Skip to content

Commit 0bedcaa

Browse files
thomaspatzkethomaspatzke
committed
Merge branch 'release-0.11'
2 parents bd1d154 + 339b222 commit 0bedcaa

12 files changed

Lines changed: 440 additions & 158 deletions

File tree

‎.github/workflows/release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
- name: Set up Python
2020
uses: actions/setup-python@v5
2121
with:
22-
python-version: 3.9
22+
python-version: 3.13
2323
cache: poetry
2424
- name: Verify versioning
2525
run: |

‎.github/workflows/test.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ jobs:
1010
test:
1111
strategy:
1212
matrix:
13-
os: ["ubuntu-24.04", "windows-2022", "macos-14"]
13+
os: ["ubuntu-latest", "windows-latest", "macos-latest"]
1414
python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
1515
runs-on: ${{ matrix.os }}
1616
steps:

‎poetry.lock‎

Lines changed: 122 additions & 122 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pyproject.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[project]
22
name = "pySigma"
3-
version = "0.11.19"
3+
version = "1.0.0"
44
license = "LGPL-2.1-only"
55
description = "Sigma rule processing and conversion tools"
66
authors = [

‎sigma/collection.py‎

Lines changed: 22 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -90,33 +90,34 @@ def from_dicts(
9090
if isinstance(
9191
rule, SigmaRule
9292
): # Included rules are already parsed, skip collection action processing
93-
parsed_rules.append(rule)
94-
rule.source = source
93+
parsed_rule = rule
94+
parsed_rules.append(parsed_rule)
95+
parsed_rule.source = source
9596
else:
9697
action = rule.get("action")
9798
if action is None: # no action defined
9899
if "correlation" in rule: # correlation rule - no global rule merge
99-
parsed_rules.append(
100-
SigmaCorrelationRule.from_dict(
101-
rule,
102-
collect_errors,
103-
source,
104-
)
100+
parsed_rule = SigmaCorrelationRule.from_dict(
101+
rule,
102+
collect_errors,
103+
source,
105104
)
105+
parsed_rules.append(parsed_rule)
106+
errors.extend(parsed_rule.errors) # Propagate errors from rule
106107
elif "filter" in rule: # correlation rule - no global rule merge
107-
parsed_rules.append(
108-
SigmaFilter.from_dict(
109-
rule,
110-
collect_errors,
111-
source,
112-
)
108+
parsed_rule = SigmaFilter.from_dict(
109+
rule,
110+
collect_errors,
111+
source,
113112
)
113+
parsed_rules.append(parsed_rule)
114+
errors.extend(parsed_rule.errors) # Propagate errors from rule
114115
else: # merge with global rule and parse as simple rule
115-
parsed_rules.append(
116-
SigmaRule.from_dict(
117-
deep_dict_update(rule, global_rule), collect_errors, source
118-
)
116+
parsed_rule = SigmaRule.from_dict(
117+
deep_dict_update(rule, global_rule), collect_errors, source
119118
)
119+
parsed_rules.append(parsed_rule)
120+
errors.extend(parsed_rule.errors) # Propagate errors from rule
120121
prev_rule = rule
121122
elif action == "global": # set global rule template
122123
del rule["action"]
@@ -128,7 +129,9 @@ def from_dicts(
128129
action == "repeat"
129130
): # add content of current rule to previous rule and parse it
130131
prev_rule = deep_dict_update(prev_rule, rule)
131-
parsed_rules.append(SigmaRule.from_dict(prev_rule, collect_errors, source))
132+
parsed_rule = SigmaRule.from_dict(prev_rule, collect_errors, source)
133+
parsed_rules.append(parsed_rule)
134+
errors.extend(parsed_rule.errors) # Propagate errors from rule
132135
else:
133136
exception = SigmaCollectionError(
134137
f"Unknown Sigma collection action '{ action }' in rule { i }",

‎sigma/correlations.py‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -418,3 +418,22 @@ def resolve_rule_references(self, rule_collection: "sigma.collection.SigmaCollec
418418
rule.disable_output()
419419

420420
self.aliases.resolve_rule_references(rule_collection)
421+
422+
def flatten_rules(self, include_correlations: bool = True) -> List[SigmaRule]:
423+
"""
424+
Flattens the rules in the correlation rule and returns a list of Sigma rules. If include_correlations
425+
is set to False, only the Sigma rules are returned, excluding nested correlation rules.
426+
427+
Returns:
428+
List of Sigma rules.
429+
"""
430+
rules = []
431+
for rule_ref in self.rules:
432+
rule = rule_ref.rule
433+
if isinstance(rule, SigmaCorrelationRule):
434+
if include_correlations:
435+
rules.append(rule)
436+
rules.extend(rule.flatten_rules())
437+
else:
438+
rules.append(rule)
439+
return rules

‎sigma/data/mitre_attack.py‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,21 +74,29 @@
7474
"T1027.015": "Compression",
7575
"T1027.016": "Junk Code Insertion",
7676
"T1027.017": "SVG Smuggling",
77+
"T1027.014": "Polymorphic Code",
78+
"T1027.015": "Compression",
79+
"T1027.016": "Junk Code Insertion",
80+
"T1027.017": "SVG Smuggling",
7781
"T1029": "Scheduled Transfer",
7882
"T1030": "Data Transfer Size Limits",
7983
"T1033": "System Owner/User Discovery",
8084
"T1036": "Masquerading",
8185
"T1036.001": "Invalid Code Signature",
8286
"T1036.002": "Right-to-Left Override",
8387
"T1036.003": "Rename Legitimate Utilities",
88+
"T1036.003": "Rename Legitimate Utilities",
8489
"T1036.004": "Masquerade Task or Service",
8590
"T1036.005": "Match Legitimate Resource Name or Location",
91+
"T1036.005": "Match Legitimate Resource Name or Location",
8692
"T1036.006": "Space after Filename",
8793
"T1036.007": "Double File Extension",
8894
"T1036.008": "Masquerade File Type",
8995
"T1036.009": "Break Process Trees",
9096
"T1036.010": "Masquerade Account Name",
9197
"T1036.011": "Overwrite Process Arguments",
98+
"T1036.010": "Masquerade Account Name",
99+
"T1036.011": "Overwrite Process Arguments",
92100
"T1037": "Boot or Logon Initialization Scripts",
93101
"T1037.001": "Logon Script (Windows)",
94102
"T1037.002": "Login Hook",
@@ -145,6 +153,8 @@
145153
"T1059.010": "AutoHotKey & AutoIT",
146154
"T1059.011": "Lua",
147155
"T1059.012": "Hypervisor CLI",
156+
"T1059.011": "Lua",
157+
"T1059.012": "Hypervisor CLI",
148158
"T1068": "Exploitation for Privilege Escalation",
149159
"T1069": "Permission Groups Discovery",
150160
"T1069.001": "Local Groups",
@@ -229,6 +239,8 @@
229239
"T1127.001": "MSBuild",
230240
"T1127.002": "ClickOnce",
231241
"T1127.003": "JamPlus",
242+
"T1127.002": "ClickOnce",
243+
"T1127.003": "JamPlus",
232244
"T1129": "Shared Modules",
233245
"T1132": "Data Encoding",
234246
"T1132.001": "Standard Encoding",
@@ -256,6 +268,9 @@
256268
"T1176": "Software Extensions",
257269
"T1176.001": "Browser Extensions",
258270
"T1176.002": "IDE Extensions",
271+
"T1176": "Software Extensions",
272+
"T1176.001": "Browser Extensions",
273+
"T1176.002": "IDE Extensions",
259274
"T1185": "Browser Session Hijacking",
260275
"T1187": "Forced Authentication",
261276
"T1189": "Drive-by Compromise",
@@ -275,6 +290,7 @@
275290
"T1204.002": "Malicious File",
276291
"T1204.003": "Malicious Image",
277292
"T1204.004": "Malicious Copy and Paste",
293+
"T1204.004": "Malicious Copy and Paste",
278294
"T1205": "Traffic Signaling",
279295
"T1205.001": "Port Knocking",
280296
"T1205.002": "Socket Filters",
@@ -311,6 +327,10 @@
311327
"T1219.001": "IDE Tunneling",
312328
"T1219.002": "Remote Desktop Software",
313329
"T1219.003": "Remote Access Hardware",
330+
"T1219": "Remote Access Tools",
331+
"T1219.001": "IDE Tunneling",
332+
"T1219.002": "Remote Desktop Software",
333+
"T1219.003": "Remote Access Hardware",
314334
"T1220": "XSL Script Processing",
315335
"T1221": "Template Injection",
316336
"T1222": "File and Directory Permissions Modification",
@@ -356,6 +376,7 @@
356376
"T1505.004": "IIS Components",
357377
"T1505.005": "Terminal Services DLL",
358378
"T1505.006": "vSphere Installation Bundles",
379+
"T1505.006": "vSphere Installation Bundles",
359380
"T1518": "Software Discovery",
360381
"T1518.001": "Security Software Discovery",
361382
"T1525": "Implant Internal Image",
@@ -512,6 +533,8 @@
512533
"T1564.012": "File/Path Exclusions",
513534
"T1564.013": "Bind Mounts",
514535
"T1564.014": "Extended Attributes",
536+
"T1564.013": "Bind Mounts",
537+
"T1564.014": "Extended Attributes",
515538
"T1565": "Data Manipulation",
516539
"T1565.001": "Stored Data Manipulation",
517540
"T1565.002": "Transmitted Data Manipulation",
@@ -534,6 +557,7 @@
534557
"T1569.001": "Launchctl",
535558
"T1569.002": "Service Execution",
536559
"T1569.003": "Systemctl",
560+
"T1569.003": "Systemctl",
537561
"T1570": "Lateral Tool Transfer",
538562
"T1571": "Non-Standard Port",
539563
"T1572": "Protocol Tunneling",
@@ -542,6 +566,7 @@
542566
"T1573.002": "Asymmetric Cryptography",
543567
"T1574": "Hijack Execution Flow",
544568
"T1574.001": "DLL",
569+
"T1574.001": "DLL",
545570
"T1574.004": "Dylib Hijacking",
546571
"T1574.005": "Executable Installer File Permissions Weakness",
547572
"T1574.006": "Dynamic Linker Hijacking",
@@ -697,6 +722,15 @@
697722
"T1673": "Virtual Machine Discovery",
698723
"T1674": "Input Injection",
699724
"T1675": "ESXi Administration Command",
725+
"T1666": "Modify Cloud Resource Hierarchy",
726+
"T1667": "Email Bombing",
727+
"T1668": "Exclusive Control",
728+
"T1669": "Wi-Fi Networks",
729+
"T1671": "Cloud Application Integration",
730+
"T1672": "Email Spoofing",
731+
"T1673": "Virtual Machine Discovery",
732+
"T1674": "Input Injection",
733+
"T1675": "ESXi Administration Command",
700734
}
701735
mitre_attack_techniques_tactics_mapping: Dict[str, List[str]] = {
702736
"T1001": ["command-and-control"],
@@ -755,6 +789,10 @@
755789
"T1027.015": ["defense-evasion"],
756790
"T1027.016": ["defense-evasion"],
757791
"T1027.017": ["defense-evasion"],
792+
"T1027.014": ["defense-evasion"],
793+
"T1027.015": ["defense-evasion"],
794+
"T1027.016": ["defense-evasion"],
795+
"T1027.017": ["defense-evasion"],
758796
"T1029": ["exfiltration"],
759797
"T1030": ["exfiltration"],
760798
"T1033": ["discovery"],
@@ -770,6 +808,8 @@
770808
"T1036.009": ["defense-evasion"],
771809
"T1036.010": ["defense-evasion"],
772810
"T1036.011": ["defense-evasion"],
811+
"T1036.010": ["defense-evasion"],
812+
"T1036.011": ["defense-evasion"],
773813
"T1037": ["persistence", "privilege-escalation"],
774814
"T1037.001": ["persistence", "privilege-escalation"],
775815
"T1037.002": ["persistence", "privilege-escalation"],
@@ -826,6 +866,8 @@
826866
"T1059.010": ["execution"],
827867
"T1059.011": ["execution"],
828868
"T1059.012": ["execution"],
869+
"T1059.011": ["execution"],
870+
"T1059.012": ["execution"],
829871
"T1068": ["privilege-escalation"],
830872
"T1069": ["discovery"],
831873
"T1069.001": ["discovery"],
@@ -895,6 +937,7 @@
895937
"T1110.004": ["credential-access"],
896938
"T1111": ["credential-access"],
897939
"T1112": ["defense-evasion", "persistence"],
940+
"T1112": ["defense-evasion", "persistence"],
898941
"T1113": ["collection"],
899942
"T1114": ["collection"],
900943
"T1114.001": ["collection"],
@@ -910,6 +953,8 @@
910953
"T1127.001": ["defense-evasion"],
911954
"T1127.002": ["defense-evasion"],
912955
"T1127.003": ["defense-evasion"],
956+
"T1127.002": ["defense-evasion"],
957+
"T1127.003": ["defense-evasion"],
913958
"T1129": ["execution"],
914959
"T1132": ["command-and-control"],
915960
"T1132.001": ["command-and-control"],
@@ -937,6 +982,8 @@
937982
"T1176": ["persistence"],
938983
"T1176.001": ["persistence"],
939984
"T1176.002": ["persistence"],
985+
"T1176.001": ["persistence"],
986+
"T1176.002": ["persistence"],
940987
"T1185": ["collection"],
941988
"T1187": ["credential-access"],
942989
"T1189": ["initial-access"],
@@ -956,6 +1003,7 @@
9561003
"T1204.002": ["execution"],
9571004
"T1204.003": ["execution"],
9581005
"T1204.004": ["execution"],
1006+
"T1204.004": ["execution"],
9591007
"T1205": ["defense-evasion", "persistence", "command-and-control"],
9601008
"T1205.001": ["defense-evasion", "persistence", "command-and-control"],
9611009
"T1205.002": ["defense-evasion", "persistence", "command-and-control"],
@@ -992,6 +1040,9 @@
9921040
"T1219.001": ["command-and-control"],
9931041
"T1219.002": ["command-and-control"],
9941042
"T1219.003": ["command-and-control"],
1043+
"T1219.001": ["command-and-control"],
1044+
"T1219.002": ["command-and-control"],
1045+
"T1219.003": ["command-and-control"],
9951046
"T1220": ["defense-evasion"],
9961047
"T1221": ["defense-evasion"],
9971048
"T1222": ["defense-evasion"],
@@ -1037,6 +1088,7 @@
10371088
"T1505.004": ["persistence"],
10381089
"T1505.005": ["persistence"],
10391090
"T1505.006": ["persistence"],
1091+
"T1505.006": ["persistence"],
10401092
"T1518": ["discovery"],
10411093
"T1518.001": ["discovery"],
10421094
"T1525": ["persistence"],
@@ -1193,6 +1245,8 @@
11931245
"T1564.012": ["defense-evasion"],
11941246
"T1564.013": ["defense-evasion"],
11951247
"T1564.014": ["defense-evasion"],
1248+
"T1564.013": ["defense-evasion"],
1249+
"T1564.014": ["defense-evasion"],
11961250
"T1565": ["impact"],
11971251
"T1565.001": ["impact"],
11981252
"T1565.002": ["impact"],
@@ -1215,6 +1269,7 @@
12151269
"T1569.001": ["execution"],
12161270
"T1569.002": ["execution"],
12171271
"T1569.003": ["execution"],
1272+
"T1569.003": ["execution"],
12181273
"T1570": ["lateral-movement"],
12191274
"T1571": ["command-and-control"],
12201275
"T1572": ["command-and-control"],
@@ -1378,6 +1433,15 @@
13781433
"T1673": ["discovery"],
13791434
"T1674": ["execution"],
13801435
"T1675": ["execution"],
1436+
"T1666": ["defense-evasion"],
1437+
"T1667": ["impact"],
1438+
"T1668": ["persistence"],
1439+
"T1669": ["initial-access"],
1440+
"T1671": ["persistence"],
1441+
"T1672": ["defense-evasion"],
1442+
"T1673": ["discovery"],
1443+
"T1674": ["execution"],
1444+
"T1675": ["execution"],
13811445
}
13821446
mitre_attack_intrusion_sets: Dict[str, str] = {
13831447
"G0001": "Axiom",
@@ -1546,6 +1610,24 @@
15461610
"G1045": "Salt Typhoon",
15471611
"G1046": "Storm-1811",
15481612
"G1047": "Velvet Ant",
1613+
"G1030": "Agrius",
1614+
"G1031": "Saint Bear",
1615+
"G1032": "INC Ransom",
1616+
"G1033": "Star Blizzard",
1617+
"G1034": "Daggerfly",
1618+
"G1035": "Winter Vivern",
1619+
"G1036": "Moonstone Sleet",
1620+
"G1037": "TA577",
1621+
"G1038": "TA578",
1622+
"G1039": "RedCurl",
1623+
"G1040": "Play",
1624+
"G1041": "Sea Turtle",
1625+
"G1042": "RedEcho",
1626+
"G1043": "BlackByte",
1627+
"G1044": "APT42",
1628+
"G1045": "Salt Typhoon",
1629+
"G1046": "Storm-1811",
1630+
"G1047": "Velvet Ant",
15491631
}
15501632
mitre_attack_software: Dict[str, str] = {
15511633
"S0001": "Trojan.Mebromi",

‎sigma/filters.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -194,8 +194,8 @@ def apply_on_rule(
194194

195195
# Replace each instance of the original condition name with the new condition name to avoid conflicts
196196
filter_condition = re.sub(
197-
rf"[^ ]*{original_cond_name}[^ ]*",
198-
cond_name,
197+
rf"(\s|\(|^){original_cond_name}(\s|$|\))",
198+
r"\1" + cond_name + r"\2",
199199
filter_condition,
200200
)
201201
rule.detection.detections[cond_name] = condition

0 commit comments

Comments
 (0)