CodeByHarri · Khadinxc · Nov 15, 2025 · Nov 15, 2025 · Nov 15, 2025 · Nov 15, 2025
diff --git a/.github/workflows/update-sigma-rules.yml b/.github/workflows/update-sigma-rules.yml
@@ -0,0 +1,84 @@
+name: Update Sigma to KQL Rules
+
+on:
+  schedule:
+    # Run weekly on Sunday at 2 AM UTC
+    - cron: '0 2 * * 0'
+  workflow_dispatch:
+    # Allow manual trigger
+
+jobs:
+  convert-sigma-rules:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Sigma2KQL repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+          cache: 'pip'
+
+      - name: Clone Sigma rules repository
+        run: |
+          git clone https://github.com/SigmaHQ/sigma.git
+
+      - name: Install Python dependencies
+        run: |
+          pip install -r requirements.txt
+
+      - name: Run Sigma to KQL conversion
+        run: |
+          python helper.py --sigma-dir "./sigma" --output-dir "./KQL"
+
+      - name: Check for changes
+        id: check_changes
+        run: |
+          git diff --quiet KQL/ || echo "changes=true" >> $GITHUB_OUTPUT
+
+      - name: Create Pull Request
+        if: steps.check_changes.outputs.changes == 'true'
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: 'chore: update KQL rules from latest Sigma rules'
+          branch: update-sigma-rules-${{ github.run_number }}
+          delete-branch: true
+          title: 'Update KQL Rules from Sigma Repository'
+          body: |
+            ## Automated Sigma to KQL Conversion
+
+            This PR contains updated KQL rules converted from the latest Sigma rules repository.
+
+            ### Changes
+            - Updated KQL rules from SigmaHQ/sigma repository
+            - Conversion date: ${{ github.event.repository.updated_at }}
+            - Workflow run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+
+            ### Review Checklist
+            - [ ] Review changed rules for accuracy
+            - [ ] Verify new rules are properly formatted
+            - [ ] Check for any failed conversions in workflow logs
+
+            ---
+            *This PR was automatically created by the Update Sigma Rules workflow.*
+          labels: |
+            automated
+            sigma-update
+          reviewers: ${{ github.repository_owner }}
+
+      - name: Summary
+        if: steps.check_changes.outputs.changes == 'true'
+        run: |
+          echo "✅ Pull request created with updated Sigma rules"
+          echo "📊 Check the PR for detailed changes"
+
+      - name: No changes summary
+        if: steps.check_changes.outputs.changes != 'true'
+        run: |
+          echo "ℹ️ No changes detected - rules are up to date"
diff --git a/Collection/7Zip_Compressing_Dump_Files.kql b/Collection/7Zip_Compressing_Dump_Files.kql
diff --git a/Collection/Audio_Capture_via_PowerShell.kql b/Collection/Audio_Capture_via_PowerShell.kql
diff --git a/Collection/Audio_Capture_via_SoundRecorder.kql b/Collection/Audio_Capture_via_SoundRecorder.kql
diff --git a/Collection/Automated_Collection_Command_Prompt.kql b/Collection/Automated_Collection_Command_Prompt.kql
diff --git a/Collection/Compress_Data_and_Lock_With_Password_for_Exfiltration_With_7-ZIP.kql b/Collection/Compress_Data_and_Lock_With_Password_for_Exfiltration_With_7-ZIP.kql
diff --git a/Collection/Compress_Data_and_Lock_With_Password_for_Exfiltration_With_WINZIP.kql b/Collection/Compress_Data_and_Lock_With_Password_for_Exfiltration_With_WINZIP.kql
diff --git a/Collection/Compressed_File_Creation_Via_Tar.EXE.kql b/Collection/Compressed_File_Creation_Via_Tar.EXE.kql
diff --git a/Collection/Compressed_File_Extraction_Via_Tar.EXE.kql b/Collection/Compressed_File_Extraction_Via_Tar.EXE.kql
diff --git a/Collection/Copy_From_Or_To_Admin_Share_Or_Sysvol_Folder.kql b/Collection/Copy_From_Or_To_Admin_Share_Or_Sysvol_Folder.kql
diff --git a/Collection/CredUI.DLL_Loaded_By_Uncommon_Process.kql b/Collection/CredUI.DLL_Loaded_By_Uncommon_Process.kql
diff --git a/Collection/Data_Copied_To_Clipboard_Via_Clip.EXE.kql b/Collection/Data_Copied_To_Clipboard_Via_Clip.EXE.kql
diff --git a/Collection/Esentutl_Steals_Browser_Information.kql b/Collection/Esentutl_Steals_Browser_Information.kql
diff --git a/Collection/Exchange_PowerShell_Snap-Ins_Usage.kql b/Collection/Exchange_PowerShell_Snap-Ins_Usage.kql
diff --git a/Collection/Files_Added_To_An_Archive_Using_Rar.EXE.kql b/Collection/Files_Added_To_An_Archive_Using_Rar.EXE.kql
diff --git a/Collection/Folder_Compress_To_Potentially_Suspicious_Output_Via_Compress-Archive_Cmdlet.kql b/Collection/Folder_Compress_To_Potentially_Suspicious_Output_Via_Compress-Archive_Cmdlet.kql
diff --git a/Collection/PUA_-_Mouse_Lock_Execution.kql b/Collection/PUA_-_Mouse_Lock_Execution.kql
diff --git a/Collection/Password_Protected_Compressed_File_Extraction_Via_7Zip.kql b/Collection/Password_Protected_Compressed_File_Extraction_Via_7Zip.kql
diff --git a/Collection/PowerShell_Get-Clipboard_Cmdlet_Via_CLI.kql b/Collection/PowerShell_Get-Clipboard_Cmdlet_Via_CLI.kql
diff --git a/Collection/Rar_Usage_with_Password_and_Compression_Level.kql b/Collection/Rar_Usage_with_Password_and_Compression_Level.kql
diff --git a/Collection/Recon_Information_for_Export_with_Command_Prompt.kql b/Collection/Recon_Information_for_Export_with_Command_Prompt.kql
diff --git a/Collection/Renamed_Remote_Utilities_RAT_(RURAT)_Execution.kql b/Collection/Renamed_Remote_Utilities_RAT_(RURAT)_Execution.kql
diff --git a/Collection/SQLite_Chromium_Profile_Data_DB_Access.kql b/Collection/SQLite_Chromium_Profile_Data_DB_Access.kql
diff --git a/Collection/SQLite_Firefox_Profile_Data_DB_Access.kql b/Collection/SQLite_Firefox_Profile_Data_DB_Access.kql
diff --git a/Collection/Screen_Capture_Activity_Via_Psr.EXE.kql b/Collection/Screen_Capture_Activity_Via_Psr.EXE.kql
diff --git a/Collection/Suspicious_Camera_and_Microphone_Access.kql b/Collection/Suspicious_Camera_and_Microphone_Access.kql