SigmaHQ/sigma-specification

Add modifier to check if two fields are equal or not

YamatoSecurity opened this issue · 2 comments

Although many backends might not be able to support it, there is a need to check if two fields are equal or not.
Ref: https://github.com/SigmaHQ/sigma/discussions/3902
What about adding a |equalsfield: modifier?

That is how we implemented it in hayabusa:
https://github.com/Yamato-Security/hayabusa-rules/blob/main/hayabusa/builtin/Security/LogonLogoff/Logon/Sec_4624_Med_Logon-Type9-NewInteractive_PossibleTokenImpersonation.yml

Should be a discussion not an issue

@nasbench I see, I will close this as an issue then.