-
-
Notifications
You must be signed in to change notification settings - Fork 2.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update of Rare Service Install Detection Rule to use correlation syntax #4854
Comments
Welcome @Mat0vu 👋 It looks like this is your first issue on the Sigma rules repository! The following repository accepts issues related to If you're reporting an issue related to the pySigma library please consider submitting it here If you're reporting an issue related to the deprecated sigmac library please consider submitting it here Thanks for taking the time to open this issue, and welcome to the Sigma community! 😃 |
Hey @Mat0vu thanks for reaching out. We are now in the process of adding a folder to allow for the submitting of correlation rules and as you guessed old rules in the supported using the old pipe notation will also be converted to use the new format. Thanks for your understanding. Will take your rule suggestion as input when the new folder is added. |
HI, |
Hi @frack113, |
Hi,
as my company is trying to move from
sigmac
topysigma
for translating our detection rules, I´m currently checking if I get the same output with the new tool.For quite some time, in our environment the following rule was used to check for rare service installs: (https:/SigmaHQ/sigma/blob/master/unsupported/windows/win_system_rare_service_installs.yml)
Because this rule is using the old
|
syntax for aggregations, it is rejected by pysigma. I suppose this is also the reason why this rule is in theunsupported
directory, just like a few other rules using|
aggregations.I did not find any rules in the repository using the new correlation syntax, maybe because correlations are not yet officially and fully supported?
However, I´m following the development of
pysigma
and because converting correlation rules is possible now, I was curious and tried to change this rule following the correlation specification so thatpysigma
can convert it.Because this attempt was successful (using Elasticsearch
ESQLBackend
), I wanted to ask if it is planned that the rules in theunsupported
directory will be updated in the future to follow the new specification or if correlations are not yet to be used in the main rule repository.Here is a suggestion for the updated rule using the
event_count
correlation:The text was updated successfully, but these errors were encountered: