pysigma-backend-clickhouse 0.3.0

Clickhouse backend for sigma

pySigma Clickhouse Backend

This is the Clickhouse backend for pySigma. It provides the package sigma.backends.clickhouse with the ClickhouseBackend class.

It supports the following output formats for Sigma rules:

• default: plain clickhouse SQL querie
• clicksiem: rule format for clickdetect

Thanks

To implement this Clickhouse backend I have leanerd a lot of code, and this is my thanks to most helpful to me.

• Thanks for SQLite implementation
• Thanks for the incredible blog post Creating a Sigma Backend for Fun (and no profit)

How To

Converting sigma to clickhouse

from sigma.backends.clickhouse.clickhouse import ClickhouseBackend
from sigma.collection import SigmaCollection

rule = """
title: Run Whoami Showing Privileges
id: 97a80ec7-0e2f-4d05-9ef4-65760e634f6b
status: experimental
description: Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privieleges. This is often used after a privilege escalation attempt. 
references:
    - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/whoami
author: Florian Roth
date: 2021/05/05
modified: 2022/05/13
tags:
    - attack.privilege_escalation
    - attack.discovery
    - attack.t1033
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\whoami.exe'
        - OriginalFileName: 'whoami.exe'
    selection_cli:
        CommandLine|contains: '/priv'
    condition: all of selection*
falsepositives:
    - Administrative activity (rare lookups on current privileges)
level: high
"""

backend = ClickhouseBackend()
rule_sigma = SigmaCollection.from_yaml(rule)
print(backend.convert(rule_sigma)[0])

Maintainer

Created an maintaned by souzo

• https://github.com/souzomain
• https://medium.com/@souzo

Dev

Setup your dev environment

uv sync
source .venv/bin/activate