Purple › Module 4 › Lesson 1
Sigma Named
Sigma named literacy covers logsource, detection blocks, condition logic, and ATT&CK tags — read Sigma anatomy on YOUR $PURPLE_LAB rule drafts before SIEM conversion.
Visual · t35_sigma_named
Sigma named literacy. $PURPLE_LAB only. Original Cyberlium.
Opening
Sigma is the lingua franca of detection — literacy teaches rule anatomy so you author portable YAML on lab repos you govern.
Sigma rules are YAML detection definitions — title, id, status, description, logsource, detection block with selection and condition, falsepositives, level, and tags including attack.tXXXX. Logsource names product and category — windows/process_creation. Detection uses field modifiers — contains, startswith, all of. Cyberlium outlines Sigma anatomy on YOUR $PURPLE_LAB — write skeleton fields for one fictional T1059 rule. Next: SIEM Rules Named.
1. Sigma rule sections (named)
Metadata: title, id, status (experimental/stable), description, references. Logsource: product, category, service — maps to telemetry source. Detection: selection blocks with field matchers, condition combining selections with and/or. Tags: attack.t1059.001, attack.execution.
On $PURPLE_LAB, write Sigma skeleton — title, logsource, one selection, condition for fictional PowerShell rule.
Command guide
Try these commands — Sigma rule sections (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: curl, grep. Reference sites: Sigma (https://sigmahq.io/); Sigma rule guide (https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide); MITRE ATT&CK (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why Sigma literacy enables portable detection
Vendor-specific SIEM syntax locks rules to one platform. Sigma converts to Splunk, KQL, Elastic via backends. Shared Sigma repos accelerate purple exercise rule authorship and re-testing.
Students draft lab Sigma on notes — production rules follow org DaC repos and review pipelines.
3. Lab boundary
Forbidden: Sigma rules targeting stranger-network indicators without scope. Allowed: Sigma named card — skeleton with $PURPLE_LAB fictional example and ATT&CK tag.
Ship: Sigma named card for YOUR lab rule. Next: SIEM Rules Named.
4. What you ship: Sigma named card for $PURPLE_LAB
Sigma skeleton with logsource, selection, condition, tag. $PURPLE_LAB named. chmod 600.
5. What you record before the next lesson
Date. Sigma named card. $PURPLE_LAB named. File t35-m04-l01-sigma-named.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Write Sigma without logsource or ATT&CK tags. Copy live victim IOCs without redaction.
Right
Write Sigma named card for YOUR $PURPLE_LAB. Next: SIEM Rules Named.
Mission: draft Sigma skeleton on YOUR lab
1) List title, logsource, detection, tags sections. 2) Write skeleton for one T1059 rule. 3) Add attack.t1059.001 tag. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Logsource first — Sigma without source mapping cannot convert to SIEM.
Knowledge Check
APPLY: Sigma logsource primarily defines:
Multiple choice
Knowledge Check
APPLY: True or False: Sigma detection blocks use selection and condition logic.
True or False
Knowledge Check
APPLY: Sigma named literacy on Cyberlium uses:
Multiple choice