valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-06 17:35:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge branch 'fix_filename_test' of https://github.com/frack113/sigma into fix_filename_test

Browse Source
This commit is contained in:
frack113 2021-09-23 08:01:19 +02:00
commit 688903192d
19 changed files with 25 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

0
rules/windows/builtin/win_exploit_cve_2021_1675_printspooler_Security.yml → rules/windows/builtin/win_exploit_cve_2021_1675_printspooler_security.yml
View File

0
rules/windows/builtin/win_GPO_scheduledtasks.yml → rules/windows/builtin/win_gpo_scheduledtasks.yml
View File

0
rules/windows/builtin/win_invoke_obfuscation_stdin+_services.yml → rules/windows/builtin/win_invoke_obfuscation_stdin_services.yml
View File

0
rules/windows/builtin/win_invoke_obfuscation_stdin+_services_security.yml → rules/windows/builtin/win_invoke_obfuscation_stdin_services_security.yml
View File

0
rules/windows/builtin/win_rdp_potential_cve-2019-0708.yml → rules/windows/builtin/win_rdp_potential_cve_2019_0708.yml
View File

0
rules/windows/file_event/file_event_script_files_creation_by_office_applications_using_file_extentions.yml → rules/windows/file_event/file_event_script_creation_by_office_using_file_ext.yml
View File

0
rules/windows/other/win_exchange_TransportAgent_failed.yml → rules/windows/other/win_exchange_transportagent_failed.yml
View File

0
rules/windows/powershell/powershell_invoke_obfuscation_stdin+.yml → rules/windows/powershell/powershell_invoke_obfuscation_stdin.yml
View File

0
rules/windows/process_creation/Monitor_executable_and_script_files_creation_by_Office_applications_using_file_extentions.yml → rules/windows/process_creation/file_event_executable_and_script_creation_by_office_using_file_ext.yml
View File

0
rules/windows/process_creation/Monitor_LOLBins_Process_Creations_by_Office_applications.yml → rules/windows/process_creation/process_creation_lolbins_by_office_applications.yml
View File

0
rules/windows/process_creation/Monitor_LOLBins_process_creations_with_Wmiprvse_parent_process.yml → rules/windows/process_creation/process_creation_lolbins_with_wmiprvse_parent_process.yml
View File

0
rules/windows/process_creation/process_creation_office_applications_from_proxy_executing_regsvr32_with_payload.yml → rules/windows/process_creation/process_creation_office_from_proxy_executing_regsvr32_payload.yml
View File

0
rules/windows/process_creation/process_creation_office_application_from_proxy_executing_regsvr32_with_payload.yml → rules/windows/process_creation/process_creation_office_from_proxy_executing_regsvr32_payload2.yml
View File

0
rules/windows/process_creation/Monitor_Office_Applications_Spawning_WMI_command-line.yml → rules/windows/process_creation/process_creation_office_spawning_wmi_commandline.yml
View File

0
rules/windows/process_creation/process_creation_SDelete.yml → rules/windows/process_creation/process_creation_sdelete.yml
View File

0
rules/windows/process_creation/win_invoke_obfuscation_clip+.yml → rules/windows/process_creation/win_invoke_obfuscation_clip.yml
View File

0
rules/windows/process_creation/win_invoke_obfuscation_stdin+.yml → rules/windows/process_creation/win_invoke_obfuscation_stdin.yml
View File

0
rules/windows/process_creation/process_creation_possible_privilege_escalation_via_service_registry_permissions.yml → rules/windows/process_creation/win_possible_privilege_escalation_via_service_registry_permissions.yml
View File

36
tests/test_rules.py
View File

@ -47,18 +47,18 @@ class TestRules(unittest.TestCase):
return data return data
# Tests # Tests
def test_confirm_extension_is_yml(self): # def test_confirm_extension_is_yml(self):
files_with_incorrect_extensions = [] # files_with_incorrect_extensions = []
for file in self.yield_next_rule_file_path(self.path_to_rules): # for file in self.yield_next_rule_file_path(self.path_to_rules):
file_name_and_extension = os.path.splitext(file) # file_name_and_extension = os.path.splitext(file)
if len(file_name_and_extension) == 2: # if len(file_name_and_extension) == 2:
extension = file_name_and_extension[1] # extension = file_name_and_extension[1]
if extension != ".yml": # if extension != ".yml":
files_with_incorrect_extensions.append(file) # files_with_incorrect_extensions.append(file)
self.assertEqual(files_with_incorrect_extensions, [], Fore.RED + # self.assertEqual(files_with_incorrect_extensions, [], Fore.RED +
"There are rule files with extensions other than .yml") # "There are rule files with extensions other than .yml")
def test_legal_trademark_violations(self): def test_legal_trademark_violations(self):
files_with_legal_issues = [] files_with_legal_issues = []
@ -519,12 +519,26 @@ class TestRules(unittest.TestCase):
def test_file_names(self): def test_file_names(self):
faulty_rules = [] faulty_rules = []
name_lst = []
filename_pattern = re.compile('[a-z0-9_]{10,70}\.yml') filename_pattern = re.compile('[a-z0-9_]{10,70}\.yml')
for file in self.yield_next_rule_file_path(self.path_to_rules): for file in self.yield_next_rule_file_path(self.path_to_rules):
filename = os.path.basename(file) filename = os.path.basename(file)
if filename_pattern.match(filename) == None or not '_' in filename: if filename in name_lst:
print(Fore.YELLOW + "Rule {} is a duplicate file name.".format(file))
faulty_rules.append(file)
elif filename[-4:] != ".yml":
print(Fore.YELLOW + "Rule {} has a invalid extension (.yml).".format(file))
faulty_rules.append(file)
elif len(filename) > 74:
print(Fore.YELLOW + "Rule {} has a file name too long >70.".format(file))
faulty_rules.append(file)
elif len(filename) < 14:
print(Fore.YELLOW + "Rule {} has a file name too sort <10.".format(file))
faulty_rules.append(file)
elif filename_pattern.match(filename) == None or not '_' in filename:
print(Fore.YELLOW + "Rule {} has a file name that doesn't match our standard.".format(file)) print(Fore.YELLOW + "Rule {} has a file name that doesn't match our standard.".format(file))
faulty_rules.append(file) faulty_rules.append(file)
name_lst.append(filename)
self.assertEqual(faulty_rules, [], Fore.RED + self.assertEqual(faulty_rules, [], Fore.RED +
"There are rules with malformed file names (too short, too long, uppercase letters, a minus sign etc.). Please see the file names used in our repository and adjust your file names accordingly. The pattern for a valid file name is '[a-z0-9_]{10,70}\.yml' and it has to contain at least an underline character.") "There are rules with malformed file names (too short, too long, uppercase letters, a minus sign etc.). Please see the file names used in our repository and adjust your file names accordingly. The pattern for a valid file name is '[a-z0-9_]{10,70}\.yml' and it has to contain at least an underline character.")