Write one detection in a portable format and convert it

short · 55 min · Objective 4.3

Task

Express a detection in a vendor-neutral format, convert it to your platform's query language, run it, and find where the conversion needed help.

Steps

  1. Write a Sigma rule for a behaviour you can generate in your lab, with title, description, logsource, detection, false positive notes and an ATT&CK tag. Save to lab/rules/behaviour.yml.
  2. Convert it to your platform's query language and record BOTH in lab/rule-converted.md.
  3. Note every place the conversion needed manual adjustment -- a field name your schema calls something else, a construct the platform cannot express -- in lab/conversion-notes.md.
  4. Run it, trigger the behaviour, and capture the alert in lab/rule-fired.txt.
  5. Write a YARA rule matching a benign file you create by its strings and structure rather than its hash, prove it matches a MODIFIED copy of that file, and run it against both, saving yara's output to lab/yara-result.txt.

Verify

grep -Eci 'logsource|detection|falsepositives|tags' lab/rules/behaviour.yml
grep -Ec . lab/conversion-notes.md
test -s lab/rule-fired.txt && echo "sigma rule fired"
grep -c . lab/yara-result.txt    # yara prints the rule and the file for each match, nothing for a miss

A complete Sigma rule with false positive notes and an ATT&CK tag, conversion notes non-empty, the rule observed firing, and two lines of YARA output -- the rule matching the original and the modified copy. Matching the modified copy is the point -- a rule keyed to a hash would not, which is the indicator-versus-behaviour distinction made concrete.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.