sigma convert -t splunk -p sysmon rule.yml

Writing Good SIGMA Rules

1. Be specific: Avoid overly broad patterns
2. Document well: Future you will thank you
3. Consider performance: Avoid expensive operations
4. Test thoroughly: Validate before deployment
5. Use standard fields: Stick to normalized field names