Skip to content

v0.2.4: Wildcard escaping fixes

Compare
Choose a tag to compare
@slincoln-aiq slincoln-aiq released this 18 Feb 23:55
· 48 commits to main since this release
5c1abda
  • Fixed issue #13 where '*' character was being escaped incorrectly CommandLine strings
  • Fixed issue #14 where Sigma schema wildcards ('*', '?') in the middle of a string would create nonsense queries
    • Since KQL does not use wildcards, anytime a wildcard value is seen inside a string (not at the beginning or end) from the Sigma Rule, we now split it by the wildcard and use a contains for each substring.
    • Example: a CommandLine field with a value of advfirewall firewall add rule name=Dropbox dir=in action=allow "program=?:\Program Files (x86)\Dropbox\Client\Dropbox.exe" enable=yes profile=Any will be converted to (ProcessCommandLine contains "advfirewall firewall add rule name=Dropbox dir=in action=allow \"program=" and ProcessCommandLine contains ":\\Program Files (x86)\\Dropbox\\Client\\Dropbox.exe\" enable=yes profile=Any")