sigma-cli: convert one detection into Splunk and Microsoft Sentinel queries

Rule, backend, pipeline

A Sigma rule describes a detection in vendor-neutral YAML: a log source and selection conditions on fields. A backend turns it into a query language. A processing pipeline maps generic field names such as Image or CommandLine to the names your data actually uses. Wrong mappings produce queries that run and never match, so the pipeline matters as much as the rule.

Installing what you need

sigma-cli is a Python package. Backends are plugins: install only the ones for platforms you run. Recent releases also ship a kusto backend with a microsoft_xdr pipeline that replaces microsoft365defender; sigma list targets shows which one you have.

python3 -m pip install --user sigma-cli
sigma plugin list
sigma plugin install splunk
sigma plugin install microsoft365defender
sigma list targets
sigma list pipelines

The rule and two conversions

certutil is a Windows administration tool that can also download files, which attackers use to fetch payloads. The rule looks for its URL cache options on the command line.

title: Certutil download via urlcache
id: 6b0f2c1e-6c1d-4c2a-9f44-1a2c7e2d8b11
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\certutil.exe'
    CommandLine|contains|all: ['-urlcache', 'http']
  condition: selection
level: medium

sigma convert -t splunk -p splunk_windows rules/certutil_urlcache.yml
Image="*\\certutil.exe" CommandLine="*-urlcache*" CommandLine="*http*"

sigma convert -t microsoft365defender rules/certutil_urlcache.yml
DeviceProcessEvents
| where FolderPath endswith "\\certutil.exe" and (ProcessCommandLine contains "-urlcache" and ProcessCommandLine contains "http")

Worked check: the mapping that silently failed

The Splunk query returns nothing over a week in which the lab ran certutil twice. The lab’s Sysmon data is indexed with field names like process_path rather than Image. The fix is a small custom pipeline YAML that maps Image to process_path, passed with a second -p. Rerunning the query against the lab data returns both runs.

Keep that pipeline file in the same repository as the rules, because every rule converted for that index needs it.

# pipelines/lab_splunk_fields.yml
name: lab sysmon field names
priority: 100
transformations:
  - id: lab_fields
    type: field_name_mapping
    mapping:
      Image: process_path
      CommandLine: process_command_line

sigma convert -t splunk -p splunk_windows -p pipelines/lab_splunk_fields.yml rules/certutil_urlcache.yml