search

markuskont / go-sigma-rule-engine

Golang library that implements a sigma log rule parser and match engine.
Apache License 2.0
91 stars 17 forks source link

Issue with escaping and globs #13

Closed newodahs closed 2 years ago

newodahs commented 2 years ago

Found while testing some sigma rules that were part of a contains modified group and had a leading backslash.

Basically, the Sigma rules for escaping are different enough from the glob library to cause us to throw out things like singular backslashes.

See: https://github.com/newodahs/go-sigma-rule-engine/issues/5

I have a fix for this already, just cleaning it up and making sure testing is in place.

newodahs commented 2 years ago

Fixed with Pull Request https://github.com/markuskont/go-sigma-rule-engine/pull/14

Also found that there was some additional escaping needed for the square and curly brackets, see pull request notes.

markuskont commented 2 years ago

Glad you caught it, merged.