mdecrevoisier/SIGMA-detection-rules

Logic error in Firewall rule any/any created ?

wagga40 opened this issue · 1 comments

wagga40 commented

In the following rule : Firewall rule any/any created

The related EVTX is here

I think the important fields are :

"LocalAddresses": "*",
"LocalPorts": "",
"RemoteAddresses": "*",
"RemotePorts": "",

But the rule only checks for LocalPorts and RemotePorts :

detection:
  selection:
    EventID:
      - 2004  # new rule created
      - 2005  # existing rule modified
    Action: 3 # allow
    LocalPorts: *
    RemotePorts: *

Shouldn't you add a check for LocalAddresses and RemoteAddresses equal to '\*' ?

mdecrevoisier commented

Thanks for the advice. I have added both approaches in the rules, including your suggestion. Thanks

  • 👍1