SigmaHQ / sigma

Main Sigma Rule Repository
Other
7.84k stars 2.12k forks source link

Minor fix for rule regex #4860

Closed CR-OfirTal closed 1 month ago

CR-OfirTal commented 1 month ago

Summary of the Pull Request

Just adding a bracket to the regex

Changelog

fix: Dynamic .NET Compilation Via Csc.EXE - small regex fix fix: Csc.EXE Execution Form Potentially Suspicious Parent - small regex fix

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

frack113 commented 1 month ago

Hi, Thanks for the fix. As the regex fix change the detection the field modified must be updated.