def process_sigma_rule(self, tool: entity.Tool, detection: dict) -> None:
        """Processes a Sigma rule as specified in the lolbas json."""
        url = detection["Sigma"]
        if not url:
            return
        url = url.replace("github.com", "raw.githubusercontent.com").replace(
            "blob/", ""
        )
        try:
            sigma_yaml = self._make_request(url).text
            sigma_data = yaml.safe_load(sigma_yaml)
        except yaml.YAMLError as e:
            logging.error("Error parsing Sigma rule at %s: %s", url, e)
            return

        title = sigma_data["title"]
        description = sigma_data["description"]
        date = sigma_data["date"]
        if isinstance(date, str):
            date = datetime.strptime(date.strip(), "%Y/%m/%d")
        # create sigma indicator
        sigma = indicator.Sigma(
            name=title,
            description=description,
            created=date,
            pattern=sigma_yaml,
            location="filesystem",  # TODO: Actually parse YAML,
            kill_chain_phases=["payload-delivery"],
            diamond=indicator.DiamondModel.capability,
        ).save()
        tags = set(sigma_data.get("tags", [])) | {"lolbas"}
        sigma.tag(tags)
        sigma.link_to(
            tool,
            relationship_type="detects",
            description=f"Detects usage of {tool.name}",
        )
        sigma.link_to(
            self._lolbas_attackpattern,
            relationship_type="detects",
            description=f"Detects potentially malicious usage of {tool.name}",
        )
Processes a Sigma rule as specified in the lolbas json.
plugins/feeds/public/lolbas.py