Sigma cheatsheet

Full skeleton of a Sigma rule with all supported fields.

title: Suspicious PowerShell Execution          # Required. Short, descriptive name
id: 6f3e2d1a-4b5c-7890-abcd-ef1234567890        # Optional. UUID v4, unique rule ID
status: experimental                             # experimental | test | stable | deprecated | unsupported
description: |                                  # Optional. Multi-line explanation
  Detects suspicious PowerShell execution
  with encoded commands or download cradles.
references:                                     # Optional. URLs to context / threat intel
  - https://attack.mitre.org/techniques/T1059/001/
  - https://docs.microsoft.com/en-us/powershell
author: [email protected]                     # Optional. Free-form author string
date: 2026/03/26                                # Optional. YYYY/MM/DD
modified: 2026/03/26                            # Optional. Last modification date
logsource:                                      # Required. Defines the log origin
  category: process_creation                    # Abstract category (preferred)
  product: windows                              # OS/platform
  # service: sysmon                             # Concrete log channel (alternative)
detection:                                      # Required. Core detection logic
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - '-EncodedCommand'
      - '-enc '
      - 'DownloadString'
  filter_legitimate:
    CommandLine|contains: 'C:\Windows\System32\WindowsPowerShell'
  condition: selection and not filter_legitimate
falsepositives:                                 # Optional. Known benign triggers
  - Administrative scripts using encoded commands
  - Software deployment tools (SCCM, Ansible)
level: high                                     # informational | low | medium | high | critical
tags:                                           # Optional. MITRE ATT&CK or custom tags
  - attack.execution
  - attack.t1059.001
  - attack.defense_evasion
  - attack.t1027

Modifiers are appended to field names with | and can be chained.

Modifiers are case-insensitive by default. Add \|cs to force case-sensitive: Image\|endswith\|cs: '.EXE'.

The condition field combines named selection blocks using boolean logic.

# --- Basic boolean ---
condition: selection                          # Single block must match

condition: selection and filter               # Both must match

condition: selection and not filter           # selection matches, filter does NOT

condition: selection1 or selection2           # Either block matches

condition: (selection1 or selection2) and not filter_known_good

# --- Wildcard group matching ---
condition: 1 of selection*                   # Any block whose name starts with "selection"
condition: all of selection*                 # ALL blocks starting with "selection"
condition: 1 of them                         # Any named block in the detection section
condition: all of them                       # All named blocks must match

# --- Aggregate / threshold conditions ---
condition: selection | count() > 5
condition: selection | count(CommandLine) > 3
condition: selection | min(EventID) < 4624
condition: selection | max(bytes_out) > 10485760

# --- Aggregate with grouping (timeframe required) ---
timeframe: 5m
condition: selection | count() by SourceIp > 100

# --- Temporal near (backend-dependent) ---
condition: selection1 | near selection2

Full detection block example combining multiple patterns:

detection:
  selection_main:
    EventID: 4688
    NewProcessName|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  selection_susp:
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - '.ps1'
  filter_admin:
    SubjectUserName|endswith: '$'     # Machine account (expected)
  condition: all of selection* and not filter_admin
  timeframe: 1m
falsepositives:
  - Legitimate admin scripts
level: high

Detects Mimikatz execution by original filename, known CLI arguments, and module invocation patterns.

title: Mimikatz Execution
id: 60bd5c72-4a0f-4f3c-9a43-b4e8b5e27f2d
status: stable
description: |
  Detects Mimikatz credential dumping tool via original filename,
  command line keywords, and common module invocations (sekurlsa, lsadump, crypto).
references:
  - https://attack.mitre.org/techniques/T1003/001/
  - https://github.com/gentilkiwi/mimikatz
author: sigma-community
date: 2026/03/26
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - OriginalFileName: 'mimikatz.exe'
    - Image|endswith: '\mimikatz.exe'
  selection_cli:
    CommandLine|contains:
      - 'sekurlsa::'
      - 'lsadump::'
      - 'kerberos::'
      - 'crypto::'
      - 'token::'
      - 'vault::'
      - 'lsaenterprise::'
      - 'privilege::debug'
      - 'misc::memssp'
  selection_hash:
    Hashes|contains:
      - 'IMPHASH=A779571A9A35DD9FC26F3B826A72BB4D'  # x64 known variant
      - 'IMPHASH=9458B398D99B7FD64DE73D6A3AA1DFD0'  # x86 known variant
  condition: 1 of selection*
falsepositives:
  - Penetration testers and red team engagements
  - Authorized credential audits
level: critical
tags:
  - attack.credential_access
  - attack.t1003.001
  - attack.t1003.002
  - attack.t1003.004
  - attack.t1003.005

Additional example rules (PowerShell encoded command, LSASS access, scheduled task creation) are available in the SigmaHQ rule repository. The Mimikatz example above demonstrates all key syntax features: multiple selection blocks, modifiers (endswith, contains), hash matching, 1 of selection* condition, false positives, and ATT&CK tags.

Current tool (sigma-cli) replacing the deprecated sigmac. Uses a plugin architecture for backends.

# Install
pip install sigma-cli

# List installed backends and pipelines
sigma list backends
sigma list pipelines

# Install backend plugins
sigma plugin install splunk
sigma plugin install elasticsearch
sigma plugin install sentinel
sigma plugin install qradar
sigma plugin install chronicle
sigma plugin install loki

# --- Splunk ---
sigma convert -t splunk -p splunk_windows rule.yml
sigma convert -t splunk -p splunk_windows -f savedsearches rules/

# Output as Splunk alert (saved search format)
sigma convert -t splunk -p splunk_windows -f savedsearches -o alerts.conf rules/

# --- Elastic (ECS / Elastic SIEM) ---
sigma convert -t elasticsearch -p ecs_windows rule.yml
sigma convert -t elasticsearch -p ecs_windows -f eql rule.yml    # EQL output
sigma convert -t elasticsearch -p ecs_windows -f lucene rule.yml # Lucene output

# --- Microsoft Sentinel (KQL) ---
sigma convert -t sentinel -p azure_windows rule.yml
sigma convert -t sentinel -p azure_windows -f default -o sentinel_rules.json rules/

# --- QRadar (AQL) ---
sigma convert -t qradar -p qradar_windows rule.yml

# --- Google Chronicle (YARA-L) ---
sigma convert -t chronicle -p chronicle_windows rule.yml

# --- Loki (LogQL) ---
sigma convert -t loki -p grafana_loki rule.yml

# --- Convert entire directory, skip errors ---
sigma convert -t splunk -p splunk_windows rules/ --skip-unsupported

# --- With custom field mapping pipeline ---
sigma convert -t splunk -p splunk_windows -p custom_fields.yml rule.yml

# --- Output formats per backend ---
# splunk:         default (SPL), savedsearches, data_model
# elasticsearch:  default (Lucene), eql, dsl (query DSL)
# sentinel:       default (KQL)
# qradar:         default (AQL)

Pipeline YAML for custom field mappings:

# custom_fields.yml
name: custom_field_mapping
priority: 20
transformations:
  - id: field_remap_image
    type: field_name_mapping
    mapping:
      Image: process.executable
      CommandLine: process.command_line
      ParentImage: process.parent.executable
    rule_conditions:
      - type: logsource
        category: process_creation

Note: sigmac (the legacy tool) is deprecated since 2023 and replaced by sigma-cli above. If you encounter sigmac in older pipelines, migrate to sigma-cli with sigma plugin install <backend>.

• SigmaHQ GitHub
• Sigma Wiki
• sigma-cli
• pySigma
• Sigma Rule Creation Guide
• SigConverter

• Velociraptor (DFIR and threat hunting)
• Atomic Red Team (Unit test library for ATT&CK)
• Caldera (Adversary emulation platform)
• MITRE ATT&CK (Framework reference)
• Wazuh (HIDS and SIEM platform)
• Purple Team Toolkit (Purple team tools overview)