SPL

Sigma to Splunk (raw index)

Paste a Sigma rule, get SPL written against your raw indexed events rather than the CIM datamodel. Free, no sign-up, and it shows the field map it used.

Paste the ruleYAML in
Pick your SIEMSplunk — Raw Index · SPL
Read the reportQuery, field map, gaps

certutil

Valid Sigmaprocess_creation · windows29 lines · 968 B

Splunk — Raw IndexSPL

`sigma_windows_process_creation` EventCode=1 ((Image="*\\certutil.exe" OR OriginalFileName="CertUtil.exe") AND (CommandLine="*-encode*" OR CommandLine="*/encode*"))

1 line · 164 B2/2 conditions

Notes — not part of the query

Target: Splunk — Raw Index (SPL) — engine 1.0.1 — 2026-09-09

Profile: windows / process_creation → Splunk — Raw Index

Coverage: 2/2 conditions

Setup (sigma_windows_process_creation): This query opens with the macro `sigma_windows_process_creation`, which you define once in your Splunk instance to select the index and sourcetype for this log source — Splunk's own detection library works the same way, because index naming is per-customer. Define it as a search fragment such as `index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`; if you define it as a generating command like `| tstats`, remove the leading comment as well.

Setup: Raw Splunk field names depend on the source type and ingestion configuration. Verify the resolved fields against your Splunk event schema.

huntrule.com — sigma 7c1e0a34-2b5f-4d18-9a63-0c8b1f4e5a71 — HuntRule Team — NOASSERTION

Verify against your own telemetry before deploying.

Verify this query against your own telemetry before deploying it — a converted rule is a starting point, not a tuned detection.

No account needed for this, and none for reading the library. Every rule shows the reporting behind it, the telemetry it needs and the ATT&CK technique it covers. Sign in to keep the ones you use.

Browse the library Sign in

Conversion reportwindows / process_creation → Splunk — Raw Index3 fields mappedClean

Every condition converted cleanly to Splunk — Raw Index SPL.

Profile

Matched on product + category

Field map

Sigma field	Target field	Source
CommandLine	CommandLine	github.com
Image	Image	github.com
OriginalFileName	OriginalFileName	github.com

Coverage

selection_img — expressed
selection_cli — expressed

2 / 2 conditions expressed

Worked examples on Splunk — Raw Index

Real published rules run through the same engine as the tool above — including the ones it cannot take whole.

Base64 Encoding Via Built-In Windows Utilitywindows / process_creationClean

Sigma

title: Base64 Encoding Via Built-In Windows Utility
id: 7c1e0a34-2b5f-4d18-9a63-0c8b1f4e5a71
status: experimental
description: |
    A sample rule for the huntrule.com converter. Detects a built-in utility being asked to
    base64-encode a file, which is a common way to stage data before moving it off a host.
    The flag is written out in both its dash and slash spellings, because the utility
    accepts either and a rule that names only one misses half the invocations.
author: HuntRule Team
date: 2026-08-01
tags:
    - attack.collection
    - attack.t1560.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\certutil.exe'
        - OriginalFileName: 'CertUtil.exe'
    selection_cli:
        CommandLine|contains:
            - '-encode'
            - '/encode'
    condition: all of selection_*
falsepositives:
    - Administrative scripts that legitimately encode files
level: medium

Splunk — Raw Index · SPL

`sigma_windows_process_creation` EventCode=1 ((Image="*\\certutil.exe" OR OriginalFileName="CertUtil.exe") AND (CommandLine="*-encode*" OR CommandLine="*/encode*"))

Every condition converted cleanly to Splunk — Raw Index SPL. 2/2 conditions

PowerShell Download Cradle On The Command Linewindows / process_creationClean

Sigma

title: PowerShell Download Cradle On The Command Line
id: 1f9d4c02-6a77-4e5b-8c31-2d0af7b96e48
status: experimental
description: |
    A sample rule for the huntrule.com converter. Detects the download-and-run pattern where a
    remote payload is fetched and executed in one command. It exercises a value list under a
    single field, which every backend has to expand into its own OR form.
author: HuntRule Team
date: 2026-08-01
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_fetch:
        CommandLine|contains:
            - '.DownloadString('
            - '.DownloadFile('
            - 'Invoke-WebRequest '
            - 'Invoke-RestMethod '
    selection_run:
        CommandLine|contains:
            - '| IEX'
            - 'IEX ('
            - 'Invoke-Expression'
    condition: all of selection_*
falsepositives:
    - Installers and package managers that fetch and run their own payloads
level: high

Splunk — Raw Index · SPL

`sigma_windows_process_creation` EventCode=1 ((CommandLine="*.DownloadString(*" OR CommandLine="*.DownloadFile(*" OR CommandLine="*Invoke-WebRequest *" OR CommandLine="*Invoke-RestMethod *") AND (CommandLine="*\| IEX*" OR CommandLine="*IEX (*" OR CommandLine="*Invoke-Expression*"))

Every condition converted cleanly to Splunk — Raw Index SPL. 2/2 conditions

Registry Import With A Suspicious Pathwindows / process_creationClean

Sigma

title: Registry Import With A Suspicious Path
id: 5b3a8e91-4c26-4f70-b1d8-6e97c30a2f5d
status: experimental
description: |
    A sample rule for the huntrule.com converter. Detects a registry import whose argument does
    not look like an ordinary file path. It exercises a regular expression alongside a `not`
    filter, so the report has both a regex to check against the target's engine and a negated
    branch to place.
author: HuntRule Team
date: 2026-08-01
tags:
    - attack.defense-evasion
    - attack.t1112
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\regedit.exe'
        - OriginalFileName: 'REGEDIT.EXE'
    selection_cli:
        CommandLine|contains: '.reg'
        CommandLine|re: ':[^ \\]'
    filter_flags:
        CommandLine|contains|windash:
            - ' -e '
            - ' -a '
    condition: all of selection_* and not filter_flags
falsepositives:
    - Scripted registry maintenance
level: high

Splunk — Raw Index · SPL

`sigma_windows_process_creation` EventCode=1 ((Image="*\\regedit.exe" OR OriginalFileName="REGEDIT.EXE") AND CommandLine="*.reg*" AND (NOT (CommandLine="* -e *" OR CommandLine="* /e *" OR CommandLine="* –e *" OR CommandLine="* —e *" OR CommandLine="* ―e *" OR CommandLine="* -a *" OR CommandLine="* /a *" OR CommandLine="* –a *" OR CommandLine="* —a *" OR CommandLine="* ―a *")))
| regex CommandLine=":[^ \x5c]"

Every condition converted cleanly to Splunk — Raw Index SPL. 3/3 conditions

File Copy Through The Print Utilitywindows / process_creationClean

Sigma

title: File Copy Through The Print Utility
id: 3e6c17b8-9f40-4a2d-85e1-7b4d0c9a6f23
status: experimental
description: |
    A sample rule for the huntrule.com converter. Detects the print utility being used to copy an
    executable rather than to print. It exercises `startswith` together with `contains|all`, where
    several substrings must all appear in one field.
author: HuntRule Team
date: 2026-08-01
tags:
    - attack.defense-evasion
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\print.exe'
        CommandLine|startswith: 'print'
        CommandLine|contains|all:
            - '/D'
            - '.exe'
    filter_self:
        CommandLine|contains: 'print.exe'
    condition: selection and not filter_self
falsepositives:
    - Printing a file whose name ends in .exe
level: medium

Splunk — Raw Index · SPL

`sigma_windows_process_creation` EventCode=1 (Image="*\\print.exe" AND CommandLine="print*" AND CommandLine="*/D*" AND CommandLine="*.exe*" AND (NOT CommandLine="*print.exe*"))

Every condition converted cleanly to Splunk — Raw Index SPL. 2/2 conditions

Scheduled Task Created From A Temp Pathwindows / process_creationClean

Sigma

title: Scheduled Task Created From A Temp Path
id: 9d24a3ee-8a1b-4f26-b90f-4a71e2c85d17
status: experimental
description: |
    A sample rule for the huntrule.com converter. Detects schtasks.exe registering a task whose
    command line points into a temp directory, a common persistence shape. It exercises the
    bread-and-butter Sigma form — several selections ANDed by the condition — with no exotic
    modifiers, so it converts on every shipped target.
author: HuntRule Team
date: 2026-08-11
tags:
    - attack.persistence
    - attack.t1053.005
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\schtasks.exe'
    selection_create:
        CommandLine|contains: '/create'
    selection_path:
        CommandLine|contains:
            - '\AppData\Local\Temp\'
            - '\Windows\Temp\'
    condition: all of selection_*
falsepositives:
    - Installers registering update tasks from their extraction directory
level: medium

Splunk — Raw Index · SPL

`sigma_windows_process_creation` EventCode=1 (Image="*\\schtasks.exe" AND CommandLine="*/create*" AND (CommandLine="*\\AppData\\Local\\Temp\\*" OR CommandLine="*\\Windows\\Temp\\*"))

Every condition converted cleanly to Splunk — Raw Index SPL. 3/3 conditions

LSASS Memory Dump Via Comsvcswindows / process_creationClean

Sigma

title: LSASS Memory Dump Via Comsvcs
id: 6a95c2d4-1e08-4f7b-9d52-8c41e7b30a96
status: experimental
description: |
    A sample rule for the huntrule.com converter. Detects the comsvcs.dll MiniDump export being
    invoked through rundll32 to dump process memory, a common LSASS credential-theft technique.
    It exercises `endswith` against the image path together with `contains|all` on one field.
author: HuntRule Team
date: 2026-08-10
tags:
    - attack.credential-access
    - attack.t1003.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\rundll32.exe'
    selection_cli:
        CommandLine|contains|all:
            - 'comsvcs'
            - 'MiniDump'
    condition: all of selection_*
falsepositives:
    - Administrators legitimately capturing a process dump with comsvcs
level: high

Splunk — Raw Index · SPL

`sigma_windows_process_creation` EventCode=1 (Image="*\\rundll32.exe" AND CommandLine="*comsvcs*" AND CommandLine="*MiniDump*")

Every condition converted cleanly to Splunk — Raw Index SPL. 2/2 conditions

What to know about Splunk — Raw Index SPL

This target reads the events as your indexers stored them — `Image`, `CommandLine`, `ParentImage`, the names the Splunk Add-on for Sysmon extracts — instead of the normalised `process_path` and `process` that CIM defines. It is the sibling of the CIM target rather than a setting on it, because the two are different vocabularies over one language, and choosing between them is really a question about your estate: whether a CIM-compliant add-on is installed and mapping your sourcetypes, or whether you hunt over the events as they were indexed.

SPL resolves fields at search time, so a name this target cannot map is dropped rather than rejected, and the report says which ones went. A dropped predicate makes the query broader, never narrower, and that is the failure mode worth knowing about before you deploy. Raw field names are a property of your ingestion rather than of Splunk itself, so every query carries a note asking you to check them against your own event schema.

The raw corpus has been read for the log sources most rules target: Windows process creation, PowerShell script blocks, image and driver loads, and the Windows Security and System channel families. A profile outside that set has no raw rows, and the converter refuses rather than guessing at a field name — the same answer every other target gives for a log source its corpus has not covered.

Splunk — Raw Index SPL reference →

How it works

Step 1
Paste the rule
Drop a Sigma rule into the left pane, or open a .yml file. The tool says what it thinks you pasted before anything is sent.
Step 2
Pick your SIEM
Choose the target dialect. Every shipped target is free and none of them are behind a sign-up.
Step 3
Read the report
The query comes back with the log-source profile that was used, every field it renamed, and anything the target could not express.
Step 4
Verify, then deploy
Run it against your own telemetry in audit mode before it alerts on anything.

Questions

Paste the Sigma rule into the tool on this page and press Convert. It returns SPL for Splunk — Raw Index, the log-source profile it matched, the field map it applied, and anything Splunk — Raw Index cannot express. Free, no sign-up.

No — that is what separates it from the CIM target. This one is written against the field names your indexers wrote, the ones the Splunk Add-on for Sysmon extracts, so it is the target to pick when no CIM-compliant add-on is normalising your sourcetypes.

Almost always a field name. Raw names come from your ingestion rather than from Splunk, so `Image` on one estate can be `process_image` on another. Check the names in the query against a sample event, and check the `EventCode` the query scopes to is the one your channel actually writes.

It will run if your field names match the profile shown in the report. Whether it matches the right events depends on your own telemetry, so verify it before deploying. The coverage figure tells you how much of the rule made it into the query.

The other pair

The same tool, with a different target preselected.

Every rule in the detection catalog is written in Sigma, so any of them converts to Splunk — Raw Index here.