Splunk Rule Conversion

Overview

Convert Splunk SPL detection rules to Microsoft Sentinel KQL, Google SecOps YARA-L 2.0, and CrowdStrike CQL. Includes field mappings, syntax patterns, and detection quality improvements.

Quick Reference

SPL to Microsoft Sentinel KQL

Syntax Mapping

Data Table Mapping

Windows EventID Reference

KQL Detection Quality Guidelines

When converting, enhance detections with:

1. Avoid Low-and-Slow Blindness

``kql // Create complementary rules with different thresholds // High threshold for immediate alert // Low threshold for hunting/investigation ``

1. Address Distributed Attacks

``kql // Aggregate by user across ALL devices, not per-device SecurityEvent | where EventID == 4625 | summarize FailedLogons = count() by TargetUserName, bin(TimeGenerated, 1h) | where FailedLogons > 10 ``

1. Correlate Failures with Success

``kql // Failed attempts followed by success = potential compromise let failures = SecurityEvent | where EventID == 4625; let successes = SecurityEvent | where EventID == 4624; failures | join kind=inner (successes) on TargetUserName | where TimeGenerated1 between (TimeGenerated .. TimeGenerated + 1h) ``

1. Cover Cloud Identity

``kql // Include non-interactive sign-ins (often missed) union SigninLogs, AADNonInteractiveUserSignInLogs | where ResultType != 0 ``

1. Device Management Context

``kql // CRITICAL: Use LEFT OUTER JOIN for device tables (not all devices managed) SecurityEvent | join kind=leftouter (DeviceInfo) on DeviceId ``

1. Geographic Anomaly Detection

``kql SigninLogs | extend Country = tostring(LocationDetails.countryOrRegion) | summarize Countries = makeset(Country) by UserPrincipalName, bin(TimeGenerated, 1h) | where arraylength(Countries) > 1 ``

Example Conversion: Brute Force Detection

Original SPL:

index=windows sourcetype=WinEventLog:Security EventCode=4625
| stats count as failed_attempts by Account_Name, src_ip
| where failed_attempts > 5

Converted KQL:

let timeframe = 1h;
let threshold = 5;
SecurityEvent
| where TimeGenerated > ago(timeframe)
| where EventID == 4625
| extend AccountName = TargetUserName
| extend SourceIP = IpAddress
| summarize FailedAttempts = count() by AccountName, SourceIP, bin(TimeGenerated, 5m)
| where FailedAttempts > threshold
| project TimeGenerated, AccountName, SourceIP, FailedAttempts

SPL to Google SecOps YARA-L 2.0

YARA-L 2.0 Rule Structure

rule rule_name {
  meta:
    author = "Security Team"
    description = "Rule description"
    severity = "HIGH"  // INFO, LOW, MEDIUM, HIGH, CRITICAL
    mitre_attack_tactic = "Tactic Name"
    mitre_attack_technique = "TXXXX"

  events:
    // Event matching conditions
    $event.metadata.event_type = "PROCESS_LAUNCH"
    $event.principal.process.file.full_path = /pattern/i

  match:
    // Grouping for aggregation (optional)
    $event.principal.user.userid over 5m

  outcome:
    // Calculated fields (optional)
    $count = count($event)

  condition:
    // Rule trigger conditions
    $event and $count > 5
}

CRITICAL YARA-L Requirements

1. Risk Score MUST be static integer

```yaral // CORRECT risk_score = 85

// WRONG - will fail risk_score = $severity * 10 ```

1. No if() in aggregation functions

```yaral // WRONG $count = count_distinct(if($e.severity > 5, $e.user))

// CORRECT - use separate rules or filter in events section ```

1. Match section indentation: exactly 2 spaces

``yaral match: $user over 5m // 2 spaces, not tab ``

1. Placeholder variables use $ prefix

``yaral $e.metadata.event_type // event variable $user over 5m // match variable ``

UDM Field Mapping

UDM Event Types

Example Conversion: Suspicious PowerShell

Original SPL:

index=windows sourcetype=WinEventLog:Security EventCode=4688
| search New_Process_Name="*powershell.exe"
| search (Process_Command_Line="*-enc*" OR Process_Command_Line="*-encodedcommand*")
| stats count by Account_Name, Workstation_Name

Converted YARA-L:

rule suspicious_encoded_powershell {
  meta:
    author = "Security Team"
    description = "Detects encoded PowerShell execution"
    severity = "HIGH"
    mitre_attack_tactic = "Execution"
    mitre_attack_technique = "T1059.001"

  events:
    $process.metadata.event_type = "PROCESS_LAUNCH"
    $process.metadata.product_event_type = "4688"
    $process.principal.process.file.full_path = /powershell\.exe$/i
    $process.principal.process.command_line = /\-[eE]nc|\-[eE]ncodedCommand/
    $user = $process.principal.user.userid
    $host = $process.principal.hostname

  match:
    $user, $host over 5m

  outcome:
    $execution_count = count($process)
    $risk_score = 75

  condition:
    $process
}

SPL to CrowdStrike CQL

CQL Syntax Mapping

CrowdStrike Event Types

Platform Filtering

// Windows only
event_platform=Win

// macOS only
event_platform=Mac

// Linux only
event_platform=Lin

CQL Field Reference

Example Conversion: Network Beaconing

Original SPL:

index=firewall sourcetype=pan:traffic
| stats count by src_ip, dest_ip, dest_port
| where count > 100
| sort -count

Converted CQL:

event_simpleName=NetworkConnectIP4
| groupBy([LocalAddressIP4, RemoteAddressIP4, RemotePort])
| count(aid, as=connection_count)
| test(connection_count > 100)
| sort(connection_count, order=desc)
| select([LocalAddressIP4, RemoteAddressIP4, RemotePort, connection_count])

Conversion Workflow

Step 1: Analyze Source Rule

1. Identify data sources (index, sourcetype)
2. Map fields to target schema
3. Understand aggregation logic
4. Note time windows and thresholds

Step 2: Translate Core Logic

1. Convert search conditions
2. Map aggregation functions
3. Adapt field names
4. Adjust time syntax

Step 3: Enhance Detection Quality

1. Add complementary low-threshold variants
2. Include distributed attack patterns
3. Add success correlation for auth failures
4. Cover cloud identity sources
5. Add geographic anomaly detection

Step 4: Validate and Test

1. Syntax validation
2. Test with sample data
3. Tune thresholds
4. Document false positive patterns

MITRE ATT&CK Mapping Reference

Include MITRE mapping in converted rules:

Common Conversion Patterns

Authentication Monitoring

SPL:

index=windows EventCode=4625 | stats count by Account_Name | where count > 10

KQL:

SecurityEvent
| where EventID == 4625
| summarize FailedCount = count() by TargetUserName
| where FailedCount > 10

YARA-L:

rule brute_force_detection {
  meta:
    severity = "MEDIUM"
  events:
    $fail.metadata.event_type = "USER_LOGIN"
    $fail.security_result.action = "BLOCK"
    $user = $fail.target.user.userid
  match:
    $user over 10m
  outcome:
    $fail_count = count($fail)
  condition:
    $fail and $fail_count > 10
}

CQL:

event_simpleName=UserLogon LogonType=10
| groupBy([UserName])
| count(aid, as=logon_attempts)
| test(logon_attempts > 10)

Confidence Scoring

When converting rules, assess confidence:

Factors affecting confidence:

• Field availability in target platform
• Aggregation complexity
• Multi-event correlation
• Custom field extractions
• Platform-specific features