Reglas Sigma: guía práctica para escribir detecciones

title: Detección de Brute Force por RDP
image: "cover.png"
id: a]1b2c3d4-e5f6-7890-abcd-ef1234567890
status: test
description: >
  Detecta múltiples intentos fallidos de autenticación RDP
  desde una misma IP en un periodo corto de tiempo.
references:
  - https://attack.mitre.org/techniques/T1110/001/
author: SOC Team - Riskitera
date: 2026/05/01
modified: 2026/05/15
tags:
  - attack.credential_access
  - attack.t1110.001
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventID: 4625
    LogonType: 10  # RemoteInteractive (RDP)
  timeframe: 5m
  condition: selection | count(TargetUserName) by SourceNetworkAddress > 10
falsepositives:
  - Usuarios con problemas de credenciales
  - Escaneos de vulnerabilidades autorizados
level: high

# Logs de procesos en Windows
logsource:
  category: process_creation
  product: windows

# Logs de firewall (cualquier vendor)
logsource:
  category: firewall

# Logs de proxy web
logsource:
  category: proxy

# Sysmon específico
logsource:
  product: windows
  service: sysmon
  category: process_creation

# Logs de Active Directory
logsource:
  product: windows
  service: security

# Logs de Linux auditd
logsource:
  product: linux
  service: auditd

detection:
  selection:
    EventID: 4625
    LogonType: 10
  condition: selection

detection:
  selection:
    EventID:
      - 4624
      - 4625
      - 4648
  condition: selection

detection:
  selection_process:
    ParentImage|endswith: '\cmd.exe'
  selection_command:
    CommandLine|contains:
      - 'whoami'
      - 'net user'
      - 'net group'
  filter_legitimate:
    User|endswith: '$'  # Cuentas de máquina
  condition: selection_process and selection_command and not filter_legitimate

detection:
  selection:
    EventID: 4625
  timeframe: 10m
  condition: selection | count() by SourceIP > 20

title: SSH Brute Force Attempt
image: "cover.png"
id: 5c2a8e1d-9f3b-4a7c-b6d2-e8f1234abcde
status: stable
description: >
  Detecta múltiples intentos fallidos de autenticación SSH
  desde una misma IP de origen, indicativo de un ataque
  de fuerza bruta contra el servicio SSH.
references:
  - https://attack.mitre.org/techniques/T1110/001/
  - https://www.sshaudit.com/
author: SOC Team
date: 2026/04/10
modified: 2026/05/20
tags:
  - attack.credential_access
  - attack.t1110.001
  - attack.t1110.003
logsource:
  product: linux
  service: sshd
detection:
  selection:
    sshd_result: 'Failed'
  timeframe: 5m
  condition: selection | count() by src_ip > 15
falsepositives:
  - Usuarios legítimos que olvidan la contraseña
  - Conexiones automatizadas con credenciales caducadas
  - Herramientas de escaneo de compliance
level: medium

title: Remote WMI Command Execution
image: "cover.png"
id: 7a9b3c4d-2e1f-5678-90ab-cdef12345678
status: stable
description: >
  Detecta la ejecución remota de comandos a través de WMI
  (Windows Management Instrumentation), técnica común de
  movimiento lateral usada por atacantes y herramientas
  como Impacket wmiexec.
references:
  - https://attack.mitre.org/techniques/T1047/
  - https://github.com/fortra/impacket
author: SOC Team
date: 2026/04/15
modified: 2026/05/25
tags:
  - attack.lateral_movement
  - attack.execution
  - attack.t1047
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\WmiPrvSE.exe'
  selection_suspicious_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  filter_legitimate:
    CommandLine|contains:
      - 'Windows\CCM'       # SCCM
      - 'Windows\ccmsetup'  # SCCM setup
  condition: selection_parent and selection_suspicious_child and not filter_legitimate
falsepositives:
  - Administradores IT usando WMI para gestión remota
  - SCCM y otras herramientas de gestión de endpoints
  - Scripts de inventario y monitoreo
level: high

title: Scheduled Task Creation for Persistence
image: "cover.png"
id: 3b5c7d9e-1a2f-4e6g-8h0i-jklm12345678
status: stable
description: >
  Detecta la creación de tareas programadas que apuntan
  a ejecutables en ubicaciones sospechosas, técnica
  frecuente de persistencia usada por malware y atacantes.
references:
  - https://attack.mitre.org/techniques/T1053/005/
author: SOC Team
date: 2026/05/01
modified: 2026/05/28
tags:
  - attack.persistence
  - attack.execution
  - attack.t1053.005
logsource:
  product: windows
  service: security
detection:
  selection_event:
    EventID: 4698  # A scheduled task was created
  selection_suspicious_path:
    TaskContent|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\ProgramData\'
      - '\Windows\Temp\'
      - 'C:\Temp\'
  filter_known_tools:
    TaskContent|contains:
      - 'GoogleUpdate'
      - 'MicrosoftEdgeUpdate'
      - 'OneDrive'
  condition: selection_event and selection_suspicious_path and not filter_known_tools
falsepositives:
  - Software legítimo que instala tareas programadas en rutas de usuario
  - Herramientas de IT que usan tareas programadas para mantenimiento
level: high

title: Possible DNS Tunneling vía Long Subdomain Queries
image: "cover.png"
id: 9e8d7c6b-5a4f-3210-fedc-ba9876543210
status: test
description: >
  Detecta consultas DNS con subdominios anormalmente largos,
  indicativo de DNS tunneling donde se codifican datos en
  las consultas DNS para exfiltrarlos sin pasar por controles
  de proxy o firewall.
references:
  - https://attack.mitre.org/techniques/T1048/
  - https://attack.mitre.org/techniques/T1071/004/
  - https://www.sans.org/white-papers/dns-tunneling/
author: SOC Team
date: 2026/05/10
tags:
  - attack.exfiltration
  - attack.t1048
  - attack.command_and_control
  - attack.t1071.004
logsource:
  category: dns_query
detection:
  selection:
    query|re: '^[a-zA-Z0-9]{30,}\.[a-zA-Z0-9]{10,}\.'
  filter_cdn:
    query|endswith:
      - '.amazonaws.com'
      - '.cloudfront.net'
      - '.akamaiedge.net'
      - '.googleusercontent.com'
  filter_internal:
    query|endswith:
      - '.internal.corp'
      - '.ad.company.local'
  condition: selection and not filter_cdn and not filter_internal
falsepositives:
  - Servicios cloud con subdominios largos generados automáticamente
  - Certificados de seguridad con hashes en subdominios
  - Servicios de CDN con identificadores largos
level: medium

# Instalar sigma-cli vía pip
pip install sigma-cli

# Instalar backends (plugins) para tu SIEM
pip install pySigma-backend-splunk
pip install pySigma-backend-elasticsearch
pip install pySigma-backend-microsoft365defender
pip install pySigma-backend-kusto     # Microsoft Sentinel

# Instalar pipelines de procesamiento
pip install pySigma-pipeline-sysmon
pip install pySigma-pipeline-windows

# Verificar instalación
sigma version
sigma list backends
sigma list pipelines

# Convertir una regla a Splunk SPL
sigma convert -t splunk -p sysmon rules/brute_force_ssh.yml

# Convertir a Elastic/Lucene
sigma convert -t elasticsearch -p ecs_windows rules/wmi_lateral.yml

# Convertir a Microsoft Sentinel KQL
sigma convert -t kusto -p microsoft365defender rules/scheduled_task.yml

# Convertir un directorio completo
sigma convert -t splunk -p sysmon rules/ -o output/splunk/

# Convertir con formato de output específico
sigma convert -t splunk -p sysmon --format savedsearches rules/

title: Windows Logon Brute Force
image: "cover.png"
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4625
  timeframe: 5m
  condition: selection | count() by SourceNetworkAddress > 10
level: high

# Ver pipelines disponibles
sigma list pipelines

# Pipelines comunes:
# - sysmon: mapea campos de Sysmon
# - ecs_windows: mapea a Elastic Common Schema
# - splunk_windows: mapea a campos de Splunk para Windows
# - microsoft365defender: mapea a campos de M365 Defender

# Usar múltiples pipelines
sigma convert -t elasticsearch -p ecs_windows -p sysmon rules/

# custom_pipeline.yml
name: Custom Field Mapping
priority: 50
transformations:
  - id: custom_field_mapping
    type: field_name_mapping
    mapping:
      Image: process.executable.path
      ParentImage: process.parent.executable.path
      CommandLine: process.command_line
      User: user.name
      SourceIP: source.ip
      DestinationIP: destination.ip
      DestinationPort: destination.port

# Usar pipeline custom
sigma convert -t elasticsearch -p custom_pipeline.yml rules/

tags:
  - attack.táctica          # Nombre de la táctica en minúsculas
  - attack.tXXXX            # ID de la técnica
  - attack.tXXXX.YYY        # ID de la sub-técnica

tags:
  - attack.credential_access
  - attack.t1110             # Brute Force
  - attack.t1110.001         # Password Guessing
  - attack.t1110.003         # Password Spraying

# sigma_coverage.py
import yaml
import glob
from collections import defaultdict

def extract_attack_tags(rules_path):
    """Extrae tags ATT&CK de todas las reglas Sigma."""
    coverage = defaultdict(list)

    for rule_file in glob.glob(f"{rules_path}/**/*.yml", recursive=True):
        with open(rule_file) as f:
            rule = yaml.safe_load(f)

        tags = rule.get("tags", [])
        title = rule.get("title", "Unknown")
        status = rule.get("status", "unknown")

        for tag in tags:
            if tag.startswith("attack.t"):
                technique_id = tag.replace("attack.", "").upper()
                coverage[technique_id].append({
                    "title": title,
                    "status": status,
                    "file": rule_file
                })

    return coverage

def print_coverage_report(coverage):
    """Imprime un resumen de cobertura."""
    print(f"\nCobertura ATT&CK: {len(coverage)} técnicas cubiertas\n")
    for technique, rules in sorted(coverage.items()):
        stable = sum(1 for r in rules if r["status"] == "stable")
        test = sum(1 for r in rules if r["status"] == "test")
        print(f"  {technique}: {len(rules)} regla(s) "
              f"({stable} stable, {test} test)")

if __name__ == "__main__":
    coverage = extract_attack_tags("rules/")
    print_coverage_report(coverage)

python sigma_coverage.py

# Output:
# Cobertura ATT&CK: 47 técnicas cubiertas
#
#   T1047: 2 regla(s) (1 stable, 1 test)
#   T1053.005: 3 regla(s) (2 stable, 1 test)
#   T1059.001: 5 regla(s) (3 stable, 2 test)
#   T1110.001: 2 regla(s) (2 stable, 0 test)
#   ...

# Buscar reglas de SigmaHQ para una técnica específica
find sigma/rules/ -name "*.yml" -exec grep -l "t1059.001" {} \;

# O usando sigma-cli
sigma list rules --tag attack.t1059.001

title: Descarga de herramienta de hacking desde GitHub
image: "cover.png"
id: nuevo-uuid-generado
status: test
description: >
  Detecta el uso de curl, wget o Invoke-WebRequest para
  descargar herramientas de hacking conocidas desde GitHub
  o repositorios públicos.
references:
  - https://attack.mitre.org/techniques/T1105/
author: Tu Nombre - Tu Organización
date: 2026/06/01
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\curl.exe'
      - '\wget.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_url:
    CommandLine|contains:
      - 'github.com'
      - 'raw.githubusercontent.com'
  selection_hacking_tool:
    CommandLine|contains:
      - 'mimikatz'
      - 'rubeus'
      - 'SharpHound'
      - 'Certify'
      - 'Seatbelt'
      - 'winPEAS'
      - 'LaZagne'
      - 'BloodHound'
      - 'Covenant'
      - 'Sliver'
  condition: selection_tool and selection_url and selection_hacking_tool
falsepositives:
  - Red team autorizado descargando herramientas
  - Investigadores de seguridad analizando malware
level: high

# Verificar que la sintaxis es correcta
sigma check rules/custom/download_hacking_tool.yml

# Convertir a tu SIEM para verificar la query generada
sigma convert -t splunk -p sysmon rules/custom/download_hacking_tool.yml

# Ejecutar contra logs históricos (ejemplo Splunk)
# source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
# (Image="*\\curl.exe" OR Image="*\\wget.exe" OR ...)
# AND (CommandLine="*github.com*" OR CommandLine="*raw.githubusercontent.com*")
# AND (CommandLine="*mimikatz*" OR CommandLine="*rubeus*" OR ...)

# MAL: detecta cualquier ejecución de PowerShell
detection:
  selection:
    Image|endswith: '\powershell.exe'
  condition: selection
# Resultado: miles de alertas diarias

# BIEN: detecta PowerShell con comportamiento sospechoso específico
detection:
  selection_process:
    Image|endswith: '\powershell.exe'
  selection_suspicious:
    CommandLine|contains|all:
      - '-EncodedCommand'
      - '-WindowStyle Hidden'
  condition: selection_process and selection_suspicious

# MAL: solo detecta un hash específico de mimikatz
detection:
  selection:
    Hashes|contains: 'SHA256=abc123...'
  condition: selection
# Resultado: solo detecta una versión específica

# BIEN: detecta el comportamiento, no el artefacto
detection:
  selection:
    TargetFilename|contains: 'mimikatz'
  selection_alt:
    CommandLine|contains:
      - 'sekurlsa::logonpasswords'
      - 'lsadump::sam'
      - 'kerberos::golden'
  condition: selection or selection_alt

# MAL: búsqueda exacta que falla con variaciones de ruta
detection:
  selection:
    Image: 'C:\Windows\System32\cmd.exe'
  condition: selection

# BIEN: usar endswith para ser resiliente a variaciones
detection:
  selection:
    Image|endswith: '\cmd.exe'
  condition: selection

# sigma check válida la estructura YAML y los campos obligatorios
sigma check rules/custom/my_rule.yml

# Verificar que la conversión no produce errores
sigma convert -t splunk rules/custom/my_rule.yml > /dev/null

# test_data/wmi_lateral_positive.json
# Debe disparar la regla
{
  "EventID": 1,
  "ParentImage": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
  "Image": "C:\\Windows\\System32\\cmd.exe",
  "CommandLine": "cmd.exe /c whoami",
  "User": "DOMAIN\\admin_user"
}

# test_data/wmi_lateral_negative.json
# NO debe disparar la regla (SCCM legítimo)
{
  "EventID": 1,
  "ParentImage": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
  "Image": "C:\\Windows\\System32\\cmd.exe",
  "CommandLine": "cmd.exe /c C:\\Windows\\CCM\\ccmsetup.exe",
  "User": "SYSTEM"
}

# Ejecutar simulación de WMI lateral movement
Invoke-AtomicTest T1047 -TestNumbers 1

# Esperar a que los logs se procesen (2-5 minutos)
# Ejecutar la regla convertida en el SIEM de test
# Verificar que se generó la alerta esperada

# .github/workflows/sigma-ci.yml
name: Sigma Rules CI
on:
  pull_request:
    paths: ['rules/**']

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install sigma-cli
        run: |
          pip install sigma-cli
          pip install pySigma-backend-splunk
          pip install pySigma-backend-elasticsearch

      - name: Check Sigma syntax
        run: sigma check rules/

      - name: Convert to Splunk (validate)
        run: sigma convert -t splunk rules/ > /dev/null

      - name: Convert to Elastic (validate)
        run: sigma convert -t elasticsearch rules/ > /dev/null

      - name: Check mandatory fields
        run: |
          python scripts/check_mandatory_fields.py rules/
          # Verifica: title, id, status, description, author,
          # date, tags, logsource, detection, falsepositives, level

      - name: Check ATT&CK tags
        run: |
          python scripts/check_attack_tags.py rules/
          # Verifica que cada regla tiene al menos un tag ATT&CK