Skip to content

Siemphony is in beta and still being built. How a rule earns its badge.

Siemphony is in beta and still being built. How a rule earns its badge.

How it works The corpus Translate a rule Techniques Playbooks

Alert response · Command and Control responders

Command and control

A channel out. Containment competes with evidence collection here more sharply than anywhere else.

Containment competes with evidence collection here more sharply than anywhere else. Cutting the channel ends the session and your visibility together.

What this does not establish

Whether anyone is at the keyboard. Beacons run for months unattended.
What was sent. Volume is not content, and most of it is encrypted.
Whether a second channel exists. Operators plan for the first being found.

0 of 10 ticked

Flow width52%

Selected step

DetectStep 1 of 10

Characterise the channel and its timing

A fixed interval with jitter is a beacon; bursts are hands on keyboard.
DNS and HTTPS to a legitimate service are the normal shapes now.
Capture the destination before anything blocks it.
Start the timeline now: every action, who took it, when.

Tick this step

How to use this

Select a step to read its reasoning. Tick steps to track this browser’s progress. A decision can send you to a named owner or another step. A tick is a reading aid, not an incident status.

Reference sources

This guide is Siemphony’s synthesis for a general workflow. Review the original guidance and your local procedure before using it operationally.

NIST SP 800-61 Rev. 3
MITRE ATT&CK detection and analytics

Siemphony

A detection-engineering studio for people moving from the SOC into detection work. Compose in Sigma, translate it, publish a repertoire anyone can open.

Less noise. More signal.

On this page

One source, four artifacts
The reference corpus
ATT&CK coverage
How verification works

Explore

Every ATT&CK technique
SOC playbooks
Translate a rule

Sources

MITRE ATT&CK
Sigma specification
SigmaHQ rule repository

Account

Log in
Sign up
Terms
Privacy

© 2026 Siemphony

Sigma is a community standard maintained by SigmaHQ. ATT&CK is a registered trademark of The MITRE Corporation. Siemphony is not affiliated with either, nor with Microsoft, Splunk, Elastic or Wazuh.