diff --git a/.github/workflows/sigma-test.yml b/.github/workflows/sigma-test.yml index 5d85c95bb..316c6ef38 100644 --- a/.github/workflows/sigma-test.yml +++ b/.github/workflows/sigma-test.yml @@ -77,7 +77,7 @@ jobs: run: | # pip install sigma-cli~=0.7.1 pip install sigma-cli - pip install pySigma-validators-sigmahq==0.5.2 + pip install pySigma-validators-sigmahq==0.7.0 - name: Test Sigma Rule Syntax run: | sigma check --fail-on-error --fail-on-issues --validation-config tests/sigma_cli_conf.yml rules* diff --git a/rules-emerging-threats/2024/Malware/kapeka/registry_set_malware_kapeka_backdoor_autorun_persistence.yml b/rules-emerging-threats/2024/Malware/kapeka/registry_set_malware_kapeka_backdoor_autorun_persistence.yml index eb08d2df8..612cd9611 100644 --- a/rules-emerging-threats/2024/Malware/kapeka/registry_set_malware_kapeka_backdoor_autorun_persistence.yml +++ b/rules-emerging-threats/2024/Malware/kapeka/registry_set_malware_kapeka_backdoor_autorun_persistence.yml @@ -17,7 +17,7 @@ logsource: category: registry_set product: windows detection: - selection_base: + selection: TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' TargetObject|endswith: - '\Sens Api' @@ -26,7 +26,7 @@ detection: - ':\WINDOWS\system32\rundll32.exe' - '.wll' - '#1' - condition: all of selection_* + condition: selection falsepositives: - Unknown level: high diff --git a/rules/windows/process_creation/proc_creation_win_node_abuse.yml b/rules/windows/process_creation/proc_creation_win_node_abuse.yml index d5de03284..e2dd47204 100644 --- a/rules/windows/process_creation/proc_creation_win_node_abuse.yml +++ b/rules/windows/process_creation/proc_creation_win_node_abuse.yml @@ -17,19 +17,19 @@ logsource: category: process_creation product: windows detection: - selection: + selection_main: Image|endswith: '\node.exe' CommandLine|contains: - ' -e ' - ' --eval ' # Add more pattern of abuse as actions - action_reverse_shell: + selection_action_reverse_shell: CommandLine|contains|all: - '.exec(' - 'net.socket' - '.connect' - 'child_process' - condition: selection and 1 of action_* + condition: selection_main and 1 of selection_action_* falsepositives: - Unlikely level: high diff --git a/tests/sigma_cli_conf.yml b/tests/sigma_cli_conf.yml index aca5a55ec..263f94344 100644 --- a/tests/sigma_cli_conf.yml +++ b/tests/sigma_cli_conf.yml @@ -2,11 +2,11 @@ validators: - all - -tlptag - -tlpv1_tag - - -sigmahq_logsource_coherent - -sigmahq_logsource_known - -sigmahq_fieldname_cast - -sigmahq_filename_prefix - + - -sigmahq_categorie_eventid + - -sigmahq_ofselection_condition exclusions: # escaped_wildcard 021310d9-30a6-480a-84b7-eaa69aeb92bb: escaped_wildcard