Skip to content

Siemphony is in beta and still being built. How a rule earns its badge.

Siemphony is in beta and still being built. How a rule earns its badge.

How it works The corpus Translate a rule Techniques Playbooks

Alert response · Impact responders

Destructive impact

Something moved to destroy, encrypt or disable. The only family where speed genuinely beats certainty.

The one family where acting on incomplete information is correct. This is the last quiet step before encryption.

What this does not establish

Whether encryption has started. These run before it — and during.
How far it spread. One alert is a sample, not a scope.
Whether backups are safe. Check, do not assume.

0 of 12 ticked

Flow width52%

Selected step

DetectStep 1 of 12Decision

Same command on other hosts?

If yes: Escalate now — fleet-wide, not one hostOtherwise continue to “Is the operator still inside?”.

Scope before investigating. Everything downstream changes.
Match on command shape, not exact string — arguments get randomised.
Run this and the backup check in parallel if you have the people.
Start the timeline now: every action, who took it, when.
Escalating means naming an incident commander and a note-taker first.

Tick this step

How to use this

Select a step to read its reasoning. Tick steps to track this browser’s progress. A decision can send you to a named owner or another step. A tick is a reading aid, not an incident status.

Related playbooks

Critical incident: standing up the response
Ransomware, end to end

Reference sources

This guide is Siemphony’s synthesis for a general workflow. Review the original guidance and your local procedure before using it operationally.

NIST SP 800-61 Rev. 3
MITRE ATT&CK detection and analytics

Siemphony

A detection-engineering studio for people moving from the SOC into detection work. Compose in Sigma, translate it, publish a repertoire anyone can open.

Less noise. More signal.

On this page

One source, four artifacts
The reference corpus
ATT&CK coverage
How verification works

Explore

Every ATT&CK technique
SOC playbooks
Translate a rule

Sources

MITRE ATT&CK
Sigma specification
SigmaHQ rule repository

Account

Log in
Sign up
Terms
Privacy

© 2026 Siemphony

Sigma is a community standard maintained by SigmaHQ. ATT&CK is a registered trademark of The MITRE Corporation. Siemphony is not affiliated with either, nor with Microsoft, Splunk, Elastic or Wazuh.