Sigma Detection Rule Library

A library of production-ready Sigma detection rules covering common attacker techniques, mapped to MITRE ATT&CK. Includes a Python converter that translates rules to Splunk SPL and Elasticsearch/OpenSearch KQL.

Built from real-world detection engineering experience across enterprise SIEM environments (Panther, Splunk, ELK Stack).

---

Rules

File	Technique	MITRE	Level
credential-access/T1003_lsass_memory_dump.yml	LSASS memory dump via ProcDump, Mimikatz, comsvcs	T1003.001	High
credential-access/T1110_brute_force_okta.yml	Okta brute force / credential stuffing	T1110	Medium
defense-evasion/T1562_cloudtrail_stopped.yml	CloudTrail logging disabled or deleted	T1562.008	High
defense-evasion/T1055_process_injection_common.yml	Process injection via CreateRemoteThread / LSASS access	T1055	High
execution/T1059_powershell_encoded.yml	PowerShell -EncodedCommand obfuscation	T1059.001	Medium
lateral-movement/T1021_rdp_from_unexpected_host.yml	RDP logon from non-admin/non-bastion host	T1021.001	Medium
persistence/T1098_aws_iam_key_created_root.yml	IAM access key created for root account	T1098	Critical
persistence/T1547_registry_run_key.yml	Persistence via Windows registry Run keys	T1547.001	Medium

---

Quickstart

Convert a rule to Splunk SPL

pip install -r requirements.txt

python converter/sigma_converter.py rules/execution/T1059_powershell_encoded.yml --target splunk

Output:

// PowerShell Encoded Command Execution | Level: medium | MITRE: attack.t1059.001, attack.t1027
index=* (process_path="*\powershell.exe" OR process_path="*\pwsh.exe") AND
(process_command_line="* -EncodedCommand *" OR process_command_line="* -enc *" OR ...)
NOT (parent_process_path="*\VeeamBackup.exe" OR ...)

Convert to Elasticsearch KQL

python converter/sigma_converter.py rules/persistence/T1098_aws_iam_key_created_root.yml --target elastic

Convert all rules at once

# Print to stdout
python converter/sigma_converter.py rules/ --target splunk

# Write to files
python converter/sigma_converter.py rules/ --target elastic --output converted/

# Validate all rules
python converter/sigma_converter.py rules/ --validate

---

Rule Format

Rules follow the Sigma specification:

title: Short, descriptive rule name
id: unique-uuid
status: stable | test | experimental
description: What this detects and why it matters
author: ClockworkZMP
tags:
  - attack.tactic
  - attack.tNNNN
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\evil.exe'
    CommandLine|contains: 'bad'
  filter_legit:
    ParentImage|endswith: '\legit.exe'
  condition: selection and not filter_legit
falsepositives:
  - List known false positive scenarios
level: critical | high | medium | low | informational

---

Supported Modifiers

Modifier	Behavior	Example
endswith	Field ends with value	Image|endswith: '\cmd.exe'
startswith	Field starts with value	CommandLine|startswith: 'powershell'
contains	Field contains substring	CommandLine|contains: '-enc'
contains|all	Field must contain ALL values	CommandLine|contains|all: ['sekurlsa', 'logon']
re	Regex match	CommandLine|re: '(?i)mimikatz'

---

Adding Rules

1. Copy a rule from rules/ as a template
2. Generate a UUID for the id field: python -c "import uuid; print(uuid.uuid4())"
3. Set status: experimental until validated in your environment
4. Validate: python converter/sigma_converter.py your_rule.yml --validate

---

License

MIT — rules may be freely used, modified, and incorporated into commercial SIEM deployments.