Skip to content

v0.2.1

Choose a tag to compare

View all tags
@chriswayneh chriswayneh released this 24 Sep 11:22
· 13 commits to main since this release
v0.2.1
054fdcb

Fix

  • Schema loaders open NDJSON/JSON with utf-8-sig so UTF-8 BOM-prefixed files (common from Windows editors and PowerShell Set-Content -Encoding utf8) parse cleanly. Previously those files could make detdrift diff exit 2.

Dogfood

Ran against a sparse clone of SigmaHQ/sigma rules/windows/process_creation (~1185 YAML rules) with a synthetic CommandLine to cmd rename (detdrift 0.2.0):

  • schema_version: 1
  • removed: ['CommandLine']
  • 914 IMPACTED (all missing CommandLine)
  • 271 SAFE
  • 0 UNKNOWN

See docs/dogfood.md.

Version

0.2.1

Assets 2
Loading