pySigma-backend-elasticsearch
pySigma-backend-elasticsearch copied to clipboard
Wrong network direction values
The default winlogbeat sysmon pipeline values for the network direction are changed from true/false to egress/ingress, and winlog.event_data.Initiated is removed (changed to network.direction). This backend will output the values of true/false
detection:
selection:
Initiated: 'true'
Image|endswith: '\msiexec.exe'
DestinationPort:
- 80
- 443
I'm not sure what the best way to handle this would be....also not 100% sure if it's an issue with this repo, the rules, both, or neither. I didn't see 'Initiated' anywhere in the sigma rule taxonomy specification.