Custom Sigma Detection Rules Quiz

1. A Sigma rule detects suspicious parent-child process relationships. Which field identifies the parent process executable?

ParentImage

Image

ProcessName

ExecutablePath

Submit

3. When testing a Sigma rule, which metric indicates the ratio of correct detections to total alerts?

Precision

Recall

Accuracy

Specificity

Submit

5. A well-written Sigma rule for detecting credential dumping should look for specific process names and APIs. Which tool is commonly detected?

Mimikatz

Wireshark

Nmap

Curl

6. Which Sigma modifier would you use to match values that are NOT present in a list?

Exclude

Not

Negative

None of the above

Submit

8. When detecting lateral movement, a Sigma rule should monitor which type of event?

Network connections to unusual destinations or ports

Only outbound HTTP traffic

Disk read operations

User login attempts only

9. What is the purpose of the 'falsepositives' field in a Sigma rule?

To document known conditions that may trigger false alerts

To increase detection sensitivity

To disable the rule automatically

To randomize alert thresholds

Submit

11. What is the primary purpose of Sigma rules in security analytics?

To define generic, platform-agnostic detection logic for threats

To replace all commercial SIEM solutions

To encrypt network traffic automatically

To patch vulnerabilities in endpoints

12. Which Sigma modifier is used to perform case-insensitive string matching?

Nocase

Insensitive

Ignore_case

Icase

13. When writing a Sigma rule for registry modification detection, which field captures the registry path?

RegistryPath

TargetObject

ImagePath

ObjectName

14. In Sigma rules, what does the 'logsource' section specify?

The type of log and platform from which events are expected

The destination IP address for alerts

The encryption method used

The time zone of the detection

15. Which Sigma modifier enables pattern matching with wildcard characters?

Contains

Startswith

Endswith

All of the above

16. A Sigma rule detecting command-line execution should include which field to capture process arguments?

CommandLine

ProcessID

EventID

LogSource

17. What does the 'filter' field in a Sigma rule allow you to do?

Exclude specific events from detection based on conditions

Encrypt detected events

Automatically remediate threats

Generate false positives intentionally

18. Which logical operator in Sigma rules combines multiple conditions where ALL must be true?

OR

AND

NOT

XOR

19. In Sigma syntax, what does the 'selection' section define?

The specific conditions and filters for detecting an attack pattern

The output format for alerts

The SIEM platform compatibility

The geographic location of threats

20. Which Sigma rule field specifies the severity level of a detected event?

Severity

Level

Priority

Risk

Security Expert Writing a Custom Sigma Detection Rule Quiz

1. A Sigma rule detects suspicious parent-child process relationships. Which field identifies the parent process executable?

2.

What first name or nickname would you like us to use?

2. A Sigma rule with multiple 'selection' blocks combined with 'OR' logic will detect an event if ____ of the selection criteria match.

3. When testing a Sigma rule, which metric indicates the ratio of correct detections to total alerts?

4. The 'references' field in a Sigma rule should contain ____.

5. A well-written Sigma rule for detecting credential dumping should look for specific process names and APIs. Which tool is commonly detected?

6. Which Sigma modifier would you use to match values that are NOT present in a list?

7. In Sigma syntax, the 'keywords' field is used to ____.

8. When detecting lateral movement, a Sigma rule should monitor which type of event?

9. What is the purpose of the 'falsepositives' field in a Sigma rule?

10. In Sigma rules, the 'title' field should be ____.

11. What is the primary purpose of Sigma rules in security analytics?

12. Which Sigma modifier is used to perform case-insensitive string matching?

13. When writing a Sigma rule for registry modification detection, which field captures the registry path?

14. In Sigma rules, what does the 'logsource' section specify?

15. Which Sigma modifier enables pattern matching with wildcard characters?

16. A Sigma rule detecting command-line execution should include which field to capture process arguments?

17. What does the 'filter' field in a Sigma rule allow you to do?

18. Which logical operator in Sigma rules combines multiple conditions where ALL must be true?

19. In Sigma syntax, what does the 'selection' section define?

20. Which Sigma rule field specifies the severity level of a detected event?