Reusable list in one rule

[frack113]

hello,
many rule use the same patern but with other logsource.
example (a simple)

detection:
    selection_1:
        EventID: 4104
        ScriptBlockText|re: '.*cmd.{0,5}(?:\/c|\/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\\"\{\d\}.+\-f.+\"'
    selection_2:
        EventID: 4103
        Payload|re: '.*cmd.{0,5}(?:\/c|\/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\\"\{\d\}.+\-f.+\"'
    condition: 1 of them

this would be

internal:
    my_regex : '.*cmd.{0,5}(?:\/c|\/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\\"\{\d\}.+\-f.+\"'
detection:
    selection_1:
        EventID: 4104
        ScriptBlockText|re: %my_regex%
    selection_2:
        EventID: 4103
        Payload|re: %my_regex%
    condition: 1 of them

for list

internal:
    bad_word:
        - "get_ad"
        - "set_ad"
        - "kill_ad"
detection:
    selection_1:
        EventID: 4104
        ScriptBlockText|contains: %bad_word%
    selection_2:
        EventID: 4103
        Payload|contains: %bad_word%
    condition: 1 of them

So if there a update to the list / patern only one to correct 😄

[thomaspatzke]

Good idea! @Neo23x0 what do you think about it?

I would prefer some other name for it instead of internal, which could be everything. placeholders would be clearer about its usage for the rule writer or what do you think? The ValueListPlaceholderTransformation class could be possibly reused for this purpose with some minor tweaks (pulling the placeholder from a dictionary instead of a pipeline).

[frack113]

Hi,
I only use internal for the example, I've keep the logic of %placeholders% but in the rule.
Perhars internal_placeholders should have be a better name to start...

[Neo23x0]

Good idea - I think Thomas has already planned to revive the placeholders from our specs in the new converter. I wouldn't backport that feature to the old sigmac converter, thou.

https://github.com/SigmaHQ/sigma/wiki/Specification#placeholders