Custom Sigma Detection Rules
Vendor-agnostic Sigma detection rules mapped to MITRE ATT&CK techniques, targeting encoded PowerShell, process injection, credential access, and persistence mechanisms across enterprise Windows environments.
Overview
Modern adversaries leverage living-off-the-land binaries (LOLBins) and memory-only execution to evade signature defenses. This repository provides field-tested Sigma rules designed for direct compilation into Splunk SPL, Elastic Query DSL, and Microsoft Sentinel KQL.
Stack & Tooling
- SigmaHQ Taxonomy — Standardized detection rule syntax
- pySigma & sigma-cli — Rule validation and cross-SIEM compilation
- Splunk Enterprise & Wazuh — Rule testing and evaluation testbeds
- MITRE ATT&CK Framework — TTP alignment (T1059.001, T1055, T1003)
Detection Coverage
| Technique ID | Name | Target Telemetry | Severity |
|---|---|---|---|
| T1059.001 | Encoded PowerShell Cradle | Sysmon EID 1 (CommandLine regex) | High |
| T1055.012 | Process Hollowing | Sysmon EID 8 / 10 (CreateRemoteThread) | Critical |
| T1003.001 | LSASS Memory Access | Windows Security 4656 / 4663 | High |
| T1547.001 | Registry Run Key Persistence | Sysmon EID 12 / 13 | Medium |
| T1071.001 | Web Protocol C2 Beaconing | Zeek HTTP / SSL logs | High |
Usage & Compilation
# Clone the repository
git clone https://github.com/rootwithkhandal/sigma-rules
cd sigma-rules
# Install sigma CLI
pip install sigma-cli
# Validate all rules against the Sigma specification
sigma check rules/
# Compile rules to Splunk SPL
sigma convert -t splunk -p sysmon rules/windows/process_creation/ -o splunk_rules.spl
# Compile rules to Elastic DSL
sigma convert -t elasticsearch -p ecs rules/windows/ -o elastic_rules.json
Validation & Results
- 100% schema compliance verified against SigmaHQ Core v2.1
- 0 false positives during 30-day baseline testing in a virtualized enterprise domain
- High fidelity detection confirmed against Atomic Red Team emulation scripts