Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add list of unsupported modifiers #553

Merged
merged 2 commits into from
Dec 19, 2023
Merged

add list of unsupported modifiers #553

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
08a1d4e
add list of unsupported modifiers
YamatoSecurity Dec 19, 2023
2e86adc
update
YamatoSecurity Dec 19, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions README-Japanese.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@
- [EventDataの例外的なパターン](#eventdataの例外的なパターン)
- [同じ名前の複数のフィールド名からフィールドデータを出力する](#同じ名前の複数のフィールド名からフィールドデータを出力する)
- [パイプ修飾子 (Pipe Modifiers)](#パイプ修飾子-pipe-modifiers)
- [対応していないパイプ修飾子](#対応していないパイプ修飾子)
- [ワイルドカード](#ワイルドカード)
- [イベントキー内のキーワードのネスト](#イベントキー内のキーワードのネスト)
- [regexesとallowlistキーワード](#regexesとallowlistキーワード)
Expand Down Expand Up @@ -505,6 +506,17 @@ detection:
condition: keywords
```

## 対応していないパイプ修飾子

以下の修飾子は、現在サポートされていないため、Sigmaリポジトリでこれらの修飾子を使用するルールは含まれていません:
- `expand`
- `gt`
- `gte`
- `lt`
- `lte`
- `utf16 / utf16le / utf16be / wide`
- `windash`

## ワイルドカード

Hayabusaルールではワイルドカードを使用することができます。以下の例では、`ProcessCommandLine` が "malware" という文字列で始まる場合、このルールでログが検知されます。この仕様はSigmaルールのワイルドカードと同じく、大文字小文字を区別しません。
Expand Down
12 changes: 12 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@ This is the repository for [hayabusa](https://github.com/Yamato-Security/hayabus
- [Abnormal patterns in EventData](#abnormal-patterns-in-eventdata)
- [Outputting field data from multiple field names with the same name](#outputting-field-data-from-multiple-field-names-with-the-same-name)
- [Pipe Modifiers](#pipe-modifiers)
- [Unsupported Pipe Modifiers](#unsupported-pipe-modifiers)
- [Wildcards](#wildcards)
- [Nesting keywords inside eventkeys](#nesting-keywords-inside-eventkeys)
- [regexes and allowlist keywords](#regexes-and-allowlist-keywords)
Expand Down Expand Up @@ -505,6 +506,17 @@ detection:
condition: keywords
```

## Unsupported Pipe Modifiers

The following modifiers are currently not supported so we do not include any rules from the Sigma repository that use them:
- `expand`
- `gt`
- `gte`
- `lt`
- `lte`
- `utf16 / utf16le / utf16be / wide`
- `windash`

## Wildcards

Wildcards can be used in eventkeys. In the example below, if `ProcessCommandLine` starts with the string "malware", the rule will match.
Expand Down