Skip to content

Siemphony is in beta and still being built. How a rule earns its badge.

Siemphony is in beta and still being built. How a rule earns its badge.

How it works The corpus Translate a rule Techniques Playbooks

Alert response · Defense Evasion responders

Defence evasion

Something tried to hide, disable logging, or look like software it is not. Treat other alerts as unreliable from this point.

Treat every other alert as unreliable from this point. Someone chose to be harder to see, which means there is something to see.

What this does not establish

What was hidden. That is the entire point of the technique.
How long visibility has been degraded. Measure the gap, not the alert.
Whether the rest of your tooling is still honest. Verify, do not assume.

0 of 9 ticked

Flow width52%

Selected step

DetectStep 1 of 9

Establish exactly what was blinded, and when

Log cleared, agent stopped, exclusion added — each hides something different.
The gap's start time is your timeline anchor.
Ask the console, not the host. The host may be the liar.
Start the timeline now: every action, who took it, when.
Export whatever logs remain, off-host, before rotation takes them too.

Tick this step

How to use this

Select a step to read its reasoning. Tick steps to track this browser’s progress. A decision can send you to a named owner or another step. A tick is a reading aid, not an incident status.

Reference sources

This guide is Siemphony’s synthesis for a general workflow. Review the original guidance and your local procedure before using it operationally.

NIST SP 800-61 Rev. 3
MITRE ATT&CK detection and analytics

Siemphony

A detection-engineering studio for people moving from the SOC into detection work. Compose in Sigma, translate it, publish a repertoire anyone can open.

Less noise. More signal.

On this page

One source, four artifacts
The reference corpus
ATT&CK coverage
How verification works

Explore

Every ATT&CK technique
SOC playbooks
Translate a rule

Sources

MITRE ATT&CK
Sigma specification
SigmaHQ rule repository

Account

Log in
Sign up
Terms
Privacy

© 2026 Siemphony

Sigma is a community standard maintained by SigmaHQ. ATT&CK is a registered trademark of The MITRE Corporation. Siemphony is not affiliated with either, nor with Microsoft, Splunk, Elastic or Wazuh.