Missing Sigma Base64 Encoding? about chainsaw HOT 3 CLOSED

Hi Louis,

Chainsaw is not aware of base64offset and is therefore ignoring it completely hence the outcomes you have listed in the summary. If this modifier is useful to you I can update the sigma parser in Chainsaw to handle this flag.

I will also update Chainsaw to not silently ignore modifiers it is not aware of, so its more obvious when this sort of stuff happens.

from chainsaw.

Hello Alex,

thank you for your quick response!

Since many Sigma rules are being updated to also include the encoded Base64 strings themselves, it is not as critical to support the base64offset modifier as it may seem. Nonetheless, I think adding support for it would be really great.

I will also update Chainsaw to not silently ignore modifiers it is not aware of, so its more obvious when this sort of stuff happens.

This is definitely a good idea! 👍

from chainsaw.

Thanks for the thorough description in the issue, yep all that makes sense. I'll find time to get it in sometime this week.

from chainsaw.