Sigma Rules para Detección de Malware: El Estándar Universal de Detección en Logs

Sigma: escribir una vez, detectar en cualquier SIEM

El problema antes de Sigma: cada SIEM tiene su propio lenguaje de queries. Una regla de detección en Splunk (SPL) no funciona en Elastic (KQL) ni en Sentinel (KQL diferente). Los equipos de detección escribían la misma regla 3-4 veces para cada plataforma.

Sigma resuelve esto: escribes la regla en formato YAML genérico y la conviertes automáticamente al lenguaje de tu SIEM. Esto democratiza la detección: las reglas de SigmaHQ son accesibles para cualquier organización independientemente de su SIEM.

Anatomía de una regla Sigma

title: Shadow Copy Deletion via Vssadmin
id: c947b146-0abc-4f87-9c64-b17e9d7274a2
status: stable
description: Detects deletion of shadow copies via vssadmin, a common ransomware precursor
references:
    - https://attack.mitre.org/techniques/T1490/
author: MalwareIntel Research
date: 2026/05/21
modified: 2026/05/21
tags:
    - attack.impact
    - attack.t1490

logsource:
    category: process_creation
    product: windows

detection:
    selection_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains|all:
            - 'shadowcopy'
            - 'delete'
    condition: selection_vssadmin or selection_wmic

falsepositives:
    - Legitimate backup software managing shadow copies
    - System administrators performing maintenance

level: critical

Secciones

Sección	Obligatorio	Descripción
title	Sí	Nombre descriptivo de la regla
id	Sí	UUID único
status	Sí	test, experimental, stable, deprecated
description	Sí	Qué detecta y por qué
logsource	Sí	Tipo de log: category + product
detection	Sí	Lógica de detección: selections + condition
level	Sí	informational, low, medium, high, critical
tags	No	MITRE ATT&CK tags
falsepositives	No	Posibles falsos positivos
references	No	URLs de referencia

Logsources comunes

Category	Product	Fuente de log
process_creation	windows	Sysmon Event ID 1, Event ID 4688
registry_set	windows	Sysmon Event ID 13
registry_add	windows	Sysmon Event ID 12
network_connection	windows	Sysmon Event ID 3
file_event	windows	Sysmon Event ID 11
image_load	windows	Sysmon Event ID 7
pipe_created	windows	Sysmon Event ID 17
dns_query	windows	Sysmon Event ID 22
ps_script	windows	PowerShell Event ID 4104
wmi_event	windows	Sysmon Event ID 19/20/21
driver_load	windows	Sysmon Event ID 6
process_creation	linux	auditd, Sysmon for Linux

Modificadores de detección

Modificador	Ejemplo	Significado
contains	CommandLine|contains: 'shadow'	Contiene substring
endswith	Image|endswith: '\cmd.exe'	Termina con
startswith	TargetFilename|startswith: 'C:\Temp'	Empieza con
all	contains|all: ['delete', 'shadows']	Debe contener TODOS
base64	CommandLine|base64: 'IEX'	Busca la versión base64 del string
re	CommandLine|re: 'cmd.*\/c.*del'	Regex
cidr	DestinationIp|cidr: '10.0.0.0/8'	CIDR range

Reglas esenciales para malware

Ransomware pre-cifrado

title: Multiple Ransomware Precursors
id: d1234567-e2f3-a4b5-c678-9def01234567
status: stable
description: Detects combination of shadow copy deletion and service stopping
logsource:
    category: process_creation
    product: windows
detection:
    shadow_delete:
        CommandLine|contains:
            - 'vssadmin delete'
            - 'wmic shadowcopy delete'
            - 'bcdedit /set'
    service_stop:
        Image|endswith: '\net.exe'
        CommandLine|contains: 'stop'
    condition: shadow_delete or service_stop
level: critical
tags:
    - attack.impact
    - attack.t1490
    - attack.t1489

Credential dumping (LSASS)

title: LSASS Memory Access by Suspicious Process
id: a2b3c4d5-e6f7-8901-abcd-ef2345678901
status: stable
logsource:
    category: process_access
    product: windows
detection:
    selection:
        TargetImage|endswith: '\lsass.exe'
        GrantedAccess|contains:
            - '0x1010'
            - '0x1FFFFF'
            - '0x1410'
    filter_legitimate:
        SourceImage|endswith:
            - '\svchost.exe'
            - '\MsMpEng.exe'
            - '\csfalconservice.exe'
    condition: selection and not filter_legitimate
level: critical
tags:
    - attack.credential_access
    - attack.t1003.001

Cobalt Strike named pipes

title: Cobalt Strike Named Pipe
id: b3c4d5e6-f7a8-9012-bcde-f34567890123
status: stable
logsource:
    category: pipe_created
    product: windows
detection:
    selection:
        PipeName|startswith:
            - '\MSSE-'
            - '\postex_'
            - '\status_'
            - '\msagent_'
    condition: selection
level: critical
tags:
    - attack.command_and_control
    - attack.t1071

PowerShell download cradle

title: PowerShell Download and Execute
id: c4d5e6f7-a8b9-0123-cdef-456789012345
status: stable
logsource:
    category: process_creation
    product: windows
detection:
    selection_ps:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_download:
        CommandLine|contains:
            - 'DownloadString'
            - 'DownloadFile'
            - 'Invoke-WebRequest'
            - 'iwr '
            - 'wget '
            - 'Start-BitsTransfer'
    selection_execute:
        CommandLine|contains:
            - 'IEX'
            - 'Invoke-Expression'
            - '| bash'
            - '| sh'
    condition: selection_ps and (selection_download or selection_execute)
level: high
tags:
    - attack.execution
    - attack.t1059.001

Lateral movement via PsExec

title: PsExec Service Installation
id: d5e6f7a8-b9c0-1234-def0-567890123456
status: stable
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7045
        ServiceName: 'PSEXESVC'
    condition: selection
level: high
tags:
    - attack.lateral_movement
    - attack.t1569.002

Data exfiltration with Rclone

title: Rclone Data Exfiltration
id: e6f7a8b9-c0d1-2345-ef01-678901234567
status: stable
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\rclone.exe'
        CommandLine|contains:
            - 'copy'
            - 'sync'
            - 'move'
    cloud_target:
        CommandLine|contains:
            - 'mega'
            - 'pcloud'
            - 's3'
            - 'ftp'
            - 'sftp'
    condition: selection and cloud_target
level: high
tags:
    - attack.exfiltration
    - attack.t1567

Conversión a SIEM

Instalación de sigma-cli

pip install sigma-cli
pip install pySigma-backend-splunk
pip install pySigma-backend-elasticsearch
pip install pySigma-pipeline-sysmon
pip install pySigma-pipeline-windows

Convertir a Splunk

sigma convert -t splunk -p sysmon rule.yml
# Output:
# Image="*\\vssadmin.exe" CommandLine="*delete*" CommandLine="*shadows*"
# | OR Image="*\\wmic.exe" CommandLine="*shadowcopy*" CommandLine="*delete*"

Convertir a Elastic/KQL

sigma convert -t elasticsearch -p ecs_windows rule.yml
# Output:
# (process.executable:*\\vssadmin.exe AND process.command_line:*delete* AND process.command_line:*shadows*)

Convertir a Microsoft Sentinel

sigma convert -t microsoft365defender rule.yml

Convertir todo el repositorio SigmaHQ

git clone https://github.com/SigmaHQ/sigma
# Convertir todas las reglas a Splunk
sigma convert -t splunk -p sysmon sigma/rules/windows/ -o splunk_rules/

SigmaHQ: el repositorio

URL: github.com/SigmaHQ/sigma

Estructura:

sigma/rules/
├── windows/
│   ├── process_creation/     # Sysmon Event ID 1
│   ├── registry/             # Sysmon Event ID 12/13
│   ├── network_connection/   # Sysmon Event ID 3
│   ├── pipe_created/         # Sysmon Event ID 17
│   ├── ps_script/            # PowerShell Script Block
│   ├── file/                 # Sysmon Event ID 11
│   ├── image_load/           # Sysmon Event ID 7
│   └── ...
├── linux/
│   ├── process_creation/
│   ├── auditd/
│   └── ...
├── cloud/
│   ├── aws/
│   ├── azure/
│   └── gcp/
└── ...

Estadísticas (2026): 3.500+ reglas, 200+ contribuidores, actualizaciones semanales.

Buenas prácticas

Práctica	Motivo
Usar logsources genéricas (category: process_creation)	Portabilidad entre SIEMs
Incluir falsepositives	Documentar excepciones conocidas
Testear con Atomic Red Team	Verificar que la regla detecta la técnica
level: critical solo para detecciones de alta confianza	Evitar alert fatigue
Incluir tags ATT&CK	Mapeo a framework estándar
Usar id UUID único	Referenciabilidad
filter_ para exclusiones	Separar la lógica de exclusión de la selección

Mapeo MITRE ATT&CK

Sigma tags mapean directamente a ATT&CK:

tags:
    - attack.execution          # Táctica
    - attack.t1059.001         # Técnica: PowerShell
    - attack.defense_evasion
    - attack.t1562.001         # Técnica: Disable Security Tools

Los tags permiten buscar reglas por técnica ATT&CK en SigmaHQ.

---

Fuentes y referencias

• SigmaHQ. "Sigma: Generic Signature Format for SIEM Systems." https://github.com/SigmaHQ/sigma
• Roth, F. & Patzke, T. "Sigma: A Generic Signature Format." 2017.
• pySigma. "Sigma Rule Processing Framework." https://github.com/SigmaHQ/pySigma
• sigma-cli. "Sigma Rule Converter." https://github.com/SigmaHQ/sigma-cli
• Red Canary. "Atomic Red Team for Sigma Validation." https://github.com/redcanaryco/atomic-red-team
• MITRE ATT&CK. "Techniques Reference." https://attack.mitre.org/techniques/