detection-sigma

# Sigma Detection Engineering ## Overview Sigma is to log detection what Snort is to network traffic and YARA is to files - a universal signature format for describing security-relevant log events. This skill helps create, validate, and convert Sigma rules for deployment across multiple SIEM platforms, enabling detection-as-code workflows. **Core capabilities**: - Create detection rules using Sigma format - Convert rules to 25+ SIEM/EDR backends (Splunk, Elastic, QRadar, Sentinel, etc.) - Validate rule syntax and logic - Map detections to MITRE ATT&CK framework - Build threat hunting queries - Implement compliance-based monitoring ## Quick Start ### Install Dependencies ```bash pip install pysigma pysigma-backend-splunk pysigma-backend-elasticsearch pyyaml ``` ### Create a Basic Sigma Rule ```yaml title: Suspicious PowerShell Execution id: 7d6d30b8-5b91-4b90-a71e-4f5a3f5a3c3f status: experimental description: Detects suspicious PowerShell execution with encoded commands references: - https://attack.mitre.org/techniques/T1059/001/ author: Your Name date: YYYY/MM/DD modified: YYYY/MM/DD tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: '\powershell.exe' CommandLine|contains: - '-enc' - '-EncodedCommand' - 'FromBase64String' condition: selection falsepositives: - Legitimate administrative scripts level:...