{"id":2959,"date":"2018-02-10T15:07:04","date_gmt":"2018-02-10T14:07:04","guid":{"rendered":"http:\/\/nextron.bsk-consulting.de\/?p=2959"},"modified":"2022-10-04T15:14:48","modified_gmt":"2022-10-04T13:14:48","slug":"write-sigma-rules","status":"publish","type":"post","link":"https:\/\/www.nextron-systems.com\/2018\/02\/10\/write-sigma-rules\/","title":{"rendered":"How to Write Sigma Rules"},"content":{"rendered":"

[et_pb_section fb_built=”1″ admin_label=”section” _builder_version=”4.16″ global_colors_info=”{}” da_is_popup=”off” da_exit_intent=”off” da_has_close=”on” da_alt_close=”off” da_dark_close=”off” da_not_modal=”on” da_is_singular=”off” da_with_loader=”off” da_has_shadow=”on” da_disable_devices=”off|off|off”][et_pb_row admin_label=”row” _builder_version=”4.16″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_text admin_label=”Text” _builder_version=”4.18.0″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” hover_enabled=”0″ global_colors_info=”{}” sticky_enabled=”0″]Sigma is an open standard for rules that allow you to describe searches on log data in generic form. These rules can be converted and applied to many log management or SIEM systems and can even be used with grep on the command line.<\/p>\n

In this article I’d like to give you a brief practical introduction into the rule creation process. I’ll recommend some tools and draft a guide that helps you to write Sigma rules as quick and sound as possible.<\/p>\n

1. Get the Repository<\/h2>\n

First download or clone our Sigma repository<\/a> from Github.<\/p>\n

It contains the rule base in the folder “.\/rules” and the Sigma rule compiler “.\/tools\/sigmac”. We will use the existing rules as examples and create a new rule based on a similar existing one. We will then test that rule by using “sigmac”.<\/p>\n

\"\"

Sigma Github Repository<\/p><\/div>\n

2. Copy and Edit YAML Files<\/h2>\n

My personal favorite editor for YAML is VSCode<\/a>. It is free and runs on all major platforms. (alternatively you can use Atom<\/a>\u00a0with ‘language-yaml’ and ‘linter-js-yaml’ packages)<\/p>\n

\"\"

Visual Studio Code<\/p><\/div>\n

I used the following extensions but I don’t know if they are still necessary. VSCode has improved a lot over the last 12 months and it is possible that it supports YAML highlighting and syntax checks by default now.<\/p>\n

\"\"

YAML Extensions for VSCode<\/p><\/div>\n

We open the Sigma repository folder with “Open …” and see all existing rules.<\/p>\n

\"\"

Sigma Rules<\/p><\/div>\n

3. Create a Sigma Rule<\/h2>\n

I selected an example in which we will create a Sigma rule from one of @JPCERT<\/a>‘s findings in their awesome “Tool Analysis Result Sheet<\/a>“.<\/p>\n

We open the results for “Quarks PWDump<\/a>“, a password dumper often used by Chinese threat groups. It creates temporary files that we want to detect in our SysInternals Sysmon<\/a> log data. To collect the needed events we use Sysmon with @SwiftOnSecurity<\/a>‘s Sysmon config file<\/a>, Windows Event Forwarding<\/a> or NXlog<\/a>.<\/p>\n

\"\"

Quarks PWDump Analysis Results<\/p><\/div>\n

So, what we do is to find a Sigma rule in the repository that we can use as a template for our new rule. We use the ‘search’ function to find a rule that looks for “File Creation” events (EventID 11) in Sysmon log data.<\/p>\n

\"\"

Sigma Example Rule<\/p><\/div>\n

We find a rule that has a special format. It is a so-called “rule-collection<\/a>“, which allows us to define a global section in the YAML file marked with “action: global” that will be applied to all other sections in that file during the search query generation process. This way you can define and create multiple search queries from a single YAML file.<\/p>\n

In the case of our QuarksPwDump example we don’t need a rule collection, so we reduce the rule to a standard rule that contains a detection expression looking Sysmon Events with Event ID 11 and save it as “sysmon_quarkspw_filedump.yml” to a new file in the folder “.\/rules\/windows\/sysmon\/”.<\/p>\n

\"\"

Simple Sysmon Sigma Rule<\/p><\/div>\n

After that, we modify several fields of that rule:<\/p>\n