Sigma Rules List with Examples

Sigma Rules List: Sigma is a standardised rule syntax which can be converted into many different SIEM supported syntax formats. The Recored Future Platform allows clients to access and download Sigma rules developed by Insikt Group for Use in their organisations.

The Sigma rules provided by the open source Sigma project and the custom rules developed by Recorded Future offer a powerful capability to detect and respond to credential harvesting using existing SIEM solution. When combined with properly configured host-based logging, using tools such as Sysmon, Sigma rules can elevate the ability of an orgnization to detect and respond to threats with increased accuracy and efficiency. Sigma Rules List is given below.

Sigma Rules List

Common Sigma Rule Mistakes

There are some common sigma rule list mistakes which are given below with example

Not Knowing When Rules are Case Sensitive

Because strings in Sigma rules are case insensitive, except when they contain a regex pattern, defenders who are new to writing these rules might inadvertently introduce errors. An erroneous rule can turn out to be a wasted effort and a security miss as it may never be triggered when expected.

Improper Backslash Use

Another source of error comes from the improper use of the backslash when escaping strings, specifically using the wrong number of backslashes. This is particularly an issue in regular expressions.

The rule creation guide explains a solution to avoid this. Cases where only single backslashes are being used by themselves need not be escaped. For example, the string C:\Windows\System32\cmd.exe does not need to be escaped and the single backslash will be treated as a “plain” string value. In other words, defenders should not escape single backslashes by writing “C:\Windows\System32\cmd.exe.”

A working example of this is shown in a Sigma rule shared by Florian Roth himself. The rule alerts sysadmins on seeing instances of the “ping” command being provided a hex-encoded IP address, possibly to avoid detection. Notice, the use of wildcards (*) and the “\” not being escaped.

Logical Errors From Operator Misuse

When crafting selection criteria and condition that is required to trigger the rule, beware of how your expression is being evaluated. Crafting an expression with multiple expressions using the OR operator when your logic is meant to convey AND can trigger a plethora of false alerts. This can get especially difficult to master when combining multiple selection criteria (containing a list of items) with the condition field combining such criteria using AND/OR/NOT

Read : Pradhan Mantri Kaushal Vikas Yojana Courses List PDF 2022 | PMKVY Course Fee and Job Roles