Turn a threat report into Sigma detection rules

Turn this threat report into Sigma detection rules for my environment. Threat report or advisory: [PASTE the text, or a summary with behaviors and indicators] Log sources I have: [e.g. "Sysmon", "Windows Security event logs", "PowerShell script block logging", "EDR telemetry", "Linux auditd"] SIEM or backend: [e.g. "Splunk", "Microsoft Sentinel", "Elastic"] Noise tolerance: [low / medium / high] Steps: 1. Extract TTPs: list each attacker behavior the report describes, mapped to a MITRE ATT&CK technique ID. Include only what the report supports; mark weak inferences [INFERRED]. 2. Prioritize behaviors over indicators. Hashes, IPs, and domains change quickly; process chains, command-line patterns, registry changes, and parent-child relationships last longer. List atomic indicators separately. 3. Write one Sigma rule per behavior in valid YAML with: title, id (placeholder UUID), status: experimental, description, references, tags (attack.tXXXX), logsource (product, category or service), detection with named selections and a condition, falsepositives, and level. 4. Tune: for each rule, list likely false positives in a normal enterprise, suggest filters, and note which log source or audit setting must be enabled for it to fire. 5. Test: describe a safe way to validate each rule in a lab (e.g. a matching Atomic Red Team test, marked [VERIFY]). Return: a TTP table (Behavior | ATT&CK ID | Evidence in report | Log source), the Sigma rules in YAML code blocks, then tuning and test notes. Don't invent event IDs, field names, or ATT&CK mappings; mark anything uncertain [CHECK]. Test rules outside production before deploying them.