Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Looking for clarity for mft yaml 'filter' issue #148

Open
gr3y56 opened this issue Nov 20, 2023 · 3 comments
Open

Looking for clarity for mft yaml 'filter' issue #148

gr3y56 opened this issue Nov 20, 2023 · 3 comments
Assignees

Comments

@gr3y56
Copy link

gr3y56 commented Nov 20, 2023

im working a on a particular issue where the use of chainsaw has been very welcome and essential, but im unfamiliar with a great deal in cybersecurity for the sake of redundancy this particular feature seemed helpful. is there a particular reason it isnt working and are there any solutions that i may not be readily aware of

@alexkornitzer
Copy link
Collaborator

Hey @gr3y56, which issue are you referring to? Are you able to explain what is not working? If so then I should be able to assist.

@alexkornitzer alexkornitzer added the question Further information is requested label Nov 20, 2023
@gr3y56
Copy link
Author

gr3y56 commented Nov 20, 2023

this is the command im running

./chainsaw_x86_64-pc-windows-msvc.exe hunt -s sigma/ --mapping mappings/sigma-mft-logs-all.yml C:/Windows/System32/winevt/Logs --from 2023-11-18T17:00:00 --to 2023-11-19T01:45:00 --full

this is the output in getting in return

[+] Loading detection rules from: sigma/
[!] Loaded 3040 detection rules (339 not loaded)
[x] Provided mapping file is invalid - groups[0]: missing field filter at line 8 column 5

i looked into the yml file and i see that theres a comment hinting at the possibility that this is a known issue i dont necessarily get it ? line 8 column 5 is just after the comment ## TODO: Flesh this out... but sigma does not seem geared for this?

@alexkornitzer alexkornitzer added bug Something isn't working and removed question Further information is requested labels Nov 21, 2023
@alexkornitzer alexkornitzer self-assigned this Nov 21, 2023
@alexkornitzer
Copy link
Collaborator

Right okay, so I never did the initial MFT work, but from looking over it the reason the mapping file is empty is because there is no easy way to map the sigma rules onto an MFT. They all appear to be very event log centric. I think what I will do is remove that mapping file as it just causes confusion, that being said you can still dump or search an MFT with the following commands or rules could be written to hunt MFTs.

chainsaw dump ~/Downloads/mft.bin

# or

chainsaw search -t 'FullPath: *Teams.exe' ~/Downloads/mft.bin

@alexkornitzer alexkornitzer removed the bug Something isn't working label Nov 21, 2023
alexkornitzer pushed a commit that referenced this issue Nov 21, 2023
There is no resonable way to currently coerce sigma rules onto an MFT so
rather than providing a broken mapping file lets remove it.

Issue #148
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants