feat: ✨ Add SigmahqMitreLinkValidator (#35)

* feat: ✨ Add SigmahqMitreLinkValidator

* Apply suggestions from code review

Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>

---------

Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>

Author: frack113

sigma/validators/sigmahq/metadata.py

@@ -290,3 +290,24 @@ def validate(self, rule: SigmaRule) -> List[SigmaValidationIssue]:
                     if re.match(r".*/[0-9a-z]{40}/.*", link) is None:
                         result.append(SigmahqGithubLinkIssue([rule], link))
         return result
+
+
+@dataclass
+class SigmahqMitreLinkIssue(SigmaValidationIssue):
+    description: ClassVar[str] = (
+        "Rule has a MITRE link instead of a MITRE attack tag. Use e.g. - attack.t1053.003"
+    )
+    severity: ClassVar[SigmaValidationIssueSeverity] = SigmaValidationIssueSeverity.MEDIUM
+    link: str
+
+
+class SigmahqMitreLinkValidator(SigmaRuleValidator):
+    """Checks if a rule uses a MITRE link instead of tag"""
+
+    def validate(self, rule: SigmaRule) -> List[SigmaValidationIssue]:
+        result = []
+        if rule.references is not None:
+            for link in rule.references:
+                if link.startswith("https://attack.mitre.org/"):
+                    result.append(SigmahqMitreLinkIssue([rule], link))
+        return result

tests/test_metadata.py

@@ -33,6 +33,8 @@
     SigmahqStatusToHighValidator,
     SigmahqGithubLinkIssue,
     SigmahqGithubLinkValidator,
+    SigmahqMitreLinkIssue,
+    SigmahqMitreLinkValidator,
 )
 
 
@@ -620,3 +622,47 @@ def test_validator_SigmahqStatusToHigh():
     """
     )
     assert validator.validate(rule) == []
+
+
+def test_validator_SigmahqMitreLink():
+    validator = SigmahqMitreLinkValidator()
+    rule = SigmaRule.from_yaml(
+        """
+    title: Test
+    description: Test
+    status: stable
+    references:
+        - https://attack.mitre.org/techniques/T1588/007/
+    logsource:
+        category: test
+    detection:
+        sel:
+            candle|exists: true
+        condition: sel
+    """
+    )
+    assert validator.validate(rule) == [
+        SigmahqMitreLinkIssue(rule, "https://attack.mitre.org/techniques/T1588/007/")
+    ]
+
+
+def test_validator_SigmahqMitreLink_valid():
+    validator = SigmahqMitreLinkValidator()
+    rule = SigmaRule.from_yaml(
+        """
+    title: Test
+    description: Test
+    status: stable
+    references:
+        - http://some-blog.org
+    tag:
+        - attack.t1588.007
+    logsource:
+        category: test
+    detection:
+        sel:
+            candle|exists: true
+        condition: sel
+    """
+    )
+    assert validator.validate(rule) == []