Lucene Rule Generation Quotation Mark Issue

[LucaKuechler]

Lucene Rule Generation Quotation Mark Issue

When a selection item contains a blank space, the Lucene rule will be surrounded by quotation marks, which seems like an invalid syntax.

Description

I tried converting this rule by using the command below:

title: Xmrig
status: experimental
description: Detect Xmrig
references:
  - https://google.com
author: unknown
date: 2023/08/16
modified: 2023/08/16
tags:
  - attack.placeholder
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'cn/half --cpu-priority'
      - '--cpu-priority 1'
  condition: selection
level: critical

sigma convert -t lucene -p ecs_windows rule.yml

The generated rule looked like this:

process.command_line:("*cn\/half\ \-\-cpu\-priority*" OR "*\-\-cpu\-priority\ 1*")

My expectation would be to not have those quotation marks. It should look like:

process.command_line:(*cn\/half\ \-\-cpu\-priority* OR *\-\-cpu\-priority\ 1*)

I tested both versions inside my local Elasticsearch instance and the one with quotation mark didn't show any results. This is due to the nature of Lucene query language, which interprets the quotation marks as normal character. This behavior is also mentioned inside their documentation.

Environment

• Elasticsearch Version: 8
• pySigma-backend-elasticsearch Version: 1.0.9
• Python Version: 3.10

Possible Fix

• When I change the variable str_quote: ClassVar[str] = '"' to str_quote: ClassVar[str] = '' then it works. But not sure if it breaks other things.

[Securityinbits]

This one similar to this issue https://github.com/SigmaHQ/pySigma-backend-elasticsearch/issues/28

[Koen1999]

Possible Fix

* When I change the variable ` str_quote: ClassVar[str] = '"'` to ` str_quote: ClassVar[str] = ''`  then it works. But not sure if it breaks other things.

I can confirm this would break at least one thing. Specifically, matching against the empty string would result in a malformed Lucene query. (field:) Please check out PR #43 for a different solution that mitigates this problem.

[andurin]

Result after #43:

$ sigma convert -t lucene -p ecs_windows rule.yml
process.command_line.keyword:(*cn\/half\ \-\-cpu\-priority* OR *\-\-cpu\-priority\ 1*)

As long as your index-mapping owns the command_line.keyword - the query looks good to me.