Write one detection in a portable format and convert it

short · 55 min · Objective 4.3

Task

Express a detection in a vendor-neutral format, convert it to your platform's query language, run it, and find where the conversion needed help.

Steps

  1. Write a Sigma rule for a behaviour you can generate in your lab, with title, description, logsource, detection, false positive notes and an ATT&CK tag. Save to lab/rules/behaviour.yml.
  2. Convert it to your platform's query language and record BOTH in lab/rule-converted.md.
  3. Note every place the conversion needed manual adjustment -- a field name your schema calls something else, a construct the platform cannot express -- in lab/conversion-notes.md.
  4. Run it, trigger the behaviour, and capture the alert in lab/rule-fired.txt.
  5. Write a YARA rule matching a benign file you create by its strings and structure rather than its hash, prove it matches a MODIFIED copy of that file, and capture both results.

Verify

grep -Eci 'logsource|detection|falsepositives|tags' lab/rules/behaviour.yml
grep -Ec . lab/conversion-notes.md
test -s lab/rule-fired.txt && echo "sigma rule fired"
grep -Eic 'match' lab/yara-result.txt 2>/dev/null || echo "record yara output in lab/yara-result.txt"

A complete Sigma rule with false positive notes and an ATT&CK tag, conversion notes non-empty, the rule observed firing, and the YARA rule matching a modified copy. Matching the modified copy is the point -- a rule keyed to a hash would not, which is the indicator-versus-behaviour distinction made concrete.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.