Purple › Module 4 › Lesson 1
Sigma Named
Sigma named literacy covers logsource, detection blocks, condition logic, and ATT&CK tags — read Sigma anatomy on YOUR $PURPLE_LAB rule drafts before SIEM conversion.
Visual · t35_sigma_named
Sigma named literacy. $PURPLE_LAB only. Original Cyberlium.
Opening
Sigma is the lingua franca of detection — literacy teaches rule anatomy so you author portable YAML on lab repos you govern.
Sigma rules are YAML detection definitions — title, id, status, description, logsource, detection block with selection and condition, falsepositives, level, and tags including attack.tXXXX. Logsource names product and category — windows/process_creation. Detection uses field modifiers — contains, startswith, all of. Cyberlium outlines Sigma anatomy on YOUR $PURPLE_LAB — write skeleton fields for one fictional T1059 rule. Next: SIEM Rules Named.
1. Sigma rule sections (named)
Metadata: title, id, status (experimental/stable), description, references. Logsource: product, category, service — maps to telemetry source. Detection: selection blocks with field matchers, condition combining selections with and/or. Tags: attack.t1059.001, attack.execution.
On $PURPLE_LAB, write Sigma skeleton — title, logsource, one selection, condition for fictional PowerShell rule.
Command guide
Try these commands — Sigma rule sections (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Sigma — https://sigmahq.io/ Sigma rule guide — https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide MITRE ATT&CK — https://attack.mitre.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
curl -sS https://sigmahq.io/ | head -10
cat > "$PURPLE_LAB/notes/sigma-named.txt" <<'EOF'
Sigma rule anatomy — NAMED LITERACY:
title, id, status, description, author, date
logsource: product + service (windows/security)
detection: selection + condition (Sigma logic)
falsepositives: documented tuning context
tags: attack.t1110.001 etc. (ATT&CK mapping)
level: informational/low/medium/high/critical
Lab: write stub in rules/failed-logon-lab.yml — YOUR sample pattern only
EOFCommand — copy this
grep -E 'logsource|detection|attack.t1110|failed-logon' "$PURPLE_LAB/notes/sigma-named.txt"
Primary tools to practice this lesson: curl, grep. Reference sites: Sigma (https://sigmahq.io/); Sigma rule guide (https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide); MITRE ATT&CK (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why Sigma literacy enables portable detection
Vendor-specific SIEM syntax locks rules to one platform. Sigma converts to Splunk, KQL, Elastic via backends. Shared Sigma repos accelerate purple exercise rule authorship and re-testing.
Students draft lab Sigma on notes — production rules follow org DaC repos and review pipelines.
3. Lab boundary
Forbidden: Sigma rules targeting stranger-network indicators without scope. Allowed: Sigma named card — skeleton with $PURPLE_LAB fictional example and ATT&CK tag.
Ship: Sigma named card for YOUR lab rule. Next: SIEM Rules Named.
4. What you ship: Sigma named card for $PURPLE_LAB
Sigma skeleton with logsource, selection, condition, tag. $PURPLE_LAB named. chmod 600.
5. What you record before the next lesson
Date. Sigma named card. $PURPLE_LAB named. File t35-m04-l01-sigma-named.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Write Sigma without logsource or ATT&CK tags. Copy live victim IOCs without redaction.
Right
Write Sigma named card for YOUR $PURPLE_LAB. Next: SIEM Rules Named.
Mission: draft Sigma skeleton on YOUR lab
1) List title, logsource, detection, tags sections. 2) Write skeleton for one T1059 rule. 3) Add attack.t1059.001 tag. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Logsource first — Sigma without source mapping cannot convert to SIEM.
Knowledge Check
APPLY: Sigma logsource primarily defines:
Multiple choice
Knowledge Check
APPLY: True or False: Sigma detection blocks use selection and condition logic.
True or False
Knowledge Check
APPLY: Sigma named literacy on Cyberlium uses:
Multiple choice