8a3117d73e
Nested list handling for chained value modifiers
2019-07-16 23:03:19 +02:00
e2050404bc
prevent EventID collision for dhcp
...
This prevents EventID collision for this rule with other sources/logs that share the same EventIDs.
specifically a lot with Microsoft-Windows-Security-SPP
2019-07-16 15:30:52 -04:00
6881967889
Further modifiers
...
* base64
* base64offset
2019-07-16 00:00:35 +02:00
1bb29dca26
Implemented type modifiers and regular expressions
2019-07-15 22:52:10 +02:00
b9ff280209
Cleanup of configuration names
2019-07-14 00:50:15 +02:00
b20b42b9c9
Added breaking changes file
2019-07-14 00:24:32 +02:00
5489f870cc
Merge pull request #393 from HacknowledgeCH/master
...
Explicit OR for list elements
2019-07-13 23:11:44 +02:00
134bfebe57
Ignore "timeframe" detection keyword in "all/any of" conditions
...
Fixes #395
2019-07-13 00:35:35 +02:00
576912eb7a
Support OR queries for Elasticsearch 6 and above
2019-07-08 17:12:53 +02:00
d08a993159
Fixed commandline to detect any shim install from any location
2019-07-08 12:31:18 +03:00
10290beb54
config/sumologic: more index mappings
2019-07-06 12:42:12 -04:00
7b0cace217
config/sumologic: more index mappings
2019-07-06 12:42:05 -04:00
2b5a77db53
add sumologic _sourceCategory and _view in aFL
2019-07-06 12:41:56 -04:00
b358d38e68
_index in aFL and mappings working!
2019-07-06 12:41:40 -04:00
2b062a0de7
Merge pull request #389 from christophetd/patch-1
...
Include Github raw URLs in suspicious downloads detection rule
2019-07-05 16:54:09 +02:00
5bc10a4855
Include Github raw URLs in suspicious downloads detection rule
2019-07-05 09:01:35 +00:00
f7ba2b3976
fix: bug in sumologic backend with 'null' values
2019-07-02 22:31:10 +02:00
0b883a90b6
fix: null value in separate expression
2019-07-02 20:14:45 +02:00
f5a8a81ff7
fix: linux cmds rule
2019-07-02 15:22:26 +02:00
ce43d600e3
fix: added null value / application to 4688 problem
2019-07-02 10:51:48 +02:00
337681cfce
Value modifiers
...
* First transformation modfiers: contains, all
* Sigma converter modifier list
2019-06-30 23:41:28 +02:00
161965d14c
Added version information to Winlogbeat configs
2019-06-30 22:44:12 +02:00
66f7f5b516
Merge pull request #385 from herrBez/fix-beat-fieldnames
...
Modified winlogbeat config to adhere to winlogbeat 7 field names
2019-06-30 22:42:59 +02:00
141c4f42f3
Merge pull request #383 from TareqAlKhatib/typos
...
fixed typos
2019-06-30 22:39:56 +02:00
74021d53d8
Modified winlogbeat config to adhere to winlogbeat 7 field names breaking changes
...
ref: https://www.elastic.co/guide/en/beats/libbeat/current/breaking-changes-7.0.html
2019-06-30 12:13:21 +02:00
15e2f5df5f
fixed typos
2019-06-29 15:35:59 +03:00
f4c8745cde
Merge branch 'juju4-devel-sumo'
2019-06-29 00:12:25 +02:00
6fab5d7f23
Improved testing and removed dead&debug code
2019-06-29 00:09:53 +02:00
377872c91e
Merge branch 'devel-sumo' of https://github.com/juju4/sigma into juju4-devel-sumo
2019-06-28 23:39:15 +02:00
1cb84d0592
Merge pull request #381 from vburov/patch-6
...
Added command that stops services.
2019-06-28 23:33:54 +02:00
a61ad9c9a6
Merge branch 'master' of https://github.com/Neo23x0/sigma
2019-06-28 23:32:37 +02:00
c09c1c1b6e
Merge branch 'sacx-master'
2019-06-28 23:31:09 +02:00
0c7151c901
Watcher backend default options, refactoring and testing
2019-06-28 23:22:16 +02:00
2f123f64a7
Added command that stops services.
2019-06-28 19:46:34 +03:00
3813d277a6
Ryuk Ransomware commands from real case
2019-06-28 19:26:05 +03:00
feac0be8a4
Added 2 more actions on Elasticsearch X-pack Watcher: index and webhook
...
Added timestamp filter query.
2019-06-27 08:54:59 +03:00
ad386474bf
fix: removed unusable extensions in proc exec context
2019-06-26 17:03:01 +02:00
708f3ef002
fix: fixed duplicate element in new double extension rule
2019-06-26 16:00:58 +02:00
41dc076959
Rule: suspicious double extension
2019-06-26 15:57:25 +02:00
0ea3a681df
Merge pull request #378 from cclauss/patch-1
...
Use print() function in both Python 2 and Python 3
2019-06-26 15:15:49 +02:00
2cbefb208b
Use print() function in both Python 2 and Python 3
...
Legacy __print__ statements are syntax errors in Python 3 but __print()__ function works as expected in both Python 2 and Python 3.
[flake8](http://flake8.pycqa.org ) testing of https://github.com/Neo23x0/sigma on Python 3.7.1
$ __flake8 . --count --select=E9,F63,F72,F82 --show-source --statistics__
```
./contrib/sigma2sumologic.py:123:5: F821 undefined name 'parser_print_help'
parser_print_help()
^
./contrib/sigma2sumologic.py:211:32: F821 undefined name 'r'
f.write(json.dumps(r, indent=4, sort_keys=True) + " ERROR: %s\n\nQUERY: %s" % (e, sumo_query))
^
./contrib/sigma2elastalert.py:165:32: E999 SyntaxError: invalid syntax
print "Converting file " + file
^
./tools/sigma/parser/collection.py:52:27: F821 undefined name 'SigmaCollectionParseError'
raise SigmaCollectionParseError("action 'repeat' is only applicable after first valid Sigma rule")
^
1 E999 SyntaxError: invalid syntax
3 F821 undefined name 'parser_print_help'
4
```
__E901,E999,F821,F822,F823__ are the "_showstopper_" [flake8](http://flake8.pycqa.org ) issues that can halt the runtime with a SyntaxError, NameError, etc. These 5 are different from most other flake8 issues which are merely "style violations" -- useful for readability but they do not effect runtime safety.
* F821: undefined name `name`
* F822: undefined name `name` in `__all__`
* F823: local variable name referenced before assignment
* E901: SyntaxError or IndentationError
* E999: SyntaxError -- failed to compile a file into an Abstract Syntax Tree
2019-06-26 14:44:09 +02:00
39b5eddfc7
Rule: Suspicious userinit.exe child process
2019-06-23 13:27:06 +02:00
654a009c9e
sumologic backend: remove TypeError
2019-06-22 16:49:46 -04:00
559d0f4ba8
sumologic backend: force as string
2019-06-22 16:43:50 -04:00
2df0e9765c
sumologic backend: pycodestyle review - E501
2019-06-22 16:41:57 -04:00
49533a5909
sumologic backend: pycodestyle review
2019-06-22 16:39:13 -04:00
84de12635e
self.debug option, fix multiple keyvalue escapings/cleanValue, inline index for now
2019-06-22 16:19:45 -04:00
059957138d
pycodestyle review, openpyxl, error at query generation=continue
2019-06-22 16:18:17 -04:00
a11d800353
Merge branch 'master' into devel-sumo
2019-06-22 09:18:23 -04:00
26036e0d35
fix: fixed image in taskmgr rule
2019-06-21 17:15:53 +02:00
Thomas Patzke