Detect Linux Reconnaissance in Microsoft Sentinel with Sigma-to-KQL Conversion

How It Works

The showcased feature translates a Linux-based Sigma rule — specifically targeting the sysinfo system call — into Microsoft Sentinel KQL. This system call provides an attacker with system metadata like uptime, memory usage, and load averages — commonly abused during reconnaissance.

Left Panel – Sigma Rule:

• Targets Linux auditd telemetry for syscall sysinfo.
  
• Includes specific auditd rule configuration (-a always,exit ... -S sysinfo) for rule applicability.
  
• Applies filtering to exclude benign admin processes like splunkd.

Explore Uncoder AI

Right Panel – Microsoft Sentinel Query:

Uncoder AI converts the Sigma logic into Microsoft Sentinel’s Syslog-based KQL:

Syslog

|where ((SyslogMessage =~ 'SYSCALL' and SyslogMessage =~ 'sysinfo') and not (SyslogMessage contains '/bin/splunkd'))

This query mirrors the Sigma rule’s logic:

• Filters for syscall events containing sysinfo
  
• Excludes known benign noise (/bin/splunkd)
  
• Uses exact and case-insensitive string comparisons for precision
  

Why It’s Innovative

Mapping Linux-specific syscall detection from Sigma to Microsoft Sentinel requires:

• Translating Sigma’s auditd abstraction into raw syslog patterns
  
• Understanding platform logging nuances (e.g., KQL field structures)
  
• Preserving semantic filters (e.g., excluding Splunk agent activity)
  

Uncoder AI handles this automatically through:

• LLM-powered parsing of Sigma logic
  
• Schema-aware mapping to Sentinel Syslog fields
  
• Operator fidelity and filter preservation
  

This level of cross-platform detection logic normalization is typically time-intensive when done manually.

Operational Value

Security teams gain:

• Broader threat coverage across hybrid cloud + Linux infrastructure monitored via Sentinel
  
• No need for manual KQL scripting, reducing errors and delays
  
• Tactical reconnaissance detection with real-world utility against early-stage attacks
  
• Cleaner signals by preserving custom filters from Sigma into KQL
  

Uncoder AI empowers detection engineers to operationalize Linux audit rules in cloud-native SIEMs like Microsoft Sentinel — all in seconds.

Explore Uncoder AI

The post Detect Linux Reconnaissance in Microsoft Sentinel with Sigma-to-KQL Conversion appeared first on SOC Prime.