I'd like to support the V2 re sub-modifiers before they start being used. Currently they are not in use but will probably be soon.
Example:
title: Potential Registry Reconnaissance Via PowerShell Script
id: 064060aa-09fb-4636-817f-020a32aa7e9e
detection:
selection:
# TODO: switch to |re|i: after sigma specification v2 is released
ScriptBlockText|re: '(Get-Item|gci|Get-ChildItem).{1,64}-Path.{1,64}\\(currentcontrolset\\services|CurrentVersion\\Policies\\Explorer\\Run|CurrentVersion\\Run|CurrentVersion\\ShellServiceObjectDelayLoad|CurrentVersion\\Windows\winlogon)\\'
condition: selection
|re|i: : (insensitive) to disable case-sensitive matching. (Note: the documentation says to enable it, but I think is a typo)
|re|m: : (multi line) to match across multiple lines. ^ /$ match the start/end of line.
|re|s: : (single line) to enable that dot (.) matches all characters, including the newline character.
@fukusuket Since you are our regular expressions master, do you want to do this? It is ok if it is not complete before HITCON.
https://github.com/SigmaHQ/sigma-specification/blob/main/appendix/sigma-modifiers-appendix.md
I'd like to support the V2
re
sub-modifiers before they start being used. Currently they are not in use but will probably be soon. Example:|re|i:
: (insensitive) to disable case-sensitive matching. (Note: the documentation says to enable it, but I think is a typo)|re|m:
: (multi line) to match across multiple lines. ^ /$ match the start/end of line.|re|s:
: (single line) to enable that dot (.) matches all characters, including the newline character.@fukusuket Since you are our regular expressions master, do you want to do this? It is ok if it is not complete before HITCON.