First Three Rules
Company: Nur Integrator LLP
Briefing
Nur Integrator LLP is an IT services company. You have been asked to write detection rules for the SIEM. The format is Sigma: a common language later translated into any system's query.
The day's data is deliberately mixed. Next to the events you need to catch lie similar but legitimate ones: administrators use RDP from the office, services are installed from Program Files, people are added to ordinary groups. A rule that catches everything is a bad rule.
Every rule is run against this data as soon as you submit it. You will see how many target events it caught and how many extra ones it hit. It passes when everything is caught and nothing extra. Refine and resubmit — attempts are unlimited.
A reference shape: title: Name logsource: product: windows detection: selection: event.code: 4624 filter: source.ip|startswith: '10.' condition: selection and not filter
Artifacts
The same data as files for real tools: open in Wireshark or Excel, or load into Elastic. The answers match — it is the same data.
| @timestamp | event.code | host.name | user.name | source.ip | process.name |
|---|---|---|---|---|---|
| 2026-03-06T04:01:41Z | 1 | NUR-WS-16 | a.zhuma | — | powerpnt.exe |
| 2026-03-06T04:02:23Z | 4624 | NUR-WS-16 | a.zhuma | 10.90.8.51 | — |
| 2026-03-06T04:04:04Z | 1 | NUR-WS-13 | e.beketov | — | powerpnt.exe |
| 2026-03-06T04:07:24Z | 4624 | NUR-WS-50 | a.serik | 10.90.8.68 | — |
| 2026-03-06T04:22:39Z | 4625 | NUR-WS-16 | a.zhuma | 10.90.8.97 | — |
| 2026-03-06T04:26:39Z | 4624 | NUR-WS-16 | a.zhuma | 10.90.8.97 | — |
| 2026-03-06T04:33:01Z | 4624 | NUR-WS-50 | a.serik | 10.90.8.57 | — |
| 2026-03-06T04:33:13Z | 4624 | NUR-WS-15 | r.tleubaev | 10.90.8.42 | — |
| 2026-03-06T04:34:55Z | 4624 | NUR-WS-13 | e.beketov | 10.90.8.45 | — |
| 2026-03-06T05:37:27Z | 1 | NUR-WS-50 | a.serik | — | powershell.exe |
| 2026-03-06T05:41:26Z | 4624 | NUR-WS-15 | m.nurpeis | 10.90.8.80 | — |
| 2026-03-06T06:03:06Z | 1 | NUR-WS-50 | a.serik | — | cmd.exe |
| 2026-03-06T06:05:29Z | 1 | NUR-WS-13 | e.beketov | — | winword.exe |
| 2026-03-06T06:08:07Z | 1 | NUR-WS-50 | a.serik | — | powerpnt.exe |
| 2026-03-06T06:09:29Z | 4624 | NUR-WS-13 | e.beketov | 10.90.8.103 | — |
| 2026-03-06T06:13:42Z | 4624 | NUR-WS-15 | r.tleubaev | 10.90.8.86 | — |
| 2026-03-06T06:22:43Z | 4625 | NUR-WS-43 | d.abdrah | 10.90.8.36 | — |
| 2026-03-06T06:26:43Z | 4624 | NUR-WS-43 | d.abdrah | 10.90.8.36 | — |
| 2026-03-06T06:40:00Z | 4732 | NUR-DC-01 | a.zhuma | — | — |
| 2026-03-06T06:42:38Z | 4624 | NUR-WS-57 | s.isaeva | 10.90.8.92 | — |
| 2026-03-06T06:56:47Z | 4624 | NUR-SRV-APP | a.zhuma | 10.90.8.58 | — |
| 2026-03-06T07:00:00Z | 7045 | NUR-SRV-APP | a.zhuma | — | — |
| 2026-03-06T07:03:15Z | 4624 | NUR-WS-15 | r.tleubaev | 10.90.8.108 | — |
| 2026-03-06T07:04:39Z | 4625 | NUR-WS-15 | m.nurpeis | 10.90.8.41 | — |
| 2026-03-06T07:05:39Z | 4624 | NUR-WS-15 | m.nurpeis | 10.90.8.41 | — |
| 2026-03-06T07:06:39Z | 4624 | NUR-WS-50 | a.serik | 10.90.8.54 | — |
| 2026-03-06T07:09:32Z | 1 | NUR-WS-42 | t.kaliev | — | cmd.exe |
| 2026-03-06T07:23:13Z | 4624 | NUR-WS-15 | m.nurpeis | 10.90.8.96 | — |
| 2026-03-06T07:26:00Z | 4720 | NUR-DC-01 | a.zhuma | — | — |
| 2026-03-06T07:33:01Z | 4634 | NUR-WS-50 | a.serik | — | — |
| 2026-03-06T07:33:13Z | 4634 | NUR-WS-15 | r.tleubaev | — | — |
| 2026-03-06T07:44:02Z | 4624 | NUR-SRV-APP | a.zhuma | 10.90.8.115 | — |
| 2026-03-06T07:54:00Z | 4698 | NUR-DC-01 | a.serik | — | — |
| 2026-03-06T07:59:01Z | 1 | NUR-WS-15 | m.nurpeis | — | cmd.exe |
| 2026-03-06T08:01:20Z | 4624 | NUR-SRV-APP | a.zhuma | 10.90.8.85 | — |
| 2026-03-06T08:03:28Z | 4624 | NUR-WS-13 | e.beketov | 10.90.8.66 | — |
| 2026-03-06T08:17:31Z | 1 | NUR-WS-13 | e.beketov | — | excel.exe |
| 2026-03-06T08:20:00Z | 7045 | NUR-DC-01 | a.zhuma | — | — |
| 2026-03-06T08:23:56Z | 4624 | NUR-WS-15 | m.nurpeis | 10.90.8.52 | — |
| 2026-03-06T08:29:26Z | 4624 | NUR-WS-15 | m.nurpeis | 10.90.8.50 | — |
| 2026-03-06T08:46:09Z | 4624 | NUR-WS-15 | r.tleubaev | 10.90.8.64 | — |
| 2026-03-06T08:57:53Z | 1 | NUR-WS-50 | a.serik | — | cmd.exe |
| 2026-03-06T09:07:24Z | 4634 | NUR-WS-50 | a.serik | — | — |
| 2026-03-06T09:10:00Z | 4732 | NUR-DC-01 | a.zhuma | — | — |
| 2026-03-06T09:17:26Z | 4625 | NUR-WS-13 | e.beketov | 10.90.8.102 | — |
| 2026-03-06T09:17:42Z | 4624 | NUR-WS-13 | e.beketov | 10.90.8.46 | — |
| 2026-03-06T09:20:26Z | 4624 | NUR-WS-13 | e.beketov | 10.90.8.102 | — |
| 2026-03-06T09:29:33Z | 4624 | NUR-WS-13 | e.beketov | 10.90.8.90 | — |
| 2026-03-06T09:36:54Z | 4624 | NUR-WS-43 | d.abdrah | 10.90.8.57 | — |
| 2026-03-06T09:42:38Z | 4634 | NUR-WS-57 | s.isaeva | — | — |
| 2026-03-06T09:43:13Z | 4624 | NUR-WS-15 | m.nurpeis | 10.90.8.90 | — |
| 2026-03-06T09:44:11Z | 1 | NUR-WS-57 | s.isaeva | — | excel.exe |
| 2026-03-06T09:49:54Z | 1 | NUR-WS-16 | a.zhuma | — | powershell.exe |
| 2026-03-06T09:54:29Z | 1 | NUR-WS-15 | m.nurpeis | — | winword.exe |
| 2026-03-06T10:00:04Z | 4624 | NUR-SRV-APP | a.zhuma | 10.90.8.101 | — |
| 2026-03-06T10:02:41Z | 4624 | NUR-WS-42 | t.kaliev | 10.90.8.96 | — |
| 2026-03-06T10:08:36Z | 4624 | NUR-SRV-APP | a.zhuma | 10.90.8.44 | — |
| 2026-03-06T10:16:41Z | 4624 | NUR-WS-42 | t.kaliev | 10.90.8.52 | — |
| 2026-03-06T10:19:08Z | 4624 | NUR-WS-15 | m.nurpeis | 10.90.8.118 | — |
| 2026-03-06T10:26:59Z | 4624 | NUR-WS-42 | t.kaliev | 10.90.8.41 | — |
Questions
0/3 · 0/90 points
Log in to save your progress and appear on the leaderboard.
Write a rule that catches successful remote-desktop logons from external addresses — and does not catch the same logons from the internal network.
Format: A Sigma rule in YAML · 30 points
Write a rule that catches a command shell launched from an office application: cmd or powershell whose parent is winword, excel or powerpnt.
Format: A Sigma rule in YAML · 30 points
Write a rule for clearing the audit log.
Format: A Sigma rule in YAML · 30 points