the-dfir-report / sigma-rules Goto Github PK
View Code? Open in Web Editor NEWRules generated from our investigations.
License: GNU General Public License v3.0
sigma-rules's People
Contributors
Stargazers
Watchers
Forkers
nasbench majenkins31 drakevonduck guliqbal87 dfir-ronin bcp-infosec-repo rakhithjk nejibnbm bolotovyp bijaysenihang ibr2 yamatosecurity 0xatef cyb3rjy0t double-q1015 mkdemir williamtaack 0xthiebaut haxormad tobey123 leexuan securepeacock 0x616c6578 5l1v3r1 jabdy86 newbie2soc iandavila orhaniscansigma-rules's Issues
date field is in the wrong format
pySigma throws a sigma.exceptions.SigmaDateError exception when attempting to load some rules in this repository due to the format of the date field. For example:
sigma.exceptions.SigmaDateError: Rule date '01/22/2023' is invalid, must be yyyy/mm/dd or yyyy-mm-dd in The-DFIR-Report/Sigma-Rules/rules/network/zeek/zeek_smb_mapping_invoke-sharefinder_discovery.yml
This error can be reproduced with the SigmaCollection.load_ruleset() function:
from sigma.collection import SigmaCollection
SigmaCollection.load_ruleset(['The-DFIR-Report/Sigma-Rules'])The following files use this problematic format for dates:
/rules/network/zeek/zeek_smb_mapping_invoke-sharefinder_discovery.yml/rules/windows/builtin/win_security_invoke_sharefinder_discovery.yml/rules/windows/powershell/powershell_module/posh_pm_invoke-sharefinder_discovery.yml/rules/windows/powershell/powershell_script/posh_ps_invoke_sharefinder_discovery.yml
All other files use the appropriate yyyy/mm/dd format.
incorrect tag format for proc_creation_win_registry_query_for_wdigest.yml
pySigma throws a sigma.exceptions.SigmaValueError exception when attempting to load proc_creation_win_registry_query_for_wdigest.yml due to the format of the tag field:
Traceback (most recent call last):
File "\AppData\Local\Programs\Python\Python39\lib\site-packages\sigma\rule.py", line 61, in from_str
ns, n = tag.split(".", maxsplit=1)
ValueError: not enough values to unpack (expected 2, got 1)
...
sigma.exceptions.SigmaValueError: Sigma tag must start with namespace separated with dot from remaining tag.
This error can be reproduced with the SigmaCollection.load_ruleset() function:
from sigma.collection import SigmaCollection
SigmaCollection.load_ruleset(['The-DFIR-Report/Sigma-Rules'])The problematic tag is t012. This should be part of the attack namespace i.e. attack.t012.
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.