Refactor artifacts to allow for a base artifact. (#39)

Refactored the Windows.Hayabusa.Rules artifact into two artifacts:

- Windows.Sigma.Base is a base artifact containing log sources and field
mappings within the Velociraptor realm
- Windows.Hayabusa.Rules calls Windows.Sigma.Base with pre-packaged
rules.

This effectively creates a reusable Velociraptor taxonomy which can be
used to help build custom rules - as long as the rule refers to the well
defined log sources and field mappings, the rule will work within
Velociraptor.

Also removed curated rules and upgraded Hayabusa rules.

.github/workflows/gh-pages.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   deploy:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
         with:
@@ -30,6 +30,7 @@ jobs:
       - name: Prepare
         run: |
           make linux
+          ./velosigmac compile --config ./config/windows_base.yaml --output ./output/Windows-Sigma-Base.zip  --yaml ./output/Windows.Sigma.Base.yaml
           ./velosigmac compile --config ./config/windows_hayabusa_rules.yaml --output ./output/Velociraptor-Hayabusa-Rules.zip --rejects ./rejected/windows_hayabusa_rejects.json --ignore_previous_rejects
           ./velosigmac compile --config ./config/windows_hayabusa_event_monitoring.yaml --output ./output/Velociraptor-Hayabusa-Monitoring.zip --rejects rejected/windows_hayabusa_rejects.json --ignore_previous_rejects
           ./velosigmac compile --config ./config/ChopChopGo_rules.yaml --output ./output/Velociraptor-ChopChopGo-Rules.zip --rejects rejected/ChopChopGo_rules_rejects.json --ignore_previous_rejects

.github/workflows/test.yml

@@ -9,23 +9,23 @@ jobs:
     steps:
 
     - name: Set up Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v4
       with:
-        go-version: '^1.20'
+        go-version: '^1.23'
       id: go
 
     - name: Check out code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         submodules: recursive
 
     - name: Download Latest Velociraptor
-      uses: robinraju/release-downloader@v1.8
+      uses: robinraju/release-downloader@v1
       id: velociraptor
       with:
         repository: velocidex/velociraptor
-        tag: v0.72
-        fileName: "velociraptor-v0.72.4-linux-amd64-musl"
+        tag: v0.73
+        fileName: "velociraptor-v0.73.3-linux-amd64-musl"
         out-file-path: tests
 
     - name: Run tests
@@ -43,13 +43,13 @@ jobs:
         chmod +x ./tests/velociraptor
         make golden
 
-    - uses: actions/upload-artifact@v3
+    - uses: actions/upload-artifact@v4
       if: always()
       with:
         name: artifact
         path: tests/testcases
 
-    - uses: actions/upload-artifact@v3
+    - uses: actions/upload-artifact@v4
       if: always()
       with:
         name: output

Makefile

@@ -1,5 +1,3 @@
-
-
 all: linux
 
 linux:
@@ -8,12 +6,15 @@ linux:
 windows:
 	GOOS=windows go build -o velosigmac.exe .\src\
 
-compile: compileThirdParty compileCurated
+compile: compileThirdParty
 
 compileThirdParty:  compileHayabusa compileHayabusaMonitoring compileChopChopGo
 
-compileHayabusa:
-	./velosigmac compile --config ./config/windows_hayabusa_rules.yaml --output ./output/Velociraptor-Hayabusa-Rules.zip --yaml ./output/Velociraptor-Hayabusa-Rules.yaml --rejects rejected/windows_hayabusa_rejects.json --ignore_previous_rejects
+compileWindowsBase:
+	./velosigmac compile --config ./config/windows_base.yaml --output ./output/Windows-Sigma-Base.zip --yaml ./output/Windows.Sigma.Base.yaml
+
+compileHayabusa: compileWindowsBase
+	./velosigmac compile --config ./config/windows_hayabusa_rules.yaml --output ./output/Velociraptor-Hayabusa-Rules.zip --yaml ./output/Velociraptor.Hayabusa.Rules.yaml --rejects rejected/windows_hayabusa_rejects.json --ignore_previous_rejects
 
 debugHayabusa:
 	dlv debug ./src -- compile --config ./config/windows_hayabusa_rules.yaml --output ./output/Velociraptor-Hayabusa-Rules.zip --yaml ./output/Velociraptor-Hayabusa-Rules.yaml
@@ -24,14 +25,6 @@ compileHayabusaMonitoring:
 compileChopChopGo:
 	./velosigmac compile --config ./config/ChopChopGo_rules.yaml --output ./output/Velociraptor-ChopChopGo-Rules.zip --yaml ./output/Velociraptor-ChopChopGo-Rules.yaml --rejects rejected/ChopChopGo_rules_rejects.json --ignore_previous_rejects
 
-compileCurated:  compilePostProcess compileWindowsRules
-
-compilePostProcess:
-	./velosigmac compile --config ./config/velociraptor_post_process.yaml --output ./output/Velociraptor-Post-Process.zip --yaml ./output/Velociraptor-Post-Process.yaml
-
-compileWindowsRules:
-	./velosigmac compile --config ./config/velociraptor_windows_rules.yaml --output ./output/Velociraptor-Windows-Rules.zip --yaml ./output/Velociraptor-Windows-Rules.yaml
-
 test: compile
 	go test -v ./...