Skip to content

[Bug] Rule Toml Write Formatting Wrongly Formats \\\\x #4978

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
eric-forte-elastic merged 13 commits into from
Aug 18, 2025
Merged

[Bug] Rule Toml Write Formatting Wrongly Formats \\\\x #4978

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
c6a2bdc
Fix rule and mitigate py toml
eric-forte-elastic Aug 13, 2025
c19c8e3
Bump patch version
eric-forte-elastic Aug 13, 2025
2ced0dc
Add reference to issue
eric-forte-elastic Aug 13, 2025
7bd4787
Merge branch 'main' into 4977-bug-rule-toml-write-formatting-wrongly-…
eric-forte-elastic Aug 18, 2025
1965007
Add unit test for path issues
eric-forte-elastic Aug 18, 2025
958fcfe
Merge branch 'main' into 4977-bug-rule-toml-write-formatting-wrongly-…
eric-forte-elastic Aug 18, 2025
5dab229
Update comment
eric-forte-elastic Aug 18, 2025
1f0dca0
Merge branch '4977-bug-rule-toml-write-formatting-wrongly-formats-x' …
eric-forte-elastic Aug 18, 2025
d69acdd
Certain strings were not properly escaped
eric-forte-elastic Aug 18, 2025
e6d22d9
Updated to use json instead of repr
eric-forte-elastic Aug 18, 2025
f1501ca
replace _old_dump_str with json.dumps
eric-forte-elastic Aug 18, 2025
b68278c
Merge branch 'main' into 4977-bug-rule-toml-write-formatting-wrongly-…
eric-forte-elastic Aug 18, 2025
84da63c
Bump Version
eric-forte-elastic Aug 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions detection_rules/rule_formatter.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,6 +151,8 @@ def dump_str(self, v: str | NonformattedField) -> str:
return "\n".join([TRIPLE_SQ] + [self._old_dump_str(line)[1:-1] for line in lines] + [TRIPLE_SQ])
if raw:
return f"'{lines[0]:s}'"
if "\\\\x" in v:
return f'"{v!s}"'

@Mikaayenson Mikaayenson Aug 15, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we will want a new unit test in test_toml_formatter.py

@eric-forte-elastic eric-forte-elastic Aug 18, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

++ agreed, added new unit test that looks for this specifically. It also will fail if the path behavior changes. E.g. currently we expect \\\\ to be formatted to \\. If this changes the unit test will fail on purpose as we want to match Query DSL's path handling which does this as well.

return self._old_dump_str(v)

def _dump_flat_list(self, v: Iterable[Any]) -> str:
Expand Down
2 changes: 1 addition & 1 deletion pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
[project]
name = "detection_rules"
version = "1.3.23"
version = "1.3.24"
description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
readme = "README.md"
requires-python = ">=3.12"
Expand Down
8 changes: 4 additions & 4 deletions rules/windows/privilege_escalation_printspooler_service_suspicious_file.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2020/08/14"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/08/13"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -106,14 +106,14 @@ value = "?:\\\\Windows\\\\Sys?????\\\\PrintConfig.dll"
negate = true
[rule.filters.query.wildcard."file.path"]
case_insensitive = true
value = "?:\\Windows\\Sys?????\\u005lrs.dll"
value = "?:\\Windows\\Sys?????\\x5lrs.dll"
[[rule.filters]]

[rule.filters.meta]
negate = true
[rule.filters.query.wildcard."file.path"]
case_insensitive = true
value = "?:\\Windows\\system32\\spool\\DRIVERS\\u0064\\\\*.dll"
value = "?:\\Windows\\system32\\spool\\DRIVERS\\x64\\*.dll"
[[rule.filters]]

[rule.filters.meta]
Expand All @@ -127,7 +127,7 @@ value = "?:\\\\Windows\\\\system32\\\\spool\\\\DRIVERS\\\\W32X86\\\\*.dll"
negate = true
[rule.filters.query.wildcard."file.path"]
case_insensitive = true
value = "?:\\Windows\\system32\\spool\\PRTPROCS\\u0064\\\\*.dll"
value = "?:\\Windows\\system32\\spool\\PRTPROCS\\x64\\*.dll"
[[rule.filters]]

[rule.filters.meta]
Expand Down
Loading