Detection rule translator

Paste a rule in any format and get every other dialect at once — Sigma, Splunk SPL, Microsoft Sentinel KQL, Elastic ES|QL, and Google Chronicle YARA-L2 / UDM. Deterministic and computed entirely in your browser.

Source format

Splunk SPL

index=* sourcetype=WinEventLog
| search title: Suspicious PowerShell download cradle
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    process_name|endswith: '\\powershell.exe'
    process_path|contains:
      - 'DownloadString'
      - 'IEX'
  condition: selection

Microsoft Sentinel KQL

SecurityEvent
| where title: Suspicious PowerShell download cradle
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    NewProcessName|endswith: '\\powershell.exe'
    CommandLine|contains:
      - 'DownloadString'
      - 'IEX'
  condition: selection

Elastic ES|QL

FROM logs-*
| WHERE title: Suspicious PowerShell download cradle
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    process.executable|endswith: '\\powershell.exe'
    process.command_line|contains:
      - 'DownloadString'
      - 'IEX'
  condition: selection

Google Chronicle YARA-L2

rule translated_rule {
  meta:
    author = "AiSOC"
  condition:
    title: Suspicious PowerShell download cradle
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    principal.process.file.full_path|endswith: '\\powershell.exe'
    principal.process.command_line|contains:
      - 'DownloadString'
      - 'IEX'
  condition: selection
}

Google Chronicle UDM Search

// Chronicle UDM Search
title: Suspicious PowerShell download cradle
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    principal.process.file.full_path|endswith: '\\powershell.exe'
    principal.process.command_line|contains:
      - 'DownloadString'
      - 'IEX'
  condition: selection

⚠ Deterministic field-map translation, computed in your browser (no server, no LLM). Review field names before deploying.