Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ignore detections with leading underscore "_" in "of" condition pattern matching #207

Merged
merged 4 commits into from
Mar 28, 2024
Merged

Ignore detections with leading underscore "_" in "of" condition pattern matching #207

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
e0e5716
ConditionSelector enforces valid selector
thomaspatzke Mar 28, 2024
de369ae
of-conditions with pattern matching or "them" ignore detections that …
thomaspatzke Mar 28, 2024
6b2893d
Updated black and reformatted
thomaspatzke Mar 28, 2024
e222785
Added black commit to ignored versions for "git blame"
thomaspatzke Mar 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .git-blame-ignore-revs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# Reformatting by black
a6b11efb3455b0d13d4d712413052061580d43c4
6b2893d0a7a7771984937d68d3f0306fe164d94a
# Set line-length to 100 for black
17185b23e5d18f0977eaf0f96bd941fb6c8d53f1

46 changes: 23 additions & 23 deletions poetry.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 4 additions & 2 deletions sigma/conditions.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,8 +179,10 @@ class ConditionSelector(ConditionItem):
def __post_init__(self):
if self.args[0] in ["1", "any"]:
self.cond_class = ConditionOR
else:
elif self.args[0] == "all":
self.cond_class = ConditionAND
else:
raise SigmaConditionError("Invalid quantifier in selector", source=self.source)
self.pattern = self.args[1]

def resolve_referenced_detections(self, detections: "sigma.rule.SigmaDetections") -> List[str]:
Expand All @@ -195,7 +197,7 @@ def resolve_referenced_detections(self, detections: "sigma.rule.SigmaDetections"
return [
ConditionIdentifier([identifier])
for identifier in detections.detections.keys()
if r.match(identifier)
if r.match(identifier) and not identifier.startswith("_")
]

def postprocess(
Expand Down
38 changes: 38 additions & 0 deletions tests/test_conditions.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,6 +160,30 @@ def sigma_invalid_detections():
)


@pytest.fixture
def sigma_underscore_detections():
return SigmaDetections(
{
"detection_1": SigmaDetection(
[
SigmaDetectionItem(None, [], [SigmaString("val1")]),
]
),
"detection_2": SigmaDetection(
[
SigmaDetectionItem(None, [], [SigmaString("val2")]),
]
),
"_detection_3": SigmaDetection(
[
SigmaDetectionItem(None, [], [SigmaString("val3")]),
]
),
},
list(),
)


def test_or(sigma_simple_detections):
assert SigmaCondition(
"detection1 or detection2", sigma_simple_detections
Expand Down Expand Up @@ -381,6 +405,20 @@ def test_selector_all_of_them(sigma_simple_detections):
)


def test_selector_underscore_filter(sigma_underscore_detections):
assert SigmaCondition("any of them", sigma_underscore_detections).parsed == ConditionOR(
[
ConditionValueExpression(SigmaString("val1")),
ConditionValueExpression(SigmaString("val2")),
]
)


def test_selector_invalid_quantifier(sigma_simple_detections):
with pytest.raises(SigmaConditionError, match="Invalid quantifier"):
ConditionSelector("invalid", "them")


def test_keyword_detection(sigma_detections):
assert SigmaCondition("keywords", sigma_detections).parsed == ConditionOR(
[
Expand Down