Skip to main content
Version: 1.0.0 (Latest)

Sigma Rule Reference

This reference section provides explanations on inner workings of Sigma v2 to Padas converter script.

Field Mapping (Padas : Sigma)​

The table below provides field mapping information of Padas Rule vs. Sigma Rule. There is a tiny difference between Simple and Meta mapping. Padas creates PDL with detection field from Simple Rule but action field from Meta.

Padas Rule : Simple Sigma v2 RulePadas Rule : Meta Sigma v2 Rule
    id          : id / title / name
    name        : title / name
    description : description
    datamodel   : logsource
    annotations : tags
    pdl         : detection

 

    id          : id / title / name
    name        : title / name
    description : description
    datamodel   : "padas_alert"
    annotations : tags
    pdl         : type, field, group-by, timespan, condition, ordered, aliases *
* See below for details.

Conversion of Fields​

#### id
The first matching Sigma field ise used from the following list, in order of precedence: id, title, name

name​

The first matching Sigma field ise used from the following list, in order of precedence: title, name

description​

The description Sigma field is used.

datamodel​

For Simple Rules, logsource Sigma field is used. For Meta Rules padas_alert is assigned for this value. Following table shows the subfields used to construct datamodel field in Padas Rule.

Simple RuleMeta Rule
category + "_" + product + "_" + servicepadas_alert

annotations​

The tags Sigma field is used.

pdl​

This field is where the actual conversion happens to make it meaningful for Padas. The condition field works similarly for both Simple and Meta rules as it gives information about modifiers, conditions, etc. and their relationships for desired fields. There are some modifiers for field conditions rules. The following table provides information regarding Simple Rule modifier conversion.

Sigma Rule Field ModifiersPDL Field Modifiers

contains

?=

startswith

"...*"

endswith

"*..."

gt

>

gte

>=

lt

<

lte

<=

Simple Rule Examples​
#Simple RulePDL

1

detection:
    selection:
        file: 'example.exe'
    condition: selection
file="example.exe"

2

detection:
    selection:
        file: 'example.exe'
        eventId: 4769
    condition: selection
file="example.exe" AND eventId=4769

3

detection:
    selection:
        file: 
            - 'example.exe'
            - 'example2.exe'
        eventId: 4769
    filter:
        user: 'someuser'
    condition: selection and not filter
((file="example.exe" OR file="example2.exe") AND eventId=4769) AND NOT (user="someuser")

4

detection:
    selection:
        file: 
            - 'example.exe'
            - 'example2.exe'
        eventId: 4769
    filter:
        user: 'someuser'
        password: null
    condition: selection and not filter
((file="example.exe" OR file="example2.exe") AND eventId=4769) AND NOT (user="someuser" AND password!="*")

5

detection:
    selection:
        file|endswith: 
            - '\\example.exe'
            - '\\example2.exe'
        eventId|gte: 4769
    filter:
        user|contains: 'someuser'
        password: null
    condition: selection and not filter
((file="*\\example.exe" OR file="*\\example2.exe") AND eventId>=4769) AND NOT (user?="someuser" AND password!="*")

6

detection:
    selection:
        file|endswith: 
            - '\\example.exe'
    selection2:
        file|endswith: 
            - '\\example2.exe'
        eventId|gte: 4769
    filter:
        user|contains: 'someuser'
        password: null
    condition: 1 of selection* and not filter
((file="*\\example.exe") OR (file="*\\example2.exe" AND eventId>=4769)) AND NOT (user?="someuser" AND password!="*")

7

detection:
    selection:
        file|endswith: 
            - '\\example.exe'
    selection2:
        file|endswith: 
            - '\\example2.exe'
        eventId|gte: 4769
    filter:
        user|contains: 'someuser'
        password: null
    condition: all of selection* and not filter
((file="*\\example.exe") AND (file="*\\example2.exe" AND eventId>=4769)) AND NOT (user?="someuser" AND password!="*")

8

detection:
    selection:
        file|endswith|all: 
            - '\\example.exe'
            - '\\example2.exe'
        eventId|gte: 4769
    filter:
        user|contains: 'someuser'
        password: null
    condition: selection and not filter
((file="*\\example.exe" AND file="*\\example2.exe") AND eventId>=4769) AND NOT (user?="someuser" AND password!="*")

Meta Rule Examples​

Sigma Meta Rule with action: correlation fields are converted only. The following table provides information on Sigma Meta Rule functions and their corresponding PDL correlation.

Sigma Meta Rule FunctionPDL Correlation Usage
event_count`
value_count`
temporal`

The following table provides some examples on Sigma Meta Rule to PDL Expression/Correlation conversions.

#Meta RulePDL Expression/Correlation

1

title: Event Count
id: "0e00016d"
action: correlation
type: event_count
rules:
    - 5638f7c0-ac70-491d-8465-2a65075e0d86
    - 5638f7c0-ac70-491d-8465-2a65075e0d87
group-by:
    - ComputerName
timespan: 1h
condition:
    range: 100..200
    "id": "0e00016d",
    "name": "Event Count",
    "description":"",
    "datamodel":"padas_alert",
    "annotations": [""],
    "pdl": "padas_rule IN [\"5638f7c0-ac70-491d-8465-2a65075e0d86\", \"5638f7c0-ac70-491d-8465-2a65075e0d87\"] 
            | event_count timespan=1h group_by ComputerName where padasAggregation.eventCount>=100 AND padasAggregation.eventCount<=200",
    "enabled": false

2

title: Value Count
id: "0e00017d"
action: correlation
type: value_count
field: User
group-by:
    - ComputerName
    - WorkstationName
timespan: 1d
condition:
    gte: 100
    "id": "0e00017d",
    "name": "Value Count",
    "description":"",
    "datamodel":"padas_alert",
    "annotations": [""],
    "pdl": "value_count(User) timespan=1d group_by ComputerName, WorkstationName where padasAggregation.valueCount>= 100",
    "enabled": false

3

title: internal_error
id: "0e00018d"
name: select01
detection:
  selection:
    http.response.status_code: 500
  condition: selection
---
title: new_network_connection
id: "0e00019d"
name: select02
detection:
  selection:
    event.category: network
    event.type: connection
    event.outcome: success
  condition: selection
---
title: Temporal
id: "0e00020d"
action: correlation
type: temporal
rule:
  - select01
  - select02
group-by:
  - internal_ip
  - remote_ip
timespan: 10s
ordered: true
aliases:
  internal_ip:
    internal_error: destination.ip
    new_network_connection: source.ip
  remote_ip:
    internal_error: source.ip
    new_network_connection: destination.ip
     {
      {
            "id": "0e00018d",
            "name": "select01",
            "description":"",
            "datamodel":"",
            "annotations": [""],
            "pdl": "http.response.status_code=500",
            "enabled": false
        },
        {
            "id": "0e00019d",
            "name": "select02",
            "description":"",
            "datamodel":"",
            "annotations": [""],
            "pdl": "((event.category=\"network\") AND (event.type=\"connection\") AND (event.outcome=\"success\"))",
            "enabled": false
        },
        {
            "id": "0e00020d",
            "name": "Temporal",
            "description":"",
            "datamodel":"padas_alert",
            "annotations": [""],
            "pdl": "eval internal_ip=if(padas_rule=\"internal_error\", destination.ip, if(padas_rule=\"new_network_connection\", source.ip, \"\")) 
                | eval remote_ip=if(padas_rule=\"internal_error\", source.ip, if(padas_rule=\"new_network_connection\", destination.ip, \"\")) 
                | temporal(ordered=true) [padasRule=\"select01\" || padasRule=\"select02\"] timespan=10s group_by internal_ip, remote_ip",
            "enabled": false
        }
    }