YARA-L 2.0

Sigma to Google Security Operations

Paste a Sigma rule, get a Google SecOps UDM Search query with every UDM field mapping shown. Free, no sign-up.

certutil

title: Base64 Encoding Via Built-In Windows Utility
id: 7c1e0a34-2b5f-4d18-9a63-0c8b1f4e5a71
status: experimental
description: |
    A sample rule for the huntrule.com converter. Detects a built-in utility being asked to
    base64-encode a file, which is a common way to stage data before moving it off a host.
    It exercises the `windash` modifier, where one flag has to be matched in both its dash
    and slash spellings.
author: HuntRule Team
date: 2026-08-01
tags:
    - attack.collection
    - attack.t1560.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\certutil.exe'
        - OriginalFileName: 'CertUtil.exe'
    selection_cli:
        CommandLine|contains|windash: '-encode'
    condition: all of selection_*
falsepositives:
    - Administrative scripts that legitimately encode files
level: medium
license: DRL-1.1

28 lines · 906 B

Google Security Operations

// Target: Google Security Operations (YARA-L 2.0) — engine 1.0.1 — 2026-08-07
// Profile: windows / process_creation → Google Security Operations
// Coverage: 2/2 conditions
// Verify against your own telemetry before deploying.

// huntrule.com — sigma 7c1e0a34-2b5f-4d18-9a63-0c8b1f4e5a71 — HuntRule Team — DRL-1.1
metadata.event_type = "PROCESS_LAUNCH" AND ((target.process.file.full_path = /\\certutil\.exe$/ nocase OR target.process.file.exif_info.original_file = "CertUtil.exe" nocase) AND (target.process.command_line = /-encode/ nocase OR target.process.command_line = /\/encode/ nocase OR target.process.command_line = /–encode/ nocase OR target.process.command_line = /—encode/ nocase OR target.process.command_line = /―encode/ nocase))

2 lines · 528 B2/2 conditions

Verify this query against your own telemetry before deploying it — a converted rule is a starting point, not a tuned detection.

Conversion reportwindows / process_creation → Google Security Operations3 fields mappedClean

Every condition converted cleanly to Google Security Operations YARA-L 2.0.

Profile

Matched on product + category

Field map

Sigma field	Target field	Source
CommandLine	target.process.command_line	cloud.google.com
Image	target.process.file.full_path	cloud.google.com
OriginalFileName	target.process.file.exif_info.original_file	cloud.google.com

Coverage

selection_img — expressed
selection_cli — expressed

2 / 2 conditions expressed

Worked examples on Google Security Operations

Real published rules run through the same engine as the tool above — including the ones it cannot take whole.

Base64 Encoding Via Built-In Windows Utilitywindows / process_creationClean

Sigma

title: Base64 Encoding Via Built-In Windows Utility
id: 7c1e0a34-2b5f-4d18-9a63-0c8b1f4e5a71
status: experimental
description: |
    A sample rule for the huntrule.com converter. Detects a built-in utility being asked to
    base64-encode a file, which is a common way to stage data before moving it off a host.
    It exercises the `windash` modifier, where one flag has to be matched in both its dash
    and slash spellings.
author: HuntRule Team
date: 2026-08-01
tags:
    - attack.collection
    - attack.t1560.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\certutil.exe'
        - OriginalFileName: 'CertUtil.exe'
    selection_cli:
        CommandLine|contains|windash: '-encode'
    condition: all of selection_*
falsepositives:
    - Administrative scripts that legitimately encode files
level: medium
license: DRL-1.1

Google Security Operations · YARA-L 2.0

// huntrule.com — sigma 7c1e0a34-2b5f-4d18-9a63-0c8b1f4e5a71 — HuntRule Team — DRL-1.1
metadata.event_type = "PROCESS_LAUNCH" AND ((target.process.file.full_path = /\\certutil\.exe$/ nocase OR target.process.file.exif_info.original_file = "CertUtil.exe" nocase) AND (target.process.command_line = /-encode/ nocase OR target.process.command_line = /\/encode/ nocase OR target.process.command_line = /–encode/ nocase OR target.process.command_line = /—encode/ nocase OR target.process.command_line = /―encode/ nocase))

Every condition converted cleanly to Google Security Operations YARA-L 2.0. 2/2 conditions

PowerShell Download Cradle On The Command Linewindows / process_creationClean

Sigma

title: PowerShell Download Cradle On The Command Line
id: 1f9d4c02-6a77-4e5b-8c31-2d0af7b96e48
status: experimental
description: |
    A sample rule for the huntrule.com converter. Detects the download-and-run pattern where a
    remote payload is fetched and executed in one command. It exercises a value list under a
    single field, which every backend has to expand into its own OR form.
author: HuntRule Team
date: 2026-08-01
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_fetch:
        CommandLine|contains:
            - '.DownloadString('
            - '.DownloadFile('
            - 'Invoke-WebRequest '
            - 'Invoke-RestMethod '
    selection_run:
        CommandLine|contains:
            - '| IEX'
            - 'IEX ('
            - 'Invoke-Expression'
    condition: all of selection_*
falsepositives:
    - Installers and package managers that fetch and run their own payloads
level: high
license: DRL-1.1

Google Security Operations · YARA-L 2.0

// huntrule.com — sigma 1f9d4c02-6a77-4e5b-8c31-2d0af7b96e48 — HuntRule Team — DRL-1.1
metadata.event_type = "PROCESS_LAUNCH" AND ((target.process.command_line = /\.DownloadString\(/ nocase OR target.process.command_line = /\.DownloadFile\(/ nocase OR target.process.command_line = /Invoke-WebRequest / nocase OR target.process.command_line = /Invoke-RestMethod / nocase) AND (target.process.command_line = /\| IEX/ nocase OR target.process.command_line = /IEX \(/ nocase OR target.process.command_line = /Invoke-Expression/ nocase))

Every condition converted cleanly to Google Security Operations YARA-L 2.0. 2/2 conditions

Registry Import With A Suspicious Pathwindows / process_creationClean

Sigma

title: Registry Import With A Suspicious Path
id: 5b3a8e91-4c26-4f70-b1d8-6e97c30a2f5d
status: experimental
description: |
    A sample rule for the huntrule.com converter. Detects a registry import whose argument does
    not look like an ordinary file path. It exercises a regular expression alongside a `not`
    filter, so the report has both a regex to check against the target's engine and a negated
    branch to place.
author: HuntRule Team
date: 2026-08-01
tags:
    - attack.defense-evasion
    - attack.t1112
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\regedit.exe'
        - OriginalFileName: 'REGEDIT.EXE'
    selection_cli:
        CommandLine|contains: '.reg'
        CommandLine|re: ':[^ \\]'
    filter_flags:
        CommandLine|contains|windash:
            - ' -e '
            - ' -a '
    condition: all of selection_* and not filter_flags
falsepositives:
    - Scripted registry maintenance
level: high
license: DRL-1.1

Google Security Operations · YARA-L 2.0

// huntrule.com — sigma 5b3a8e91-4c26-4f70-b1d8-6e97c30a2f5d — HuntRule Team — DRL-1.1
metadata.event_type = "PROCESS_LAUNCH" AND ((target.process.file.full_path = /\\regedit\.exe$/ nocase OR target.process.file.exif_info.original_file = "REGEDIT.EXE" nocase) AND target.process.command_line = /\.reg/ nocase AND target.process.command_line = /:[^ \\]/ AND (NOT (target.process.command_line = / -e / nocase OR target.process.command_line = / \/e / nocase OR target.process.command_line = / –e / nocase OR target.process.command_line = / —e / nocase OR target.process.command_line = / ―e / nocase OR target.process.command_line = / -a / nocase OR target.process.command_line = / \/a / nocase OR target.process.command_line = / –a / nocase OR target.process.command_line = / —a / nocase OR target.process.command_line = / ―a / nocase)))

Every condition converted cleanly to Google Security Operations YARA-L 2.0. 3/3 conditions

File Copy Through The Print Utilitywindows / process_creationClean

Sigma

title: File Copy Through The Print Utility
id: 3e6c17b8-9f40-4a2d-85e1-7b4d0c9a6f23
status: experimental
description: |
    A sample rule for the huntrule.com converter. Detects the print utility being used to copy an
    executable rather than to print. It exercises `startswith` together with `contains|all`, where
    several substrings must all appear in one field.
author: HuntRule Team
date: 2026-08-01
tags:
    - attack.defense-evasion
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\print.exe'
        CommandLine|startswith: 'print'
        CommandLine|contains|all:
            - '/D'
            - '.exe'
    filter_self:
        CommandLine|contains: 'print.exe'
    condition: selection and not filter_self
falsepositives:
    - Printing a file whose name ends in .exe
level: medium
license: DRL-1.1

Google Security Operations · YARA-L 2.0

// huntrule.com — sigma 3e6c17b8-9f40-4a2d-85e1-7b4d0c9a6f23 — HuntRule Team — DRL-1.1
metadata.event_type = "PROCESS_LAUNCH" AND (target.process.file.full_path = /\\print\.exe$/ nocase AND target.process.command_line = /^print/ nocase AND target.process.command_line = /\/D/ nocase AND target.process.command_line = /\.exe/ nocase AND (NOT target.process.command_line = /print\.exe/ nocase))

Every condition converted cleanly to Google Security Operations YARA-L 2.0. 2/2 conditions

What to know about Google Security Operations YARA-L 2.0

Google Security Operations uses the Unified Data Model, so converting a Sigma rule is more than changing query syntax. The converter scopes each query to the UDM event type that represents the rule's log source — for example, process creation becomes PROCESS_LAUNCH and a network connection becomes NETWORK_CONNECTION — then maps each Sigma field to a documented UDM path.

YARA-L 2.0 has no wildcard or substring operator over UDM fields. The converter therefore emits RE2 regular expressions for Sigma contains, startswith and endswith modifiers, preserves Sigma's case-insensitive default with nocase, and refuses a regex feature RE2 cannot represent rather than returning a query that will not compile.

This first surface is UDM Search: a query you can run and validate against your own normalized telemetry. A deployable YARA-L detection rule has a separate lifecycle — metadata, alerting and scheduling — and will be added as an artifact rather than pretending that a search query is already a production alert.

Google Security Operations YARA-L 2.0 reference →

How it works

Step 1
Paste the rule
Drop a Sigma rule into the left pane, or open a .yml file. The tool says what it thinks you pasted before anything is sent.
Step 2
Pick your SIEM
Choose the target dialect. Every shipped target is free and none of them are behind a sign-up.
Step 3
Read the report
The query comes back with the log-source profile that was used, every field it renamed, and anything the target could not express.
Step 4
Verify, then deploy
Run it against your own telemetry in audit mode before it alerts on anything.

Questions

Paste the Sigma rule into the tool on this page and press Convert. It returns YARA-L 2.0 for Google Security Operations, the log-source profile it matched, the field map it applied, and anything Google Security Operations cannot express. Free, no sign-up.

Not yet. This surface emits a UDM Search query you can run against normalized telemetry. A deployable YARA-L detection needs its own rule metadata, alerting and lifecycle configuration, so it is deliberately not presented as a ready-to-deploy alert.

Google UDM is a typed schema and this target is strict. If a Sigma field has no verified UDM equivalent, the converter refuses rather than silently broadening the hunt. The report identifies the field so you can decide whether to rewrite it for your own telemetry.

It will run if your field names match the profile shown in the report. Whether it matches the right events depends on your own telemetry, so verify it before deploying. The coverage figure tells you how much of the rule made it into the query.

The other pair

The same tool, with a different target preselected.

Every rule in the detection catalog is written in Sigma, so any of them converts to Google Security Operations here.