whx
/
killchain-compendium
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
killchain-compendium/Miscellaneous/Threat Intelligence/Sigma Rules.md

1.4 KiB
Raw Blame History

Sigma Rules

An abstracted yaml configuration setup as an universal notation format which can be converted into multiple queries like Splunk, Kibana, Yara etc. ...

Specify IOC or troubleshooting issues in a data format that can be shared and versionized.
This specified configuration can be translated to multiple different tools as specific queries.

Fields

A minimal configuration should contain at least the following fields

  • title
  • id (UUID)
  • status
  • description
  • logsource
  • detection
  • condition

Additional fields may be

  • falsePositives
  • levels
  • tags

Sigma Fields

Filters

Filter can be used to specify detection

File|endswith
CommandLine|contains
CommandLine|startswith

Transform Modifiers

A detection selection can be refined through setting a pipe | followed by the modifier contains, endswith, startswith and all.

Tools