| name | defense-detection-sigma |
| description | Write portable detections as Sigma rules and map them to MITRE ATT&CK, then convert to your SIEM. Load for blue-team/detection-engineering tasks: "write a detection", "sigma rule", "alert on", turning an offensive technique or an incident into a repeatable detection.
|
| domain | defense |
| type | technique |
| stability | learning |
| modes | ["defense"] |
| severity | info |
| mitre | ["T1059","T1078"] |
| tools | ["sigma","sigmac","chainsaw"] |
| schema_version | 1 |
Detection engineering with Sigma
When it applies
You need a detection that survives a SIEM change: express the logic once in Sigma (a generic
YAML rule format), then compile to Splunk/Elastic/Sentinel/etc. Pairs with offensive skills —
every technique you learn to run, you can learn to catch.
Why it works
Sigma abstracts log-source + condition from backend query syntax, so one rule ports across
SIEMs and reviews cleanly. Mapping to ATT&CK gives coverage you can measure and gaps you can see.
Method
- Pick the behaviour, not the artifact: detect the technique (e.g. suspicious child of
w3wp.exe, certutil download, new service creation), not a single hash/IP that rotates.
- Identify the log source & fields: e.g. Windows Security 4688 / Sysmon 1 (process create),
or web/proxy logs — Sigma's
logsource block (product, category).
- Write the rule:
detection: with a selection: map (field → value/wildcards) and a
condition:; add falsepositives:, level:, and tags: [attack.tXXXX].
- Tune for FPs: add
filter: blocks for known-good (admin tools, scanners) and set a
sane level; validate against real logs (chainsaw hunt/sigmac to your backend).
- Version & map: store in git, tag ATT&CK IDs, track coverage across the matrix.
Gotchas
- Detecting the tool name (
mimikatz.exe) is brittle — detect the behaviour (LSASS access).
- No
falsepositives/tuning = an alert nobody trusts; noisy rules get muted and miss real hits.
- Confirm the field names match your actual log schema (EDR vs Sysmon vs raw ETW differ).
Verify success
The rule fires on a controlled reproduction of the technique and stays quiet on benign
baseline activity, and it compiles cleanly to your SIEM query.
References
SigmaHQ spec & rule repo; MITRE ATT&CK; Florian Roth detection-engineering guidance.
