valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-06 17:35:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Enabled check for process_creation

Browse Source
This commit is contained in:
Tareq AlKhatib 2019-03-09 21:00:11 +03:00
parent 075df83118
commit 7f4557d183
1 changed files with 3 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
tests/test_rules.py
View File

@ -200,7 +200,7 @@ class TestRules(unittest.TestCase):
"There are detections with 'Source: Eventlog'. This does not add value to the detection.")
def test_event_id_instead_of_process_create(self):
def test_event_id_instead_of_process_creation(self):
faulty_detections = []
for file in self.yield_next_rule_file_path(self.path_to_rules):
with open(file) as f:
@ -208,17 +208,8 @@ class TestRules(unittest.TestCase):
if re.search(r'.*EventID: (?:1|4688)\s*$', line) and file not in faulty_detections:
faulty_detections.append(file)
# Tareq won't enable until all existing rules are migrated to prevent breaking all CI builds
# self.assertEqual(faulty_detections, [],
# "There are rules still using Sysmon 1 or Event ID 4688. Please migrate to the process_creation category.")
# Report but do not throw an error
if faulty_detections:
print("The following rules still use Sysmon 1 or Event ID 4688.")
print("Please migrate to the process_creation category.")
print("List length is: {}".format(len(faulty_detections)))
print("------------------------------------------------")
print(*faulty_detections, sep='\n')
self.assertEqual(faulty_detections, [],
"There are rules still using Sysmon 1 or Event ID 4688. Please migrate to the process_creation category.")
if __name__ == "__main__":