🧠 Writing Advanced Sigma Rules: Techniques & Real-World Use Cases

🔖 Introduction: Moving Beyond Basics in Detection Engineering

Sigma rules have become a cornerstone in the modern SOC and detection engineering toolbox. They provide a vendor-agnostic way to define detections in YAML format, making rule sharing and collaboration easier across different SIEM platforms.

But while writing basic Sigma rules can be as simple as identifying a known indicator or event ID, advanced Sigma rule writing requires context, creativity, and a deeper understanding of attacker behaviors.

This guide is for:

• Security Analysts looking to upskill
• Detection Engineers refining their threat coverage
• Blue Team professionals working on real-time defenses

Let’s take your Sigma game to the next level.

🧹 What Makes a Sigma Rule “Advanced”?

Writing advanced Sigma rules means moving beyond simple single-event detection. Key aspects include:

• Context Awareness: Correlating multiple log types or events.
• Event Chaining: Detecting patterns over time (e.g., brute force followed by login).
• Enrichments: Adding external intelligence (e.g., watchlists, known tools).
• Diversity in Log Sources: Not just relying on Windows Security logs; using Sysmon, DNS, Linux auditd, proxy logs, etc.

Example: Detecting RDP brute force based on failed logins across multiple hosts rather than a single system.

🛠️ Key Techniques for Writing Advanced Sigma Rules

1. Conditional Logic

Use logical operators smartly:

condition: selection1 and (selection2 or selection3)

2. Aggregation & Thresholds

Track repeated behavior in a short time frame:

condition: selection | count() by user > 5

3. Regex & Wildcards

Flexible detection patterns:

CommandLine|contains|regex: "(?i)rundll32.*url"

4. Diverse Log Sources

Think beyond Event ID 4688:

• Sysmon for process creation and network activity
• DNS logs for domain name anomalies
• Linux auditd for process execution and privilege escalations

5. Metadata Enrichment

Good rules have metadata:

level: high
tactics:
  - credential-access
tags:
  - attack.t1003.001

🧠 Real-World Use Cases

✅ 1. Detecting Credential Dumping (LSASS Access)

• What: Attackers accessing lsass.exe to dump credentials
• Log Source: Sysmon Event ID 10 (ProcessAccess)

detection:
  selection:
    TargetImage: 'C:\\Windows\\System32\\lsass.exe'
    GrantedAccess: '0x1410'
condition: selection

• MITRE ATT&CK: T1003.001
• Tuning: Exclude common tools like antivirus

✅ 2. Lateral Movement via RDP Brute Force

• What: Multiple failed login attempts followed by success
• Log Source: Windows Security Event ID 4625 and 4624

detection:
  failed:
    EventID: 4625
    LogonType: 10
  success:
    EventID: 4624
    LogonType: 10
condition: failed[\*] followed_by success

• MITRE ATT&CK: T1021.001
• Tuning: Use thresholds (e.g., 5+ failures in 5 minutes)

✅ 3. Suspicious Use of Rundll32 or Mshta

• What: Living-off-the-land techniques
• Log Source: Sysmon Event ID 1

detection:
  selection:
    Image|endswith:
      - 'rundll32.exe'
      - 'mshta.exe'
    CommandLine|contains:
      - 'http'
condition: selection

• MITRE ATT&CK: T1218.011, T1216
• Tuning: Look for usage in non-system folders

🧪 Testing & Tuning Your Advanced Sigma Rules

• Test Labs: DetectionLab, HELK
• Tools: sigmac, Red Canary’s Atomic Red Team
• Practice: Log real attacker tools like mimikatz or cobalt strike, then build rules

Example of Iteration:

1. Write initial rule
2. Run in lab
3. Analyze false positives
4. Add exclusions or enrich conditions

🌐 Integrating with SIEMs

• Conversion: Use sigmac to convert to Elastic, Sentinel, Splunk
• Normalization: Ensure fields match your SIEM schema
• CI/CD: Integrate with GitHub workflows for deployment

💡 Pro Tips from the Field

• Version your rules: Use Git for tracking changes
• Contribute back: Share to the SigmaHQ GitHub repo
• Use Tags Wisely: Helps with MITRE mapping and alert prioritization
• Documentation: Always write what the rule does and why

🔺 Conclusion

Advanced Sigma rule writing is part science, part art. It requires context, attacker knowledge, and iteration.

Try upgrading one of your existing basic rules using:

• Event chaining
• Diverse logs
• Regex
• Metadata

Then test it, tune it, and share it with your peers. Together, we can push detection engineering forward.

🔗 Useful Resources

• SigmaHQ Documentation
• GitHub – SigmaHQ Rules
• GitHub – sigmac
• DetectionLab
• MITRE ATT&CK

Stay sharp, stay curious.