Sigma Generic Signature Format

repository·master·Indexed 27 days ago

A generic and open signature format for describing log events in a structured, vendor-agnostic way. Sigma allows security practitioners to write detection rules once and convert them for use across various SIEM, EDR, and XDR platforms. The project provides several rule categories, including Generic Detection, Threat Hunting, Emerging Threat, and Compliance rules, and supports conversion via the Sigma CLI, sigconverter.io, Detection Studio, and the pySigma library.

Tokens: 26.4K
Snippets: 81
Records: 113
Agent score: 95%

What's inside Sigma

Overview of Sigma detection rules
master
Sigma is a generic, open signature format used to describe log events in a structured, vendor-agnostic way. It serves as a standard for sharing detection methods across different SIEM (Security Information and Event Management) systems, similar to how Snort is used for network traffic and YARA for files.
The repository contains several types of rules:
- Generic Detection Rules: Threat-agnostic rules targeting specific behaviors or techniques.
- Threat Hunting Rules: Broad-scope rules designed as starting points for analysts to hunt for suspicious activity.
- Emerging Threat Rules: Timely rules covering specific APT campaigns, Zero-Day vulnerabilities, or specific malware.
- Compliance Rules: Rules used to identify violations of security frameworks like CIS Controls, NIST, or ISO 27001.
- Placeholder Rules: Rules that resolve their final meaning during conversion or usage.
https://github.com/sigmahq/sigma/blob/master/README.md
Overview of Goofy Guineapig Malware Rules
master
Goofy Guineapig is a persistent backdoor designed to collect and exfiltrate system information and load additional plugins. The Sigma repository provides several rules to detect various stages of this threat, including file indicators, process creation anomalies, C2 communication, and service persistence.
https://github.com/sigmahq/sigma/blob/master/rules-emerging-threats/2021/Malware/Goofy-Guineapig/README.md
Detect COLDSTEEL Windows Remote Access Tool
master
COLDSTEEL is a Remote Access Tool (RAT) that provides interactive desktop functionality and command-line access. Use the following Sigma rules to detect various stages of its lifecycle, including persistence, process execution, and cleanup.
Available Detection Rules:
- Persistence:
  win_system_malware_coldsteel_persistence_service.yml: COLDSTEEL Persistence Service Creation
  proc_creation_win_malware_coldsteel_service_persistence.yml: COLDSTEEL RAT Service Persistence Execution
  file_event_win_malware_coldsteel_service_dll_creation.yml: Potential COLDSTEEL Persistence Service DLL Creation
  image_load_malware_coldsteel_persistence_service_dll.yml: Potential COLDSTEEL Persistence Service DLL Load
  registry_set_malware_coldsteel_created_users.yml: Potential COLDSTEEL RAT Windows User Creation
- Execution & Activity:
  proc_creation_win_malware_coldsteel_anonymous_process.yml: COLDSTEEL RAT Anonymous User Process Execution
  proc_creation_win_malware_coldsteel_cleanup.yml: COLDSTEEL RAT Cleanup Command Execution
  file_event_win_malware_coldsteel_renamed_cmd.yml: Potential COLDSTEEL RAT File Indicators
https://github.com/sigmahq/sigma/blob/master/rules-emerging-threats/2023/Malware/COLDSTEEL/README.md
Understand the Emerging Threats rule category
master
The emerging-threats category in Sigma contains rules designed to cover timely and relevant threats. This includes specific APT campaigns, exploitation of Zero-Day vulnerabilities, and specific malware used during active attacks.
Rules are organized by year and further categorized into the following sub-folders:
- Exploits: Rules covering the exploitation of specific vulnerabilities.
- Malware: Rules covering malware, ransomware, and suspicious software used by threat actors.
- TA: Rules covering APT (Advanced Persistent Threat), Threat Actor, and specific malware activities.
https://github.com/sigmahq/sigma/blob/master/rules-emerging-threats/README.md
Enable Windows Registry auditing
master
To monitor registry access, enable the 'Audit Registry' subcategory.
Event Details:
- Subcategory GUID: {0CCE921E-69AE-11D9-BED3-505054503030}
- Provider: Microsoft Windows Security Auditing
- Channel: Security
- EventIDs: 4656, 4657, 4658, 4660, 4663, 4670, 5039
Configuration via Group Policy (gpedit.msc): Navigate to: Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies - Local Group Policy Object > Object Access > Audit Registry > Success and Failure.
```
# Enable Success audit Only
auditpol /set /subcategory:{0CCE921E-69AE-11D9-BED3-505054503030}, /success:enable

# Enable both Success and Failure auditing
auditpol /set /subcategory:{0CCE921E-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable
```
https://github.com/sigmahq/sigma/blob/master/documentation/logsource-guides/windows/service/security.md
Enable Windows Audit Other Logon/Logoff Events logging
master
To capture other Logon/Logoff events, use Group Policy or auditpol.
Group Policy Path:
- Computer Configuration
  Windows Settings
  Security Settings
  Advanced Audit Policy Configuration
  System Audit Policies - Local Group Policy Object
  Logon/Logoff
  Audit Other Logon/Logoff Events
  Success and Failure
Auditpol Commands:
```
# Enable Success audit Only
auditpol /set /subcategory:{0CCE921C-69AE-11D9-BED3-505054503030}, /success:enable

# Enable both Success and Failure auditing
auditpol /set /subcategory:{0CCE921C-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable
```
https://github.com/sigmahq/sigma/blob/master/documentation/logsource-guides/windows/service/security.md
Configure Audit Authorization Policy Change logging
master
To monitor changes to authorization policies, enable auditing for the 'Audit Authorization Policy Change' subcategory. This captures EventIDs 4670, 4703, 4704, 4705, 4911, and 4913 via the Microsoft Windows Security Auditing provider on the Security channel.
Via Group Policy (gpedit.msc): Navigate to: Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies - Local Group Policy Object -> Policy Change -> Audit Authorization Policy Change -> Set to Success and Failure.
Via auditpol (PowerShell): Use the subcategory GUID {0CCE9231-69AE-11D9-BED3-505054503030}.
```
# Enable Success audit Only
auditpol /set /subcategory:{0CCE9231-69AE-11D9-BED3-505054503030}, /success:enable

# Enable both Success and Failure auditing
auditpol /set /subcategory:{0CCE9231-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable
```
https://github.com/sigmahq/sigma/blob/master/documentation/logsource-guides/windows/service/security.md
Identify Devil Bait malware activity using Sigma rules
master
The Devil Bait rule package contains Sigma signatures to detect a malicious macro-enabled Microsoft Word document targeting Korean speakers. This malware uses 'live off the land' binaries (LOLbins) to execute, enumerate systems, modify registries, and establish persistence via a second-stage VBScript.
Use the following rules to detect different stages of the attack:
- Script Dropping: Detects the initial drop of the VBScript stage (file_event_win_malware_devil_bait_script_drop.yml).
- Reconnaissance: Detects malware reconnaissance activities involving output redirection (proc_creation_win_malware_devil_bait_output_redirect.yml).
- C2 Communication: Detects potential Command and Control (C2) traffic associated with the malware (proxy_malware_devil_bait_c2_communication.yml).
https://github.com/sigmahq/sigma/blob/master/rules-emerging-threats/2021/Malware/Devil-Bait/README.md
Configure Microsoft Windows Security Auditing for Process Creation
master
To use SIGMA rules in the process_creation category with native Windows Security Auditing, you must enable auditing for the Process Creation subcategory. This generates EventID 4688 in the Security channel.
Subcategory GUID: {0CCE922B-69AE-11D9-BED3-505054503030}
Via Group Policy (gpedit.msc)
Navigate to: Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies - Local Group Policy Object -> Detailed Tracking -> Audit Process Creation -> Set to Success and Failure.
Via Command Line (auditpol)
Use the auditpol utility to enable auditing directly.
```
# Enable Success audit Only
auditpol /set /subcategory:{0CCE922B-69AE-11D9-BED3-505054503030}, /success:enable

# Enable both Success and Failure auditing
auditpol /set /subcategory:{0CCE922B-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable
```
https://github.com/sigmahq/sigma/blob/master/documentation/logsource-guides/windows/category/process_creation.md
Enable Windows Audit Logoff logging
master
To capture Logoff events, use Group Policy or auditpol.
Group Policy Path:
- Computer Configuration
  Windows Settings
  Security Settings
  Advanced Audit Policy Configuration
  System Audit Policies - Local Group Policy Object
  Logon/Logoff
  Audit Logoff
  Success and Failure
Auditpol Commands:
```
# Enable Success audit Only
auditpol /set /subcategory:{0CCE9216-69AE-11D9-BED3-505054503030}, /success:enable

# Enable both Success and Failure auditing
auditpol /set /subcategory:{0CCE9216-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable
```
https://github.com/sigmahq/sigma/blob/master/documentation/logsource-guides/windows/service/security.md
Configure PowerShell Script Block Logging for PowerShell 7 (PowerShellCore)
master
To use Sigma rules in the ps_script category for PowerShell 7, enable Script Block Logging via Group Policy or Administrative Templates. This generates EventID 4104 in the PowerShellCore/Operational channel.
Configuration Path:
- Computer Configuration
  Administrative Templates
  PowerShell Core
  Turn On PowerShell Script Block Logging
Note: If the logging template is not available after installing PowerShell 7, run the InstallPSCorePolicyDefinitions.ps1 script located in the installation directory.
```
Provider: PowerShellCore
GUID: {f90714a8-5509-434a-bf6d-b1624c8a19a2}
Channel: PowerShellCore/Operational
EventID: 4104
```
https://github.com/sigmahq/sigma/blob/master/documentation/logsource-guides/windows/category/ps_script.md
Configure Account Management: Other Account Management Events logging
master
To capture Other Account Management events (EventIDs: 4782, 4793) from the Microsoft Windows Security Auditing provider on the Security channel, use one of the following methods:
Via Group Policy (gpedit.msc)
Navigate to: Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies - Local Group Policy Object -> Account Management -> Audit Other Account Management Events -> Set to Success and Failure.
Via auditpol (PowerShell)
Use the subcategory GUID {0CCE923A-69AE-11D9-BED3-505054503030}.
```
# Enable Success audit Only
auditpol /set /subcategory:{0CCE923A-69AE-11D9-BED3-505054503030}, /success:enable

# Enable both Success and Failure auditing
auditpol /set /subcategory:{0CCE923A-69AE-11D9-BED3-505054503030}, /success:enable /failure:enable
```
https://github.com/sigmahq/sigma/blob/master/documentation/logsource-guides/windows/service/security.md

Sigma Generic Signature Format

What's inside Sigma

Via Group Policy (gpedit.msc)

Via Command Line (auditpol)

Via Group Policy (gpedit.msc)

Via auditpol (PowerShell)