Definition
Sigma rules are generic, open-source detection patterns used in cybersecurity to identify malicious activity within log data. They provide a structured way to describe threat behaviors, allowing security analysts to create and share detection logic across different security information and event management SIEM systems. This standardization enables faster threat hunting and incident response by translating complex attack techniques into searchable queries. For instance, a Sigma rule might detect suspicious PowerShell commands indicative of malware execution. Unlike specific vendor signatures, Sigma rules are platform agnostic, requiring translation to work with particular SIEM tools. This concept is frequently encountered in cybersecurity certifications like Security+, CySA+, and CISSP.