pysigma

import os from pysigma import PySigmaCollection from pysigma.backends.sigma import SigmaDetectionsBackend # Create a dummy Sigma rule file for demonstration rule_content = """ title: Detect PowerShell Encoded Command id: 03f57279-7928-4e89-a5e2-6320573e6a4b status: stable description: Detects PowerShell usage with encoded commands, often used in malicious activity. logsource: category: process_creation product: windows detection: selection: Image|endswith: - '\\powershell.exe' - '\\pwsh.exe' CommandLine|contains: - '-EncodedCommand' - '-eNcoDedCOmmaNd' condition: selection fields: - CommandLine - ParentCommandLine - Image tags: - attack.execution - attack.t1059.001 """ # Save the rule to a temporary directory if not os.path.exists('sigma_rules'): os.makedirs('sigma_rules') with open('sigma_rules/powershell_encoded_command.yml', 'w') as f: f.write(rule_content) # 1. Load Sigma rules from a directory collection = PySigmaCollection.from_directory('sigma_rules') print(f"Loaded {len(collection.rules)} Sigma rule(s).") # 2. Instantiate a backend (e.g., generic Sigma detection backend) # For Splunk, use: from pysigma.backends.splunk import SplunkBackend; backend = SplunkBackend() backend = SigmaDetectionsBackend() # 3. Process the collection using the backend # This generates a list of Backend_Rule objects detection_rules = backend.convert(collection) # 4. Print the converted query for each rule for rule in detection_rules: print(f"\nRule ID: {rule.id}") print(f"Query: {rule.text}") # Clean up the dummy rule file and directory os.remove('sigma_rules/powershell_encoded_command.yml') os.rmdir('sigma_rules')