Convert Google Chronicle YARA-L2 to Splunk SPL

Free, in-browser Google Chronicle YARA-L2 → Splunk SPL detection-rule converter. Paste your Google Chronicle YARA-L2 rule below; the Splunk SPL equivalent (and every other dialect) is generated instantly. Deterministic, open source, no upload.

Source format

Sigma YAML

title: Suspicious PowerShell download cradle
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\\powershell.exe'
    CommandLine|contains:
      - 'DownloadString'
      - 'IEX'
  condition: selection

Splunk SPL

index=* sourcetype=WinEventLog
| search title: Suspicious PowerShell download cradle
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    process_name|endswith: '\\powershell.exe'
    process_path|contains:
      - 'DownloadString'
      - 'IEX'
  condition: selection

Microsoft Sentinel KQL

SecurityEvent
| where title: Suspicious PowerShell download cradle
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    NewProcessName|endswith: '\\powershell.exe'
    CommandLine|contains:
      - 'DownloadString'
      - 'IEX'
  condition: selection

Elastic ES|QL

FROM logs-*
| WHERE title: Suspicious PowerShell download cradle
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    process.executable|endswith: '\\powershell.exe'
    process.command_line|contains:
      - 'DownloadString'
      - 'IEX'
  condition: selection

Google Chronicle UDM Search

// Chronicle UDM Search
title: Suspicious PowerShell download cradle
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    principal.process.file.full_path|endswith: '\\powershell.exe'
    principal.process.command_line|contains:
      - 'DownloadString'
      - 'IEX'
  condition: selection

⚠ Deterministic field-map translation, computed in your browser (no server, no LLM). Review field names before deploying.