Sigma rules for log detection

1 Introduction

2 Rule anatomy

This rule detects certutil.exe, a legitimate Windows certificate tool, being abused to download a file (MITRE ATT&CK T1105, Ingress Tool Transfer). The comments explain each field.

proc_creation_win_certutil_download.yml

title: File Download via Certutil                # short, human-readable name
id: 3f2a8c1e-5b7d-4e9a-9c61-2d8f0a7b4c13         # random UUIDv4, never reused
status: experimental                             # experimental -> test -> stable
description: Detects certutil.exe used with the urlcache option to fetch a remote file, a classic living-off-the-land download technique.
references:
    - https://attack.mitre.org/techniques/T1105/
author: mlab Academy
date: 2026-10-21                                 # YYYY-MM-DD
tags:                                            # MITRE ATT&CK tactic + technique
    - attack.command-and-control
    - attack.t1105
logsource:                                       # WHICH logs this rule applies to
    category: process_creation
    product: windows
detection:                                       # WHAT to look for
    selection_img:                               # a list = OR between its items
        - Image|endswith: '\certutil.exe'
        - OriginalFileName: 'CertUtil.exe'
    selection_cli:                               # keys in a map = AND
        CommandLine|contains|all:                # |all = every value must be present
            - 'urlcache'
            - 'http'
    condition: all of selection_*                # how the named blocks combine
falsepositives:
    - Administrators manually retrieving certificates or CRLs over HTTP
level: high                                      # informational, low, medium, high, critical

Metadata fields

logsource: which logs?

logsource combines up to three keys: product (windows, linux, aws, azure…), service (security, sysmon, powershell, cloudtrail…) and category (a generic type such as process_creation, network_connection, dns_query, file_event). Categories are powerful: process_creation on Windows can be fed by Sysmon event 1, Windows Security event 4688 or an EDR. The pipeline decides which data source is queried.

detection: selections, modifiers and condition

The detection block contains named search identifiers (any name you like: selection, filter_admin…) and one condition that combines them. Two rules are enough to read any of them:

Values are case-insensitive by default, and * / ? are wildcards. Field modifiers, chained with |, change how a value is compared:

The condition line accepts:

3 Worked examples

Step 1: one event, one field

The simplest possible rule: every failed Windows logon (Security event 4625). Far too noisy to alert on by itself, hence level: low, but it is a perfect building block for step 4.

win_security_failed_logon.yml

title: Windows Failed Logon
id: 0c7a1f2e-3b4d-4e5f-8a6b-7c8d9e0f1a2b
status: test
description: Demo rule - matches every failed logon on a Windows host.
author: mlab Academy
date: 2026-10-21
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4625
    condition: selection
level: low

Step 2: two selections combined

The certutil rule from section 2. selection_img identifies the binary twice, by path and by OriginalFileName (taken from the PE header, so it still matches if the attacker renames certutil.exe to notepad.exe). selection_cli requires both keywords.

Step 3: parent/child behaviour with a filter

A classic of malicious macro documents: an Office application starts PowerShell with an encoded command. We add a filter for a (fictional) approved add-in: filters are how you tune a rule for your environment without weakening it everywhere else.

proc_creation_win_office_spawn_encoded_powershell.yml

title: Encoded PowerShell Spawned by an Office Application
id: 9b1e4d27-6c3a-4f8e-b2d5-1a7c0e9f3b64
status: experimental
description: Detects Word, Excel or PowerPoint launching PowerShell with an encoded command, typical of malicious macro documents.
references:
    - https://attack.mitre.org/techniques/T1059/001/
    - https://attack.mitre.org/techniques/T1204/002/
author: mlab Academy
date: 2026-10-21
modified: 2026-10-21
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1204.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\winword.exe'
            - '\excel.exe'
            - '\powerpnt.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_cli:
        CommandLine|contains|windash:
            - ' -enc '
            - ' -encodedcommand '
    filter_main_approved_addin:
        CommandLine|contains: 'C:\Program Files\Contoso\ApprovedAddin\'
    condition: all of selection_* and not 1 of filter_main_*
falsepositives:
    - Rare internal add-ins that legitimately call encoded PowerShell (add them to a filter)
level: high

Exercise: PowerShell accepts any unambiguous prefix of a parameter, so -e, -ec or -enco also work. How would you extend selection_cli without matching every command line containing "-e"? (Hint: look at how the SigmaHQ rules handle it.)

Step 4: a correlation rule (brute force)

Since version 2.0 of the specification, Sigma supports correlation rules that count or link events from other rules. Here we reuse the step 1 rule (referenced by its name) and alert on ten failures from the same IP within five minutes. Both documents live in the same file, separated by ---.

win_security_failed_logon_bruteforce.yml

title: Windows Failed Logon
id: 0c7a1f2e-3b4d-4e5f-8a6b-7c8d9e0f1a2b
name: windows_failed_logon
status: test
description: Demo rule - matches every failed logon on a Windows host.
author: mlab Academy
date: 2026-10-21
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4625
    condition: selection
level: low
---
title: Many Failed Logons From One Source
id: 5e2d8b1a-7f4c-4a3e-9d6b-0c1f2a3b4c5d
status: experimental
description: Ten or more failed logons from the same source IP within five minutes.
author: mlab Academy
date: 2026-10-21
correlation:
    type: event_count
    rules:
        - windows_failed_logon
    group-by:
        - IpAddress
    timespan: 5m
    condition:
        gte: 10
level: medium

$ sigma convert -t splunk -p splunk_windows win_security_failed_logon_bruteforce.yml
source="WinEventLog:Security" EventCode=4625

| bin _time span=5m
| stats count as event_count by _time IpAddress

| search event_count >= 10

Other correlation types: value_count (e.g. one source trying many different user names), temporal and temporal_ordered (several rules firing together, or in a given order). Not every backend supports them yet.

4 Converting rules

The reference toolchain is pySigma (a Python library) and its command-line front-end sigma-cli. The old sigmac converter is deprecated: if a tutorial uses it, it is out of date.

# Install the CLI and the backends you need
$ pip install sigma-cli
$ sigma plugin install splunk
$ sigma plugin install elasticsearch
$ sigma plugin install kusto

# Lint your rules (syntax + style checks)
$ sigma check rules/

# See which targets and pipelines are available
$ sigma list targets
$ sigma list pipelines splunk

A conversion always needs a target (-t, the query language) and usually a pipeline (-p, the field mapping for your data). Here is the certutil rule converted for three SIEMs, real output of sigma-cli:

$ sigma convert -t splunk -p splunk_windows proc_creation_win_certutil_download.yml
Image="*\\certutil.exe" OR OriginalFileName="CertUtil.exe" CommandLine="*urlcache*" CommandLine="*http*"

$ sigma convert -t lucene -p ecs_windows proc_creation_win_certutil_download.yml
(process.executable.caseless:*\\certutil.exe OR process.pe.original_file_name:CertUtil.exe) AND (process.command_line:*urlcache* AND process.command_line:*http*)

$ sigma convert -t kusto -p microsoft_xdr proc_creation_win_certutil_download.yml
DeviceProcessEvents
| where (FolderPath endswith "\\certutil.exe" or ProcessVersionInfoOriginalFileName =~ "CertUtil.exe") and (ProcessCommandLine contains "urlcache" and ProcessCommandLine contains "http")

The microsoft_xdr pipeline targets the advanced hunting tables (DeviceProcessEvents…), which are also available in Sentinel when the Defender XDR connector is enabled; sentinel_asim targets Sentinel's normalised ASIM tables instead. For the step 3 rule, the KQL looks like this. Notice how |windash expanded each flag into five variants:

DeviceProcessEvents
| where ((InitiatingProcessFolderPath endswith "\\winword.exe" or InitiatingProcessFolderPath endswith "\\excel.exe" or InitiatingProcessFolderPath endswith "\\powerpnt.exe") and (FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe") and (ProcessCommandLine contains " -enc " or ProcessCommandLine contains " /enc " or ProcessCommandLine contains " –enc " or ProcessCommandLine contains " —enc " or ProcessCommandLine contains " ―enc " or ProcessCommandLine contains " -encodedcommand " or ProcessCommandLine contains " /encodedcommand " or ProcessCommandLine contains " –encodedcommand " or ProcessCommandLine contains " —encodedcommand " or ProcessCommandLine contains " ―encodedcommand ")) and (not(ProcessCommandLine contains "C:\\Program Files\\Contoso\\ApprovedAddin\\"))

No SIEM? Run Sigma directly on log files

Several free tools apply Sigma rules straight to Windows event logs (.evtx), ideal for practising or for incident response on a single machine: Hayabusa (Yamato Security), Chainsaw (WithSecure) and Zircolite. The web converter sigconverter.io, built on pySigma, lets you try conversions without installing anything.

5 Common pitfalls

Performance tips

6 Going further

Where to find rules

Connecting the dots

Sigma tags map every rule to MITRE ATT&CK, which lets you draw a coverage heat map and spot the techniques you cannot see. Behaviour observed in a sandbox (process tree, command lines) is the best raw material for new rules. For indicators that change daily, keep using IOC lookups and STIX/TAXII feeds; for files, use YARA; for network traffic, Suricata and Snort.