Making a rule ready for use

A rule that matches the right events is half of the work. The other half is what the person who receives the alert, and the person who maintains the rule a year later, need to know. Sigma has fields for that; none of them change which events match.

title: mshta running inline script code
id: 7f3e2c9a-4b1d-4e8a-9c6f-2d5b8a1e0c47
status: test
description: Detects mshta.exe started with VBScript or JavaScript code on its command line.
references:
  - https://attack.mitre.org/techniques/T1218/005/
author: Your name
date: 2026-10-20
tags:
  - attack.defense-evasion
  - attack.t1218.005
falsepositives:
  - Legacy administration scripts that start mshta with inline script code
level: high

• id: a random UUID (version 4), created once. It stays the same when the title or the detection changes, so alerts and exceptions in a SIEM keep pointing at the same rule.
• status: experimental (new, may be noisy), test (mostly stable), stable (ready for production), deprecated, unsupported.
• description, references, author, date (YYYY-MM-DD), modified: what the rule is about and where it came from.
• tags: namespaced labels in lower case. attack.t1218.005 is the ATT&CK technique, attack.defense-evasion the tactic.
• falsepositives: the normal activity known to match. This is the first thing an analyst reads.
• level: informational, low, medium, high or critical. The Sigma specification reserves high for events that need a prompt review and critical for cases where the probability of an incident borders on certainty.

Before it goes live

• Run it on logs where the activity happened (does it catch it) and on normal logs from your own environment (how often does it fire). The challenges on this site are the first two steps; your own SIEM is the third.
• Convert it with the converter your SIEM uses (for example sigma convert from sigma-cli, which is built on pySigma) and read the resulting query. Field mappings and unsupported modifiers show up there, not in the YAML.
• This site's evaluator supports a subset of Sigma. Keyword search (a list of values without a field name), correlation rules and placeholders are not supported here; a rule that uses them is rejected with a message rather than evaluated differently.