Matching values

Without a modifier: the whole value

Image: 'C:\Windows\System32\mshta.exe' matches only when the whole field equals that text. The comparison ignores case, so C:\windows\system32\MSHTA.EXE matches too, but C:\Windows\SysWOW64\mshta.exe does not. Sigma compares strings case-insensitively unless the cased modifier is used (Image|cased: ...).

Wildcards

Two characters have a special meaning in a value: * stands for any number of characters, ? for exactly one. Image: '*\mshta.exe' matches every path that ends in \mshta.exe. To match a real * or ?, put a backslash before it: \*. A backslash before any other character is an ordinary backslash, so Windows paths are written as they are.

Modifiers

A modifier follows the field name after a | and changes how the value is compared:

• contains: the value appears anywhere in the field. CommandLine|contains: 'vbscript:'
• startswith: the field begins with the value.
• endswith: the field ends with the value. Image|endswith: '\mshta.exe' is the usual way to name a program regardless of the folder it runs from.

Modifiers are easier to read than wildcards and say what was meant. contains is the widest of them and the most likely to match things you did not intend; prefer startswith or endswith when the position is known.

A list of values

A field can take a list. The field matches if any of the values matches:

CommandLine|contains:
  - 'vbscript:'
  - 'javascript:'

Two conditions in the same search must both match, also when they look at the same field with different modifiers. The next lesson builds on this.