Advanced Sigma Techniques

Basic Sigma rules match individual events. Advanced techniques correlate across events, implement time-based logic, and reduce false positives through careful condition crafting.

Correlation Rules

Correlations match patterns across multiple events. A single failed login is normal; hundreds from one source against many accounts is password spraying:

detection:
selection:
EventID: 4625
timeframe: 5m
condition: selection | count(TargetUserName) by IpAddress > 20

This triggers when one IP fails login against more than 20 different accounts within 5 minutes.

Aggregation Patterns

Aggregations summarize activity for threshold-based detection:

detection:
selection:
EventID: 4688
CommandLine|contains: 'net use'
timeframe: 1h
condition: selection | count() by ComputerName > 50

This flags hosts executing many net use commands, potentially indicating lateral movement.

Reducing False Positives

Filters exclude known benign behavior:

detection:
selection:
CommandLine|contains: 'powershell'
filter:
User: SYSTEM
ParentImage|endswith: 'svchost.exe'
condition: selection and not filter

This detects PowerShell while excluding system-initiated execution from expected sources.

Testing Methodology

Unit testing verifies rules match expected events. Create sample events representing the attack, ensure the rule matches.

Baseline testing ensures rules do not match normal activity. Run against production data logs without alerting to measure false positive rates.

Red team validation confirms rules detect actual attack execution, not just crafted samples.

Document expected false positives. Every rule should explain what legitimate activity might match and how to distinguish from threats.

Rule Management

Version control rules like code. Track changes, review modifications, and roll back problems.

Organize by MITRE ATT&CK technique or by log source. Consistent organization helps find and maintain rules.

Update regularly. Attackers evolve techniques; detections must evolve too. Subscribe to threat intelligence that informs rule updates.