From f49cdaee5b136374df194d8839fac5e66e6b741d Mon Sep 17 00:00:00 2001 From: Maxime Lamothe-Brassard Date: Tue, 8 Feb 2022 11:33:26 -0800 Subject: [PATCH] The LimaCharlie "exists" operator has no case param. --- tools/sigma/backends/limacharlie.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/sigma/backends/limacharlie.py b/tools/sigma/backends/limacharlie.py index 6736f5e1b..3d396ab9b 100644 --- a/tools/sigma/backends/limacharlie.py +++ b/tools/sigma/backends/limacharlie.py @@ -516,7 +516,7 @@ class LimaCharlieBackend(BaseBackend): newOp["re"] = newVal elif op == "exists": # Exists has no value. - pass + newOp.pop( "case sensitive", None ) else: newOp["value"] = newVal if self._postOpMapper is not None: @@ -537,7 +537,7 @@ class LimaCharlieBackend(BaseBackend): newOp["re"] = newVal elif op == "exists": # Exists has no value. - pass + newOp.pop( "case sensitive", None ) else: newOp["value"] = newVal if self._postOpMapper is not None: