/Sigma Rule Builder
Create a portable Sigma detection rule locally and adapt it to your SIEM or EDR pipeline.
Local processing
This tool processes your input in your browser.
Command Palette
Search for a command to run...
Rule inputs
Sigma YAML
title: "Suspicious process execution"
id: replace-with-uuid
status: experimental
description: "Generated locally; review and tune before deployment."
author: ""
date: 2026-09-08
logsource:
product: windows
service: sysmon
detection:
selection:
Image:
- "powershell.exe"
- "cmd.exe"
condition: selection
level: medium
Related Tools
Investigation Workspace
Analyze and organize security indicators, logs, files, and timelines in one local workspace.
Incident Response Playbook Engine
Design and execute structured security incident response workflows.
Email Security Analyzer
Inspect email headers locally for SPF, DKIM, DMARC and phishing indicators.
Active Directory Attack Path Analyzer
Review BloodHound-style relationships locally and prioritize Tier 0 exposure.