A key rule can bring hidden attack behaviors to the surface, but writing such a rule requires a deep background knowledge of system event investigation. This course will teach students how to use SIGMA rules to identify the true attack behavior of hackers in a sea of log records, and to describe the TTPs (tactics, techniques, and procedures) of these attacks. In the course, we will delve into Sigma rules and how to collect system log files, and then explain the principles and implementation methods of various attacks, in order to consider their possible detection rules. Finally, we will collaborate to write and execute our own detection rules to judge whether malicious attack behaviors can be caught. This course allows students to experience threat hunting and try to face practical challenges.