Lessons

Short lessons on writing Sigma detection rules. Each one ends with an exercise on real process and registry events that runs in this browser.

1. The parts of a Sigma ruleLesson 1 · 3 to find
2. Log sources and field namesLesson 2 · 3 to find
3. Matching valuesLesson 3 · 2 to find
4. Lists, searches and conditionsLesson 4 · 1 to find
5. False positives and how to narrow a ruleLesson 5 · 27 to find
6. Command lines that change shapeLesson 6 · 8 to find
7. Process access and access masksLesson 7 · 40 to find
8. Making a rule ready for useLesson 8 · 2 to find

Challenges