Map EVTX samples to Sigma rules

[thomaspatzke]

Someone should map publicly available EVTX samples to Sigma rules. This would enable us to automatically test the correctness of generated queries.

Known security-related EVTX repositories:

• https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES
• https://github.com/Cyb3rWard0g/mordor

Feel free to extend the list.

Mapping should be:

Sigma rule -> Repository/EVTX ( -> expected matched event)

Comment here if you want to support!

[StevenD33]

Hi i don't understand what do you mean, how evtx samples should be map on a sigma rule ? in the references section of a sigma rule ?

[thomaspatzke]

I think that's a good idea, something like this:

reference:
  - https://<rule url>#<event-id in evtx>

[signus]

As this is a fairly old issue, would this be prime for closing?

It seems that the GitHub Actions pipeline within the project specify steps for testing evtx_baseline in .github/workflows/sigma-test.yml within the check-baseline-win* jobs.

Referencing needs for EventIDs can go into the rule documentation and anything extra (like examples) can be made into wiki documents.

[TheEis4Extra]

I'd like to think about this. Could be a useful resource for new SIEM implementation.

[nasbench]

Closing this as there are future plans to integrate testing in other ways.