rsigma 0.18.0

CLI for parsing, validating, linting and evaluating Sigma detection rules
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129

//! Integration tests for `engine eval --schema-routing`.

mod common;

use common::{rsigma, temp_file};
use predicates::prelude::*;

const RULE: &str = r#"
title: Whoami
id: r-whoami
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: whoami
    condition: selection
level: high
"#;

const SCHEMA_CONFIG: &str = r#"
routing:
  on_unknown: warn
  bindings:
    - schema: ecs
      pipelines: [ecs_windows]
"#;

#[test]
fn routes_ecs_event_through_bound_pipeline() {
    let rule = temp_file(".yml", RULE);
    let schema = temp_file(".yml", SCHEMA_CONFIG);
    // ECS event: the rule field CommandLine is mapped to process.command_line
    // by the ecs_windows pipeline the `ecs` schema is bound to, so it matches.
    rsigma()
        .args([
            "engine",
            "eval",
            "-r",
            rule.path().to_str().unwrap(),
            "--schema-routing",
            "--schema-config",
            schema.path().to_str().unwrap(),
            "-e",
            r#"{"ecs.version":"8.0.0","process.command_line":"cmd /c whoami"}"#,
            "--output-format",
            "json",
        ])
        .assert()
        .success()
        .stdout(predicate::str::contains("\"rule_id\":\"r-whoami\""));
}

#[test]
fn ecs_event_without_routing_does_not_match() {
    let rule = temp_file(".yml", RULE);
    // Without routing the rule uses CommandLine, which the ECS event does not
    // carry (it has process.command_line), so nothing matches.
    rsigma()
        .args([
            "engine",
            "eval",
            "-r",
            rule.path().to_str().unwrap(),
            "-e",
            r#"{"ecs.version":"8.0.0","process.command_line":"cmd /c whoami"}"#,
            "--output-format",
            "json",
        ])
        .assert()
        .success()
        .stdout(predicate::str::contains("rule_id").not());
}

const CORR_RULES: &str = r#"
title: Whoami
id: r-whoami
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: whoami
    condition: selection
level: high
---
title: Repeated whoami by user
correlation:
    type: event_count
    rules:
        - r-whoami
    group-by:
        - User
    timespan: 1h
    condition:
        gte: 2
level: high
"#;

#[test]
fn cross_schema_correlation_groups_same_user() {
    let rule = temp_file(".yml", CORR_RULES);
    let schema = temp_file(".yml", SCHEMA_CONFIG);
    // One ECS event (user.name) and one Sigma-native event (User) for the same
    // user "alice". With schema-aware group-by over a shared store, they land
    // in the same window and fire the count>=2 correlation.
    let stdin = concat!(
        r#"{"ecs.version":"8.0.0","process.command_line":"cmd /c whoami","user.name":"alice"}"#,
        "\n",
        r#"{"CommandLine":"cmd /c whoami","User":"alice"}"#,
        "\n",
    );
    rsigma()
        .args([
            "engine",
            "eval",
            "-r",
            rule.path().to_str().unwrap(),
            "--schema-routing",
            "--schema-config",
            schema.path().to_str().unwrap(),
            "--output-format",
            "ndjson",
        ])
        .write_stdin(stdin)
        .assert()
        .success()
        .stdout(predicate::str::contains("Repeated whoami by user"));
}