Detection as Code with Sigma Rules

Detection logic written directly in your SIEM's query language is logic you cannot take anywhere. Change platform and you rewrite everything; read a good rule published by a researcher and you translate it by hand.

Sigma is the portable format that fixes both problems.

The idea

Write the detection once in YAML, then convert it to whatever backend you run:

title: Web shell dropped in web root
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|startswith: '/var/www/'
    TargetFilename|endswith:
      - '.php'
      - '.jsp'
  filter:
    Image|endswith: '/apt'
  condition: selection and not filter
level: high

A converter turns that into a query for your platform. The logic lives in version control, in a format a human can review in a pull request.

Why this matters more than it sounds

Detection becomes code. Reviewed, versioned, diffed, and rolled back. The same discipline you apply to application changes, applied to the rules that are supposed to catch attacks.

Community rules become usable. There is a large public rule repository. When a technique is described publicly, a Sigma rule for it usually follows, and adopting it is a conversion rather than a translation project.

Platform migration stops being catastrophic. The reason teams stay on a SIEM they dislike is the rule library they cannot move.

Writing your own

Start from what would actually indicate a problem in the systems you run — not from a generic attack catalogue.

For the web platforms I maintain, that is: a new file appearing in the web root, an admin account created outside business hours, a spike in failed logins for one account, an outbound connection from the web server to an address it has never contacted.

Four rules that fit the environment beat four hundred that fit someone else's.

Then verify they fire

A rule that has never triggered is a rule you are trusting on faith. Generate the condition safely in a test environment and confirm the alert appears end to end.

I have found more broken detections this way than actual attacks — a field name that changed, a log source that stopped reporting, a rule that silently matched nothing for six months.

Resources

• Repo: SigmaHQ/sigma
• Converter: SigmaHQ/pySigma
• Video walkthroughs: YouTube: Sigma rules tutorial
• Verify them with Atomic Red Team