undefined

undefined

| Suspicious PowerShell Encoded Command — compiled from Sigma rule
index=windows sourcetype=WinEventLog:Sysmon EventCode=1
  (ParentImage="*\\cmd.exe" OR ParentImage="*\\wscript.exe"
   OR ParentImage="*\\cscript.exe" OR ParentImage="*\\mshta.exe"
   OR ParentImage="*\\wmiprvse.exe")
  (Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
  (CommandLine="*-enc *" OR CommandLine="*-EncodedCommand*"
   OR CommandLine="*-ec *" OR CommandLine="*FromBase64String*")
| eval risk_score=case(
    ParentImage LIKE "%wmiprvse.exe", 90,
    ParentImage LIKE "%mshta.exe", 85,
    1=1, 70
  )
| where NOT match(CommandLine, "(?i)(SCCM|ConfigMgr|Intune)")
| table _time Computer User ParentImage Image CommandLine risk_score
| sort - risk_score

// Suspicious PowerShell Encoded Command — compiled from Sigma rule
DeviceProcessEvents
| where Timestamp > ago(1h)
| where InitiatingProcessFileName in~ (
    "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "wmiprvse.exe"
  )
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (
    "-enc ", "-EncodedCommand", "-ec ", "FromBase64String"
  )
// Exclude known legitimate automation
| where ProcessCommandLine !contains "SCCM"
    and ProcessCommandLine !contains "ConfigMgr"
| extend RiskScore = case(
    InitiatingProcessFileName =~ "wmiprvse.exe", 90,
    InitiatingProcessFileName =~ "mshta.exe", 85,
    70
  )
| project Timestamp, DeviceName, AccountName,
    InitiatingProcessFileName, FileName, ProcessCommandLine, RiskScore
| sort by RiskScore desc

undefined

undefined

undefined

  - name: Install sigma-cli
    run: pip install sigma-cli pySigma-backend-splunk pySigma-backend-microsoft365defender

  - name: Validate Sigma syntax
    run: |
      find detections/ -name "*.yml" -exec sigma check {} \;

  - name: Check required fields
    run: |
      # Every rule must have: title, id, level, tags (ATT&CK), falsepositives
      for rule in detections/**/*.yml; do
        for field in title id level tags falsepositives; do
          if ! grep -q "^${field}:" "$rule"; then
            echo "ERROR: $rule missing required field: $field"
            exit 1
          fi
        done
      done

  - name: Verify ATT&CK mapping
    run: |
      # Every rule must map to at least one ATT&CK technique
      for rule in detections/**/*.yml; do
        if ! grep -q "attack\.t[0-9]" "$rule"; then
          echo "ERROR: $rule has no ATT&CK technique mapping"
          exit 1
        fi
      done

  - name: Install sigma-cli with backends
    run: |
      pip install sigma-cli \
        pySigma-backend-splunk \
        pySigma-backend-microsoft365defender \
        pySigma-backend-elasticsearch

  - name: Compile to Splunk
    run: |
      sigma convert -t splunk -p sysmon \
        detections/**/*.yml > compiled/splunk/rules.conf

  - name: Compile to Sentinel KQL
    run: |
      sigma convert -t microsoft365defender \
        detections/**/*.yml > compiled/sentinel/rules.kql

  - name: Compile to Elastic EQL
    run: |
      sigma convert -t elasticsearch \
        detections/**/*.yml > compiled/elastic/rules.ndjson

  - uses: actions/upload-artifact@v4
    with:
      name: compiled-rules
      path: compiled/

  - name: Run detection tests
    run: |
      # Each rule should have a matching test case in tests/
      for rule in detections/**/*.yml; do
        rule_id=$(grep "^id:" "$rule" | awk '{print $2}')
        test_file="tests/${rule_id}.json"
        if [ ! -f "$test_file" ]; then
          echo "WARN: No test case for rule $rule_id ($rule)"
        else
          echo "Testing rule $rule_id against sample data..."
          python scripts/test_detection.py \
            --rule "$rule" --test-data "$test_file"
        fi
      done

  - name: Deploy to Splunk
    run: |
      # Push compiled rules via Splunk REST API
      curl -k -u "${{ secrets.SPLUNK_USER }}:${{ secrets.SPLUNK_PASS }}" \
        https://${{ secrets.SPLUNK_HOST }}:8089/servicesNS/admin/search/saved/searches \
        -d @compiled/splunk/rules.conf

  - name: Deploy to Sentinel
    run: |
      # Deploy via Azure CLI
      az sentinel alert-rule create \
        --resource-group ${{ secrets.AZURE_RG }} \
        --workspace-name ${{ secrets.SENTINEL_WORKSPACE }} \
        --alert-rule @compiled/sentinel/rules.kql

undefined

undefined

index=windows sourcetype=WinEventLog:Sysmon EventCode=10
  TargetImage="*\\lsass.exe"
  GrantedAccess IN ("0x1010", "0x1038", "0x1fffff", "0x1410")
  NOT SourceImage IN (
    "*\\csrss.exe", "*\\lsm.exe", "*\\wmiprvse.exe",
    "*\\svchost.exe", "*\\MsMpEng.exe"
  )
| stats count by SourceImage GrantedAccess Computer User
| sort - count

index=windows sourcetype=WinEventLog:Sysmon EventCode=7
  Image="*\\lsass.exe"
  NOT ImageLoaded IN ("*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*")
| stats count values(ImageLoaded) as SuspiciousModules by Computer

undefined

undefined

undefined