Building a Detection Rule in Sigma From Scratch

[SEED CONTENT — replace] This article is placeholder copy seeded to exercise the layout. Swap it for a real write-up before launch.

Sigma's value is portability — write the logic once, convert it to your SIEM's query language with sigma-cli. But a rule that looks correct on paper can still flood your queue if you skip the tuning pass.

Start from the log, not the threat model

Open the raw event you want to detect on and note the exact field names your source emits. A rule written against generic field names ("CommandLine") will silently fail against a source that calls the same field "process.command_line" unless your Sigma field mapping config accounts for it.

A minimal working rule

title: Suspicious LOLBAS Execution via Rundll32
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\rundll32.exe'
    CommandLine|contains:
      - 'javascript:'
      - '.dll,'
  condition: selection
level: medium

This will fire on legitimate software installers too — rundll32.exe invoking a .dll export is extremely common. Ship it as-is and you'll generate noise on day one.

Tuning before you ship

• Baseline the rule against 30 days of production logs before enabling it in blocking or high-priority alerting mode.
• Add an explicit exclusion list for known-benign command lines rather than loosening the core selection logic.
• Track each rule's true-positive rate over its first two weeks — a rule under 10% true positive needs another tuning pass, not a permanent suppression.

Version the rule like code

Store Sigma rules in a git repository, require review on changes, and tag releases. A detection that silently regresses because someone "fixed" a false positive by deleting the whole condition block is a common, avoidable failure mode.

A detection engineer's job doesn't end at "the rule fires" — it ends when the rule fires only on what it's meant to catch.