search

google / timesketch

Collaborative forensic timeline analysis
Apache License 2.0
2.58k stars 589 forks source link

Error when importing sigma rule with single quote #3027

Closed lo-chr closed 8 months ago

lo-chr commented 8 months ago

Describe the bug In certain cases, the import of Sigma rules fails, especially when they contain characters like '.

To Reproduce Steps to reproduce the behavior:

  1. Download triggering Sigma rule like proc_creation_lnx_gtfobin_vim.yml
  2. Run tsctl import-sigma-rules [location_of_rule]/proc_creation_lnx_gtfobin_vim.yml
  3. See error:

yaml.parser.ParserError: while parsing a flow mapping
  in "<unicode string>", line 1, column 1:
    {'title': 'Vim GTFOBin Abuse - L ...
    ^
expected ',' or '}', but got '<scalar>'
  in "<unicode string>", line 1, column 151:
     ... 'Detects usage of "vim" and it\'s siblings as a GTFOBin to execu ...
**Expected behavior**
Successful import of rule

Additional context I think the problem here lies in line 250 to 255 of sigma_util.py: https://github.com/google/timesketch/blob/57c585c0fae11accb1881c3a820a845b3af4c03b/timesketch/lib/sigma_util.py#L250-L255

in connection with line 32 to 36 of tools/sigma/parser/collection.py in the sigmatools package:

The function is called twice on the same input (once in sigma_util.py, once in collection.py). The "double-escaping" seems to lead to a ParserError.