Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support Temporal Proximity correlation #1446

Open
YamatoSecurity opened this issue Oct 14, 2024 · 1 comment
Open

Support Temporal Proximity correlation #1446

YamatoSecurity opened this issue Oct 14, 2024 · 1 comment
Assignees
Labels
enhancement New feature or request

Comments

@YamatoSecurity
Copy link
Collaborator

YamatoSecurity commented Oct 14, 2024

Support Temporal Proximity correlation

https://github.com/SigmaHQ/sigma-specification/blob/main/specification/sigma-correlation-rules-specification.md#temporal-proximity-temporal

Reference: https://blog.sigmahq.io/introducing-sigma-correlations-52fe377f2527

Sample rule from blog:

title: CVE-2023-22518 Exploit Chain
description: Access to endpoint vulnerable to CVE-2023-22518 with suspicious process creation.
status: experimental
correlation:
    type: temporal
    rules:
        - a902d249-9b9c-4dc4-8fd0-fbe528ef965c
        - 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db
    group-by:
        - Computer
    timespan: 10s
level: high

(Note: when testing you can use any two rules that find two different events within a short period of time.)

I think this is similar to the count rules we already have but instead of treating multiple rules as OR, we treat them as AND. And then we ignore the part about aggregating fields, so should actually be easier to implement. 😄 (Well, except for filtering to check if they have certain same fields, defined by group-by)

@fukusuket I think this one will be very easy for you, so I will assign you. 😉

@YamatoSecurity YamatoSecurity added the enhancement New feature or request label Oct 14, 2024
@YamatoSecurity YamatoSecurity modified the milestones: 3.0.0, v3.0 Oct 14, 2024
@fukusuket
Copy link
Collaborator

@YamatoSecurity
Thank you for the assignment! Yes, I would love to implement it!!💪

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants