sigma icon indicating copy to clipboard operation
sigma copied to clipboard

[STIX Backend] Rule partly converted bug

Open barvhaim opened this issue 5 years ago • 0 comments

There are some rules which are converted partly to STIX pattern if config mapping is not available for one of the fields, for example, rule A and not B where A does not have mapping and B have mapping will be converted to just not B,

Example rule: https://github.com/Neo23x0/sigma/tree/master/rules/windows/process_creation/win_renamed_binary_highly_relevant.yml

detection:
    selection:
        OriginalFileName:
            - "powershell.exe"
            - "powershell_ise.exe"
            - "psexec.exe"
            - "psexec.c"  # old versions of psexec (2016 seen)
            - "cscript.exe"
            - "wscript.exe"
            - "mshta.exe"
            - "regsvr32.exe"
            - "wmic.exe"
            - "certutil.exe"
            - "rundll32.exe"
            - "cmstp.exe"
            - "msiexec.exe"
    filter:
        Image:
            - '*\powershell.exe'
            - '*\powershell_ise.exe'
            - '*\psexec.exe'
            - '*\psexec64.exe'
            - '*\cscript.exe'
            - '*\wscript.exe'
            - '*\mshta.exe'
            - '*\regsvr32.exe'
            - '*\wmic.exe'
            - '*\certutil.exe'
            - '*\rundll32.exe'
            - '*\cmstp.exe'
            - '*\msiexec.exe'
    condition: selection and not filter

after conversion (not filter)

"pattern": "[(((process:binary_ref.name NOT LIKE '%\\\\powershell.exe' AND process:binary_ref.name NOT LIKE '%\\\\powershell_ise.exe' AND process:binary_ref.name NOT LIKE '%\\\\psexec.exe' AND process:binary_ref.name NOT LIKE '%\\\\psexec64.exe' AND process:binary_ref.name NOT LIKE '%\\\\cscript.exe' AND process:binary_ref.name NOT LIKE '%\\\\wscript.exe' AND process:binary_ref.name NOT LIKE '%\\\\mshta.exe' AND process:binary_ref.name NOT LIKE '%\\\\regsvr32.exe' AND process:binary_ref.name NOT LIKE '%\\\\wmic.exe' AND process:binary_ref.name NOT LIKE '%\\\\certutil.exe' AND process:binary_ref.name NOT LIKE '%\\\\rundll32.exe' AND process:binary_ref.name NOT LIKE '%\\\\cmstp.exe' AND process:binary_ref.name NOT LIKE '%\\\\msiexec.exe')))]",

barvhaim avatar Mar 02 '21 15:03 barvhaim