Repository: SigmaHQ/sigma

Issue:
Unknown field modifier in master rules
sigmac fails to parse both `rules/windows/builtin/security/win_security_successful_external_remote_smb_login.yml` and `rules/windows/builtin/security/win_security_successful_external_remote_rdp_login.yml` due to an unknown field modifier, `IpAddress|cidr`. The unit tests also failed https://github.com/SigmaHQ/sigma/actions/runs/4052855667/jobs/6972774488#step:6:66.


Discussion:
This modifier in question is a new modifier introduced in PySIGMA and is not compatible with SIGMAC. 

The failed unit test you point out was just due to missing the modifier from the list of the test  (see [here](https://github.com/SigmaHQ/sigma/blob/master/tests/test_rules.py#L1174)). You can see the test actually succeded that's why the PR was merged ;)

You can read more about the modifier in the V2 branch of the specification [here](https://github.com/SigmaHQ/sigma-specification/blob/version_2/Sigma_specification.md#value-modifiers) and you can use the [SIGMA-CLI](https://github.com/SigmaHQ/sigma-cli) to convert the rule to a supported backend.

You can check more about PySIGMA [here](https://github.com/SigmaHQ/pySigma)

Note that this modifier won't be backported to SIGMAC as it's approaching it's EOL. So basically this new rule only works with the new PySIGMA
That makes sense. Thanks for the explanation. Is there an archive of rules that work still with sigmac that I can use while I transition to one of the other tools you mentioned?
This is the first rule that uses the new notation in the repo. So don't worry all rules are working with both SIGMAC and Sigma-CLI. But we are encouraging the transition to PySIGMA slowly. So where it makes sense from a rule POV you'll see the usage of these new modifiers.

A graceful error should be introduced (if not already) to SIGMAC to drop rules using the new notation and not generate any blocking errors during conversion.

Once the move is done we will showcase that and keep a working set of rules before the new notation so no worries.

Time to get ahead and start checking out PySIGMA :D 

Hope this answers your questions.
I can see above that such errors are expected to be handled gracefully in sigmac, however this does not seem to be the case when I try to compile all rules in the "windows" directory using it.

My command (which has worked in some automation code I wrote for about 9 months): 
```
sigmac -of title,description,references,id,status,level,falsepositives,tags,fields -oF json -o rules.json -d -r -I -t es-qs -c tools/config/velo.yml rules/windows/
```
The error (which causes the program to exit):
```
Traceback (most recent call last):
  File "C:\Users\AndrewCallow\Documents\code\sigma\tools\sigmac", line 5, in <module>
    main()
  File "C:\Users\AndrewCallow\Documents\code\sigma\tools\sigma\sigmac.py", line 325, in main
    parser = SigmaCollectionParser(f, sigmaconfigs, rulefilter, sigmafile)
  File "C:\Users\AndrewCallow\Documents\code\sigma\tools\sigma\parser\collection.py", line 73, in __init__
    self.parsers.append(SigmaParser(yamldoc, config))
  File "C:\Users\AndrewCallow\Documents\code\sigma\tools\sigma\parser\rule.py", line 29, in __init__
    self.parse_sigma()
  File "C:\Users\AndrewCallow\Documents\code\sigma\tools\sigma\parser\rule.py", line 53, in parse_sigma
    condparsed = SigmaConditionParser(self, tokens)
  File "C:\Users\AndrewCallow\Documents\code\sigma\tools\sigma\parser\condition.py", line 496, in __init__
    self.parsedSearch = self.parseSearch(tokens)
  File "C:\Users\AndrewCallow\Documents\code\sigma\tools\sigma\parser\condition.py", line 554, in parseSearch
    treenode = operator[2](self.sigmaParser, tok_op)
  File "C:\Users\AndrewCallow\Documents\code\sigma\tools\sigma\parser\condition.py", line 315, in convertId
    return NodeSubexpression(sigma.parse_definition_byname(op.matched))
  File "C:\Users\AndrewCallow\Documents\code\sigma\tools\sigma\parser\rule.py", line 61, in parse_definition_byname
    return self.parse_definition(definition, condOverride)
  File "C:\Users\AndrewCallow\Documents\code\sigma\tools\sigma\parser\rule.py", line 86, in parse_definition
    value = apply_modifiers(value, modifiers)
  File "C:\Users\AndrewCallow\Documents\code\sigma\tools\sigma\parser\modifiers\discovery.py", line 36, in apply_modifiers
    value = modifiers[modifier](value).apply()
KeyError: 'cidr'
```

Simply changing the apply_modifiers function (tools/sigma/parser/modifiers/discovery.py) to this works, however it's a bit of a hack as just returns the original value without any modifications:

```
def apply_modifiers(value, modifier_list):
    """
    Apply modifiers to value.

    value: value from Sigma rule
    modifiers: list of modifier names
    """
    for modifier in modifier_list:
        try:# apply modifiers in given order
            value = modifiers[modifier](value).apply()
        except KeyError:
            return value
    return value
```

I'm happy to transition to the new tools, however thought it was worth pointing the above out. 
I'm reopening this just to point out that I received the same error as above. In the meantime, I am transitioning to the new tools. In the meantime, I think that any rules with the new modifiers that can't be converted by sigmac should be handled gracefully.

Resolving patch:
diff --git a/tools/sigma/parser/rule.py b/tools/sigma/parser/rule.py
--- a/tools/sigma/parser/rule.py
+++ b/tools/sigma/parser/rule.py
@@ -83,6 +83,9 @@ def parse_definition(self, definition, condOverride=None):
             for key, value in definition.items():
                 if "|" in key:  # field name contains value modifier
                     fieldname, *modifiers = key.split("|")
+                    if "cidr" in modifiers: # Add other unsupported modifiers here
+                        raise SigmaParseError("Cannot convert the rule. Unsupported new cidr modifier by SIGMAC. Please use the new PySigma/SigmaCLI to be able to convert the rule")
+                        break
                     value = apply_modifiers(value, modifiers)
                 else:
                     fieldname = key


Test patch: