Sigma rules for Linux and MacOS

VirusTotal has expanded crowdsourced Sigma rule matching beyond Windows to include macOS and Linux by extracting and mapping sandbox runtime behavior to Sigma fields (e.g., process creation, file and registry events). The post shows how to inspect matches, highlights cross-OS applicability of some rules, and demonstrates crafting YARA LiveHunt/Retrohunt rules from Sigma match context and Sysmon EVTX-derived structures, while noting limitations and recommending use of VT’s native behavior fields when possible.