8000 fix logic of detection section by CheraghiMilad · Pull Request #5457 · SigmaHQ/sigma · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

fix logic of detection section #5457

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix logic of detection section #5457

wants to merge 1 commit into from

Conversation

CheraghiMilad
Copy link
Contributor

Summary of the Pull Request

logic of detection section is wrong and no one log case match. i changed it and know is operational

Changelog

update: Credentials In Files - Linux

Example Log Event

type=EXECVE msg=audit(1748905439.265:56449): argc=5 a0="grep" a1="--color=auto" a2="-ri" a3="password" a4="/"

image

Fixed Issues

SigmaHQ Rule Creation Conventions

  • If your PR adds new rules, please consider following and applying these conventions

@github-actions github-actions bot added Rules Linux Pull request add/update linux related rules labels Jun 2, 2025
nasbench
nasbench requested changes Jun 4, 2025
View reviewed changes
rules/linux/auditd/lnx_auditd_find_cred_in_files.yml
Comment on lines +19 to +23
a0: 'grep'
a1: '--color=auto' # Is Alias
a2: '-ri'
a3: 'password'
a4: '/'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This does not fix the logic but make it more strict and will not match different orders of args.

The reason you did not get a match is probably due to a backend issue when converting the rule. Because a keyword rule should match all strings present on the log.

Since both the original and change contain the required strings, this does not improve the detections but makes it compatible with auditd. But as I said you are now hardcoding arg order.

So the change does not make sense. Please explain your reasoning?

@nasbench nasbench added Work In Progress Some changes are needed Author Input Required changes the require information from original author of the rules labels Jun 4, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@nasbench nasbench nasbench requested changes

Assignees
No one assigned
Labels
Author Input Required changes the require information from original author of the rules Linux Pull request add/update linux related rules Rules Work In Progress Some changes are needed
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@CheraghiMilad @nasbench
0