Siemphony — write the detection once, in Sigma, for Microsoft Sentinel, Splunk, Elastic and Wazuh.
How Siemphony works, in six scenes
Your detection logic shouldn’t become four maintenance jobs. Sentinel, Splunk, Elastic, Wazuh — the same idea written four times, edited by hand, slowly drifting apart.
Write the detection once. Author in Sigma: one readable source, and the only thing you maintain.
One source. Four artifacts. Change the source once and all four follow — KQL, SPL and ES|QL to run, and a Wazuh manager rule to deploy.
Understand the logic behind the rule. Every detection topic opens a lesson beside the editor: the logic, the telemetry it needs, and where it gets noisy.
Show your work. Prove it fires. Verification is earned in the lab, on real attack telemetry — and a public page anyone can open shows the evidence.
Less noise. More signal.
siemphony.com · detection libraryOpens without an account
Detection library400 detections, translated and explained
Active Directory database file copied, exported or dumpedLab-verified
BITS job creation or notify command set from the command lineLab-verified
Child process spawned by the WinRM shell host wsmprovhost.exeLab-verified
CMSTP profile installer executed on a Windows endpointLab-verified
Microsoft SentinelKQL · QUERY
RUN
DeviceProcessEvents| where (FolderPath endswith "\\reg.exe" and (ProcessCommandLine contains " save " and ProcessCommandLine contains "hklm\\sam"))
SplunkSPL · SEARCH
RUN
index=* (Image="*\\reg.exe" AND (CommandLine="* save *" AND CommandLine="*hklm\\sam*"))
ElasticES|QL · QUERY
RUN
FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*\\\\reg.exe" AND (TO_LOWER(process.command_line) LIKE "* save *" AND TO_LOWER(process.command_line) LIKE "*hklm\\\\sam*"))
WazuhXML · MANAGER RULEexcerpt · 2 of 12 lines
DEPLOY
<field name="Image" type="pcre2">(?i)\\reg\.exe$</field> <field name="CommandLine" type="pcre2">(?i)(?=.*(?: save ))(?=.*(?:hklm\\sam)).*</field>
Why does it fire?
The reasoning lives in another tab — a wiki, a course, a colleague — and drifts from all four copies.
detection.ymlSigma · source of truth
title: Registry hive saved with reg.exelogsource:category: process_creationproduct: windowsdetection:selection:Image|endswith: '\reg.exe'CommandLine|contains|all: - ' save ' - 'hklm\sam'condition: selection
Example rule
Lesson · credential dumpATT&CK T1003.002
Attempts to read credential material out of memory or from disk — most commonly the LSASS process on Windows, or the SAM and SECURITY registry hives.
The logic
The second matches the tooling: command lines containing comsvcs.dll MiniDump, reg save of the credential hives, or known dumper names.
Telemetry you need
Process creation with full command lines
Registry save operations against the SAM, SYSTEM and SECURITY hives
Where it will be noisy
Backup software reading registry hives during a system state backup
Not yet verified
Translation is not proof. The badge is earned when the rule fires on real attack telemetry in the lab.
Detection libraryT1003.002
Local credential registry hive saved or exported to disk
Verified in the Siemphony lab
Security Datasets — SAM hive copied out with esentutl.exe · attack capture2 matches
Siemphony benign baseline · benign baseline1 match
Earned by firing on a real capture of its own technique.
reg.exe save hklm\\samreg.exe save hklm\\samreg.exe save hklm\\\\samreg\.exe save hklm\\sam
Your detection logic shouldn’t become four maintenance jobs. Sentinel, Splunk, Elastic, Wazuh — the same idea written four times, edited by hand, slowly drifting apart.
Write the detection once. Author in Sigma: one readable source, and the only thing you maintain.
One source. Four artifacts. Change the source once and all four follow — KQL, SPL and ES|QL to run, and a Wazuh manager rule to deploy.
Understand the logic behind the rule. Every detection topic opens a lesson beside the editor: the logic, the telemetry it needs, and where it gets noisy.
Show your work. Prove it fires. Verification is earned in the lab, on real attack telemetry — and a public page anyone can open shows the evidence.
Less noise. More signal.
siemphony.com · detection library
Detection library400 detections, translated and explained
Active Directory database file copied, exported or dumpedLab-verified
BITS job creation or notify command set from the command lineLab-verified
Child process spawned by the WinRM shell host wsmprovhost.exeLab-verified
CMSTP profile installer executed on a Windows endpointLab-verified
Microsoft SentinelKQL · QUERY
RUN
DeviceProcessEvents| where (FolderPath endswith "\\reg.exe" and (ProcessCommandLine contains " save " and ProcessCommandLine contains "hklm\\sam"))
SplunkSPL · SEARCH
RUN
index=* (Image="*\\reg.exe" AND (CommandLine="* save *" AND CommandLine="*hklm\\sam*"))
ElasticES|QL · QUERY
RUN
FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*\\\\reg.exe" AND (TO_LOWER(process.command_line) LIKE "* save *" AND TO_LOWER(process.command_line) LIKE "*hklm\\\\sam*"))
WazuhXML · MANAGER RULE
DEPLOY
<field name="Image" type="pcre2">(?i)\\reg\.exe$</field> <field name="CommandLine" type="pcre2">(?i)(?=.*(?: save ))(?=.*(?:hklm\\sam)).*</field>
Why does it fire?
The reasoning lives in another tab — a wiki, a course, a colleague — and drifts from all four copies.
detection.ymlSigma · source of truth
title: Registry hive saved with reg.exelogsource:category: process_creationproduct: windowsdetection:selection:Image|endswith: '\reg.exe'CommandLine|contains|all: - ' save ' - 'hklm\sam'condition: selection
Example rule
Lesson · credential dumpATT&CK T1003.002
Attempts to read credential material out of memory or from disk — most commonly the LSASS process on Windows, or the SAM and SECURITY registry hives.
The logic
The second matches the tooling: command lines containing comsvcs.dll MiniDump, reg save of the credential hives, or known dumper names.
Telemetry you need
Process creation with full command lines
Registry save operations against the SAM, SYSTEM and SECURITY hives
Where it will be noisy
Backup software reading registry hives during a system state backup
Not yet verified
Translation is not proof. The badge is earned when the rule fires on real attack telemetry in the lab.
Detection libraryT1003.002
Local credential registry hive saved or exported to disk
Verified in the Siemphony lab
Security Datasets — SAM hive copied out with esentutl.exe · attack capture2 matches
Siemphony benign baseline · benign baseline1 match
Earned by firing on a real capture of its own technique.
reg.exe save hklm\\samreg.exe save hklm\\samreg.exe save hklm\\\\samreg\.exe save hklm\\sam
Your detection logic shouldn’t become four maintenance jobs.
Microsoft SentinelKQL · QUERY
Edited here only
DeviceProcessEvents| where (FolderPath endswith "\\reg.exe" and (ProcessCommandLine contains " save " and ProcessCommandLine contains "hklm\\system"))
SplunkSPL · SEARCH
RUN
index=* (Image="*\\reg.exe" AND (CommandLine="* save *" AND CommandLine="*hklm\\sam*"))
ElasticES|QL · QUERY
RUN
FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*\\\\reg.exe" AND (TO_LOWER(process.command_line) LIKE "* save *" AND TO_LOWER(process.command_line) LIKE "*hklm\\\\sam*"))
…and the reasoning lives in yet another tab.
Sentinel, Splunk, Elastic, Wazuh — the same idea written four times, edited by hand, slowly drifting apart.
2 of 6
Write the detection once.
detection.ymlSigma · source of truth
title: Registry hive saved with reg.exelogsource:category: process_creationproduct: windowsdetection:selection:Image|endswith: '\reg.exe'CommandLine|contains|all: - ' save ' - 'hklm\sam'condition: selection
Example rule
Author in Sigma: one readable source, and the only thing you maintain.
3 of 6
One source. Four artifacts.
detection.ymlSigma · source of truth
title: Registry hive saved with reg.exelogsource:category: process_creationproduct: windowsdetection:selection:Image|endswith: '\reg.exe'CommandLine|contains|all: - ' save ' - 'hklm\system'condition: selection
Example rule
Microsoft SentinelKQL · QUERY
RUN
DeviceProcessEvents| where (FolderPath endswith "\\reg.exe" and (ProcessCommandLine contains " save " and ProcessCommandLine contains "hklm\\system"))
SplunkSPL · SEARCH
RUN
index=* (Image="*\\reg.exe" AND (CommandLine="* save *" AND CommandLine="*hklm\\system*"))
ElasticES|QL · QUERY
RUN
FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*\\\\reg.exe" AND (TO_LOWER(process.command_line) LIKE "* save *" AND TO_LOWER(process.command_line) LIKE "*hklm\\\\system*"))
WazuhXML · MANAGER RULE
DEPLOY
<field name="Image" type="pcre2">(?i)\\reg\.exe$</field> <field name="CommandLine" type="pcre2">(?i)(?=.*(?: save ))(?=.*(?:hklm\\system)).*</field>
Excerpt · 2 of 12 lines, verbatim
Change the source once and all four follow — KQL, SPL and ES|QL to run, and a Wazuh manager rule to deploy.
4 of 6
Understand the logic behind the rule.
Lesson · credential dumpATT&CK T1003.002
Attempts to read credential material out of memory or from disk — most commonly the LSASS process on Windows, or the SAM and SECURITY registry hives.
The logic
The second matches the tooling: command lines containing comsvcs.dll MiniDump, reg save of the credential hives, or known dumper names.
Telemetry you need
Process creation with full command lines
Registry save operations against the SAM, SYSTEM and SECURITY hives
Where it will be noisy
Backup software reading registry hives during a system state backup
Every detection topic opens a lesson beside the editor: the logic, the telemetry it needs, and where it gets noisy.
5 of 6
Show your work. Prove it fires.
Not yet verified
Translation is not proof. The badge is earned when the rule fires on real attack telemetry in the lab.
Detection libraryT1003.002
Local credential registry hive saved or exported to disk
Verified in the Siemphony lab
Security Datasets — SAM hive copied out with esentutl.exe · attack capture2 matches
Siemphony benign baseline · benign baseline1 match
Earned by firing on a real capture of its own technique.
Every technique in ATT&CK v19.2 — enterprise, mobile and ICS. Coverage is measured against the whole framework, so the number you see is the number you have.
529
Detectable in Sigma.
Siemphony knows which techniques leave a trace a Sigma rule can match — so your effort goes where a detection can actually fire.
400
Detections ready to start from.
A public library of Sigma detections, each translated for the platforms it supports and explained by a lesson. Open one, read the logic, adapt it to your environment. Where a rule would only add noise, the reasoning is written down instead.
See every gap, by tactic.
Tag a detection and your studio counts it against the real per-tactic totals of ATT&CK, so you always know what you have covered — and what you have not, yet.
Three things other tools make you leave the editor for.
A converter converts. A course teaches. A portfolio site hosts. Siemphony puts all three on one screen, in the order you actually work.
StudioComposer · one screen
detection.ymlSigma · source of truth
title: Registry hive saved with reg.exelogsource:category: process_creationproduct: windowsdetection:selection:Image|endswith: '\reg.exe'CommandLine|contains|all: - ' save ' - 'hklm\sam'condition: selection
Example rule
A converter · another tab
Microsoft SentinelKQL · QUERY
RUN
DeviceProcessEvents| where (FolderPath endswith "\\reg.exe" and (ProcessCommandLine contains " save " and ProcessCommandLine contains "hklm\\sam"))
A course · another tab
Lesson · credential dumpATT&CK T1003.002
Attempts to read credential material out of memory or from disk — most commonly the LSASS process on Windows, or the SAM and SECURITY registry hives.
Telemetry you need
Process creation with full command lines
Registry save operations against the SAM, SYSTEM and SECURITY hives
A portfolio site · another tab
Your profile
Public
Registry hive saved with reg.exe
Published
A plain link that opens without an account.
StudioOne screen
detection.ymlSigma
Image|endswith: '\reg.exe' CommandLine|contains|all: - ' save ' - 'hklm\sam'
A converter
Microsoft Sentinel KQL · QUERY
DeviceProcessEvents
| where (FolderPath endswith "\\reg.exe" and (ProcessCommandLine contains " save " and ProcessCommandLine contains "hklm\\sam"))
A course
Lesson
Attempts to read credential material out of memory or from disk — most commonly the LSASS process on Windows, or the SAM and SECURITY registry hives.
A portfolio site
Your profile
Public
01 · replaces a converter
Four backends, one edit
Change a selection and all four translations move with it, using the same code that runs on save — so the preview is what gets stored. Sentinel, Splunk and Elastic give you a query to run; Wazuh gives you a manager rule to deploy, and the interface says which.
02 · replaces a course
The lesson is beside the rule
Pick a detection topic and its lesson opens next to the editor: what the behaviour is, the telemetry you need, a walkthrough of the logic, where it will be noisy, how to tune it, and where it sits on the DeBMM maturity ladder.
03 · replaces a portfolio site
A repertoire you can send
Publish a composition and choose whether it appears on your profile. That page is a plain link that opens without an account. Your profile is private until you switch it on.
Sentinel KQL
Splunk SPL
Elastic ES|QL
Wazuh XML rule
Verification
A badge you can check, not a checkbox.
No switch to flip. Every rule starts unverified, and there is nothing to click that changes that. The badge only comes from evidence.
Earned on real telemetry. The lab runs the rule against a public capture of its own technique and against benign activity, and shows both results side by side.
Always current. A badge lasts 90 days from its run, so it always points at a recent result, never a stale one.
Tied to the exact rule. Change anything in the Sigma — even letter case — and the badge waits for the lab to confirm the new version. See the technique.
Detection library · T1003.002Example edit
Local credential registry hive saved or exported to disk
Not verified
Verified in Siemphony lab
Verified — re-test pending
Security Datasets — SAM hive copied out with esentutl.exe · attack capturematches 2
The rule was edited after its last passing test on 3 Sept 2026.
A real verified rule and its real lab results. The edit is an example of what any change does.
Feedback
Other engineers tell you whether it fires.
Every published composition takes likes, comments and a verdict from anyone signed in: it works, it doesn't fire, or they found a bug.
A verdict asks why before it asks for prose: a structured reason, where it was tested, and an optional note of 300 characters.
Reports are sorted by what they mean, so “Our field names are different” tells you about someone's environment — and only real logic problems count against your rule.
Feedback you can trust. Authors cannot vote on their own rules — enforced by the database, not just the interface.
Detection library
Local credential registry hive saved or exported to disk
Your verdict
It worksIt doesn't fireFound a bug
What went wrong?
Our field names are different
Where did you test it?
Elastic
Our pipeline renames Sysmon fields to ECS, so CommandLine never matched here.
77/300Reported
Recorded as not a defect in the rule — the data differs, not the logic.
cannot vote on your own rule
another engineer
the rule's author
The verdict panel, shown with an example report.
Vendor-neutral detection engineering
Write the detection once.
Author in Sigma. Siemphony derives the metadata, links the ATT&CK techniques you tagged, and renders the rule for Microsoft Sentinel, Splunk, Elastic and Wazuh — with the reasoning for the logic sitting beside the editor rather than in a separate course.
A public library of Sigma detections, each translated for the platforms it supports and explained by a lesson. Open one, read the logic, adapt it to your environment.
Coverage is measured against the whole of ATT&CK, so the number you see is the number you have — and where a rule would only add noise, the reasoning is written down instead.
Sigma stays the source of truth. The structured metadata, the technique tags and every query are derived from it, so there is one thing to maintain rather than four that drift apart.
The signal path
One source · four artifacts
Why this and not three tools
Three things other tools make you leave the editor for.
A converter converts. A course teaches. A portfolio site hosts. Siemphony puts all three on one screen, in the order you actually work.
01
The lesson is beside the rule
Pick a detection topic in the composer and its lesson opens next to the editor: what the behaviour is, the telemetry you need, a walkthrough of the logic, where it will be noisy, how to tune it, and where it sits on the DeBMM maturity ladder.
02
Four backends, one edit
Change a selection and all four translations move with it, using the same code that runs on save — so the preview is what gets stored. Sentinel, Splunk and Elastic give you a query to run. Wazuh gives you a manager rule to deploy, and the interface says which.
03
A repertoire you can send
Publish a composition and choose whether it appears on your profile. That page is a plain link that opens without an account. Your profile is private until you switch it on.
Sentinel KQL
Splunk SPL
Elastic ES|QL
Wazuh XML rule
Coverage
See every gap, by tactic.
Tag a detection and your studio counts it against the real per-tactic totals of ATT&CK, so you always know what you have covered — and what you have not, yet.
Sigma-detectable techniques, by tactic
529 total
stealth143
persistence100
privilege-escalation89
credential-access59
execution54
command-and-control45
Verified in the Siemphony lab
Earned, never assumed
The lab runs a composition against a public capture of the technique it claims to detect and against benign activity, and shows both results. A rule earns the badge only by firing on a capture of its own technique.
Verification
A badge you can check, not a checkbox.
There is no switch to flip: every rule starts unverified and the badge only comes from evidence. It lasts 90 days from its run, so it always points at a recent result.
And it is tied to the exact rule — change anything in the Sigma and the badge waits for the lab to confirm the new version.
Feedback
Other engineers tell you whether it fires.
Every published composition takes likes, comments and a verdict from anyone signed in. Authors cannot vote on their own rules — enforced by the database, not just the interface.
works
Deployed it, and it fired on the behaviour it claims to detect.
doesn't fire
Deployed it, and the telemetry was not there or the logic missed.
bug
The rule or one of its translations is wrong. Say which, in 300 characters.
Less noise. More signal.
Create an account and start from a labelled Sigma skeleton — not a pre-written rule with your name on it. What ends up on your profile is work you actually did.
