Sigma rule

Why it matters

Sigma is to log detections what STIX is to indicators and YARA is to files: the shared format. Before it, a detection written for Splunk was useless to a Sentinel shop and had to be reverse-engineered from a blog post. Now the SigmaHQ repository holds thousands of community rules, each tagged with the ATT&CK technique it detects, and a converter emits the SPL, KQL, AQL or Elastic query for your platform. Change SIEM and the rules come with you.

It also disciplines the writing. A rule must say which log source it needs, which makes the telemetry gap explicit: a rule for process_creation on Windows needs Sysmon Event 1 or audited 4688 with command lines, and if you do not collect that, the rule is fiction.

Anatomy of a rule

title: Office Application Spawning a Shell
id: 6f2a4e0c-3b1d-4d8e-9c7a-2f5e8b1a9d03
status: experimental
description: Detects Word, Excel or PowerPoint starting a command interpreter — typical macro phishing.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Your SOC
date: 2026-09-19
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\POWERPNT.EXE'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
  filter_signed_tool:
    CommandLine|contains: '\Program Files\FinanceMacro\'
  condition: selection and not filter_signed_tool
falsepositives:
  - Legitimate macros that launch scripts
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
  - attack.t1566.001

• logsource — abstract: category (process_creation, network_connection, dns_query, file_event…), product (windows, linux, aws…), service. The converter's pipeline maps this to the real index and field names.
• detection — named selections of field/value pairs, with modifiers: |contains, |startswith, |endswith, |re, |all, |cidr, |base64offset. A list of values is OR; keys within one selection are AND.
• condition — boolean logic over the selection names; 1 of selection_*, all of them, not filter. Correlation across events lives in separate correlation rules (Sigma v2).
• level (informational–critical), status (experimental–stable), tags in the attack.tXXXX and attack.<tactic> form, and a UUID id so the rule can be referenced and updated.

Common misreadings

• Sigma is not a query language and does not run anything. It is converted; a rule that converts is not a rule that works until the field mapping in the pipeline matches your data.
• Community rules are a starting point, not a deployment. Import all 3,000 and you get 3,000 rules tuned for someone else's environment. Start with the techniques in your threat profile.
• Case and paths. |endswith: '\cmd.exe' matches on Windows regardless of case in most backends but not all; check the converter's case-sensitivity rules for your target.

Related terms

• IOA — An IOA describes what an attacker is doing rather than what they left behind — a sequence of actions such as "a document opens a shell that downloads and executes a file" — so it detects the technique regardless of which hash, IP or domain is used this time.
• MITRE ATT&CK — MITRE ATT&CK is a public, curated catalogue of the behaviours real attackers use, organised so defenders can say "we saw T1059.001" instead of "some PowerShell thing".
• TTP — TTPs are the three levels at which attacker behaviour is described — the tactic is why (steal credentials), the technique is how (dump LSASS memory), the procedure is exactly how this actor does it (procdump renamed to dump64.exe, run via a scheduled task).
• IOC — An IOC is a piece of forensic evidence — a file hash, an IP address, a domain, a registry key, a mutex — whose presence on a system or in traffic indicates that a known intrusion has occurred.