Update of Rare Service Install Detection Rule to use correlation syntax about sigma HOT 4 OPEN

Welcome @Mat0vu 👋

It looks like this is your first issue on the Sigma rules repository!

The following repository accepts issues related to false positives or 'rule ideas'.

If you're reporting an issue related to the pySigma library please consider submitting it here

If you're reporting an issue related to the deprecated sigmac library please consider submitting it here

Thanks for taking the time to open this issue, and welcome to the Sigma community! 😃

from sigma.

Hey @Mat0vu thanks for reaching out.
You are correct in your assumptions. While correlations were recently added to PySigma we still haven't announced the V2 spec (which include correlationà.

We are now in the process of adding a folder to allow for the submitting of correlation rules and as you guessed old rules in the supported using the old pipe notation will also be converted to use the new format.

Thanks for your understanding.

Will take your rule suggestion as input when the new folder is added.

from sigma.

HI,
I have try as a POC on https://github.com/frack113/MetaRuleBazar
No test , No review only the curiosity : is it hard to convert old rules ?

from sigma.

Hi @frack113,
that´s a great resource, thanks for the link! Looks like you´ve already converted most the currently unsupported rules 👍

from sigma.