# SIGMA Rule Templates

This directory contains YAML template files for generating SIGMA rules automatically based on CVE and PoC data.

## Template Structure

Each template file is a YAML file with the following structure:

```yaml
template_name: "Template Name"
description: "Description of what this template detects"
applicable_product_patterns:
  - "pattern1"
  - "pattern2"
template_content: |
  title: {{TITLE}}
  id: {{RULE_ID}}
  # ... SIGMA rule content with placeholders
```

## Template Fields

- **template_name**: Human-readable name for the template
- **description**: What the template is designed to detect
- **applicable_product_patterns**: List of keywords that help match CVEs to this template
- **template_content**: The actual SIGMA rule template with placeholders

## Placeholders

Templates use the following placeholders that get replaced during rule generation:

- `{{TITLE}}`: Rule title based on CVE
- `{{RULE_ID}}`: Unique rule identifier
- `{{DESCRIPTION}}`: CVE description and context
- `{{DATE}}`: Rule creation date
- `{{REFERENCES}}`: CVE references and PoC URLs
- `{{TAGS}}`: Relevant tags based on CVE data
- `{{LEVEL}}`: Severity level (low, medium, high, critical)
- `{{PROCESSES}}`: Process names from PoC analysis
- `{{COMMANDS}}`: Command patterns from PoC analysis
- `{{FILES}}`: File paths from PoC analysis
- `{{NETWORK}}`: Network indicators from PoC analysis
- `{{URLS}}`: URL patterns from PoC analysis
- `{{REGISTRY}}`: Registry keys from PoC analysis

## Available Templates

### Core Categories
1. **process_execution.yaml** - Process creation and execution
2. **network_connection.yaml** - Network connections and communications
3. **file_system_activity.yaml** - File system operations
4. **registry_modification.yaml** - Windows registry changes

### Attack Techniques
5. **powershell_execution.yaml** - PowerShell-based attacks
6. **web_application_attack.yaml** - Web application vulnerabilities
7. **command_injection.yaml** - Command injection attacks
8. **privilege_escalation.yaml** - Privilege escalation attempts
9. **credential_access.yaml** - Credential theft and access
10. **persistence.yaml** - Persistence mechanisms
11. **lateral_movement.yaml** - Lateral movement techniques
12. **service_manipulation.yaml** - Windows service manipulation

## Usage

### Initialize Templates
```bash
# Load all templates into the database
docker-compose exec backend python initialize_templates.py

# List available templates
docker-compose exec backend python initialize_templates.py list
```

### Adding New Templates

1. Create a new YAML file in this directory
2. Follow the template structure above
3. Choose appropriate `applicable_product_patterns` keywords
4. Use relevant placeholders in your `template_content`
5. Run the initialization script to load into database

### Template Matching

Templates are automatically matched to CVEs based on:
- Product patterns matching CVE affected products
- PoC analysis indicators
- CVE description keywords

## Best Practices

1. **Specific Patterns**: Use specific product patterns for better matching
2. **False Positives**: Include realistic false positive scenarios
3. **Conditions**: Use appropriate SIGMA detection conditions
4. **Log Sources**: Match log sources to the type of activity being detected
5. **Severity**: Use appropriate severity levels based on the attack impact

## Example Template

```yaml
template_name: "Example Detection"
description: "Detects example malicious activity"
applicable_product_patterns:
  - "example"
  - "software"
template_content: |
  title: {{TITLE}}
  id: {{RULE_ID}}
  status: experimental
  description: {{DESCRIPTION}}
  author: CVE-SIGMA Auto Generator
  date: {{DATE}}
  references:
  {{REFERENCES}}
  tags:
  {{TAGS}}
  logsource:
      category: process_creation
      product: windows
  detection:
      selection:
          Image|endswith:
  {{PROCESSES}}
      condition: selection
  falsepositives:
      - Legitimate use cases
  level: {{LEVEL}}
```