[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ESCS0G097QD1C90TGQH529":3,"skill-same:01M6ESCS0G097QD1C90TGQH529":180},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":6,"ownerHtmlUrl":54,"ownerBlogUrl":6,"ownerDescription":55,"updatedAt":56,"install":57,"resources":70},"01M6ESCS0G097QD1C90TGQH529","building-detection-rules-with-sigma",null,"Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating portable detection logic from threat intelligence, mapping rules to MITRE ATT&CK techniques, or converting community Sigma rules into platform-specific queries using sigmac or pySigma backends.","luokai0\u002Fai-agent-skills-by-luo-kai","luokai0","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F266954973?v=4","01M6E16VNT42JB8B3X3254QWJ7","luo kai","01M6E16VTFVP6S5XJF1V1MPV90",14,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-detection-rules-with-sigma\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"building detection rules with sigma","with","Rules","detection","sigma","splunk","soc","detection-rules","elastic","sentinel","cybersecurity","mitre-attack","SOC-operations","threat intelligence","community","intelligence","microsoft sentinel","across","mapping","siem","2026-11-10 10:12:30",false,"---\nname: building-detection-rules-with-sigma\ndescription: >\n  Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across\n  SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating portable\n  detection logic from threat intelligence, mapping rules to MITRE ATT&CK techniques, or converting\n  community Sigma rules into platform-specific queries using sigmac or pySigma backends.\ndomain: cybersecurity\nsubdomain: soc-operations\ntags: [soc, sigma, detection-rules, siem, mitre-attack, splunk, elastic, sentinel]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n# Building Detection Rules with Sigma\n\n## When to Use\n\nUse this skill when:\n- SOC engineers need to create detection rules portable across multiple SIEM platforms\n- Threat intelligence reports describe TTPs requiring new detection coverage\n- Existing vendor-specific rules need standardization into a shareable format\n- The team adopts Sigma as a detection-as-code standard in CI\u002FCD pipelines\n\n**Do not use** for real-time streaming detection (Sigma is for batch\u002Fscheduled searches) or when the target SIEM has native detection features that Sigma cannot express (e.g., Splunk RBA risk scoring).\n\n## Prerequisites\n\n- Python 3.8+ with `pySigma` and appropriate backend (`pySigma-backend-splunk`, `pySigma-backend-elasticsearch`, `pySigma-backend-microsoft365defender`)\n- Sigma rule repository cloned: `git clone https:\u002F\u002Fgithub.com\u002FSigmaHQ\u002Fsigma.git`\n- MITRE ATT&CK framework knowledge for technique mapping\n- Understanding of target SIEM log source field mappings\n\n## Workflow\n\n### Step 1: Define Detection Logic from Threat Intelligence\n\nStart with a threat report or ATT&CK technique. Example: detecting Mimikatz credential dumping (T1003.001 — LSASS Memory):\n\n```yaml\ntitle: Mimikatz Credential Dumping via LSASS Access\nid: 0d894093-71bc-43c3-8d63-bf520e73a7c5\nstatus: stable\nlevel: high\ndescription: Detects process accessing lsass.exe memory, indicative of credential dumping tools like Mimikatz\nreferences:\n    - https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1003\u002F001\u002F\n    - https:\u002F\u002Fgithub.com\u002Fgentilkiwi\u002Fmimikatz\nauthor: mahipal\ndate: 2024\u002F03\u002F15\nmodified: 2024\u002F03\u002F15\ntags:\n    - attack.credential_access\n    - attack.t1003.001\nlogsource:\n    category: process_access\n    product: windows\ndetection:\n    selection:\n        TargetImage|endswith: '\\lsass.exe'\n        GrantedAccess|contains:\n            - '0x1010'\n            - '0x1038'\n            - '0x1fffff'\n            - '0x40'\n    filter_main_svchost:\n        SourceImage|endswith: '\\svchost.exe'\n    filter_main_csrss:\n        SourceImage|endswith: '\\csrss.exe'\n    filter_main_wininit:\n        SourceImage|endswith: '\\wininit.exe'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Legitimate security tools accessing LSASS\n    - Windows Defender scanning\n    - CrowdStrike Falcon sensor\n```\n\n### Step 2: Validate Sigma Rule Syntax\n\nUse `sigma check` to validate the rule:\n\n```bash\n# Install pySigma and validators\npip install pySigma pySigma-validators-sigmaHQ\n\n# Validate rule\nsigma check rule.yml\n```\n\nAlternatively, validate with Python:\n\n```python\nfrom sigma.rule import SigmaRule\nfrom sigma.validators.core import SigmaValidator\n\nrule = SigmaRule.from_yaml(open(\"rule.yml\").read())\nvalidator = SigmaValidator()\nissues = validator.validate_rule(rule)\nfor issue in issues:\n    print(f\"{issue.severity}: {issue.message}\")\n```\n\n### Step 3: Convert to Target SIEM Query\n\n**Convert to Splunk SPL:**\n\n```python\nfrom sigma.rule import SigmaRule\nfrom sigma.backends.splunk import SplunkBackend\nfrom sigma.pipelines.splunk import splunk_windows_pipeline\n\npipeline = splunk_windows_pipeline()\nbackend = SplunkBackend(pipeline)\n\nrule = SigmaRule.from_yaml(open(\"rule.yml\").read())\nsplunk_query = backend.convert_rule(rule)\nprint(splunk_query[0])\n```\n\nOutput:\n```spl\nTargetImage=\"*\\\\lsass.exe\" (GrantedAccess=\"*0x1010*\" OR GrantedAccess=\"*0x1038*\"\nOR GrantedAccess=\"*0x1fffff*\" OR GrantedAccess=\"*0x40*\")\nNOT (SourceImage=\"*\\\\svchost.exe\") NOT (SourceImage=\"*\\\\csrss.exe\")\nNOT (SourceImage=\"*\\\\wininit.exe\")\n```\n\n**Convert to Elastic Query (Lucene):**\n\n```python\nfrom sigma.backends.elasticsearch import LuceneBackend\nfrom sigma.pipelines.elasticsearch import ecs_windows_pipeline\n\npipeline = ecs_windows_pipeline()\nbackend = LuceneBackend(pipeline)\nelastic_query = backend.convert_rule(rule)\nprint(elastic_query[0])\n```\n\n**Convert to Microsoft Sentinel KQL:**\n\n```python\nfrom sigma.backends.microsoft365defender import Microsoft365DefenderBackend\n\nbackend = Microsoft365DefenderBackend()\nkql_query = backend.convert_rule(rule)\nprint(kql_query[0])\n```\n\n### Step 4: Map to MITRE ATT&CK and Add Coverage Metadata\n\nTag every rule with ATT&CK technique IDs in the `tags` field:\n\n```yaml\ntags:\n    - attack.credential_access        # Tactic\n    - attack.t1003.001                # Sub-technique\n    - attack.t1003                    # Parent technique\n```\n\nTrack detection coverage using the ATT&CK Navigator:\n\n```python\nimport json\n\n# Generate ATT&CK Navigator layer from Sigma rules\nlayer = {\n    \"name\": \"SOC Detection Coverage\",\n    \"versions\": {\"attack\": \"14\", \"navigator\": \"4.9\", \"layer\": \"4.5\"},\n    \"domain\": \"enterprise-attack\",\n    \"techniques\": []\n}\n\n# Parse Sigma rules directory for technique tags\nimport os\nfrom sigma.rule import SigmaRule\n\nfor root, dirs, files in os.walk(\"sigma\u002Frules\u002Fwindows\u002F\"):\n    for f in files:\n        if f.endswith(\".yml\"):\n            rule = SigmaRule.from_yaml(open(os.path.join(root, f)).read())\n            for tag in rule.tags:\n                if str(tag).startswith(\"attack.t\"):\n                    technique_id = str(tag).replace(\"attack.\", \"\").upper()\n                    layer[\"techniques\"].append({\n                        \"techniqueID\": technique_id,\n                        \"color\": \"#31a354\",\n                        \"score\": 1\n                    })\n\nwith open(\"coverage_layer.json\", \"w\") as f:\n    json.dump(layer, f, indent=2)\n```\n\n### Step 5: Test Rule Against Sample Data\n\nCreate test data and validate the rule catches the expected events:\n\n```bash\n# Use sigma test framework\nsigma test rule.yml --target splunk --pipeline splunk_windows\n\n# Or manually test in Splunk with sample data\n# Upload Sysmon process_access log with known Mimikatz signature\n```\n\nValidate false positive rate by running against 7 days of production data in a non-alerting saved search.\n\n### Step 6: Deploy to Production SIEM\n\nDeploy the converted query as a scheduled search or correlation rule:\n\n**Splunk ES Correlation Search:**\n```spl\n| tstats summariesonly=true count from datamodel=Endpoint.Processes\n  where Processes.process_name=\"*\\\\lsass.exe\"\n  by Processes.src, Processes.user, Processes.process_name, Processes.parent_process_name\n| `drop_dm_object_name(Processes)`\n| where count > 0\n```\n\n**Elastic Security Rule (TOML format):**\n```toml\n[rule]\nname = \"LSASS Memory Access - Credential Dumping\"\ndescription = \"Detects suspicious access to LSASS process memory\"\nrisk_score = 73\nseverity = \"high\"\ntype = \"eql\"\nquery = '''\nprocess where event.action == \"access\" and\n  process.name == \"lsass.exe\" and\n  not process.executable : (\"*\\\\svchost.exe\", \"*\\\\csrss.exe\")\n'''\n\n[rule.threat]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1003\"\nname = \"OS Credential Dumping\"\n```\n\n### Step 7: Version Control and CI\u002FCD Integration\n\nStore rules in Git with automated testing:\n\n```yaml\n# .github\u002Fworkflows\u002Fsigma-ci.yml\nname: Sigma Rule CI\non: [push, pull_request]\njobs:\n  validate:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: actions\u002Fsetup-python@v5\n        with:\n          python-version: '3.11'\n      - run: pip install pySigma pySigma-validators-sigmaHQ\n      - run: sigma check rules\u002F\n      - run: sigma convert -t splunk -p splunk_windows rules\u002F > \u002Fdev\u002Fnull\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Sigma** | Vendor-agnostic detection rule format (YAML-based) that compiles to SIEM-specific queries via backends |\n| **pySigma** | Python library replacing legacy sigmac for rule conversion, validation, and pipeline processing |\n| **Backend** | pySigma plugin that translates Sigma detection logic into a target platform query language (SPL, KQL, Lucene) |\n| **Pipeline** | Field mapping configuration that translates generic Sigma field names to SIEM-specific field names |\n| **Logsource** | Sigma rule section defining the category (process_creation, network_connection) and product (windows, linux) of the target data |\n| **Detection-as-Code** | Practice of managing detection rules in version control with CI\u002FCD testing and automated deployment |\n\n## Tools & Systems\n\n- **SigmaHQ**: Official Sigma rule repository with 3,000+ community-maintained detection rules on GitHub\n- **pySigma**: Python-based Sigma rule processing framework with modular backends and pipelines\n- **ATT&CK Navigator**: MITRE tool for visualizing detection coverage mapped to ATT&CK techniques\n- **Uncoder.IO**: Web-based Sigma rule converter supporting 30+ SIEM platforms for quick translation\n\n## Common Scenarios\n\n- **New CVE Detection**: Write Sigma rule for exploitation indicators (e.g., Log4Shell JNDI lookup patterns in web logs)\n- **Hunting Rule Promotion**: Convert ad-hoc Splunk hunting query into Sigma rule for ongoing automated detection\n- **Multi-SIEM Migration**: Converting 500+ Splunk correlation searches to Sigma for migration to Elastic Security\n- **Purple Team Output**: Convert red team findings into Sigma rules for immediate defensive coverage\n- **Threat Intel Operationalization**: Transform IOC-based threat reports into behavioral Sigma rules\n\n## Output Format\n\n```\nSIGMA RULE DEPLOYMENT REPORT\n━━━━━━━━━━━━━━━━━━━━━━━━━━━\nRule ID:      0d894093-71bc-43c3-8d63-bf520e73a7c5\nTitle:        Mimikatz Credential Dumping via LSASS Access\nATT&CK:       T1003.001 - LSASS Memory\nSeverity:     High\nStatus:       Deployed to Production\n\nConversions:\n  Splunk SPL:    PASS — Saved search \"sigma_lsass_access\" created\n  Elastic EQL:   PASS — Detection rule ID elastic-0d894093 enabled\n  Sentinel KQL:  PASS — Analytics rule deployed via ARM template\n\nTesting:\n  True Positives:    4\u002F4 test cases matched\n  False Positives:   2 in 7-day backtest (svchost edge case — filter added)\n  Performance:       Avg execution 3.2s on 50M events\u002Fday\n```\n","# Building Detection Rules with Sigma\n\n## When to Use\n\nUse this skill when:\n- SOC engineers need to create detection rules portable across multiple SIEM platforms\n- Threat intelligence reports describe TTPs requiring new detection coverage\n- Existing vendor-specific rules need standardization into a shareable format\n- The team adopts Sigma as a detection-as-code standard in CI\u002FCD pipelines\n\n**Do not use** for real-time streaming detection (Sigma is for batch\u002Fscheduled searches) or when the target SIEM has native detection features that Sigma cannot express (e.g., Splunk RBA risk scoring).\n\n## Prerequisites\n\n- Python 3.8+ with `pySigma` and appropriate backend (`pySigma-backend-splunk`, `pySigma-backend-elasticsearch`, `pySigma-backend-microsoft365defender`)\n- Sigma rule repository cloned: `git clone https:\u002F\u002Fgithub.com\u002FSigmaHQ\u002Fsigma.git`\n- MITRE ATT&CK framework knowledge for technique mapping\n- Understanding of target SIEM log source field mappings\n\n## Workflow\n\n### Step 1: Define Detection Logic from Threat Intelligence\n\nStart with a threat report or ATT&CK technique. Example: detecting Mimikatz credential dumping (T1003.001 — LSASS Memory):\n\n```yaml\ntitle: Mimikatz Credential Dumping via LSASS Access\nid: 0d894093-71bc-43c3-8d63-bf520e73a7c5\nstatus: stable\nlevel: high\ndescription: Detects process accessing lsass.exe memory, indicative of credential dumping tools like Mimikatz\nreferences:\n    - https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1003\u002F001\u002F\n    - https:\u002F\u002Fgithub.com\u002Fgentilkiwi\u002Fmimikatz\nauthor: mahipal\ndate: 2024\u002F03\u002F15\nmodified: 2024\u002F03\u002F15\ntags:\n    - attack.credential_access\n    - attack.t1003.001\nlogsource:\n    category: process_access\n    product: windows\ndetection:\n    selection:\n        TargetImage|endswith: '\\lsass.exe'\n        GrantedAccess|contains:\n            - '0x1010'\n            - '0x1038'\n            - '0x1fffff'\n            - '0x40'\n    filter_main_svchost:\n        SourceImage|endswith: '\\svchost.exe'\n    filter_main_csrss:\n        SourceImage|endswith: '\\csrss.exe'\n    filter_main_wininit:\n        SourceImage|endswith: '\\wininit.exe'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Legitimate security tools accessing LSASS\n    - Windows Defender scanning\n    - CrowdStrike Falcon sensor\n```\n\n### Step 2: Validate Sigma Rule Syntax\n\nUse `sigma check` to validate the rule:\n\n```bash\n# Install pySigma and validators\npip install pySigma pySigma-validators-sigmaHQ\n\n# Validate rule\nsigma check rule.yml\n```\n\nAlternatively, validate with Python:\n\n```python\nfrom sigma.rule import SigmaRule\nfrom sigma.validators.core import SigmaValidator\n\nrule = SigmaRule.from_yaml(open(\"rule.yml\").read())\nvalidator = SigmaValidator()\nissues = validator.validate_rule(rule)\nfor issue in issues:\n    print(f\"{issue.severity}: {issue.message}\")\n```\n\n### Step 3: Convert to Target SIEM Query\n\n**Convert to Splunk SPL:**\n\n```python\nfrom sigma.rule import SigmaRule\nfrom sigma.backends.splunk import SplunkBackend\nfrom sigma.pipelines.splunk import splunk_windows_pipeline\n\npipeline = splunk_windows_pipeline()\nbackend = SplunkBackend(pipeline)\n\nrule = SigmaRule.from_yaml(open(\"rule.yml\").read())\nsplunk_query = backend.convert_rule(rule)\nprint(splunk_query[0])\n```\n\nOutput:\n```spl\nTargetImage=\"*\\\\lsass.exe\" (GrantedAccess=\"*0x1010*\" OR GrantedAccess=\"*0x1038*\"\nOR GrantedAccess=\"*0x1fffff*\" OR GrantedAccess=\"*0x40*\")\nNOT (SourceImage=\"*\\\\svchost.exe\") NOT (SourceImage=\"*\\\\csrss.exe\")\nNOT (SourceImage=\"*\\\\wininit.exe\")\n```\n\n**Convert to Elastic Query (Lucene):**\n\n```python\nfrom sigma.backends.elasticsearch import LuceneBackend\nfrom sigma.pipelines.elasticsearch import ecs_windows_pipeline\n\npipeline = ecs_windows_pipeline()\nbackend = LuceneBackend(pipeline)\nelastic_query = backend.convert_rule(rule)\nprint(elastic_query[0])\n```\n\n**Convert to Microsoft Sentinel KQL:**\n\n```python\nfrom sigma.backends.microsoft365defender import Microsoft365DefenderBackend\n\nbackend = Microsoft365DefenderBackend()\nkql_query = backend.convert_rule(rule)\nprint(kql_query[0])\n```\n\n### Step 4: Map to MITRE ATT&CK and Add Coverage Metadata\n\nTag every rule with ATT&CK technique IDs in the `tags` field:\n\n```yaml\ntags:\n    - attack.credential_access        # Tactic\n    - attack.t1003.001                # Sub-technique\n    - attack.t1003                    # Parent technique\n```\n\nTrack detection coverage using the ATT&CK Navigator:\n\n```python\nimport json\n\n# Generate ATT&CK Navigator layer from Sigma rules\nlayer = {\n    \"name\": \"SOC Detection Coverage\",\n    \"versions\": {\"attack\": \"14\", \"navigator\": \"4.9\", \"layer\": \"4.5\"},\n    \"domain\": \"enterprise-attack\",\n    \"techniques\": []\n}\n\n# Parse Sigma rules directory for technique tags\nimport os\nfrom sigma.rule import SigmaRule\n\nfor root, dirs, files in os.walk(\"sigma\u002Frules\u002Fwindows\u002F\"):\n    for f in files:\n        if f.endswith(\".yml\"):\n            rule = SigmaRule.from_yaml(open(os.path.join(root, f)).read())\n            for tag in rule.tags:\n                if str(tag).startswith(\"attack.t\"):\n                    technique_id = str(tag).replace(\"attack.\", \"\").upper()\n                    layer[\"techniques\"].append({\n                        \"techniqueID\": technique_id,\n                        \"color\": \"#31a354\",\n                        \"score\": 1\n                    })\n\nwith open(\"coverage_layer.json\", \"w\") as f:\n    json.dump(layer, f, indent=2)\n```\n\n### Step 5: Test Rule Against Sample Data\n\nCreate test data and validate the rule catches the expected events:\n\n```bash\n# Use sigma test framework\nsigma test rule.yml --target splunk --pipeline splunk_windows\n\n# Or manually test in Splunk with sample data\n# Upload Sysmon process_access log with known Mimikatz signature\n```\n\nValidate false positive rate by running against 7 days of production data in a non-alerting saved search.\n\n### Step 6: Deploy to Production SIEM\n\nDeploy the converted query as a scheduled search or correlation rule:\n\n**Splunk ES Correlation Search:**\n```spl\n| tstats summariesonly=true count from datamodel=Endpoint.Processes\n  where Processes.process_name=\"*\\\\lsass.exe\"\n  by Processes.src, Processes.user, Processes.process_name, Processes.parent_process_name\n| `drop_dm_object_name(Processes)`\n| where count > 0\n```\n\n**Elastic Security Rule (TOML format):**\n```toml\n[rule]\nname = \"LSASS Memory Access - Credential Dumping\"\ndescription = \"Detects suspicious access to LSASS process memory\"\nrisk_score = 73\nseverity = \"high\"\ntype = \"eql\"\nquery = '''\nprocess where event.action == \"access\" and\n  process.name == \"lsass.exe\" and\n  not process.executable : (\"*\\\\svchost.exe\", \"*\\\\csrss.exe\")\n'''\n\n[rule.threat]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1003\"\nname = \"OS Credential Dumping\"\n```\n\n### Step 7: Version Control and CI\u002FCD Integration\n\nStore rules in Git with automated testing:\n\n```yaml\n# .github\u002Fworkflows\u002Fsigma-ci.yml\nname: Sigma Rule CI\non: [push, pull_request]\njobs:\n  validate:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: actions\u002Fsetup-python@v5\n        with:\n          python-version: '3.11'\n      - run: pip install pySigma pySigma-validators-sigmaHQ\n      - run: sigma check rules\u002F\n      - run: sigma convert -t splunk -p splunk_windows rules\u002F > \u002Fdev\u002Fnull\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Sigma** | Vendor-agnostic detection rule format (YAML-based) that compiles to SIEM-specific queries via backends |\n| **pySigma** | Python library replacing legacy sigmac for rule conversion, validation, and pipeline processing |\n| **Backend** | pySigma plugin that translates Sigma detection logic into a target platform query language (SPL, KQL, Lucene) |\n| **Pipeline** | Field mapping configuration that translates generic Sigma field names to SIEM-specific field names |\n| **Logsource** | Sigma rule section defining the category (process_creation, network_connection) and product (windows, linux) of the target data |\n| **Detection-as-Code** | Practice of managing detection rules in version control with CI\u002FCD testing and automated deployment |\n\n## Tools & Systems\n\n- **SigmaHQ**: Official Sigma rule repository with 3,000+ community-maintained detection rules on GitHub\n- **pySigma**: Python-based Sigma rule processing framework with modular backends and pipelines\n- **ATT&CK Navigator**: MITRE tool for visualizing detection coverage mapped to ATT&CK techniques\n- **Uncoder.IO**: Web-based Sigma rule converter supporting 30+ SIEM platforms for quick translation\n\n## Common Scenarios\n\n- **New CVE Detection**: Write Sigma rule for exploitation indicators (e.g., Log4Shell JNDI lookup patterns in web logs)\n- **Hunting Rule Promotion**: Convert ad-hoc Splunk hunting query into Sigma rule for ongoing automated detection\n- **Multi-SIEM Migration**: Converting 500+ Splunk correlation searches to Sigma for migration to Elastic Security\n- **Purple Team Output**: Convert red team findings into Sigma rules for immediate defensive coverage\n- **Threat Intel Operationalization**: Transform IOC-based threat reports into behavioral Sigma rules\n\n## Output Format\n\n```\nSIGMA RULE DEPLOYMENT REPORT\n━━━━━━━━━━━━━━━━━━━━━━━━━━━\nRule ID:      0d894093-71bc-43c3-8d63-bf520e73a7c5\nTitle:        Mimikatz Credential Dumping via LSASS Access\nATT&CK:       T1003.001 - LSASS Memory\nSeverity:     High\nStatus:       Deployed to Production\n\nConversions:\n  Splunk SPL:    PASS — Saved search \"sigma_lsass_access\" created\n  Elastic EQL:   PASS — Detection rule ID elastic-0d894093 enabled\n  Sentinel KQL:  PASS — Analytics rule deployed via ARM template\n\nTesting:\n  True Positives:    4\u002F4 test cases matched\n  False Positives:   2 in 7-day backtest (svchost edge case — filter added)\n  Performance:       Avg execution 3.2s on 50M events\u002Fday\n```\n",{"name":5,"tags":44,"author":45,"domain":29,"license":15,"version":46,"subdomain":47,"description":48},[25,23,26,38,30,24,27,28],"mahipal","1.0","soc-operations","Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating portable detection logic from threat intelligence, mapping rules to MITRE ATT&CK techniques, or converting community Sigma rules into platform-specific queries using sigmac or pySigma backends.\n","main","4d2fb89cdfb75f3f6fd3c6c5ec9ad90ea129eb3c","ai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-detection-rules-with-sigma",2,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai","https:\u002F\u002Fgithub.com\u002Fluokai0","a solo builder.","2026-05-06 04:29:04",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":69},[59,62,65],{"tool":60,"command":61},"npx","npx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill building-detection-rules-with-sigma",{"tool":63,"command":64},"bunx","bunx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill building-detection-rules-with-sigma",{"tool":66,"command":67},"pnpm","pnpm dlx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill building-detection-rules-with-sigma","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-detection-rules-with-sigma\u002FSKILL.md",true,[71,77,81,87,91,95,99,103,107,111,115,120,126,130,136,140,144,148,152,156,160,164,168,172,176],{"path":72,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":75,"sourceHtmlUrl":76},"architecture-patterns.yaml","REFERENCE","参考文档",15325,"https:\u002F\u002Fgithub.com\u002Fdeveloperworks\u002Frust-supervisor\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgds-game-architecture\u002Farchitecture-patterns.yaml",{"path":78,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":79,"sourceHtmlUrl":80},"checklist.md",8224,"https:\u002F\u002Fgithub.com\u002Fdeveloperworks\u002Frust-supervisor\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgds-game-architecture\u002Fchecklist.md",{"path":82,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"customize.toml","OTHER","其他",1639,"https:\u002F\u002Fgithub.com\u002Fdeveloperworks\u002Frust-supervisor\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgds-game-architecture\u002Fcustomize.toml",{"path":88,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":89,"sourceHtmlUrl":90},"decision-catalog.yaml",18190,"https:\u002F\u002Fgithub.com\u002Fdeveloperworks\u002Frust-supervisor\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgds-game-architecture\u002Fdecision-catalog.yaml",{"path":92,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":93,"sourceHtmlUrl":94},"engine-mcps.yaml",21944,"https:\u002F\u002Fgithub.com\u002Fdeveloperworks\u002Frust-supervisor\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgds-game-architecture\u002Fengine-mcps.yaml",{"path":96,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":97,"sourceHtmlUrl":98},"knowledge\u002Fgodot-engine.md",18740,"https:\u002F\u002Fgithub.com\u002Fdeveloperworks\u002Frust-supervisor\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgds-game-architecture\u002Fknowledge\u002Fgodot-engine.md",{"path":100,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":101,"sourceHtmlUrl":102},"knowledge\u002Fphaser-engine.md",22252,"https:\u002F\u002Fgithub.com\u002Fdeveloperworks\u002Frust-supervisor\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgds-game-architecture\u002Fknowledge\u002Fphaser-engine.md",{"path":104,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":105,"sourceHtmlUrl":106},"knowledge\u002Froblox-engine.md",43226,"https:\u002F\u002Fgithub.com\u002Fdeveloperworks\u002Frust-supervisor\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgds-game-architecture\u002Fknowledge\u002Froblox-engine.md",{"path":108,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":109,"sourceHtmlUrl":110},"knowledge\u002Funity-engine.md",20927,"https:\u002F\u002Fgithub.com\u002Fdeveloperworks\u002Frust-supervisor\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgds-game-architecture\u002Fknowledge\u002Funity-engine.md",{"path":112,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":113,"sourceHtmlUrl":114},"knowledge\u002Funreal-engine.md",20708,"https:\u002F\u002Fgithub.com\u002Fdeveloperworks\u002Frust-supervisor\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgds-game-architecture\u002Fknowledge\u002Funreal-engine.md",{"path":116,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":118,"sourceHtmlUrl":119},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-detection-rules-with-sigma\u002FLICENSE",{"path":121,"resourceType":122,"resourceTypeDesc":123,"sizeBytes":124,"sourceHtmlUrl":125},"pattern-categories.csv","ASSET","资产文件",1303,"https:\u002F\u002Fgithub.com\u002Fdeveloperworks\u002Frust-supervisor\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgds-game-architecture\u002Fpattern-categories.csv",{"path":127,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":128,"sourceHtmlUrl":129},"references\u002Fapi-reference.md",2127,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-detection-rules-with-sigma\u002Freferences\u002Fapi-reference.md",{"path":131,"resourceType":132,"resourceTypeDesc":133,"sizeBytes":134,"sourceHtmlUrl":135},"scripts\u002Fagent.py","SCRIPT","脚本",6449,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fbuilding-detection-rules-with-sigma\u002Fscripts\u002Fagent.py",{"path":137,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":138,"sourceHtmlUrl":139},"steps\u002Fstep-01-init.md",5863,"https:\u002F\u002Fgithub.com\u002Fdeveloperworks\u002Frust-supervisor\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgds-game-architecture\u002Fsteps\u002Fstep-01-init.md",{"path":141,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":142,"sourceHtmlUrl":143},"steps\u002Fstep-01b-continue.md",3769,"https:\u002F\u002Fgithub.com\u002Fdeveloperworks\u002Frust-supervisor\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgds-game-architecture\u002Fsteps\u002Fstep-01b-continue.md",{"path":145,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":146,"sourceHtmlUrl":147},"steps\u002Fstep-02-context.md",6909,"https:\u002F\u002Fgithub.com\u002Fdeveloperworks\u002Frust-supervisor\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgds-game-architecture\u002Fsteps\u002Fstep-02-context.md",{"path":149,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":150,"sourceHtmlUrl":151},"steps\u002Fstep-03-starter.md",10387,"https:\u002F\u002Fgithub.com\u002Fdeveloperworks\u002Frust-supervisor\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgds-game-architecture\u002Fsteps\u002Fstep-03-starter.md",{"path":153,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":154,"sourceHtmlUrl":155},"steps\u002Fstep-04-decisions.md",8225,"https:\u002F\u002Fgithub.com\u002Fdeveloperworks\u002Frust-supervisor\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgds-game-architecture\u002Fsteps\u002Fstep-04-decisions.md",{"path":157,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":158,"sourceHtmlUrl":159},"steps\u002Fstep-05-crosscutting.md",8393,"https:\u002F\u002Fgithub.com\u002Fdeveloperworks\u002Frust-supervisor\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgds-game-architecture\u002Fsteps\u002Fstep-05-crosscutting.md",{"path":161,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":162,"sourceHtmlUrl":163},"steps\u002Fstep-06-structure.md",8351,"https:\u002F\u002Fgithub.com\u002Fdeveloperworks\u002Frust-supervisor\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgds-game-architecture\u002Fsteps\u002Fstep-06-structure.md",{"path":165,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":166,"sourceHtmlUrl":167},"steps\u002Fstep-07-patterns.md",8479,"https:\u002F\u002Fgithub.com\u002Fdeveloperworks\u002Frust-supervisor\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgds-game-architecture\u002Fsteps\u002Fstep-07-patterns.md",{"path":169,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":170,"sourceHtmlUrl":171},"steps\u002Fstep-08-validation.md",7885,"https:\u002F\u002Fgithub.com\u002Fdeveloperworks\u002Frust-supervisor\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgds-game-architecture\u002Fsteps\u002Fstep-08-validation.md",{"path":173,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":174,"sourceHtmlUrl":175},"steps\u002Fstep-09-complete.md",10674,"https:\u002F\u002Fgithub.com\u002Fdeveloperworks\u002Frust-supervisor\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgds-game-architecture\u002Fsteps\u002Fstep-09-complete.md",{"path":177,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":178,"sourceHtmlUrl":179},"templates\u002Farchitecture-template.md",1513,"https:\u002F\u002Fgithub.com\u002Fdeveloperworks\u002Frust-supervisor\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fgds-game-architecture\u002Ftemplates\u002Farchitecture-template.md",[181,209,226,256,288,325],{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":185,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":39},"01M6F2SKTE208174C7S7JJCZC7","write-contracts","Generates secure Aptos Move V2 smart contracts with Object model, Digital Asset integration, security patterns, and storage type guidance. Includes comprehensive storage decision framework for optimal data structure selection. Triggers on: 'write contract', 'create NFT collection', 'build marketplace', 'implement minting', 'generate Move module', 'create token contract', 'build DAO', 'implement staking'. Ask storage questions when: 'store', 'track', 'registry', 'mapping', 'list', 'collection'.","MIT","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fwrite-contracts\u002FSKILL.md",[],[189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208],"write","contracts","write contracts","storage","secure","create","generate","collection","model","decision","ask","smart-contracts","selection","objects","structure","nft","token","aptos","critical","move",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":185,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":215,"publishedAt":39},"01M6F2RFXJ6T9MKW0A7N7GM45B","web-search","通用网络搜索技能，支持多引擎搜索（百度、必应、DuckDuckGo），无需API密钥即可获取实时信息","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fweb-search-ex-skill\u002FSKILL.md",[],[216,217,218,219,220,221,222,223,224,225],"web","search","web search","搜索","baidu","bing","duckduckgo","百度","多引擎","internet",{"skillNo":227,"name":228,"nameZh":6,"description":229,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":185,"licenseFileUrl":6,"sourceHtmlUrl":230,"categories":231,"keywords":237,"publishedAt":39},"01M6F2K968G1FZEZFPW2E6B222","solo-build","Execute implementation plan tasks with TDD workflow, auto-commit, and phase gates. Use when user says \"build it\", \"start building\", \"execute plan\", \"implement tasks\", \"ship it\", or references a track ID. Do NOT use for planning (use \u002Fplan) or scaffolding (use \u002Fscaffold).","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fsolo-build\u002FSKILL.md",[232],{"categoryNo":233,"categoryName":234,"taxonomyType":235,"taxonomyTypeDesc":236},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[238,239,240,241,242,243,244,245,217,246,247,248,189,249,250,251,252,253,254,255],"build","solo","solo build","MCP","workflow","commit","tasks","code","Bash","plan","read","auto","references","context7","query","scaffolding","ship it","project",{"skillNo":257,"name":258,"nameZh":6,"description":259,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":185,"licenseFileUrl":6,"sourceHtmlUrl":260,"categories":261,"keywords":268,"publishedAt":39},"01M6F2GKN39SGHSPWYB3662YC8","react-email","Use when building HTML email templates with React components, adding a visual email editor to an application using the React Email visual editor, rendering emails to HTML, or sending emails with Resend. Covers welcome emails, password resets, notifications, order confirmations, newsletters, transactional emails, and the embeddable email editor component.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Freact-email-skills\u002FSKILL.md",[262,265],{"categoryNo":263,"categoryName":264,"taxonomyType":235,"taxonomyTypeDesc":236},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":266,"categoryName":267,"taxonomyType":235,"taxonomyTypeDesc":236},"01JBSEEDCAT000000000000009","前端开发",[269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,20],"react","email","react email","github","editor","components","react components","component","welcome","https","notifications","password","node","use","html","resend","visual","emails","rendering",{"skillNo":289,"name":290,"nameZh":6,"description":291,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":185,"licenseFileUrl":6,"sourceHtmlUrl":292,"categories":293,"keywords":306,"publishedAt":39},"01M6F2FBVGVDFSG8SSFJGXA40C","APITester Agent-Driven API Testing","Test API endpoints and document responses. Define tests in plain English, run them, get formatted results. Agent-driven Postman alternative.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fopenclaw-api-tester\u002FSKILL.md",[294,297,300,301],{"categoryNo":295,"categoryName":296,"taxonomyType":235,"taxonomyTypeDesc":236},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":298,"categoryName":299,"taxonomyType":235,"taxonomyTypeDesc":236},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":233,"categoryName":234,"taxonomyType":235,"taxonomyTypeDesc":236},{"categoryNo":302,"categoryName":303,"taxonomyType":304,"taxonomyTypeDesc":305},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324],"testing","api","api testing","driven","APITester Agent Driven API Testing","test","run","postman","results","plain english","tester","endpoints","document","get","define","tests","english","api-tester",{"skillNo":326,"name":327,"nameZh":6,"description":328,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":185,"licenseFileUrl":6,"sourceHtmlUrl":329,"categories":330,"keywords":331,"publishedAt":39},"01M6F273Y3NGAPVJZ608BC0G9G","hubspot-implementation-plan","Generate a phased implementation plan from a HubSpot audit report. Creates prioritized, sequenced cleanup processes with effort estimates, dependencies, and automation feasibility. Use after running \u002Fhubspot-audit.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fhubspot-implementation-plan\u002FSKILL.md",[],[247,332,333,334,335,336,337,195,338,339,340,341,342,282,343,344,20,345],"implementation","hubspot","hubspot implementation plan","automation","feasibility","cleanup","planning","report","audit","audit report","phased implementation","dependencies","processes","hubspot audit"]