Convert Sigma YAML to Microsoft Sentinel KQL

Free, in-browser Sigma YAML → Microsoft Sentinel KQL detection-rule converter. Paste your Sigma YAML rule below; the Microsoft Sentinel KQL equivalent (and every other dialect) is generated instantly. Deterministic, open source, no upload.

Source format

Splunk SPL

index=* sourcetype=WinEventLog
| search title: Suspicious PowerShell download cradle
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    process_name|endswith: '\\powershell.exe'
    process_path|contains:
      - 'DownloadString'
      - 'IEX'
  condition: selection

Microsoft Sentinel KQL

SecurityEvent
| where title: Suspicious PowerShell download cradle
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    NewProcessName|endswith: '\\powershell.exe'
    CommandLine|contains:
      - 'DownloadString'
      - 'IEX'
  condition: selection

Elastic ES|QL

FROM logs-*
| WHERE title: Suspicious PowerShell download cradle
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    process.executable|endswith: '\\powershell.exe'
    process.command_line|contains:
      - 'DownloadString'
      - 'IEX'
  condition: selection

Google Chronicle YARA-L2

rule translated_rule {
  meta:
    author = "AiSOC"
  condition:
    title: Suspicious PowerShell download cradle
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    principal.process.file.full_path|endswith: '\\powershell.exe'
    principal.process.command_line|contains:
      - 'DownloadString'
      - 'IEX'
  condition: selection
}

Google Chronicle UDM Search

// Chronicle UDM Search
title: Suspicious PowerShell download cradle
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    principal.process.file.full_path|endswith: '\\powershell.exe'
    principal.process.command_line|contains:
      - 'DownloadString'
      - 'IEX'
  condition: selection

⚠ Deterministic field-map translation, computed in your browser (no server, no LLM). Review field names before deploying.