Claude Skill 02: Create Sigma Rules

Source: Feedly Blog

Author: Josh Darby MacLellan

URL: https://feedly.com/ti-essentials/posts/claude-skill-02-create-sigma-rules

ONE SENTENCE SUMMARY:

A free Claude Skill converts threat reports, documentation, or logs into validated, telemetry-aware draft Sigma rules with sourced evidence labeling.

MAIN POINTS:

1. Skill generates Sigma drafts from advisories, reports, tool docs, behavior descriptions, or single log lines.
2. Environment profile tailors rules to collected telemetry and records defaults as explicit assumptions.
3. Produces four artifacts: Sigma rule, converted query, per-rule validation note, package summary.
4. First run builds organizational profile covering SIEM backend, telemetry, noise tolerance, and admin-tool FPs.
5. Interprets inputs differently; tool documentation requires user-stated misuse instead of invented adversarial framing.
6. Splits content into one behavior per rule, ranks by telemetry availability, and caps output at three.
7. Tags abstraction with stp.N, prioritizing durable behaviors over short-lived IOC matches.
8. Labels each condition as SOURCED, GENERIC, or INFERRED; inferred conditions cannot narrow detections.
9. Writes metadata first, then three logic layers (anchor/invariant/discriminator) plus evasion-focused resilience record.
10. Validates via attack_check.py, sigma check, sigma convert, and grouping check; reads converted query for correctness.

TAKEAWAYS:

1. Telemetry-first filtering prevents drafting detections you cannot actually run in your environment.
2. Evidence-ledger labeling makes assumptions reviewable and blocks stealthy narrowing via inference.
3. Layered selections enable tuning without discarding the technique’s core invariant signal.
4. Multi-step validation catches spec, ATT&CK, conversion, and backend-grouping pitfalls sigma-cli may miss.
5. Packaged outputs (rules, queries, notes, summary, profile) support faster review, retrohunts, and safer promotion.