The rules available in this folder, are flexible detection templates that can be customized for your environments or use cases. Examples include rules that would require a domain or workstation variation that is specific to the company environment. This would vary on a case-by-case basis.
As a result, placeholder rules serve as an abstract detection template, where you adjust the placeholder value to fit your use case.
Placeholders can be mapped to the following pySigma transformations:
command_placeholdersfile_placeholdershttp_placeholdersquery_expression_placeholdersvalue_placeholderswildcard_placeholders
As stated in the included documentation, this is to keep private rules clean and make any environment-specific information reusable to the community. You use one of the placeholder transformations above, and future users of the rule can simply adjust the value to their use case.
The full updated list, can always be found here.