Glossary
Sigma
A generic, vendor-neutral signature format for log events that converts into queries for many SIEM platforms.
Sigma is an open signature format for describing suspicious patterns in log data. A Sigma rule declares a log source (for example process_creation or webserver), detection selections and a condition, and tools such as sigma-cli convert it into Splunk, Microsoft Sentinel, Elastic and other query languages.
For web shells, Sigma rules capture behaviour — web server workers spawning shells, script files written by web server processes, command-like parameters in requests — which remains detectable even when the shell file itself is obfuscated.