Sigma Rules - MacOS issues

[ledge39]

Version

2.4.70

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

8

RAM

24

Storage for /

175

Storage for /nsm

350

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

My network consists of both Windows and MacOS.

A number of sigma rule e.g.

Execution Of Non-Existing File
Qakbot Regsvr32 Calc Pattern
Uninstall Sysinternals Sysmon
Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE

All of them are Windows

logsource:
category: process_creation
product: windows

How do I stop them firing for the MacOS Clients? I'm guessing its filtering on process_creation and not checking product.

Any ideas

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[defensivedepth]

These are field mapping issues. Sigma rules are written using generic fields like "cmdLine" - and then we convert them into an EQL query to run against Elasticsearch. As part of that conversion process, we apply field mappings, so cmdline is transformed to process.command_line which is what is used in Security Onion.

We are still working on the field mappings - I have added the rules you noted to my list to review.