# Turn a threat report into Sigma detection rules

Extracts behaviors from a threat report, maps them to MITRE ATT&CK, and writes tuned Sigma rules with test notes.

- Topic: Software Development
- Framework: Few-Shot
- Level: Standard
- Tags: Analyze, Code, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/turn-a-threat-report-into-sigma-detection-rules

## Prompt

```text
Turn this threat report into Sigma detection rules for my environment.

**Threat report or advisory:** [PASTE the text, or a summary with behaviors and indicators]
**Log sources I have:** [e.g. "Sysmon", "Windows Security event logs", "PowerShell script block logging", "EDR telemetry", "Linux auditd"]
**SIEM or backend:** [e.g. "Splunk", "Microsoft Sentinel", "Elastic"]
**Noise tolerance:** [low / medium / high]

Steps:
1. **Extract TTPs:** list each attacker behavior the report describes, mapped to a MITRE ATT&CK technique ID. Include only what the report supports; mark weak inferences [INFERRED].
2. **Prioritize behaviors over indicators.** Hashes, IPs, and domains change quickly; process chains, command-line patterns, registry changes, and parent-child relationships last longer. List atomic indicators separately.
3. **Write one Sigma rule per behavior** in valid YAML with: title, id (placeholder UUID), status: experimental, description, references, tags (attack.tXXXX), logsource (product, category or service), detection with named selections and a condition, falsepositives, and level.
4. **Tune:** for each rule, list likely false positives in a normal enterprise, suggest filters, and note which log source or audit setting must be enabled for it to fire.
5. **Test:** describe a safe way to validate each rule in a lab (e.g. a matching Atomic Red Team test, marked [VERIFY]).

Return: a TTP table (Behavior | ATT&CK ID | Evidence in report | Log source), the Sigma rules in YAML code blocks, then tuning and test notes.

Don't invent event IDs, field names, or ATT&CK mappings; mark anything uncertain [CHECK]. Test rules outside production before deploying them.
```

## What to fill in

- PASTE the text, or a summary with behaviors and indicators
- e.g. "Splunk", "Microsoft Sentinel", "Elastic"
- low / medium / high
- INFERRED
- CHECK

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.