Problem Elastalert-dsl - Githubissues

V1D1AN commented 5 years ago

Hi,

I have a problem with several rules when I use "sigmac" for elastalert-dsl

For example, the rules apt_turla_commands.yml,

alert:

debug description: Detects automated lateral movement by Turla group filter:
query: constant_score: filter: bool: should:
- wildcard: winlog.event_data.CommandLine.keyword: net use \\%DomainControll er%\C$ "P@ssw0rd" *
- wildcard: winlog.event_data.CommandLine.keyword: dir c:\.doc /s
- wildcard: winlog.event_data.CommandLine.keyword: dir %TEMP%\.exe index: winlogbeat- name: Turla-Group-Lateral-Movement_0 priority: 1 realert: minutes: 0 type: any

I have a return to the line after "DomainController%\C$" , and I have this problem on many rules.

Thanks :)

thomaspatzke commented 5 years ago

Fixed. Please try again.

V1D1AN commented 5 years ago

Yes it's work ;) Thanks

SigmaHQ / sigma