search

theflakes / sigma_to_wazuh

Convert Sigma rules to Wazuh rules
MIT License
55 stars 15 forks source link

Not parsing field name correctly #8

Closed theflakes closed 3 years ago

theflakes commented 3 years ago

See: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_encoded_frombase64string.yml

theflakes commented 3 years ago

Need to account for base64offset values: https://twitter.com/cyb3rops/status/1163714284163084289/photo/2

theflakes commented 3 years ago

Believe this is fixed now; offsets are calculated and single values and lists are base64 encoded.