agentsclimarketplace
Sign in

Writing sigma detection rules

Skill meltedinhex/analyst-ai-pack/skills/writing-sigma-detection-rules

Converts hunt findings into portable Sigma detection rules: choosing the right logsource, expressing robust selection/filter logic, setting level and ATT&CK tags, and validating before converting to a SIEM query. Activates for requests to write a Sigma rule, convert a hunt to a detection, or create portable SIEM detection logic.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill writing-sigma-detection-rules

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.1 KB, 538 tokens by cl100k_base, as published. Nobody here has run it

Writing Sigma Detection Rules

When to Use

  • A hunt produced reliable logic and you want a portable, SIEM-agnostic detection.
  • You need to share or version a detection in a standard format and tag it to ATT&CK.
  • You are translating a vendor query into Sigma for reuse across backends.

Do not use Sigma for stateful/correlation logic it cannot express well (complex sequence or statistical detections) — keep those in the SIEM's native correlation engine.

Prerequisites

  • The sigma CLI / sigma-cli (pysigma) for validation and conversion.
  • Knowledge of the target log source's field names and the Sigma taxonomy.

Workflow

Step 1: Define the logsource

Pin category/product/service precisely (e.g., product: windows, category: process_creation) so the rule maps to the right pipeline.

Step 2: Write robust selection logic

Express the detection on stable fields. Prefer multiple ANDed conditions over a single brittle string; use contains/endswith modifiers thoughtfully to resist evasion.

python scripts/analyst.py scaffold --title "Encoded PowerShell" --category process_creation \
  --technique T1059.001 --level high

Step 3: Add filters to cut false positives

Use a filter block (negated in the condition) to exclude known-good processes/paths rather than narrowing selection until it misses variants.

Step 4: Tag and document

Add tags (ATT&CK technique), level, status, references, and a falsepositives list so consumers can tune.

Step 5: Validate and convert

Lint the rule, then convert to the target backend and test against true/false-positive data before deploying.

sigma convert -t splunk rules/encoded_powershell.yml

Validation

  • The rule passes Sigma schema validation (sigma check).
  • It fires on the hunt's true positives and not on the documented benign cases.
  • Conversion to the target backend produces a sensible, runnable query.

Pitfalls

  • Over-narrow selection that matches one sample and misses the technique.
  • Wrong logsource, so the rule never sees the relevant events.
  • No falsepositives/filter, producing a noisy alert that gets ignored.

References

What ships with it: 3 files

3.5 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 326,835. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.