theflakes/sigma_to_wazuh

Not parsing field name correctly

Closed this issue 3 years ago · 2 comments

theflakes commented 3 years ago

See: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_encoded_frombase64string.yml

theflakes commented 3 years ago

Need to account for base64offset values: https://twitter.com/cyb3rops/status/1163714284163084289/photo/2

theflakes commented 3 years ago

Believe this is fixed now; offsets are calculated and single values and lists are base64 encoded.