Sigma workbench

Paste a Sigma rule. Get it in your SIEM’s language.

Sentinel, Splunk, Elastic, Wazuh — plus the ATT&CK techniques the rule claims, and a check against benign activity before you deploy it.

No account. Your rule is translated in your browser and never sent to us.

Sigma source

A sample rule — replace it with yours

Parsed. Nothing was uploaded.

Translations

preview · not pySigma

Run this KQL in Sentinel

DeviceProcessEvents| where (((InitiatingProcessFolderPath endswith "\\WINWORD.EXE" or InitiatingProcessFolderPath endswith "\\EXCEL.EXE" or InitiatingProcessFolderPath endswith "\\POWERPNT.EXE") and (FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe")) and (ProcessCommandLine contains " -enc " or ProcessCommandLine contains " -EncodedCommand " or ProcessCommandLine contains " -e "))

Run this SPL in Splunk

index=* (((ParentImage="*\\WINWORD.EXE" OR ParentImage="*\\EXCEL.EXE" OR ParentImage="*\\POWERPNT.EXE") AND (Image="*\\powershell.exe" OR Image="*\\pwsh.exe")) AND (CommandLine="* -enc *" OR CommandLine="* -EncodedCommand *" OR CommandLine="* -e *"))

Run this ES|QL in Elastic

FROM logs-*| WHERE (((TO_LOWER(process.parent.executable) LIKE "*\\\\winword.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\excel.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\powerpnt.exe") AND (TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe")) AND (TO_LOWER(process.command_line) LIKE "* -enc *" OR TO_LOWER(process.command_line) LIKE "* -encodedcommand *" OR TO_LOWER(process.command_line) LIKE "* -e *"))

Deploy this to your manager's local_rules.xml — it is not a search

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)(\\WINWORD\.EXE$|\\EXCEL\.EXE$|\\POWERPNT\.EXE$)</field>    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)( -enc | -EncodedCommand | -e )</field>    <description>Encoded PowerShell launched by Office</description>    <mitre>      <id>T1059.001</id>      <id>T1204.002</id>    </mitre>  </rule></group>

ATT&CK techniques

Noise check · 0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Keep the ones that work

An account stores your rules, tracks which ATT&CK techniques you cover, exports that coverage as an ATT&CK Navigator layer, and lets other engineers report whether a rule actually fired in their environment.