chg: Sigma v2 compliant MitreTactics tag format
#1395
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
fukusuket
changed the title
MitreTactics tag format
hitenkoku
approved these changes
Aug 12, 2024
|
@fukusuket Thanks! I didn't notice this. It seems that there are still at least 85 files that still use the Since most rules now use this format, I will merge this. |
YamatoSecurity
approved these changes
Aug 14, 2024
I see..., I will check and create a PR on the Sigma side if necessary!💪 |
|
@YamatoSecurity import os
import yaml
def find_files_with_underscore_tags(directory):
files_with_underscore_tags = []
for root, _, files in os.walk(directory):
for file in files:
if file.endswith('.yml') or file.endswith('.yaml'):
file_path = os.path.join(root, file)
with open(file_path, 'r') as f:
try:
content = yaml.safe_load(f)
tags = content.get('tags', [])
if any('_' in tag for tag in tags):
files_with_underscore_tags.append(file_path)
except yaml.YAMLError as e:
print(f"Error parsing {file_path}: {e}")
return files_with_underscore_tags
# Example usage
directory = './'
files = find_files_with_underscore_tags(directory)
for file in files:
print(file) |
|
I see. That is unfortunate they didn't update it for those rules. How about we update the tags in our conversion tool? This way we don't need to update Hayabusa and they all use the same v2 format. |
|
I see, That's better! I'll fix the converter!💪 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What Changed
The following pull request changed the tag format of Sigma's
MitreTacticsfrom_to-. So I modified the Hayabusa side to follow that specification.The above pull request is for today, so it will be merged in today's job in the hayabusa_rules repository.
Test
I have confirmed that we can output
MitreTacticsfor the latest Sigma(SigmaHQ/sigma@760597d) repository as follows.{ "Timestamp": "2021-11-18 16:43:22.487 +09:00", "RuleTitle": "EVTX Created In Uncommon Location", "Level": "med", "Computer": "PC-01.cybercat.local", "Channel": "Sysmon", "EventID": 11, "RuleAuthor": "D3F7A5105", "RuleModifiedDate": "2024-03-26", "Status": "experimental", "RecordID": 13280, "Details": { "Path": "C:\\Users\\pc1-user\\Desktop\\sysmon.evtx", "Proc": "C:\\Windows\\system32\\mmc.exe", "PID": 3116, "PGUID": "510C1E8A-FFD9-6195-4401-000000000F00" }, "ExtraFieldInfo": { "CreationUtcTime": "2021-11-18 07:43:22.460", "RuleName": "-", "User": "CYBERCAT\\pc1-user", "UtcTime": "2021-11-18 07:43:22.460" }, "MitreTactics": [ "Evas" ], "MitreTags": [ "T1562.002" ], "OtherTags": [ "sysmon" ], "Provider": "Sysmon", "RuleCreationDate": "2023-01-02", "RuleFile": "file_event_win_create_evtx_non_common_locations.yml", "EvtxFile": "../hayabusa-sample-evtx/YamatoSecurity/DefenseEvasion/T1218.004_SignedBinaryProxyExecutionInstallUtil_Sysmon.evtx" }I would appreciate it if you could check it out when you have time🙏