Introduction to detection engineering: Sigma rules
You learn to turn attack behaviour into a detection rule, write product-neutral rules with Sigma, convert them to different SIEM query languages and test them on real logs.
Level 201 · 16 lessons · 15 practice labs
Lessons
Thinking in detections
- What detection engineering is
- From indicators to behaviour: why hashes are not enough
- Choosing a detection target with ATT&CK techniques
- The rule lifecycle: idea, writing, testing, release, retirement
- Short task: pull three detectable behaviours out of an incident report
Sigma
- Structure of a Sigma rule: logsource, detection, condition
- Modifiers: contains, startswith, re, base64offset
- Conditions: and, or, not, 1 of
- Metadata: level, tags, false positives
- Short task: write a rule that catches encoded PowerShell commands
Conversion and testing
- Converting a rule to Elastic and Splunk queries with sigma-cli
- Processing pipelines: adapting field names to your organisation
- Testing a rule against good and bad sample logs
- Adapting and tuning community rules
- Short task: convert five rules and remove the false positives of two
Capstone
- Capstone: write a five-rule detection pack for an attack chain
Practice labs
- Pull three detectable behaviours out of an incident report: Read the report, choose behaviours rather than indicators and note the log source each one needs.
- Turn a hash-based detection into a behaviour-based one: Redesign a rule that looks only at a file hash so it catches the tool’s command-line pattern.
- Decide with data which technique to cover first: Score five ATT&CK techniques against available logs and the threat report and choose the first two rules.
- Write a first Sigma rule: whoami being run: Write the rule with logsource, detection and condition sections and show it matches in the sample log.
- Add level, tags and a false-positive note to a rule: Complete a rule missing metadata with ATT&CK tags, level and known false positives and validate it.
- Catch a certutil download with contains and endswith: Write a rule catching the download parameters with modifiers and test it on three variants.
- Find the event this Sigma rule misses and fix it: Find the event missed when the parameter order changes and make the condition order-independent with the all modifier.
- Exclude admin work in the condition with 1 of and not: Combine several selections with 1 of, exclude the admin server with a filter and verify on two data sets.
- Catch an encoded command with base64offset: Write a rule that catches a download string inside encoded PowerShell in all three offset variants.
- Convert a rule to a query language with sigma-cli: Convert one rule to an Elastic and a Splunk query and compare the two outputs.
- Write a pipeline adapting field names to your organisation: See the converted query return nothing, write a processing pipeline that maps fields and convert again.
- Adapt a community rule to your environment: Test a ready-made rule with good and bad sample logs, remove the false positive and document the change.
- Stop two rules alerting twice on the same event: Find two overlapping rules, separate their scope and show each test event is caught by exactly one rule.
- Pick the rule you need from a community rule repository: Compare three candidate rules for scheduled task creation by log source, status and level, and choose the one that fits your environment with a reason.
- Filter a hundred community rules by log source and prepare them for release: Use a script to drop rules whose log sources you lack, run the rest on sample data and propose filters for the ten noisiest rules.
About this course
You learn to turn attack behaviour into a detection rule, write product-neutral rules with Sigma, convert them to different SIEM query languages and test them on real logs.
What you will learn
- Thinking in detections
- Sigma
- Conversion and testing
- Capstone
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.