Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Error when importing sigma rule with single quote #3027

Closed
lo-chr opened this issue Jan 28, 2024 · 0 comments · Fixed by #3028
Closed

Error when importing sigma rule with single quote #3027

lo-chr opened this issue Jan 28, 2024 · 0 comments · Fixed by #3028
Assignees
Labels

Comments

@lo-chr
Copy link
Contributor

lo-chr commented Jan 28, 2024

Describe the bug
In certain cases, the import of Sigma rules fails, especially when they contain characters like '.

To Reproduce
Steps to reproduce the behavior:

  1. Download triggering Sigma rule like proc_creation_lnx_gtfobin_vim.yml
  2. Run tsctl import-sigma-rules [location_of_rule]/proc_creation_lnx_gtfobin_vim.yml
  3. See error:
yaml.parser.ParserError: while parsing a flow mapping
  in "<unicode string>", line 1, column 1:
    {'title': 'Vim GTFOBin Abuse - L ...
    ^
expected ',' or '}', but got '<scalar>'
  in "<unicode string>", line 1, column 151:
     ... 'Detects usage of "vim" and it\'s siblings as a GTFOBin to execu ...

Expected behavior
Successful import of rule

Additional context
I think the problem here lies in line 250 to 255 of sigma_util.py:

rule_yaml_data = yaml.safe_load_all(rule_text)
for doc in rule_yaml_data:
parser = sigma_collection.SigmaCollectionParser(
str(doc), sigma_conf_obj, None
)

in connection with line 32 to 36 of tools/sigma/parser/collection.py in the sigmatools package:

The function is called twice on the same input (once in sigma_util.py, once in collection.py). The "double-escaping" seems to lead to a ParserError.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants