Sigma Integration v2: State-of-the-Art Threat Detections for uberAgent ESA

We’re thrilled to unveil the second generation of our Sigma to uberAgent ESA rule converter. pySigma-backend-uberAgent is a brand-new backend plugin that adds uberAgent support to Sigma’s second generation rule converter tool, sigma-cli, and the Python library it’s based on, pySigma.

What Is Sigma?

Sigma is an open signature format that allows security researchers and analysts to describe their detection methods in a generic, vendor-agnostic manner. Sigma is also a growing repository of peer-reviewed detection and hunting rules that can be converted to a variety of backends. One such backend is uberAgent ESA.

Sigma Rule Example

title: Detect start of powershell.exe
status: test
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: powershell.exe
    condition: selection

Sigma rules are written in YAML. The example above shows a simple rule that matches Windows process creation events where the executable’s name ends with powershell.exe.

Why a New Rule Converter?

Sigma’s existing rule converter, sigmac, has been marked as deprecated because its architecture proved too inflexible for the project’s growing success, which brought along the need for new detection rule capabilities. Specifically, adding modifiers such as cidr (IP range) or expand (variable expansion) would have been challenging to implement with the legacy converter sigmac.

New Converter → New Backend Plugins

Sigma’s new rule conversion library, pySigma, has a much more modular architecture than its predecessor. Unfortunately, it marks a breaking change in that it isn’t compatible with existing backend plugins. For that reason, we set out to create a new uberAgent backend plugin for Sigma’s shiny new converter. This new plugin is pySigma-backend-uberAgent.

Many New Rules

Many Sigma rules already make use of the additional capabilities of Sigma’s new converter. These rules couldn’t be converted with the legacy converter sigmac and had to be disabled in our conversion pipeline for uberAgent. With the switch to Sigma’s new pySigma converter, that restriction does not apply anymore, resulting in many more Sigma rules being available for uberAgent ESA.

Release Status of uberAgent’s Sigma Backend Plugin

pySigma-backend-uberAgent should show up in Sigma’s plugin directory soon; a pull request is on its way. Once that PR has been approved, the uberAgent backend plugin will show up in Sigma’s online rule converter, too.

Our own rule repository is being updated to incorporate the additional rules generated by v2 of the uberAgent backend plugin for Sigma, too, of course.

Conclusion

Launching our new rule converter is underway, modernizing the uberAgent configuration repository with new and updated rules from the leading open detection signature project. Our technological enhancements go beyond mere updates; we’ve introduced new capabilities tailored to uberAgent ESA’s threat detection event types, such as file system monitoring.

Here’s a snapshot of the new event types now supported:

• File delete: 12/12 rules
• File read: 5/5 rules
• File rename: 2/2 rules
• File create: 150/150 rules
• File write: 1/2 rules

Moreover, with the release of uberAgent 7.1, we’ve expanded the reach of uberAgent ESA’s Threat Detection Engine to macOS. We’re positively thrilled that we achieved 100% coverage for all macOS rules available in the Sigma project. Stay tuned for a detailed breakdown of what’s currently supported and a glimpse into what we have in store next!

For a more comprehensive overview of the changes and new capabilities in uberAgent 7.1, read the release blog post.