Sigma Rules

Tamandua EDR uses Sigma rules for behavioral detection based on log and event analysis. Sigma is a generic signature format for log events, enabling cross-platform detection that works across Windows, Linux, and macOS endpoints.

Built-in Rule Sets

Tamandua ships with 100+ Sigma rules organized by MITRE ATT&CK tactic:

Example Rules

PowerShell Download Cradle

title: Suspicious PowerShell Download Cradle
id: a0c3d5e2-6789-0abc-def1-234567890123
status: experimental
description: Detects PowerShell download and execute patterns
author: Tamandua Security Team
date: 2024/01/15
references:
    - https://attack.mitre.org/techniques/T1059/001/
logsource:
    category: process_creation
    product: windows
detection:
    selection_powershell:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_download:
        CommandLine|contains:
            - 'IEX'
            - 'Invoke-Expression'
            - 'DownloadString'
            - 'DownloadFile'
            - 'Net.WebClient'
            - 'Invoke-WebRequest'
            - 'Invoke-RestMethod'
            - 'Start-BitsTransfer'
    selection_flags:
        CommandLine|contains:
            - '-enc'
            - '-encodedcommand'
            - '-nop'
            - '-noprofile'
            - '-w hidden'
            - '-windowstyle hidden'
            - '-exec bypass'
            - '-executionpolicy bypass'
    condition: selection_powershell and (selection_download or selection_flags)
falsepositives:
    - Legitimate administrative scripts
level: high
tags:
    - attack.execution
    - attack.t1059.001

LSASS Memory Access

title: LSASS Memory Access via Process
id: b1d4e6f3-789a-1bcd-ef01-345678901234
status: stable
description: Detects suspicious access to LSASS memory
author: Tamandua Security Team
logsource:
    category: process_access
    product: windows
detection:
    selection:
        TargetImage|endswith: '\lsass.exe'
        GrantedAccess|contains:
            - '0x1010'  # PROCESS_QUERY_LIMITED_INFORMATION + PROCESS_VM_READ
            - '0x1410'  # PROCESS_QUERY_INFORMATION + PROCESS_VM_READ
            - '0x1fffff'  # PROCESS_ALL_ACCESS
    filter_legitimate:
        SourceImage|endswith:
            - '\wmiprvse.exe'
            - '\taskmgr.exe'
            - '\procexp64.exe'
            - '\MsMpEng.exe'
    condition: selection and not filter_legitimate
level: critical
tags:
    - attack.credential_access
    - attack.t1003.001

Scheduled Task Persistence

title: Scheduled Task Creation for Persistence
id: c2e5f7a4-89ab-2cde-f012-456789012345
status: stable
description: Detects creation of scheduled tasks commonly used for persistence
author: Tamandua Security Team
logsource:
    category: process_creation
    product: windows
detection:
    selection_schtasks:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains: '/create'
    selection_suspicious:
        CommandLine|contains:
            - '/sc onlogon'
            - '/sc onstart'
            - '/sc onidle'
            - 'powershell'
            - 'cmd.exe /c'
            - 'mshta'
            - 'wscript'
            - 'cscript'
    condition: selection_schtasks and selection_suspicious
level: high
tags:
    - attack.persistence
    - attack.t1053.005

Supported Modifiers

Tamandua's Sigma parser supports 15+ field modifiers:

String Modifiers

Encoding Modifiers

Comparison Modifiers

Boolean Modifiers

Condition Syntax

Basic Operators

# AND
condition: selection1 and selection2

# OR
condition: selection1 or selection2

# NOT
condition: selection and not filter

# Parentheses
condition: (selection1 or selection2) and not filter

Quantifiers

# Any of (OR across selections)
condition: 1 of selection_*

# All of (AND across selections)
condition: all of selection_*

# N of them
condition: 2 of them

# N of specific
condition: 3 of (selection_a*, selection_b*)

Count Aggregations

detection:
    selection:
        EventType: login_failure
    timeframe: 5m
    condition: selection | count(SourceIP) > 10

# Supported aggregations:
# count(), count(field)
# sum(field), avg(field)
# min(field), max(field)

Logsource Categories

Windows

Linux

macOS

Custom Rule Creation

Via API

# Create a custom Sigma rule
curl -X POST "https://api.tamandua.io/v1/rules/sigma" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/x-yaml" \
  -d @custom_rule.yml

Response:

{
  "id": "sigma_custom_12345",
  "title": "Custom Detection Rule",
  "status": "active",
  "validation": {
    "syntax_valid": true,
    "logsource_supported": true,
    "modifiers_valid": true
  }
}

Via Dashboard

1. Navigate to Detection > Rules > Sigma
2. Click Add Custom Rule
3. Enter rule in YAML format
4. Click Validate to check syntax
5. Click Test to run against sample events
6. Click Deploy to activate

Via CLI

# Add custom rule
tamanduactl rules sigma add custom_rule.yml

# Validate rule syntax
tamanduactl rules sigma validate custom_rule.yml

# Test against events
tamanduactl rules sigma test custom_rule.yml --events events.json

Rule Conversion

SigmaHQ Integration

Tamandua supports importing rules from the SigmaHQ repository:

# Import from SigmaHQ
tamanduactl rules sigma import --source sigmahq \
  --category windows/process_creation

# Sync with SigmaHQ
tamanduactl rules sigma sync-sigmahq

Conversion from Other Formats

# Convert from Splunk
tamanduactl rules sigma convert --from splunk \
  --input splunk_query.spl \
  --output sigma_rule.yml

# Convert from Elastic
tamanduactl rules sigma convert --from elastic \
  --input elastic_rule.json \
  --output sigma_rule.yml

Aggregations and Timeframes

Timeframe-based Detection

title: Brute Force Detection
detection:
    selection:
        EventID: 4625
        LogonType: 2
    timeframe: 10m
    condition: selection | count(TargetUserName) > 5
level: high
tags:
    - attack.credential_access
    - attack.t1110

Supported Aggregations

Timeframe Syntax

Rule Management

Listing Rules

# List all Sigma rules
tamanduactl rules sigma list

# Filter by tactic
tamanduactl rules sigma list --tactic persistence

# Filter by severity
tamanduactl rules sigma list --level critical

Enabling/Disabling

# Disable a rule
tamanduactl rules sigma disable sigma_rule_id

# Enable a rule
tamanduactl rules sigma enable sigma_rule_id

# Disable by tactic
tamanduactl rules sigma disable --tactic discovery

Rule Updates

# Check for updates
tamanduactl rules sigma check-updates

# Update all rules
tamanduactl rules sigma update

# View changelog
tamanduactl rules sigma changelog

Performance Tuning

Rule Performance Levels

Optimization Tips

1. Use specific logsources

   # Good - specific
   logsource:
       category: process_creation
       product: windows

   # Bad - generic
   logsource:
       category: generic
   

1. Avoid excessive wildcards

   # Good
   CommandLine|contains: 'powershell.exe -enc'

   # Bad
   CommandLine|re: '.*powershell.*'
   

1. Use appropriate timeframes

   # For brute force: 5-10 minutes
   timeframe: 10m

   # For data exfil: 1 hour
   timeframe: 1h
   

API Reference

List Rules

GET /api/v1/rules/sigma

# Response
{
  "rules": [
    {
      "id": "sigma_001",
      "title": "PowerShell Download Cradle",
      "level": "high",
      "status": "stable",
      "enabled": true
    }
  ],
  "total": 100
}

Get Rule Details

GET /api/v1/rules/sigma/{id}

# Response
{
  "id": "sigma_001",
  "title": "PowerShell Download Cradle",
  "content": "title: Suspicious PowerShell...",
  "stats": {
    "total_matches": 250,
    "last_match": "2025-01-15T14:30:00Z",
    "false_positives": 5
  }
}

Create Rule

POST /api/v1/rules/sigma
Content-Type: application/x-yaml

title: Custom Rule
...

# Response
{
  "id": "sigma_custom_123",
  "status": "active"
}

Test Rule

POST /api/v1/rules/sigma/test
Content-Type: application/json

{
  "rule": "title: Test Rule...",
  "events": [
    {"Image": "powershell.exe", "CommandLine": "IEX..."}
  ]
}

# Response
{
  "matches": [
    {"event_index": 0, "matched_selections": ["selection_powershell", "selection_download"]}
  ]
}

Related Documentation

• Detection Overview - Multi-layered detection strategy
• YARA Rules - File-based signature detection
• MITRE Coverage - ATT&CK technique mapping