开源SOC实现（十一）-Wazuh集成Sigma规则

1、Clone repository.
2、Install Python3 packages: pip3 install lxml bs4 ruamel.yaml
3、Clone Sigma repository: https://github.com/SigmaHQ/sigma
4、Update "config.ini" variables where necessary.
5、directory: point it to the rules folder in the cloned Sigma repositoryRun sigma_to_wazuh.py
You'll see output of rules that are skipped, rules that error out on loading, followed by a summary of the rules conversion.

1、git clone https://github.com/theflakes/sigma_to_wazuh
2、pip3 install lxml bs4 ruamel.yaml
3、git clone https://github.com/SigmaHQ/sigma

python3 sigma_to_wazuh.py

cd /var/ossec/etc/rules/

    <rule id="900346" level="7">        <info type="link">https://github.com/SigmaHQ/sigma/tree/master/rules/rules/windows/powershell/powershell_script/posh_ps_susp_smb_share_reco.yml</info>        <!--Sigma Rule Author: frack113-->        <!--Description: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather asa precursor for Collection and to identify potential systems of interest for Lateral Movement.Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.-->        <!--Date: 2021/12/15-->        <!--Status: test-->        <!--ID: 95f0643a-ed40-467c-806b-aac9542ec5ab-->        <mitre>            <id>attack.discovery</id>            <id>attack.t1069.001</id>        </mitre>        <description>Suspicious Get Information for SMB Share</description>        <options>no_full_log</options>        <group>windows,ps_script,</group>        <if_sid>18100, 60000, 60001, 60002, 60003, 60004, 60006, 60007, 60008, 60009, 60010, 60011, 60012</if_sid>        <field name="win.eventdata.scriptBlockText" negate="no" type="pcre2">(?i)get-smbshare</field>    </rule>

function Enable-PSScriptBlockLogging{    $basePath = 'HKLM:SoftwarePoliciesMicrosoftWindows' +      'PowerShellScriptBlockLogging'
    if(-not (Test-Path $basePath))    {        $null = New-Item $basePath -Force    }
    Set-ItemProperty $basePath -Name EnableScriptBlockLogging -Value "1"}//参考链接：https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.3

powershell get-smbshare

powershell get-process