SIGMA – A Universal Detection Rule Language: From Basics To SIEM Integration v.2.2 is a comprehensive guide to understanding, writing, and operationalizing Sigma detection rules. Sigma has become the de facto standard for expressing log-based detections in a SIEM-agnostic way, enabling analysts to “write once, detect everywhere.”
\nThis publication explains the evolution of Sigma (from early YAML prototypes to the current 2.0 specification), the anatomy of Sigma rules, and practical steps to create, validate, and test detections. It covers tooling such as pySigma and sigma-cli, and shows how Sigma rules can be translated and deployed across multiple platforms including Splunk, Elastic, IBM QRadar, and Microsoft Sentinel.
\nAdvanced chapters explore performance tuning, false positive reduction, contextual correlation, enrichment strategies, and QA workflows. Real-world detection scenarios such as malicious PowerShell, credential dumping, lateral movement, and ransomware kill-chains are included, with examples of Sigma rules and their equivalents in native SIEM languages.
\nThe guide is aimed at SOC analysts, detection engineers, and threat hunters, providing both theoretical foundations and actionable techniques to build reliable, portable detections across diverse environments.
", "identifiers": [ { "identifier": "https://securitybeztabu.pl", "scheme": "url" }, { "identifier": "https://www.linkedin.com/in/wojciech-ciemski", "scheme": "url" }, { "identifier": "https://securitybeyondtaboo.com", "scheme": "url" } ], "languages": [ { "id": "eng", "title": { "en": "English" } } ], "publication_date": "2025-08-28", "publisher": "Wojciech Ciemski", "references": [ { "reference": "https://graylog.org/post/the-ultimate-guide-to-sigma-rules/; https://attack.mitre.org/techniques/T1021/001/; https://blog.sigmahq.io/connecting-sigma-rule-sets-to-your-environment-with-processing-pipelines-4ee1bd577070; https://blog.sigmahq.io/how-to-validate-sigma-rules-with-github-actions-for-improved-security-monitoring-3d23a23803ff; https://blog.sigmahq.io/introducing-sigma-filters-204bd896273; https://blog.sigmahq.io/introducing-sigma-specification-v2-0-25f81a926ff0; https://blog.sigmahq.io/sigmahq-rules-release-highlights-r2024-03-26-50b086b2f540; https://blog.sigmahq.io/sigmahq-rules-release-highlights-r2024-05-13-237ed77459bf; https://blog.sigmahq.io/sigma-rule-repository-enhancements-new-folder-structure-rule-types-30adb70f5e10; https://cardinalops.com/blog/splunk-and-other-siem-detections-for-follina/; https://community.opentext.com/cybersec/threat-detect-response/f/discussions/105445/sigma-rules-guide-threat-hunting-for-esm-arcsight-command-center-and-logger; https://cymulate.com/blog/cymulates-sigma-rules/; https://detection.fyi/mbabinski/sigma-rules/2024_redcanary_threatdetectionreport/technique_powershell_encoded_command/; https://detection.fyi/sigmahq/sigma/windows/file/file_event/file_event_win_lsass_default_dump_file_names/; https://detection.fyi/sigmahq/sigma/windows/powershell/powershell_script/posh_ps_potential_invoke_mimikatz/; https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_msra_process_injection/; https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_powershell_base64_hidden_flag/; https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_sysinternals_procdump_lsass/; https://docs.alphasoc.com/detections_and_findings/sigma_custom/; https://enescayvarli.medium.com/sigma-rules-to-splunk-from-detection-logic-to-real-time-alerts-c1c8900ca660; https://github.com/SigmaHQ/pySigma; https://github.com/SigmaHQ/sigma; https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide/97c55ea762e775787c1f38a623a8ae12de94253b; https://graylog.org/post/sigma-specification-2-0-what-you-need-to-know/; https://marketplace.visualstudio.com/items?itemName=humpalum.sigma; https://medium.com/@Architekt.exe/writing-your-first-sigma-rule-5ed783c87570; https://medium.com/@balasubramanya.c/advanced-guide-to-sigma-rules-for-elastic-siem-web-server-log-analysis-3fd595c9e74d; https://medium.com/@imanvanpersien/mitre-att-ck-framework-as-a-standard-for-developing-siem-use-cases-d7dc7db4e1ba; https://micahbabinski.medium.com/creating-a-sigma-backend-for-fun-and-no-profit-ed16d20da142; https://pypi.org/project/pySigma/; https://readsecurity.medium.com/powerful-powershell-commands-to-monitor-for-attack-detections-2397b4f154d1; https://securitybeztabu.pl/sigma-uniwersalny-jezyk-regul-detekcji-czesc-1/; https://securitybeztabu.pl/sigma-uniwersalny-jezyk-regul-detekcji-czesc-2/; https://sigmahq.io/docs/basics/conditions.html; https://sigmahq.io/docs/basics/log-sources.html; https://sigmahq.io/docs/basics/modifiers.html; https://sigmahq.io/docs/basics/rules.html; https://sigmahq.io/docs/digging-deeper/backends; https://sigmahq.io/docs/guide/about; https://sigmahq.io/docs/guide/getting-started.html; https://sigmahq.io/docs/meta/; https://socprime.com/blog/uncoder-ai-automates-mitre-attck-tagging-in-sigma-rules/; https://www.logpoint.com/en/blog/how-to-use-logpoint-pysigma-backend-for-threat-detection/; https://www.nextron-systems.com/2018/02/10/write-sigma-rules/; https://www.picussecurity.com/resource/detection-and-prevention-in-the-late-phase-of-the-ransomware-attacks; https://www.reddit.com/r/QRadar/comments/13179z9/ho_to_fix_field_does_not_exist_in_catalog_events/" } ], "resource_type": { "id": "publication-report", "title": { "de": "Bericht", "en": "Report" } }, "rights": [ { "description": { "en": "The Creative Commons Attribution license allows re-distribution and re-use of a licensed work on the condition that the creator is appropriately credited." }, "icon": "cc-by-icon", "id": "cc-by-4.0", "props": { "scheme": "spdx", "url": "https://creativecommons.org/licenses/by/4.0/legalcode" }, "title": { "en": "Creative Commons Attribution 4.0 International" } } ], "subjects": [ { "subject": "Cybersecurity" }, { "subject": "Sigma rules" }, { "subject": "Detection engineering" }, { "subject": "SIEM integration" }, { "subject": "Threat detection" }, { "subject": "Log analysis" }, { "subject": "Splunk" }, { "subject": "Elastic Stack" }, { "subject": "IBM QRadar" }, { "subject": "Microsoft Sentinel" }, { "subject": "SOC operations" }, { "subject": "MITRE ATT&CK" }, { "subject": "Threat hunting" } ], "title": "SIGMA \u2013 A Universal Detection Rule Language From Basics To SIEM Integration", "version": "2.2" }, "parent": { "access": { "owned_by": { "user": "1382043" }, "settings": { "accept_conditions_text": null, "allow_guest_requests": false, "allow_user_requests": false, "secret_link_expiration": 0 } }, "communities": {}, "id": "16989642", "pids": { "doi": { "client": "datacite", "identifier": "10.5281/zenodo.16989642", "provider": "datacite" } } }, "pids": { "doi": { "client": "datacite", "identifier": "10.5281/zenodo.16989643", "provider": "datacite" }, "oai": { "identifier": "oai:zenodo.org:16989643", "provider": "oai" } }, "revision_id": 10, "stats": { "all_versions": { "data_volume": 141586505.0, "downloads": 149, "unique_downloads": 116, "unique_views": 812, "views": 842 }, "this_version": { "data_volume": 141586505.0, "downloads": 149, "unique_downloads": 116, "unique_views": 812, "views": 842 } }, "status": "published", "swh": {}, "updated": "2025-08-28T20:47:48.297390+00:00", "versions": { "index": 1, "is_latest": true } }