Sigma 101 Walkthrough

Scenario

As a Detection Engineer, we play a critical role in the company's cybersecurity posture, ensuring that threats are quickly identified and responded to. The SOC team has forwarded a collection of suspicious logs that were flagged during routine review. These logs originated from various systems, including endpoint devices and servers, all aggregated within the SIEM. The logs point to potential lateral movement within the network, a technique often employed by attackers once they gain initial access, allowing them to explore, escalate privileges, and exfiltrate data.

Our primary goal is to ascertain the legitimacy of these suspicious logs, understand the nature of the activities observed, and enhance the organization's detection capability by writing Sigma rules.

Lab Environment

Upon launching the lab, we land on a standard Windows desktop with a "Start here" folder. Inside, we find the usual Artifacts and Tools directories along with a README.txt reiterating the scenario description.

The Artifacts folder contains a Levels subdirectory with three separate folders (named 1, 2, and 3). Each subfolder holds a small Windows Event Log file (.evtx), which we can open with the built-in Event Viewer. These logs contain the suspicious activity we need to analyze and build detection logic around.

The Tools folder contains a browser-based application called Hunter x Hunter. This is the Sigma rule validation engine for this lab. It presents three levels, each with its own description, and our task is to write a valid Sigma rule that correctly detects the malicious pattern found in the corresponding event log. When we submit a rule, the tool provides one of three responses: the rule is syntactically invalid, the rule is valid but matches nothing (incorrect detection logic), or the rule is both valid and correctly matches the suspicious activity, at which point it reveals the flag.

What Is Sigma?

Before diving into the …