ecs_windows mappig skipped

during the conversion of some rules ecs_windows mapping doesn't work properly Example rule:

title: Potential Remote PowerShell Session Initiated
id: c539afac-c12a-46ed-b1bd-5a5567c9f045
status: test
description: |
    Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account.
    This could potentially indicates a remote PowerShell connection.
references:
    - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html
author: Roberto Rodriguez @Cyb3rWard0g
date: 2019/09/12
modified: 2024/02/02
tags:
    - attack.execution
    - attack.t1059.001
    - attack.lateral_movement
    - attack.t1021.006
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort:
            - 5985
            - 5986
        Initiated: 'true' # only matches of the initiating system can be evaluated
        SourceIsIpv6: 'false'
    filter_main_service_users:
        - User|contains: # covers many language settings for Network Service. Please expand
              - 'NETWORK SERVICE'
              - 'NETZWERKDIENST'
              - 'SERVICIO DE RED'
              - 'SERVIZIO DI RETE'
        - User|contains|all:
              - 'SERVICE R'
              - 'SEAU'
    filter_main_localhost:
        SourceIp:
            - '::1'
            - '127.0.0.1'
        DestinationIp:
            - '::1'
            - '127.0.0.1'
    filter_optional_avast:
        Image:
            - 'C:\Program Files\Avast Software\Avast\AvastSvc.exe'
            - 'C:\Program Files (x86)\Avast Software\Avast\AvastSvc.exe'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Legitimate usage of remote PowerShell, e.g. remote administration and monitoring.
    - Network Service user name of a not-covered localization
level: high

Pipeline used: https://github.com/SigmaHQ/pySigma-backend-elasticsearch/blob/main/sigma/pipelines/elasticsearch/windows.py

Executed command:

> sigma convert -t lucene -p sysmon -p ecs_windows ~/sigma_core_11_03_2024/rules/windows/network_connection/net_connection_win_susp_remote_powershell_session.yml

Output:

winlog.channel:Microsoft\-Windows\-Sysmon\/Operational AND (event.code:3 AND (((destination.port:(5985 OR 5986)) AND network.direction:true AND winlog.event_data.SourceIsIpv6:false) AND (NOT (((winlog.event_data.User:(*NETWORK\ SERVICE* OR *NETZWERKDIENST* OR *SERVICIO\ DE\ RED* OR *SERVIZIO\ DI\ RETE*)) OR (winlog.event_data.User:*SERVICE\ R* AND winlog.event_data.User:*SEAU*)) OR ((source.ip:(\:\:1 OR 127.0.0.1)) AND (destination.ip:(\:\:1 OR 127.0.0.1))))) AND (NOT (process.executable:(C\:\\Program\ Files\\Avast\ Software\\Avast\\AvastSvc.exe OR C\:\\Program\ Files\ \(x86\)\\Avast\ Software\\Avast\\AvastSvc.exe)))))

Expected output:

winlog.channel:Microsoft\-Windows\-Sysmon\/Operational AND (event.code:3 AND (((destination.port:(5985 OR 5986)) AND network.direction:true AND winlog.event_data.SourceIsIpv6:false) AND (NOT (((user.name:(*NETWORK\ SERVICE* OR *NETZWERKDIENST* OR *SERVICIO\ DE\ RED* OR *SERVIZIO\ DI\ RETE*)) OR (user.name:*SERVICE\ R* AND user.name:*SEAU*)) OR ((source.ip:(\:\:1 OR 127.0.0.1)) AND (destination.ip:(\:\:1 OR 127.0.0.1))))) AND (NOT (process.executable:(C\:\\Program\ Files\\Avast\ Software\\Avast\\AvastSvc.exe OR C\:\\Program\ Files\ \(x86\)\\Avast\ Software\\Avast\\AvastSvc.exe)))))

As you can see the field User is not converted to user.name as expected in the mapping.

SigmaHQ / pySigma-backend-elasticsearch

ecs_windows mappig skipped #52