fix(sigma): generated IOC rules now OR across observable types - #13
Merged
SkxOverKill merged 2 commits intoAug 11, 2026
Merged
Conversation
Generated rules put every observable type into one flat `selection` map with a `1 of selection*` condition. In Sigma a single selection map ANDs its fields, so a network blocklist rule only fired when one event contained a matching domain AND IP AND URL simultaneously — which almost never happens, silently neutering the rules. The same applied to hash and host-artifact rules. Split each generator into `selection_*` sub-selections (DNS/IP/URL, SHA256/MD5/SHA1, mutex/filename/regkey) so `1 of selection*` means "any type matches", and switch MD5/SHA1 to Sysmon's `Hashes` field (plain `md5`/`sha1` fields are not standard Sigma fields and match nothing in most backends).
The web-shell entry declared a `webserver` logsource at the map level but its build() emits `file_event`, so the outer value was dead config that disagreed with the generated rule. Align it to what the rule actually uses.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Two fixes to the Sigma rule generator (
src/lib/sigma/generate.ts):Generated IOC rules no longer require all types to match in one event. The network, file-hash, and host-artifact generators put every observable type into a single flat
selectionmap with a1 of selection*condition. In Sigma, one selection map ANDs its fields — so the network blocklist rule only fired when a single event contained a matching domain and IP and URL at once (effectively never). Each type is now emitted as its ownselection_*sub-selection so1 of selection*means "any type matches", which is what a blocklist rule intends.MD5/SHA1 hash rules use Sysmon's
Hashesfield. The old rules emittedmd5|contains/sha1|contains— not standard Sigma fields for Windows process creation, so they match nothing in most backends. All three hash types now matchHashes|containswith theALGO=<hex>value.Plus a small consistency fix: the T1505.003 web-shell entry declared a
webserverlogsource at the map level while itsbuild()emitsfile_event— the outer value was dead config and is now aligned.How verified
src/lib/sigma/generate.test.ts(5 tests) asserting sub-selection structure,Hashesfield usage, and YAML output.npm run test: 175 passed (12 files).npm run lint/npm run typecheck: no new issues vsmain(the remaining extract.ts typecheck errors and unused-var warnings are pre-existing on the base branch).