Pysigma-backend-microsoft365defender

Latest version: v0.2.4

Safety actively analyzes 623248 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 1 of 2

0.2.4

- Fixed issue 13 where '*' character was being escaped incorrectly CommandLine strings
- Fixed issue 14 where Sigma schema wildcards ('*', '?') in the middle of a string would create nonsense queries
- Since KQL does not use wildcards, anytime a wildcard value is seen inside a string (not at the beginning or end) from the Sigma Rule, we now split it by the wildcard and use a `contains` for each substring.
- Example: a CommandLine field with a value of `advfirewall firewall add rule name=Dropbox dir=in action=allow "program=?:\Program Files (x86)\Dropbox\Client\Dropbox.exe" enable=yes profile=Any` will be converted to `(ProcessCommandLine contains "advfirewall firewall add rule name=Dropbox dir=in action=allow \"program=" and ProcessCommandLine contains ":\\Program Files (x86)\\Dropbox\\Client\\Dropbox.exe\" enable=yes profile=Any")`

0.2.3

- Fixed issue 11 by adding more verbose error handling and hash algorithm parsing in 'Hashes' field
- Loosened pySigma pinned version to allow compatibility with pySigma >= 0.11.0

0.2.2

- Increased supported pySigma version to `>= 0.9.0, <= 0.10.6`

0.2.0

Not secure
Support for the ParentImage Field!

* The pipeline and backend now support the argument `transform_parent_image` (bool, defaults to True)
* If set, this will map the `ParentImage` Sysmon field to `InitiatingProcessParentFileName` M365 field, and extract the parent process name from the full path as the value for all supported rule categories *except* process_creation.
* This is because the Microsoft 365 Defender table schema does not have a InitiatingProcessParentFolderPath field where the entire path can be used. Previously, having the ParentImage field in a rule would cause an invalid field error for non-process_creation rules.
* For usage and more information, see [the README](https://github.com/AttackIQ/pySigma-backend-microsoft365defender/blob/main/README.md#pipeline--backend-args-new-in-020)

0.1.3

Not secure
- Changed backend negation logic to fix 7 issue
- Changed backend `parenthesize` attribute to `True` to fix 8 issue
- README and formatting edits

0.1.2

Not secure
- Fixed an issue where a condition was being applied to a whole rule rather than individual detection items, causing issues when using generic field mappings (fixes 2 )
- Fixed Python v3.11 regex compatibility, moved the case-insensitive global flag to the beginning of registry pipeline regexes (fixes 3 )
- General whitespace/readability edits
- Changed Poetry installation github action

Page 1 of 2

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.