Sigma Rules using Imphash|contains: does not detect hashes

[Carlos-mb]

If you use this search in Detections:

"Hashes|contains" AND so_detection.language : "sigma" AND NOT "imphash" AND NOT "SHA256"

There will appear 4 rules (in my case).

I have tested all of them I have seen that the are not checking the HASHES.

I guess that all the other rules using "Hashes|contains" have a different way to detail the HASH to check.

I hope this will help.

Regards
Carlos

[Carlos-mb]

It also happens with others like:

id: bc309b7a-3c29-4937-a4a3-e232473f9168

I guess code like this is not working

        - Hashes|contains:
            - IMPHASH=E772C815072311D6FB8C3390743E6BE5
            - SHA256=423A9D13D410E2DC38EABB9FDF3121D2072472D0426260283A638B822DCD5180
            - SHA256=559CAE635F0D870652B9482EF436B31D4BB1A5A0F51750836F328D749291D0B6
            - SHA256=855EB5481F77DDE5AD8FA6E9D953D4AEBC280DDDF9461144B16ED62817CC5071
            - SHA256=FAB408536AA37C4ABC8BE97AB9C1F86CB33B63923D423FDC2859EB9D63FA8EA0

They had to add this:

        - sha256:
            - 423A9D13D410E2DC38EABB9FDF3121D2072472D0426260283A638B822DCD5180
            - 559CAE635F0D870652B9482EF436B31D4BB1A5A0F51750836F328D749291D0B6

Other way, the rule does not considers the Hashes.

Is it possible Hashes|contains: has no effect?