Phoenix Studio
Convert indexed Sigma rules into analyst-ready detections.
This studio is built around Phoenix's own rule corpus, not a blank editor. Search by title or rule id, choose a live sigma-cli backend, then reveal pipelines only when you actually need them.
Indexed Rules
3,707
Ready to search
Backends
17
Live from sigconverter.io
CLI Versions
10
Newest: 2.0.2
Translation Workspace
Shape the rule before it leaves Phoenix
Tune Translation
Active Rule
Suspicious Environment Variable Has Been Registered
Target Profile
Splunk
Splunk SPL & tstats data model queries
Format Mode
Default
Plain SPL queries
Conversion Output
Suspicious Environment Variable Has Been Registered
Using Splunk · Default · sigma-cli 2.0.2
Translation controls
Adjust the rule on the left, then regenerate when you want a fresh backend-native query.
BackendSplunkFormatDefaultVersion2.0.2
title: Suspicious Environment Variable Has Been Registered
id: 966315ef-c5e1-4767-ba25-fce9c8de3660
status: test
description: Detects the creation of user-specific or system-wide environment variables via the registry. Which contains suspicious commands and strings
references:
- https://infosec.exchange/@sbousseaden/109542254124022664
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-20
modified: 2023-08-17
tags:
- attack.defense-evasion
- attack.persistence
logsource:
product: windows
category: registry_set
detection:
selection_main:
TargetObject|contains: '\Environment\'
selection_details:
- Details:
- 'powershell'
- 'pwsh'
- Details|contains:
# Add more suspicious strings in env variables below
- '\AppData\Local\Temp\'
- 'C:\Users\Public\'
# Base64 MZ Header
- 'TVqQAAMAAAAEAAAA' # MZ..........
- 'TVpQAAIAAAAEAA8A'
- 'TVqAAAEAAAAEABAA'
- 'TVoAAAAAAAAAAAAA'
- 'TVpTAQEAAAAEAAAA'
# Base64 Invoke- (UTF-8)
- 'SW52b2tlL'
- 'ludm9rZS'
- 'JbnZva2Ut'
# Base64 Invoke- (UTF-16LE)
- 'SQBuAHYAbwBrAGUALQ'
- 'kAbgB2AG8AawBlAC0A'
- 'JAG4AdgBvAGsAZQAtA'
- Details|startswith: # https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639
- 'SUVY'
- 'SQBFAF'
- 'SQBuAH'
- 'cwBhA'
- 'aWV4'
- 'aQBlA'
- 'R2V0'
- 'dmFy'
- 'dgBhA'
- 'dXNpbm'
- 'H4sIA'
- 'Y21k'
- 'cABhAH'
- 'Qzpc'
- 'Yzpc'
condition: all of selection_*
falsepositives:
- Unknown
level: high
CLI command
Copy the exact command to reproduce this translation locally.
sigma convert --without-pipeline -t splunk -f default rules/windows/registry/registry_set/registry_set_suspicious_env_variables.yml