Using Process Name instead of Image

[lolbins]

Hi Team,

My data has a parsed process.name field which i'd like to do exact matches on in elastic.

I'm finding most sigma detections use "Image|endswith: '\cmd.exe'".
I'd prefer to do something like:

Image: "cmd.exe"

and map it to my process.name field as this is more performant than doing wildcard matches on the entire process path and ending with \cmd.exe.

Any ideas on how to achieve this using sigmac?
Thanks for all the amazing work!

[nasbench]

This is possible with Pysigma. Give this a read as it should have your answer https://medium.com/sigma-hq/connecting-sigma-rule-sets-to-your-environment-with-processing-pipelines-4ee1bd577070