Closed Maspital closed 1 year ago
Hi @Maspital,
Thanks for such a thorough example that made it really easy to bisect and fix that is now done, i'll get the build out later today.
On the second note you have, I think I answered it somewhere in the issues or discussions before, but keyless rules are not supported because I can't see any valid usecase for having them. If we look a the rule posted it is very very badly written, all of those keywords are command line arguments within the context of a process execution. Happy to reopen the discussion for this but my opinion atm is that the rule should be 'fixed'.
Chainsaw version 2.4 and higher is unable to catch Sigma alerts which 2.3 successfully found. Assume the following minimal example
Some Sigma rule:
Some random logs. The seconds one contains the string "powercat " in the process.command_line field
Some mapping file:
Running the command
with Chainsaw 2.3, this works as intended (1 detection), but all higher versions fail to detect anything.
In addition to this, all versions seem to be unable to handle Sigma rules that, instead of looking for a value in a particular field, trigger if something is present anywhere in the log (see specification) like this rule, though this probably warrants a separate issue.
Any help with this would be greatly appreciated