<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: writing-sigma-detection-rules
description: >-
  Author, test, and deploy Sigma detection rules for cross-platform SIEM integration. Covers rule syntax, log source mapping, condition logic, false-positive tuning, and automated rule lifecycle management.
domain: cybersecurity
subdomain: blue-team
tags:
  - sigma-rules
  - detection-engineering
  - siem
  - threat-detection
  - false-positive-tuning
expertise_level: intermediate
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Writing Sigma Detection Rules

## Overview

Sigma is a generic, open signature format for SIEM detection rules. A single Sigma rule compiles to Splunk SPL, Elastic KQL, Microsoft Sentinel KQL, QRadar AQL, and other SIEM query languages — write once, deploy everywhere. This skill covers rule authoring, log source mapping, condition logic, false-positive reduction, and lifecycle management.

Mode: `[MODE: BLUE]` — Detection engineering. Every rule requires a corresponding false positive suppression strategy.

## Rule Skeleton

```yaml
title: Detect Suspicious Process — PowerShell Encoded Command
id: 7f3c2b1a-4e5d-4f6a-8b9c-1d2e3f4a5b6c
status: experimental
description: Detects PowerShell invocations using -EncodedCommand flag, commonly used to obfuscate malicious payloads.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains: '-EncodedCommand'
  filter_admin:
    User|contains: 'SYSTEM'
    ParentImage|endswith: '\services.exe'
  condition: selection and not filter_admin
falsepositives:
  - Administrative scripts using encoded commands from trusted paths
  - Software deployment tools (SCCM, Intune) with encoded payloads
level: high
tags:
  - attack.t1059.001
  - attack.execution
```

## Log Source Categories

| Category | Windows Event IDs | Linux Sources | Notes |
|---|---|---|---|
| `process_creation` | 4688 (Sysmon: 1) | auditd, syslog | Best coverage with Sysmon installed |
| `network_connection` | Sysmon 3 | auditd net, zeek | IP/port correlation |
| `file_change` | Sysmon 11, 12, 13 | auditd, inotify | File create/modify/delete |
| `registry_add/set/delete` | Sysmon 12, 13, 14 | — | Windows only |
| `dns_query` | Sysmon 22 | zeek dns.log | C2 domain detection |
| `authentication` | 4624, 4625, 4648 | /var/log/auth.log | Login success/failure |
| `image_load` | Sysmon 7 | — | DLL hijack, LOLBin |

## Condition Modifiers

| Modifier | Behavior | Example |
|---|---|---|
| `contains` | Substring match | `CommandLine|contains: '-enc'` |
| `startswith` | Prefix match | `Image|startswith: 'C:\Windows\Temp'` |
| `endswith` | Suffix match | `Image|endswith: '\cmd.exe'` |
| `re` | Regex match | `CommandLine|re: 'powershell.*-e[nc]+'` |
| `all of` | AND across list values | `condition: all of selection*` |
| `1 of` | OR across named selections | `condition: 1 of filter_*` |
| `near` | Temporal proximity (Splunk) | — |

## False Positive Reduction Techniques

| Technique | When to Use | Example |
|---|---|---|
| Filter admin paths | Legitimate admin tool paths trigger rule | `filter: Image|startswith: 'C:\Program Files\'` |
| Filter trusted parents | Known-good parent process | `filter: ParentImage|endswith: '\svchost.exe'` |
| Filter user exclusion | Service account triggers | `filter: User|contains: 'SVC_'` |
| Threshold condition | Single event is benign, volume is not | `count() > 10 by ComputerName within 5m` |
| Allowlist integration | Known-good hashes or command patterns | Maintain external allowlist, inject as filter |

## Rule Lifecycle

| Stage | Actions | Tools |
|---|---|---|
| Draft | Author rule, validate YAML syntax | `sigma check` |
| Test | Simulate against log samples | `sigma convert` + SIEM test environment |
| Staging | Deploy to non-production, measure FP rate | SIEM staging tenant |
| Production | Deploy with suppression rules active | Sigma CI/CD pipeline |
| Tuning | Adjust filters based on analyst feedback | Rule PR with FP evidence |
| Retirement | Rule no longer fires or superseded | Archive, document reason |

## Compilation Targets

| SIEM | Convert Command |
|---|---|
| Splunk SPL | `sigma convert -t splunk rule.yml` |
| Elastic KQL | `sigma convert -t elasticsearch rule.yml` |
| Microsoft Sentinel | `sigma convert -t microsoft365defender rule.yml` |
| QRadar AQL | `sigma convert -t qradar rule.yml` |
| Chronicle | `sigma convert -t chronicle rule.yml` |

## Related Techniques

- [Implementing Detection-as-Code Pipeline](../building-detection-as-code-pipeline/SKILL.md)
- [Performing Alert Triage and Investigation](../tuning-edr-detection-rules/SKILL.md)
