From a471214d07244eb61492d5a5ef1bedbb18a47e83 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Sun, 4 Aug 2024 17:57:35 +0200
Subject: [PATCH 01/31] rename
---
.github/workflows/jekyll-gh-pages.yml | 50 ---
V2_changes.md | 27 --
...ndix_modifier.md => appendix_modifiers.md} | 176 ++++----
appendix/appendix_tags.md | 21 +-
appendix/appendix_taxonomy.md | 6 +-
.../detection-rule-schema.json | 0
.../meta-filter-schema.json | 228 +++++-----
{schema => json-schema}/meta-rule-schema.json | 406 +++++++++---------
.../sigma_meta_filter.md | 2 +-
.../sigma_meta_rules.md | 2 +-
.../sigma_rules.md | 6 +-
version_2_changes.md | 23 +
12 files changed, 447 insertions(+), 500 deletions(-)
delete mode 100644 .github/workflows/jekyll-gh-pages.yml
delete mode 100644 V2_changes.md
rename appendix/{appendix_modifier.md => appendix_modifiers.md} (97%)
rename {schema => json-schema}/detection-rule-schema.json (100%)
rename {schema => json-schema}/meta-filter-schema.json (96%)
rename {schema => json-schema}/meta-rule-schema.json (96%)
rename Sigma_meta_filter.md => specification/sigma_meta_filter.md (98%)
rename Sigma_meta_rules.md => specification/sigma_meta_rules.md (99%)
rename Sigma_specification.md => specification/sigma_rules.md (99%)
create mode 100644 version_2_changes.md
diff --git a/.github/workflows/jekyll-gh-pages.yml b/.github/workflows/jekyll-gh-pages.yml
deleted file mode 100644
index 85430f5..0000000
--- a/.github/workflows/jekyll-gh-pages.yml
+++ /dev/null
@@ -1,50 +0,0 @@
-# Sample workflow for building and deploying a Jekyll site to GitHub Pages
-name: Deploy Jekyll with GitHub Pages dependencies preinstalled
-
-on:
- # Runs on pushes targeting the default branch
- push:
- branches: ["main","jekyll"]
-
- # Allows you to run this workflow manually from the Actions tab
- workflow_dispatch:
-
-# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
-permissions:
- contents: read
- pages: write
- id-token: write
-
-# Allow one concurrent deployment
-concurrency:
- group: "pages"
- cancel-in-progress: true
-
-jobs:
- # Build job
- build:
- runs-on: ubuntu-latest
- steps:
- - name: Checkout
- uses: actions/checkout@v3.3.0
- - name: Setup Pages
- uses: actions/configure-pages@v3.0.4
- - name: Build with Jekyll
- uses: actions/jekyll-build-pages@v1.0.7
- with:
- source: ./
- destination: ./_site
- - name: Upload artifact
- uses: actions/upload-pages-artifact@v1
-
- # Deployment job
- deploy:
- environment:
- name: github-pages
- url: ${{ steps.deployment.outputs.page_url }}
- runs-on: ubuntu-latest
- needs: build
- steps:
- - name: Deploy to GitHub Pages
- id: deployment
- uses: actions/deploy-pages@v1.2.4
diff --git a/V2_changes.md b/V2_changes.md
deleted file mode 100644
index e1e89c1..0000000
--- a/V2_changes.md
+++ /dev/null
@@ -1,27 +0,0 @@
-The following is a non-exhaustive list of changes between the v1 and v2 specifications.
-
-
-# Sigmac
-
-Warning `sigmac` will not be able to convert all the specification of this version. \
-Only `pySigma` and the corresponding `sigma-cli` provide full support for version 2.
-
-# Date
-
-Legacy sigma rule use YYYY/MM/DD or YYYY-MM-DD format for the date. \
-Version 2 only use ISO 8601 with separator format : YYYY-MM-DD
-
-# New Modifiers
-
-- `windash` : creates all possible permutations of the `-` and `/` characters. Windows command line flags can often be indicated by both characters. Using the `windash` modifier converts `-` values into `/` and vice versa and uses all possible permutation of strings in the selection. This will be used for all `CommandLine` fields in windows > `process_creation` rules.
-- `exists` that allows to define that a certain field exists or doesn't exists in a log event by providing
- a boolean value. Currently we use filters with `field: null` as a workaround for this purpose, which is less descriptive.
-
-
-# Correlation
-
-- Remove aggregation expression in Sigma rule file, see [Sigma meta rules](/Sigma_meta_rules.md)
-
-# Global filter
-
-- Adds the ability to make filter rule files, see [Sigma meta filter](/Sigma_meta_filter.md)
diff --git a/appendix/appendix_modifier.md b/appendix/appendix_modifiers.md
similarity index 97%
rename from appendix/appendix_modifier.md
rename to appendix/appendix_modifiers.md
index ed12940..4508c67 100644
--- a/appendix/appendix_modifier.md
+++ b/appendix/appendix_modifiers.md
@@ -1,88 +1,88 @@
-# Modifiers
-
-The following document defines the standardized modifiers that can be used in Sigma.
-
-* Version 2.0.0
-* Release date 2024-01-01
-
-## Summary
-- [Summary](#summary)
-- [General](#general)
- - [String only](#string-only)
- - [Numeric only](#numeric-only)
- - [Ip only](#ip-only)
- - [String Encoding](#string-encoding)
-- [Specific](#specific)
-- [History](#history)
-
-
-## General
-
-* `all`: Normally, lists of values are linked with *OR* in the generated query. This modifier
- changes this to *AND*. This is useful if you want to express a command line invocation with different
- parameters where the order may vary and removes the need for some cumbersome workarounds.
-
- Single item values are not allowed to have an `all` modifier as some back-ends cannot support it.
- If you use it as a workaround to duplicate a field in a selection, use a new selection instead.
-
-* `startswith`: The value is expected at the beginning of the field's content. (replaces e.g. 'adm*')
-* `endswith`: The value is expected at the end of the field's content (replaces e.g. '*\cmd.exe')
-* `contains`: Puts `*` wildcards around the values, such that the value is matched anywhere in the
- field.
-
-* `exists`: Defines that a certain field has to exist or must not exist in a log event by providing a boolean value.
-* `cased`: Values are applied case sensitively. Default Sigma behaviour is case-insensitive matching.
-
-### String only
-
-* `windash`: Creates all possible permutations of the `-` and `/` characters. Windows command line flags can often be indicated by both characters. Using the `windash` modifier converts `-` values into `/` and vice versa and uses all possible permutation of strings in the selection.
-* `re`: Value is handled as a regular expression by backends. Regex is matched case-sensitive by default
- * `i`: (insensitive) `re` sub-modifier to enable case-sensitive matching.
- * `m`: (multi line) `re` sub-modifier to match across multiple lines. `^` /`$` match the start/end of line.
- * `s`: (single line) `re` sub-modifier to enable that dot (`.`) matches all characters, including the newline character.
-
-
-### Numeric only
-
-* `lt`: Field is less than the value
-* `lte`: Field is less or equal than the value
-* `gt`: Field is greater than the value
-* `gte`: Field is greater or equal than the value
-
-
-### Ip only
-
-* `cidr`: The value is handled as an CIDR by backends
-
-
-### String Encoding
-
-* `base64`: The value is encoded with Base64.
-* `base64offset`: If a value might appear somewhere in a base64-encoded string the representation
- might change depending on the position of the value in the overall string. There are three variants for shifts
- by zero to two bytes and except the first and last byte the encoded values have a static part in
- the middle that can be recognized.
-
-* `utf16le`: Transforms value to UTF16-LE encoding, e.g. `cmd` > `63 00 6d 00 64 00` (only used in combination with base64 modifiers)
-* `utf16be`: Transforms value to UTF16-BE encoding, e.g. `cmd` > `00 63 00 6d 00 64` (only used in combination with base64 modifiers)
-* `wide`: Alias for `utf16le` modifier
-* `utf16`: Prepends a [byte order mark](https://en.wikipedia.org/wiki/Byte_order_mark) and encodes UTF16, e.g. `cmd` > `FF FE 63 00 6d 00 64 00` (only used in combination with base64 modifiers)
-
-
-## Specific
-
-* `expand`: Modifier for expansion of placeholders in values. The final behavior of the replacement is determined by processing pipeline transformations. Current possibilities in pySigma are:
- * Expand to value list (`ValueListPlaceholderTransformation`/`value_placeholders`)
- * Replace with query expression in target query language (`QueryExpressionPlaceholderTransformation`/`query_expression_placeholders`)
- * Replace placeholder with wildcard `*`, which should only be used as last resort. (`WildcardPlaceholderTransformation`/`wildcard_placeholders`)
-
-* `fieldref`: Modifies a plain string into a field reference. A field reference can be used to compare fields of matched
- events directly at query/matching time.
-
-## History
-* 2023-05-27
- * Update from PySigma 0.7.6
- * Add `fieldref`
-* 2023-05-21 v1.0.3
- * Creation of the file
-* 2017 Sigma creation
+# Modifiers
+
+The following document defines the standardized modifiers that can be used in Sigma.
+
+* Version 2.0.0
+* Release date 2024-08-12
+
+## Summary
+- [Summary](#summary)
+- [General](#general)
+ - [String only](#string-only)
+ - [Numeric only](#numeric-only)
+ - [Ip only](#ip-only)
+ - [String Encoding](#string-encoding)
+- [Specific](#specific)
+- [History](#history)
+
+
+## General
+
+* `all`: Normally, lists of values are linked with *OR* in the generated query. This modifier
+ changes this to *AND*. This is useful if you want to express a command line invocation with different
+ parameters where the order may vary and removes the need for some cumbersome workarounds.
+
+ Single item values are not allowed to have an `all` modifier as some back-ends cannot support it.
+ If you use it as a workaround to duplicate a field in a selection, use a new selection instead.
+
+* `startswith`: The value is expected at the beginning of the field's content. (replaces e.g. 'adm*')
+* `endswith`: The value is expected at the end of the field's content (replaces e.g. '*\cmd.exe')
+* `contains`: Puts `*` wildcards around the values, such that the value is matched anywhere in the
+ field.
+
+* `exists`: Defines that a certain field has to exist or must not exist in a log event by providing a boolean value.
+* `cased`: Values are applied case sensitively. Default Sigma behaviour is case-insensitive matching.
+
+### String only
+
+* `windash`: Creates all possible permutations of the `-` and `/` characters. Windows command line flags can often be indicated by both characters. Using the `windash` modifier converts `-` values into `/` and vice versa and uses all possible permutation of strings in the selection.
+* `re`: Value is handled as a regular expression by backends. Regex is matched case-sensitive by default
+ * `i`: (insensitive) `re` sub-modifier to enable case-sensitive matching.
+ * `m`: (multi line) `re` sub-modifier to match across multiple lines. `^` /`$` match the start/end of line.
+ * `s`: (single line) `re` sub-modifier to enable that dot (`.`) matches all characters, including the newline character.
+
+
+### Numeric only
+
+* `lt`: Field is less than the value
+* `lte`: Field is less or equal than the value
+* `gt`: Field is greater than the value
+* `gte`: Field is greater or equal than the value
+
+
+### Ip only
+
+* `cidr`: The value is handled as an CIDR by backends
+
+
+### String Encoding
+
+* `base64`: The value is encoded with Base64.
+* `base64offset`: If a value might appear somewhere in a base64-encoded string the representation
+ might change depending on the position of the value in the overall string. There are three variants for shifts
+ by zero to two bytes and except the first and last byte the encoded values have a static part in
+ the middle that can be recognized.
+
+* `utf16le`: Transforms value to UTF16-LE encoding, e.g. `cmd` > `63 00 6d 00 64 00` (only used in combination with base64 modifiers)
+* `utf16be`: Transforms value to UTF16-BE encoding, e.g. `cmd` > `00 63 00 6d 00 64` (only used in combination with base64 modifiers)
+* `wide`: Alias for `utf16le` modifier
+* `utf16`: Prepends a [byte order mark](https://en.wikipedia.org/wiki/Byte_order_mark) and encodes UTF16, e.g. `cmd` > `FF FE 63 00 6d 00 64 00` (only used in combination with base64 modifiers)
+
+
+## Specific
+
+* `expand`: Modifier for expansion of placeholders in values. The final behavior of the replacement is determined by processing pipeline transformations. Current possibilities in pySigma are:
+ * Expand to value list (`ValueListPlaceholderTransformation`/`value_placeholders`)
+ * Replace with query expression in target query language (`QueryExpressionPlaceholderTransformation`/`query_expression_placeholders`)
+ * Replace placeholder with wildcard `*`, which should only be used as last resort. (`WildcardPlaceholderTransformation`/`wildcard_placeholders`)
+
+* `fieldref`: Modifies a plain string into a field reference. A field reference can be used to compare fields of matched
+ events directly at query/matching time.
+
+## History
+* 2023-05-27
+ * Update from PySigma 0.7.6
+ * Add `fieldref`
+* 2023-05-21 v1.0.3
+ * Creation of the file
+* 2017 Sigma creation
diff --git a/appendix/appendix_tags.md b/appendix/appendix_tags.md
index 04d7ae7..24cc029 100644
--- a/appendix/appendix_tags.md
+++ b/appendix/appendix_tags.md
@@ -2,8 +2,8 @@
The following document defines the standardized tags that can be used to categorize the different Sigma rules.
-* Version 1.2.0
-* Release date 2023-11-23
+* Version 2.0.0
+* Release date 2024-08-12
## Summary
@@ -19,10 +19,11 @@ The following document defines the standardized tags that can be used to categor
## Namespaces
-* attack: Categorization according to [MITRE ATT&CK](https://attack.mitre.org). To get the current supported version of ATT&CK please visite [MITRE CTI](https://github.com/mitre/cti)
+* attack: Categorization according to [MITRE ATT&CK](https://attack.mitre.org). To get the current supported version of ATT&CK please visit [MITRE CTI](https://github.com/mitre/cti)
* car: Link to the corresponding [MITRE Cyber Analytics Repository (CAR)](https://car.mitre.org/)
* stp: Rating of detection analytic robustness according to the [MITRE Summiting the Pyramid](https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/) scheme.
-* tlp: [Traffic Light Protocol](https://www.first.org/tlp/)
+* tlp: [Traffic Light Protocol](https://www.first.org/tlp/).
+* detection: Categorization according to the types of rules provided in the [SigmaHQ rule repository](https://github.com/SigmaHQ/sigma).
### Namespace: attack
@@ -71,7 +72,7 @@ specify the robustness in the following ways:
### Namespace: cve
-Use the CVE tag from the [mitre](https://cve.mitre.org) in lower case seperated by dots. Example tag: `cve.2021.44228`.
+Use the CVE tag from the [mitre](https://cve.mitre.org) in lower case seperated by dots. Example tag: `cve.2021-44228`.
### Namespace: tlp
@@ -79,13 +80,15 @@ All TLP levels defined by the [FIRST TLP-SIG](https://www.first.org/tlp/) in low
### namespace: detection
-Use the detection tag to indicate the type of a rule. Example tag: `detection.threat_hunting`.
+Use the detection tag to indicate the type of a rule. Example tag: `detection.threat-hunting`.
* dfir
-* emerging_threats
-* threat_hunting
+* emerging-threats
+* threat-hunting
## History
+* 2024-08-12 Tags V2.0.0
+ * Release of V2.0.0 of the specification
* 2023-11-23 Tags V1.2.0
* Add Summiting the Pyramid
* 2023-06-20 Tags V1.1.0
@@ -93,5 +96,5 @@ Use the detection tag to indicate the type of a rule. Example tag: `detection.th
* 2022-12-19 Tags V1.0.1
* Minor updates and tweaks
* 2022-09-18 Tags V1.0.0
- * Initial formalisation from the sigma wiki
+ * Initial formalization from the sigma wiki
* 2017 Sigma creation
diff --git a/appendix/appendix_taxonomy.md b/appendix/appendix_taxonomy.md
index 60a39f2..0ad5f26 100644
--- a/appendix/appendix_taxonomy.md
+++ b/appendix/appendix_taxonomy.md
@@ -1,9 +1,9 @@
# Sigma Taxonomy
-The following document defines the field names and log sources that should be used in SIGMA rules to ensure sharable rules.
+The following document defines the field names and log sources that are allowed to be used in SIGMA rules that are shared on the official SigmaHQ repository.
-* Version 1.3.5
-* Release date 2023/01/21
+* Version 2.0.0
+* Release date 2024/08/12
## Summary
diff --git a/schema/detection-rule-schema.json b/json-schema/detection-rule-schema.json
similarity index 100%
rename from schema/detection-rule-schema.json
rename to json-schema/detection-rule-schema.json
diff --git a/schema/meta-filter-schema.json b/json-schema/meta-filter-schema.json
similarity index 96%
rename from schema/meta-filter-schema.json
rename to json-schema/meta-filter-schema.json
index f6e4525..1b7bbac 100644
--- a/schema/meta-filter-schema.json
+++ b/json-schema/meta-filter-schema.json
@@ -1,114 +1,114 @@
-{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Sigma Global Filter specification V2.0.0 (2024/01/01)",
- "type": "object",
- "required": [
- "title",
- "logsource",
- "filter"
- ],
- "properties": {
- "title": {
- "type": "string",
- "maxLength": 256,
- "description": "A brief title for the rule that should contain what the rules is supposed to detect"
- },
- "id": {
- "type": "string",
- "description": "A globally unique identifier for the Sigma rule. This is recommended to be a UUID v4, but not mandatory.",
- "format": "uuid"
- },
- "description": {
- "type": "string",
- "description": "A short description of the rule and the malicious activity that can be detected",
- "maxLength": 65535
- },
- "date": {
- "type": "string",
- "description": "Creation date of the meta filter. Use the format YYYY-MM-DD",
- "pattern": "^\\d{4}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])$"
- },
- "modified": {
- "type": "string",
- "description": "Last modification date of the meta filter. Use the format YYYY-MM-DD",
- "pattern": "^\\d{4}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])$"
- },
- "logsource": {
- "type": "object",
- "description": "The log source that the rule is supposed to detect malicious activity in.",
- "properties": {
- "category": {
- "description": "Group of products, like firewall or process_creation",
- "type": "string"
- },
- "product": {
- "description": "A certain product, like windows",
- "type": "string"
- },
- "service": {
- "description": "A subset of a product's logs, like sshd",
- "type": "string"
- }
- }
- },
- "filter": {
- "type": "object",
- "required": ["rules","selection","condition"],
- "description": "A set of search-identifiers that represent properties of searches on log data",
- "additionalProperties": {
- "description": "A Search Identifier: A definition that can consist of two different data structures - lists and maps.",
- "anyOf": [
- {
- "type": "array",
- "items": {
- "anyOf": [
- {
- "type": "string"
- },
- {
- "type": "integer"
- },
- {
- "type": "object",
- "items": {
- "type": "string"
- }
- }
- ]
- }
- },
- {
- "type": "object",
- "items": {
- "type": "string"
- }
- }
- ]
- },
- "properties": {
- "rules": {
- "type": "array",
- "description": "list of the rule where add the filter",
- "minItems": 1,
- "uniqueItems": true,
- "items": {
- "type": "string"
- }
- },
- "selection": {
- "type": "array",
- "description": "the filter detection logic",
- "minItems": 1,
- "uniqueItems": true,
- "items": {
- "type": "string"
- }
- },
- "condition": {
- "type": "string",
- "description": "The relationship between the search identifiers to create the detection logic. selection or not selection"
- }
- }
- }
- }
-}
+{
+ "$schema": "http://json-schema.org/draft-07/schema#",
+ "title": "Sigma Global Filter specification V2.0.0 (2024/01/01)",
+ "type": "object",
+ "required": [
+ "title",
+ "logsource",
+ "filter"
+ ],
+ "properties": {
+ "title": {
+ "type": "string",
+ "maxLength": 256,
+ "description": "A brief title for the rule that should contain what the rules is supposed to detect"
+ },
+ "id": {
+ "type": "string",
+ "description": "A globally unique identifier for the Sigma rule. This is recommended to be a UUID v4, but not mandatory.",
+ "format": "uuid"
+ },
+ "description": {
+ "type": "string",
+ "description": "A short description of the rule and the malicious activity that can be detected",
+ "maxLength": 65535
+ },
+ "date": {
+ "type": "string",
+ "description": "Creation date of the meta filter. Use the format YYYY-MM-DD",
+ "pattern": "^\\d{4}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])$"
+ },
+ "modified": {
+ "type": "string",
+ "description": "Last modification date of the meta filter. Use the format YYYY-MM-DD",
+ "pattern": "^\\d{4}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])$"
+ },
+ "logsource": {
+ "type": "object",
+ "description": "The log source that the rule is supposed to detect malicious activity in.",
+ "properties": {
+ "category": {
+ "description": "Group of products, like firewall or process_creation",
+ "type": "string"
+ },
+ "product": {
+ "description": "A certain product, like windows",
+ "type": "string"
+ },
+ "service": {
+ "description": "A subset of a product's logs, like sshd",
+ "type": "string"
+ }
+ }
+ },
+ "filter": {
+ "type": "object",
+ "required": ["rules","selection","condition"],
+ "description": "A set of search-identifiers that represent properties of searches on log data",
+ "additionalProperties": {
+ "description": "A Search Identifier: A definition that can consist of two different data structures - lists and maps.",
+ "anyOf": [
+ {
+ "type": "array",
+ "items": {
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "integer"
+ },
+ {
+ "type": "object",
+ "items": {
+ "type": "string"
+ }
+ }
+ ]
+ }
+ },
+ {
+ "type": "object",
+ "items": {
+ "type": "string"
+ }
+ }
+ ]
+ },
+ "properties": {
+ "rules": {
+ "type": "array",
+ "description": "list of the rule where add the filter",
+ "minItems": 1,
+ "uniqueItems": true,
+ "items": {
+ "type": "string"
+ }
+ },
+ "selection": {
+ "type": "array",
+ "description": "the filter detection logic",
+ "minItems": 1,
+ "uniqueItems": true,
+ "items": {
+ "type": "string"
+ }
+ },
+ "condition": {
+ "type": "string",
+ "description": "The relationship between the search identifiers to create the detection logic. selection or not selection"
+ }
+ }
+ }
+ }
+}
diff --git a/schema/meta-rule-schema.json b/json-schema/meta-rule-schema.json
similarity index 96%
rename from schema/meta-rule-schema.json
rename to json-schema/meta-rule-schema.json
index 53e14a9..f2fc607 100644
--- a/schema/meta-rule-schema.json
+++ b/json-schema/meta-rule-schema.json
@@ -1,204 +1,204 @@
-{
- "$schema": "https://json-schema.org/draft/2020-12/schema",
- "title": "Sigma Meta rule specification V2.0.0 (2024/xx/xx)",
- "type": "object",
- "required": [
- "title",
- "correlation"
- ],
- "properties": {
- "title": {
- "type": "string",
- "maxLength": 256,
- "description": "A brief title for the rule that should contain what the rules is supposed to detect"
- },
- "id": {
- "type": "string",
- "description": "A globally unique identifier for the Sigma rule. This is recommended to be a UUID v4, but not mandatory.",
- "format": "uuid"
- },
- "description": {
- "type": "string",
- "description": "A short description of the rule and the malicious activity that can be detected",
- "maxLength": 65535
- },
- "author": {
- "type": "string",
- "description": "Creator of the rule. (can be a name, nickname, twitter handle, etc.)"
- },
- "references": {
- "type": "array",
- "description": "References to the source that the rule was derived from. These could be blog articles, technical papers, presentations or even tweets",
- "uniqueItems": true,
- "items": {
- "type": "string"
- }
- },
- "date": {
- "type": "string",
- "description": "Creation date of the meta rule. Use the ISO 8601 format YYYY-MM-DD",
- "pattern": "^\\d{4}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])$"
- },
- "modified": {
- "type": "string",
- "description": "Last modification date of the meta rule. Use the ISO 8601 format YYYY-MM-DD",
- "pattern": "^\\d{4}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])$"
- },
- "correlation": {
- "type": "object",
- "required": [
- "type",
- "rules",
- "timespan",
- "condition"
- ],
- "description": "represents the correlation searched for on the log data",
- "properties": {
- "type": {
- "type": "string",
- "maxLength": 16,
- "description": "Defines the corelation type",
- "oneOf": [
- {
- "const": "event_count"
- },
- {
- "const": "value_count"
- },
- {
- "const": "temporal"
- },
- {
- "const": "temporal_ordered"
- }
- ]
- },
- "rules":{
- "description": "Refers to one or multiple Sigma or Correlations rules",
- "uniqueItems": true,
- "anyOf": [
- {
- "type": "array",
- "items": {
- "anyOf":[
- {
- "type": "string",
- "minLength": 2
- },
- {
- "type": "string",
- "format": "uuid"
- }
- ]
-
- }
- }
- ]
- },
- "alias":{
- "type": "object",
- "description": "defines field name aliases that are applied to correlated Sigma rules",
- "additionalProperties":{
- "anyOf": [
- {
- "type": "object",
- "items": {
- "type": "string"
- }
- }
- ]
- }
- },
- "group-by": {
- "type": "array",
- "description": "defines one or multiple fields which should be treated as separate event occurrence scope",
- "uniqueItems": true,
- "items": {
- "type": "string"
- }
- },
- "timespan": {
- "type": "string",
- "maxLength": 10,
- "description": "defines a time period in which the correlation should be applied. used: `number + letter (in lowercase)`"
- },
- "condition": {
- "type": "object",
- "description": "The condition defines when a correlation matches",
- "uniqueItems": true,
- "minItems": 1,
- "maxItems": 3,
- "anyOf": [
- {
- "gt": {
- "description": "The count must be greater than the given value",
- "type": "integer"
- }
- },
- {
- "gte": {
- "description": "The count must be greater than or equal the given value",
- "type": "integer"
- }
- },
- {
- "lt": {
- "description": "The count must be lesser than the given value",
- "type": "integer"
- }
- },
- {
- "lte": {
- "description": "The count must be lesser than or equal the given value",
- "type": "integer"
- }
- },
- {
- "eq": {
- "description": "The count must be equal the given value",
- "type": "integer"
- }
- },
- {
- "field": {
- "description": "name of the field to counts values",
- "type": "string",
- "maxLength": 256
- }
- }
- ]
- }
- }
- },
- "level": {
- "type": "string",
- "description": "The criticality of a triggered rule",
- "oneOf": [
- {
- "const": "informational",
- "description": "Rule is intended for enrichment of events, e.g. by tagging them. No case or alerting should be triggered by such rules because it is expected that a huge amount of events will match these rules"
- },
- {
- "const": "low",
- "description": "Notable event but rarely an incident. Low rated events can be relevant in high numbers or combination with others. Immediate reaction shouldn't be necessary, but a regular review is recommended"
- },
- {
- "const": "medium",
- "description": "Relevant event that should be reviewed manually on a more frequent basis"
- },
- {
- "const": "high",
- "description": "Relevant event that should trigger an internal alert and requires a prompt review"
- },
- {
- "const": "critical",
- "description": "Highly relevant event that indicates an incident. Critical events should be reviewed immediately. It is used only for cases in which probability borders certainty"
- }
- ]
- },
- "generate": {
- "type": "boolean",
- "description": "defines if the rules referred from the correlation rule should be converted as stand-alone rules"
- }
- }
+{
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "title": "Sigma Meta rule specification V2.0.0 (2024/xx/xx)",
+ "type": "object",
+ "required": [
+ "title",
+ "correlation"
+ ],
+ "properties": {
+ "title": {
+ "type": "string",
+ "maxLength": 256,
+ "description": "A brief title for the rule that should contain what the rules is supposed to detect"
+ },
+ "id": {
+ "type": "string",
+ "description": "A globally unique identifier for the Sigma rule. This is recommended to be a UUID v4, but not mandatory.",
+ "format": "uuid"
+ },
+ "description": {
+ "type": "string",
+ "description": "A short description of the rule and the malicious activity that can be detected",
+ "maxLength": 65535
+ },
+ "author": {
+ "type": "string",
+ "description": "Creator of the rule. (can be a name, nickname, twitter handle, etc.)"
+ },
+ "references": {
+ "type": "array",
+ "description": "References to the source that the rule was derived from. These could be blog articles, technical papers, presentations or even tweets",
+ "uniqueItems": true,
+ "items": {
+ "type": "string"
+ }
+ },
+ "date": {
+ "type": "string",
+ "description": "Creation date of the meta rule. Use the ISO 8601 format YYYY-MM-DD",
+ "pattern": "^\\d{4}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])$"
+ },
+ "modified": {
+ "type": "string",
+ "description": "Last modification date of the meta rule. Use the ISO 8601 format YYYY-MM-DD",
+ "pattern": "^\\d{4}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])$"
+ },
+ "correlation": {
+ "type": "object",
+ "required": [
+ "type",
+ "rules",
+ "timespan",
+ "condition"
+ ],
+ "description": "represents the correlation searched for on the log data",
+ "properties": {
+ "type": {
+ "type": "string",
+ "maxLength": 16,
+ "description": "Defines the corelation type",
+ "oneOf": [
+ {
+ "const": "event_count"
+ },
+ {
+ "const": "value_count"
+ },
+ {
+ "const": "temporal"
+ },
+ {
+ "const": "temporal_ordered"
+ }
+ ]
+ },
+ "rules":{
+ "description": "Refers to one or multiple Sigma or Correlations rules",
+ "uniqueItems": true,
+ "anyOf": [
+ {
+ "type": "array",
+ "items": {
+ "anyOf":[
+ {
+ "type": "string",
+ "minLength": 2
+ },
+ {
+ "type": "string",
+ "format": "uuid"
+ }
+ ]
+
+ }
+ }
+ ]
+ },
+ "alias":{
+ "type": "object",
+ "description": "defines field name aliases that are applied to correlated Sigma rules",
+ "additionalProperties":{
+ "anyOf": [
+ {
+ "type": "object",
+ "items": {
+ "type": "string"
+ }
+ }
+ ]
+ }
+ },
+ "group-by": {
+ "type": "array",
+ "description": "defines one or multiple fields which should be treated as separate event occurrence scope",
+ "uniqueItems": true,
+ "items": {
+ "type": "string"
+ }
+ },
+ "timespan": {
+ "type": "string",
+ "maxLength": 10,
+ "description": "defines a time period in which the correlation should be applied. used: `number + letter (in lowercase)`"
+ },
+ "condition": {
+ "type": "object",
+ "description": "The condition defines when a correlation matches",
+ "uniqueItems": true,
+ "minItems": 1,
+ "maxItems": 3,
+ "anyOf": [
+ {
+ "gt": {
+ "description": "The count must be greater than the given value",
+ "type": "integer"
+ }
+ },
+ {
+ "gte": {
+ "description": "The count must be greater than or equal the given value",
+ "type": "integer"
+ }
+ },
+ {
+ "lt": {
+ "description": "The count must be lesser than the given value",
+ "type": "integer"
+ }
+ },
+ {
+ "lte": {
+ "description": "The count must be lesser than or equal the given value",
+ "type": "integer"
+ }
+ },
+ {
+ "eq": {
+ "description": "The count must be equal the given value",
+ "type": "integer"
+ }
+ },
+ {
+ "field": {
+ "description": "name of the field to counts values",
+ "type": "string",
+ "maxLength": 256
+ }
+ }
+ ]
+ }
+ }
+ },
+ "level": {
+ "type": "string",
+ "description": "The criticality of a triggered rule",
+ "oneOf": [
+ {
+ "const": "informational",
+ "description": "Rule is intended for enrichment of events, e.g. by tagging them. No case or alerting should be triggered by such rules because it is expected that a huge amount of events will match these rules"
+ },
+ {
+ "const": "low",
+ "description": "Notable event but rarely an incident. Low rated events can be relevant in high numbers or combination with others. Immediate reaction shouldn't be necessary, but a regular review is recommended"
+ },
+ {
+ "const": "medium",
+ "description": "Relevant event that should be reviewed manually on a more frequent basis"
+ },
+ {
+ "const": "high",
+ "description": "Relevant event that should trigger an internal alert and requires a prompt review"
+ },
+ {
+ "const": "critical",
+ "description": "Highly relevant event that indicates an incident. Critical events should be reviewed immediately. It is used only for cases in which probability borders certainty"
+ }
+ ]
+ },
+ "generate": {
+ "type": "boolean",
+ "description": "defines if the rules referred from the correlation rule should be converted as stand-alone rules"
+ }
+ }
}
\ No newline at end of file
diff --git a/Sigma_meta_filter.md b/specification/sigma_meta_filter.md
similarity index 98%
rename from Sigma_meta_filter.md
rename to specification/sigma_meta_filter.md
index 420c612..eedcdb8 100644
--- a/Sigma_meta_filter.md
+++ b/specification/sigma_meta_filter.md
@@ -1,4 +1,4 @@
-# Sigma Filter
+# Sigma Filters Specification
The following document defines the standardized global filter that can be used with Sigma rules.
diff --git a/Sigma_meta_rules.md b/specification/sigma_meta_rules.md
similarity index 99%
rename from Sigma_meta_rules.md
rename to specification/sigma_meta_rules.md
index 4ffbca7..762ff70 100644
--- a/Sigma_meta_rules.md
+++ b/specification/sigma_meta_rules.md
@@ -1,4 +1,4 @@
-# Sigma Correlation
+# Sigma Correlation Rules Specification
The following document defines the standardized correlation that can be used in Sigma rules.
diff --git a/Sigma_specification.md b/specification/sigma_rules.md
similarity index 99%
rename from Sigma_specification.md
rename to specification/sigma_rules.md
index 2472178..1bc7257 100644
--- a/Sigma_specification.md
+++ b/specification/sigma_rules.md
@@ -1,9 +1,7 @@
-# Sigma specification
+# Sigma Rules Specification
- Version 2.0.0
-- Release date 2024/09/01
-
-Take a look at [V1-V2 changes](V2_changes.md)
+- Release date 2024/08/12
# Summary
diff --git a/version_2_changes.md b/version_2_changes.md
new file mode 100644
index 0000000..dc895f8
--- /dev/null
+++ b/version_2_changes.md
@@ -0,0 +1,23 @@
+The following is a non-exhaustive list of changes between the v1 and v2 specification.
+
+# Sigmac
+
+As of August 1st 2024 the `sigmac` toolchain has reached it's end of life, and its corresponding [repository](https://github.com/SigmaHQ/legacy-sigmatools) has been archived. The `sigmac` toolchain doesn't take into account new feature introduced in the second version specification.
+
+The `pySigma` library and it's corresponding command line interface `sigma-cli`, provide full support for version 2 of the specification.
+
+# Date
+
+The latest version of the specification drops support for the date format using a slash `/` separator (YYYY/MM/DD), and now it only recommend the usage of the ISO 8601 format with the a `-` separator (YYYY-MM-DD).
+
+# Modifiers
+
+The latest version of the specification and by extension the `pySigma` library, introduces a new set of modifier. You can check the full list of all supported modifiers in the [modifiers appendix](./appendix/appendix_modifiers.md).
+
+# Correlation
+
+The latest version of the specification drops the usage of the old aggregation expression, in favour of a new format titles meta rules. Check out the [Sigma Meta Rules Specification](/sigma_meta_rules.md) files for a detailed description of the format.
+
+# Sigma Filters
+
+Check out the [Sigma Meta Filter Specification](/Sigma_meta_filter.md) for a detailed description of the format.
From addb8ee94ef003308b9f426d7d707a3fabb7d279 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Sun, 4 Aug 2024 18:44:48 +0200
Subject: [PATCH 02/31] more updates
---
appendix/appendix_tags.md | 4 ++--
json-schema/detection-rule-schema.json | 4 ++--
json-schema/meta-filter-schema.json | 4 ++--
json-schema/meta-rule-schema.json | 4 ++--
4 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/appendix/appendix_tags.md b/appendix/appendix_tags.md
index 24cc029..c31cad2 100644
--- a/appendix/appendix_tags.md
+++ b/appendix/appendix_tags.md
@@ -62,7 +62,7 @@ by MITRE defines two score dimensions for scoring of the robustness:
Details for both dimensions are [defined here](https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/levels/).
The *stp* namespace allows to score the robustness of the detection implemented by a Sigma rule according to this
-scheme. Because the event robustness depends on the event log source that is an enviromental property, Sigma allows to
+scheme. Because the event robustness depends on the event log source that is an environmental property, Sigma allows to
specify the robustness in the following ways:
* *analytic-only* defines just the analytic robustness in a tag like `stp.4`. This is usually appropriate for generic
@@ -72,7 +72,7 @@ specify the robustness in the following ways:
### Namespace: cve
-Use the CVE tag from the [mitre](https://cve.mitre.org) in lower case seperated by dots. Example tag: `cve.2021-44228`.
+Use the CVE tag from the [mitre](https://cve.mitre.org) in lower case separated by dots. Example tag: `cve.2021-44228`.
### Namespace: tlp
diff --git a/json-schema/detection-rule-schema.json b/json-schema/detection-rule-schema.json
index 629ad47..b2d7e63 100644
--- a/json-schema/detection-rule-schema.json
+++ b/json-schema/detection-rule-schema.json
@@ -1,6 +1,6 @@
{
- "$schema": "https://json-schema.org/draft/2020-12/schema",
- "title": "Sigma rule specification V2.0.0 (2024/xx/xx)",
+ "$schema": "https://json-schema.org/draft/2020-12/schema#",
+ "title": "Sigma rule specification V2.0.0 (2024/08/12)",
"type": "object",
"required": ["title", "logsource", "detection"],
"properties": {
diff --git a/json-schema/meta-filter-schema.json b/json-schema/meta-filter-schema.json
index 1b7bbac..2bcce50 100644
--- a/json-schema/meta-filter-schema.json
+++ b/json-schema/meta-filter-schema.json
@@ -1,6 +1,6 @@
{
- "$schema": "http://json-schema.org/draft-07/schema#",
- "title": "Sigma Global Filter specification V2.0.0 (2024/01/01)",
+ "$schema": "https://json-schema.org/draft/2020-12/schema#",
+ "title": "Sigma Global Filter specification V2.0.0 (2024/08/12)",
"type": "object",
"required": [
"title",
diff --git a/json-schema/meta-rule-schema.json b/json-schema/meta-rule-schema.json
index f2fc607..89aaf18 100644
--- a/json-schema/meta-rule-schema.json
+++ b/json-schema/meta-rule-schema.json
@@ -1,6 +1,6 @@
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
- "title": "Sigma Meta rule specification V2.0.0 (2024/xx/xx)",
+ "title": "Sigma Meta rule specification V2.0.0 (2024/08/12)",
"type": "object",
"required": [
"title",
@@ -201,4 +201,4 @@
"description": "defines if the rules referred from the correlation rule should be converted as stand-alone rules"
}
}
-}
\ No newline at end of file
+}
From af969728e2c9919e25a67445084cb4f9349a1bd6 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Sun, 4 Aug 2024 19:15:53 +0200
Subject: [PATCH 03/31] Update appendix_tags.md
---
appendix/appendix_tags.md | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/appendix/appendix_tags.md b/appendix/appendix_tags.md
index c31cad2..1b0977d 100644
--- a/appendix/appendix_tags.md
+++ b/appendix/appendix_tags.md
@@ -78,13 +78,23 @@ Use the CVE tag from the [mitre](https://cve.mitre.org) in lower case separated
All TLP levels defined by the [FIRST TLP-SIG](https://www.first.org/tlp/) in lower case. Example tag: `tlp.amber`.
+The following tags are currently supported:
+
+* `tlp.red`
+* `tlp.amber`
+* `tlp.amber-strict`
+* `tlp.green`
+* `tlp.clear`
+
### namespace: detection
Use the detection tag to indicate the type of a rule. Example tag: `detection.threat-hunting`.
-* dfir
-* emerging-threats
-* threat-hunting
+The following tags are currently supported:
+
+* `detection.dfir`
+* `detection.emerging-threats`
+* `detection.threat-hunting`
## History
* 2024-08-12 Tags V2.0.0
From 0a14ddb607a95fa8e6601ef7a2b6f34ef0635625 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Sun, 4 Aug 2024 19:27:14 +0200
Subject: [PATCH 04/31] remove config
---
_config.yml | 46 --------------------------
json-schema/detection-rule-schema.json | 2 +-
specification/sigma_rules.md | 4 +--
3 files changed, 3 insertions(+), 49 deletions(-)
delete mode 100644 _config.yml
diff --git a/_config.yml b/_config.yml
deleted file mode 100644
index 94c42f2..0000000
--- a/_config.yml
+++ /dev/null
@@ -1,46 +0,0 @@
-title: Specs
-description: All the specifications of Sigma format
-show_downloads: false
-color-scheme: auto
-logo: /images/Sigma_0.3.png
-favicon: true
-
-plugins:
- - jekyll-sitemap
- - jekyll-seo-tag
- - jemoji
- - jekyll-remote-theme
-
-remote_theme: BDHU/minimalist
-
-sidebar:
- - name: Home
- icon:
- link: /sigma-specification/index.html
- - name: Rules
- icon:
- link: /sigma-specification/Sigma_specification.html
- - name: Tags
- icon:
- link: /sigma-specification/Tags_specification.html
- - name: Taxonomy
- icon:
- link: /sigma-specification/Taxonomy_specification.html
- - name: SigmaHQ Filename Normalisation
- icon:
- link: /sigma-specification/sigmahq/Sigmahq_filename_rule.html
- - name: Github repository
- icon:
- link: https://github.com/SigmaHQ/sigma-specification
- - name: SigmaHQ Rules
- icon:
- link: https://github.com/SigmaHQ/sigma
- - name: PySigma Converter
- icon:
- link: https://github.com/SigmaHQ/pySigma
-
-# https://github.com/github/pages-gem/issues/399#issuecomment-301827749
-# When running locally, we run into the following error —
-# GitHub Metadata: No GitHub API authentication could be found. Some fields may be missing or have incorrect data.
-# Adding the following line to avoid the issue
-github: [metadata]
\ No newline at end of file
diff --git a/json-schema/detection-rule-schema.json b/json-schema/detection-rule-schema.json
index b2d7e63..17f7adc 100644
--- a/json-schema/detection-rule-schema.json
+++ b/json-schema/detection-rule-schema.json
@@ -34,7 +34,7 @@
"description": "The rule was derived from the referred rule or rules, which may remain active"
},
{
- "const": "obsoletes",
+ "const": "obsolete",
"description": "The rule obsoletes the referred rule or rules, which aren't used anymore"
},
{
diff --git a/specification/sigma_rules.md b/specification/sigma_rules.md
index 1bc7257..564cb33 100644
--- a/specification/sigma_rules.md
+++ b/specification/sigma_rules.md
@@ -180,13 +180,13 @@ related:
- id: 08fbc97d-0a2f-491c-ae21-8ffcfd3174e9
type: derived
- id: 929a690e-bef0-4204-a928-ef5e620d6fcc
- type: obsoletes
+ type: obsolete
```
Currently the following types are defined:
* `derived`: The rule was derived from the referred rule or rules, which may remain active.
-* `obsoletes`: The rule obsoletes the referred rule or rules, which aren't used anymore.
+* `obsolete`: The rule obsoletes the referred rule or rules, which aren't used anymore.
* `merged`: The rule was merged from the referred rules. The rules may still exist and are in use.
* `renamed`: The rule had previously the referred identifier or identifiers but was renamed for whatever
reason, e.g. from a private naming scheme to UUIDs, to resolve collisions etc. It's not
From 5372368102345f6e0e6f476f3bef4151b1b04fe1 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Sun, 4 Aug 2024 20:03:41 +0200
Subject: [PATCH 05/31] Update appendix_tags.md
---
appendix/appendix_tags.md | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/appendix/appendix_tags.md b/appendix/appendix_tags.md
index 1b0977d..fb41804 100644
--- a/appendix/appendix_tags.md
+++ b/appendix/appendix_tags.md
@@ -33,17 +33,17 @@ The following document defines the standardized tags that can be used to categor
Tactics:
-* initial_access: [Initial Access](https://attack.mitre.org/tactics/TA0001/)
+* initial-access: [Initial Access](https://attack.mitre.org/tactics/TA0001/)
* execution: [Execution](https://attack.mitre.org/tactics/TA0002/)
* persistence: [Persistence](https://attack.mitre.org/tactics/TA0003/)
-* privilege_escalation: [Privilege Escalation](https://attack.mitre.org/tactics/TA0004/)
-* defense_evasion: [Defense Evasion](https://attack.mitre.org/tactics/TA0005/)
-* credential_access: [Credential Access](https://attack.mitre.org/tactics/TA0006/)
+* privilege-escalation: [Privilege Escalation](https://attack.mitre.org/tactics/TA0004/)
+* defense-evasion: [Defense Evasion](https://attack.mitre.org/tactics/TA0005/)
+* credential-access: [Credential Access](https://attack.mitre.org/tactics/TA0006/)
* discovery: [Discovery](https://attack.mitre.org/tactics/TA0007/)
-* lateral_movement: [Lateral_Movement](https://attack.mitre.org/tactics/TA0008/)
+* lateral-movement: [Lateral_Movement](https://attack.mitre.org/tactics/TA0008/)
* collection: [Collection](https://attack.mitre.org/tactics/TA0009/)
* exfiltration: [Exfiltration](https://attack.mitre.org/tactics/TA0010/)
-* command_and_control: [Command and Control](https://attack.mitre.org/tactics/TA0011/)
+* command-and-control: [Command and Control](https://attack.mitre.org/tactics/TA0011/)
* impact: [Impact](https://attack.mitre.org/tactics/TA0040/)
### Namespace: car
From 050b0d4d74f5ab01d5ff9deec8fe868372798180 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Sun, 4 Aug 2024 20:05:49 +0200
Subject: [PATCH 06/31] typo fixes
---
sigmahq/sigmahq_conventions.md | 4 ++--
specification/sigma_rules.md | 8 ++++----
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/sigmahq/sigmahq_conventions.md b/sigmahq/sigmahq_conventions.md
index d221000..7e9ccd5 100644
--- a/sigmahq/sigmahq_conventions.md
+++ b/sigmahq/sigmahq_conventions.md
@@ -77,7 +77,7 @@ All newly created rules must start with a status of `experimental`
## Description
- All rule descriptions must explain what the rule detects. A best practice therefore is to start with the word `Detects`
-- If a description text is too long or it's expressing multiple ideas. It's advised to use the pipe symbole `|` to signify a multiline string. Example:
+- If a description text is too long or it's expressing multiple ideas. It's advised to use the pipe symbol `|` to signify a multiline string. Example:
```yml
description: |
@@ -88,7 +88,7 @@ description: |
## References
- All rules must provide a public reference, if possible.
-- References to the MITRE ATT&CK website are not allowed. Instead they shloud be expressed as tags using the appropriate MITRE tags.
+- References to the MITRE ATT&CK website are not allowed. Instead they should be expressed as tags using the appropriate MITRE tags.
- References to git-based platforms such as Github or Gitlab must be provided as permalinks instead of main or master branch links. This is to avoid any future confusion in the intended reference in case the maintainers of said branches introduce new changes.
## Detection
diff --git a/specification/sigma_rules.md b/specification/sigma_rules.md
index 564cb33..d152d07 100644
--- a/specification/sigma_rules.md
+++ b/specification/sigma_rules.md
@@ -32,7 +32,7 @@
- [Maps](#maps)
- [Field Usage](#field-usage)
- [Special Field Values](#special-field-values)
- - [Field Existance](#field-existance)
+ - [Field Existance](#field-existence)
- [Value Modifiers](#value-modifiers)
- [Modifier Types](#modifier-types)
- [Placeholders](#placeholders)
@@ -512,7 +512,7 @@ condition:
selection and not filter
```
-### Field Existance
+### Field Existence
In some case a field can be optional in the event. You can use the `exists` modifiers to check it.
@@ -624,7 +624,7 @@ The condition is the most complex part of the specification and will be subject
- 1/all of them
Logical OR (`1 of them`) or AND (`all of them`) across all defined search identifiers not starting with an underscore `_`. The search identifiers
- themselves are logically linked with their default behaviour for maps (AND) and lists (OR).
+ themselves are logically linked with their default behavior for maps (AND) and lists (OR).
The usage of `all of them` is discouraged, as it prevents the possibility of downstream users of a rule to generically filter unwanted matches. See `all of {search-identifier-pattern}` in the next section as the preferred method.
@@ -695,7 +695,7 @@ The level field contains one of five string values. It describes the criticality
**Use:** optional
-A Sigma rule can be categorised with tags. Tags should generally follow this syntax:
+A Sigma rule can be categorized with tags. Tags should generally follow this syntax:
* Character set: lower-case letters, numerals, underscores and hyphens
* no spaces
From d66bdc17ff5198deaeebe1b12d1b9cfc521b1b32 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Sun, 4 Aug 2024 20:29:07 +0200
Subject: [PATCH 07/31] rename files
---
...difiers.md => sigma-modifiers-appendix.md} | 0
...ppendix_tags.md => sigma-tags-appendix.md} | 0
...taxonomy.md => sigma-taxonomy-appendix.md} | 0
...ma.json => sigma-correlations-schema.json} | 0
....json => sigma-detection-rule-schema.json} | 0
...-schema.json => sigma-filters-schema.json} | 0
...rule.md => sigmahq_filename_convention.md} | 0
...ventions.md => sigmahq_rule_convention.md} | 11 +-
...le_rule.md => sigmahq_title_convention.md} | 196 +++++++++---------
... sigma-correlation-rules-specification.md} | 0
..._rules.md => sigma-rules-specification.md} | 0
...lter.md => sigma_filters-specification.md} | 0
version_2_changes.md => version-2-changes.md | 0
13 files changed, 106 insertions(+), 101 deletions(-)
rename appendix/{appendix_modifiers.md => sigma-modifiers-appendix.md} (100%)
rename appendix/{appendix_tags.md => sigma-tags-appendix.md} (100%)
rename appendix/{appendix_taxonomy.md => sigma-taxonomy-appendix.md} (100%)
rename json-schema/{meta-rule-schema.json => sigma-correlations-schema.json} (100%)
rename json-schema/{detection-rule-schema.json => sigma-detection-rule-schema.json} (100%)
rename json-schema/{meta-filter-schema.json => sigma-filters-schema.json} (100%)
rename sigmahq/{Sigmahq_filename_rule.md => sigmahq_filename_convention.md} (100%)
rename sigmahq/{sigmahq_conventions.md => sigmahq_rule_convention.md} (95%)
rename sigmahq/{sigmahq_title_rule.md => sigmahq_title_convention.md} (97%)
rename specification/{sigma_meta_rules.md => sigma-correlation-rules-specification.md} (100%)
rename specification/{sigma_rules.md => sigma-rules-specification.md} (100%)
rename specification/{sigma_meta_filter.md => sigma_filters-specification.md} (100%)
rename version_2_changes.md => version-2-changes.md (100%)
diff --git a/appendix/appendix_modifiers.md b/appendix/sigma-modifiers-appendix.md
similarity index 100%
rename from appendix/appendix_modifiers.md
rename to appendix/sigma-modifiers-appendix.md
diff --git a/appendix/appendix_tags.md b/appendix/sigma-tags-appendix.md
similarity index 100%
rename from appendix/appendix_tags.md
rename to appendix/sigma-tags-appendix.md
diff --git a/appendix/appendix_taxonomy.md b/appendix/sigma-taxonomy-appendix.md
similarity index 100%
rename from appendix/appendix_taxonomy.md
rename to appendix/sigma-taxonomy-appendix.md
diff --git a/json-schema/meta-rule-schema.json b/json-schema/sigma-correlations-schema.json
similarity index 100%
rename from json-schema/meta-rule-schema.json
rename to json-schema/sigma-correlations-schema.json
diff --git a/json-schema/detection-rule-schema.json b/json-schema/sigma-detection-rule-schema.json
similarity index 100%
rename from json-schema/detection-rule-schema.json
rename to json-schema/sigma-detection-rule-schema.json
diff --git a/json-schema/meta-filter-schema.json b/json-schema/sigma-filters-schema.json
similarity index 100%
rename from json-schema/meta-filter-schema.json
rename to json-schema/sigma-filters-schema.json
diff --git a/sigmahq/Sigmahq_filename_rule.md b/sigmahq/sigmahq_filename_convention.md
similarity index 100%
rename from sigmahq/Sigmahq_filename_rule.md
rename to sigmahq/sigmahq_filename_convention.md
diff --git a/sigmahq/sigmahq_conventions.md b/sigmahq/sigmahq_rule_convention.md
similarity index 95%
rename from sigmahq/sigmahq_conventions.md
rename to sigmahq/sigmahq_rule_convention.md
index 7e9ccd5..b797355 100644
--- a/sigmahq/sigmahq_conventions.md
+++ b/sigmahq/sigmahq_rule_convention.md
@@ -1,7 +1,8 @@
# SigmaHQ Rule Conventions
This document describes an additional set of rule conventions enforced by the SigmaHQ rule repository in order to ensure an easy to maintain rule base.
-For the general Sigma specification please read the [Sigma_specification.md](../Sigma_specification.md).
+
+For the general Sigma rule specification please read see [this](/specification/sigma_rules.md)
## Summary
@@ -116,7 +117,11 @@ detection:
- '\example_3.exe'
```
-## False Postives
+### Condition
+
+
+
+## False Positives
- If the rule author expects false positives (found during testing or via external references), then it must be expressed as clear as possible. For example:
@@ -131,4 +136,4 @@ falsepositives:
Also please note the following
-- Keywords such as `None`, `Pentest`, `Penetration Test`, `Red Team` are not accepted as valid values.
+- Keywords such as `None`, `Pentest`, `Penetration Test`, `Red Team`, Etc, are not accepted as valid values.
diff --git a/sigmahq/sigmahq_title_rule.md b/sigmahq/sigmahq_title_convention.md
similarity index 97%
rename from sigmahq/sigmahq_title_rule.md
rename to sigmahq/sigmahq_title_convention.md
index ddc88e8..c0a55d6 100644
--- a/sigmahq/sigmahq_title_rule.md
+++ b/sigmahq/sigmahq_title_convention.md
@@ -1,98 +1,98 @@
-# SigmaHQ Rule Conventions
-
-This document provides general guidelines and tips on how to write titles for sigma rules.
-
-Note that this is by no means an exhaustive list. It is meant to be a general guide for inspiration and to have an easily sharable resource for new contributors (e.g. a resource to link at in PR discussions).
-
-## Summary
-
-- [Summary](#summary)
-- [Generality](#generality)
-- [Structure](#structure)
- - [Prefix (Optional)](#prefix-optional)
- - [Suffix (Optional)](#suffix-optional)
- - [Main Title](#main-title)
-
-## Generality
-
-Bearing in mind that the title is one of the first things that an analyst will see. It should therefore be used as a clue and be as clear as possible to guide the assessment of the alert.
-
-The title and level of the rule must be consistent
-
-## Structure
-
-Titles can be split with "-" : `Prefix - Main Title - Sufix`
-
-### Prefix (Optional)
-
-It is used to give a category, type of malware or name a threat actor. The choice depends highly on the type of rule.
-
-Examples:
-
-- HackTool
-- PUA
-- Remote Access Tool
-
-Specific wording example:
-
-- "ATP27 - "
-- "ATP29 - "
-- "UNC2452 - "
-- "UNC4841 - "
-
-### Suffix (Optional)
-
-Sometimes the detections are duplicated across different `logsource`s with little changes to their logic. This is common in the case of Process Creation rules targeting the PowerShell process. Those rules are typically duplicated for the different PowerShell `logsource`s using ScriptBlockText to check for the same characteristics. A suffix in this case will be used to differentiate between the rules of the different `logsource`s.
-
-Example:
-
-```yaml
-title: Invoke-Obfuscation Obfuscated IEX Invocation
-title: Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell
-title: Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module
-title: Invoke-Obfuscation Obfuscated IEX Invocation - Security
-title: Invoke-Obfuscation Obfuscated IEX Invocation - System
-```
-
-### Main Title
-
-The point of a description is to explain the alert in a meaningful way.
-
-The title does not need to use the terms "Detect" or "Detection". It doesn't have to be a sentence. A keyword style increases the information density.
-
-We use a simple formula to describe the alert.
-Example:
-
-- "7Zip Compressing ..."
-- "Add User to ..."
-- "Bypass UAC Using ..."
-- "Renamed xxx Execution"
-- "UAC Bypass Using ..."
-
-Rules of level `informational` or `low` are not intended to be used to create alerts on their own. Their purpose is to conserve events or criteria of relevance, to be used in correlations or for ideas for threat hunting. A rule of those levels will by definition not create false positives as they should not be used for alerting.
-
-The title should therefore be general and should not indicate that the rule describes suspicious or malicious behavior.
-
-Example : `Net.exe Execution`
-
-`medium` rules can have environment dependent false positives and require a tuning/evaluation phase before deploying to production environments.
-
-Keywords used to indicate this:
-
-- "Potential "
-
-`high` rules requires a prompt review.
-
-Keywords used to indicate this:
-
-- "Suspicious "
-
-`critical` rules should be reviewed immediately
-The title must therefore be precise and indicate the specific threat.
-
-Keywords used to indicate this:
-
-- "Malware"
-- "Exploit"
-- "... Attempt"
-- " Activity"
+# SigmaHQ Rule Conventions
+
+This document provides general guidelines and tips on how to write titles for sigma rules.
+
+Note that this is by no means an exhaustive list. It is meant to be a general guide for inspiration and to have an easily sharable resource for new contributors (e.g. a resource to link at in PR discussions).
+
+## Summary
+
+- [Summary](#summary)
+- [Generality](#generality)
+- [Structure](#structure)
+ - [Prefix (Optional)](#prefix-optional)
+ - [Suffix (Optional)](#suffix-optional)
+ - [Main Title](#main-title)
+
+## Generality
+
+Bearing in mind that the title is one of the first things that an analyst will see. It should therefore be used as a clue and be as clear as possible to guide the assessment of the alert.
+
+The title and level of the rule must be consistent
+
+## Structure
+
+Titles can be split with "-" : `Prefix - Main Title - Sufix`
+
+### Prefix (Optional)
+
+It is used to give a category, type of malware or name a threat actor. The choice depends highly on the type of rule.
+
+Examples:
+
+- HackTool
+- PUA
+- Remote Access Tool
+
+Specific wording example:
+
+- "ATP27 - "
+- "ATP29 - "
+- "UNC2452 - "
+- "UNC4841 - "
+
+### Suffix (Optional)
+
+Sometimes the detections are duplicated across different `logsource`s with little changes to their logic. This is common in the case of Process Creation rules targeting the PowerShell process. Those rules are typically duplicated for the different PowerShell `logsource`s using ScriptBlockText to check for the same characteristics. A suffix in this case will be used to differentiate between the rules of the different `logsource`s.
+
+Example:
+
+```yaml
+title: Invoke-Obfuscation Obfuscated IEX Invocation
+title: Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell
+title: Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module
+title: Invoke-Obfuscation Obfuscated IEX Invocation - Security
+title: Invoke-Obfuscation Obfuscated IEX Invocation - System
+```
+
+### Main Title
+
+The point of a description is to explain the alert in a meaningful way.
+
+The title does not need to use the terms "Detect" or "Detection". It doesn't have to be a sentence. A keyword style increases the information density.
+
+We use a simple formula to describe the alert.
+Example:
+
+- "7Zip Compressing ..."
+- "Add User to ..."
+- "Bypass UAC Using ..."
+- "Renamed xxx Execution"
+- "UAC Bypass Using ..."
+
+Rules of level `informational` or `low` are not intended to be used to create alerts on their own. Their purpose is to conserve events or criteria of relevance, to be used in correlations or for ideas for threat hunting. A rule of those levels will by definition not create false positives as they should not be used for alerting.
+
+The title should therefore be general and should not indicate that the rule describes suspicious or malicious behavior.
+
+Example : `Net.exe Execution`
+
+`medium` rules can have environment dependent false positives and require a tuning/evaluation phase before deploying to production environments.
+
+Keywords used to indicate this:
+
+- "Potential "
+
+`high` rules requires a prompt review.
+
+Keywords used to indicate this:
+
+- "Suspicious "
+
+`critical` rules should be reviewed immediately
+The title must therefore be precise and indicate the specific threat.
+
+Keywords used to indicate this:
+
+- "Malware"
+- "Exploit"
+- "... Attempt"
+- " Activity"
diff --git a/specification/sigma_meta_rules.md b/specification/sigma-correlation-rules-specification.md
similarity index 100%
rename from specification/sigma_meta_rules.md
rename to specification/sigma-correlation-rules-specification.md
diff --git a/specification/sigma_rules.md b/specification/sigma-rules-specification.md
similarity index 100%
rename from specification/sigma_rules.md
rename to specification/sigma-rules-specification.md
diff --git a/specification/sigma_meta_filter.md b/specification/sigma_filters-specification.md
similarity index 100%
rename from specification/sigma_meta_filter.md
rename to specification/sigma_filters-specification.md
diff --git a/version_2_changes.md b/version-2-changes.md
similarity index 100%
rename from version_2_changes.md
rename to version-2-changes.md
From 85e93a500cc4a02a5c635ae7bc386550132e38d5 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Mon, 5 Aug 2024 00:45:07 +0200
Subject: [PATCH 08/31] updates
---
README.md | 28 ++++++++++++++++++++-----
images/Sigma_0.3.png | Bin 27681 -> 0 bytes
images/sigma_logo_dark.png | Bin 0 -> 97205 bytes
images/sigma_logo_light.png | Bin 0 -> 70358 bytes
sigmahq/sigmahq_filename_convention.md | 3 +--
sigmahq/sigmahq_rule_convention.md | 7 +++++--
sigmahq/sigmahq_title_convention.md | 6 +++---
7 files changed, 32 insertions(+), 12 deletions(-)
delete mode 100644 images/Sigma_0.3.png
create mode 100644 images/sigma_logo_dark.png
create mode 100644 images/sigma_logo_light.png
diff --git a/README.md b/README.md
index 8e175c8..3e78cd8 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,26 @@
-# Sigma-Specification
-
-This repository is used to maintain the specification for the Sigma format.
-
-[Web version](https://sigmahq.github.io/sigma-specification/)
+# Sigma Specification - Generic Signature Format for SIEM Systems
+
+
+
+
+
+