SIGMA, one rule to find them all

Rain Baker opens with background on Sigma, a community detection format created by Florian Roth and Thomas Patzke. Rules are written in YAML and are meant to be platform agnostic, working on log data much as YARA works on files. The talk walks through the required parts of a rule: a title, a log source defined by category, product and service, a detection section built from named selections, and a condition that combines them with boolean logic. Modifiers such as contains and filters that cut noise are also covered.

The middle of the talk shows example rules built from strings pulled from malware samples in customer environments and from sandbox detonations. Examples include a PowerShell download rule, an encoded PowerShell rule keyed on a hidden window and an Explorer parent process, and a rule for a ClickFix-style lure that prints text to the command line. A web converter built on pySigma pipelines was demonstrated, turning a rule into queries for backends such as Splunk, CrowdStrike and Carbon Black.

The closing section covers practical limits. Translation is not always clean, since Splunk field names vary by environment and a generic conversion can miss events without a custom pipeline. Rule ideas come from the team's own telemetry, fresh threat intelligence, customer requests and community repositories. The speaker's team tracks rules in Jira, vets them through weekly sprints with hunters, and then either promotes them to detections or uses them as leads for hunts.