the-dfir-report / sigma-rules Goto Github PK

pySigma throws a sigma.exceptions.SigmaDateError exception when attempting to load some rules in this repository due to the format of the date field. For example:

sigma.exceptions.SigmaDateError: Rule date '01/22/2023' is invalid, must be yyyy/mm/dd or yyyy-mm-dd in The-DFIR-Report/Sigma-Rules/rules/network/zeek/zeek_smb_mapping_invoke-sharefinder_discovery.yml

This error can be reproduced with the SigmaCollection.load_ruleset() function:

from sigma.collection import SigmaCollection
SigmaCollection.load_ruleset(['The-DFIR-Report/Sigma-Rules'])

The following files use this problematic format for dates:

• /rules/network/zeek/zeek_smb_mapping_invoke-sharefinder_discovery.yml
• /rules/windows/builtin/win_security_invoke_sharefinder_discovery.yml
• /rules/windows/powershell/powershell_module/posh_pm_invoke-sharefinder_discovery.yml
• /rules/windows/powershell/powershell_script/posh_ps_invoke_sharefinder_discovery.yml

All other files use the appropriate yyyy/mm/dd format.

pySigma throws a sigma.exceptions.SigmaValueError exception when attempting to load proc_creation_win_registry_query_for_wdigest.yml due to the format of the tag field:

Traceback (most recent call last):
  File "\AppData\Local\Programs\Python\Python39\lib\site-packages\sigma\rule.py", line 61, in from_str
    ns, n = tag.split(".", maxsplit=1)
ValueError: not enough values to unpack (expected 2, got 1)
...

sigma.exceptions.SigmaValueError: Sigma tag must start with namespace separated with dot from remaining tag.

This error can be reproduced with the SigmaCollection.load_ruleset() function:

from sigma.collection import SigmaCollection
SigmaCollection.load_ruleset(['The-DFIR-Report/Sigma-Rules'])

The problematic tag is t012. This should be part of the attack namespace i.e. attack.t012.