SigmaHQ / sigma

Main Sigma Rule Repository
Other
7.84k stars 2.12k forks source link

Clean useless `.*` in regex #4803

Closed frack113 closed 2 months ago

frack113 commented 2 months ago

Summary of the Pull Request

Changelog

update: Invoke-Obfuscation CLIP+ Launcher - PowerShell Module - Remove unnecessary starting wildcard update: Invoke-Obfuscation STDIN+ Launcher - PowerShell Module - Remove unnecessary starting wildcard update: Invoke-Obfuscation VAR+ Launcher - PowerShell Module - Remove unnecessary starting wildcard update: Invoke-Obfuscation Via Stdin - PowerShell Module - Remove unnecessary starting wildcard update: Invoke-Obfuscation Via Use Clip - PowerShell Module - Remove unnecessary starting wildcard update: Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module - Remove unnecessary starting wildcard update: Invoke-Obfuscation CLIP+ Launcher - PowerShell - Remove unnecessary starting wildcard update: Invoke-Obfuscation STDIN+ Launcher - Powershell - Remove unnecessary starting wildcard update: Invoke-Obfuscation VAR+ Launcher - PowerShell - Remove unnecessary starting wildcard update: Invoke-Obfuscation Via Stdin - Powershell - Remove unnecessary starting wildcard update: Invoke-Obfuscation Via Use Clip - Powershell - Remove unnecessary starting wildcard update: Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell - Remove unnecessary starting wildcard update: Invoke-Obfuscation STDIN+ Launcher - Update rule to use regex for better accuracy in CLI update: Invoke-Obfuscation VAR+ Launcher - Update rule to use regex for better accuracy in CLI update: Invoke-Obfuscation Via Stdin - Update rule to use regex for better accuracy in CLI update: Invoke-Obfuscation Via Use Clip - Update rule to use regex for better accuracy in CLI

Example Log Event

N/A

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions

nasbench commented 2 months ago

@phantinuss can you double check before i merge.

phantinuss commented 2 months ago

Plus of the regex is that the order or arguments is relevant, wheres with contains it's not. Can be upside or downside depending on the specific case.