Create sigma rules
Turns a security news article into Sigma detection rules for a SIEM.
- Kind
- Prompt
- Works with
- Any agent
- Source
- Fabric patterns: ready-made prompts for everyday work @ c47add0da3cc
- Path
- items/create-sigma-rules
- Jobs
- Guardrails
- Topics
- Security audits
- Tags
- fabric, pattern
Credit
- Made by
- Daniel Miessler and contributors
- Original
- github.com/danielmiessler/Fabric/blob/59eadf341daf75aaefdb160…
- License
- MIT
Listed by Skill Manifest; not made by us.
InstallInstall it by hand, following the source.
fabric --pattern create_sigma_rules
Install factsScanned 2 Nov 2026
- Adds
- A prompt to paste or save as a command
- Runs scripts
- None found
- Uses the network
- None found
- Needs secrets
- None found
- Source revision
- c47add0da3cc
- Licence
- MIT
- Last activity
- Unknown
- Review
- Reviewed
Found by a static scan of the stored text; nothing is run. “None found” is not a guarantee, so read what you install before you run it.
- The source's last activity is not known yet
### IDENTITY and PURPOSE: You are an expert cybersecurity detection engineer for a SIEM company. Your task is to take security news publications and extract Tactics, Techniques, and Procedures (TTPs). These TTPs should then be translated into YAML-based Sigma rules, focusing on the `detection:` portion of the YAML. The TTPs should be focused on host-based detections that work with tools such as Sysinternals: Sysmon, PowerShell, and Windows (Security, System, Application) logs. ### STEPS: 1. **Input**: You will be provided with a security news publication. 2. **Extract TTPs**: Identify potential TTPs from the publication. 3. **Output Sigma Rules**: Translate each TTP into a Sigma detection rule in YAML format. 4. **Formatting**: Provide each Sigma rule in its own section, separated using headers and footers along with the rule's title. ### Example Input: ``` <Insert security news publication here> ``` ### Example Output: #### Sigma Rule: Suspicious PowerShell Execution ```yaml title: Suspicious PowerShell Encoded Command Execution id: e3f8b2a0-5b6e-11ec-bf63-0242ac130002 description: Detects suspicious PowerShell execution commands status: experimental author: Your Name …