add missing mitre tactics + missing author validators (#50)

* add missing mitre tactics validator

* add author validator

* chore: group by missing technique, not by tactic, for the error message


---------

Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>

Author: nasbench

pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "pySigma-validators-sigmahq"
-version = "0.10.2"
+version = "0.11.0"
 description = "pySigma SigmaHQ validators"
 authors = ["François Hubaut <frack113@users.noreply.github.com>"]
 license = "LGPL-2.1-only"

sigma/validators/sigmahq/metadata.py

@@ -27,6 +27,22 @@ def validate(self, rule: SigmaRuleBase) -> List[SigmaValidationIssue]:
             return []
 
 
+@dataclass
+class SigmahqAuthorExistenceIssue(SigmaValidationIssue):
+    description: ClassVar[str] = "Rule is missing the author field"
+    severity: ClassVar[SigmaValidationIssueSeverity] = SigmaValidationIssueSeverity.MEDIUM
+
+
+class SigmahqAuthorExistenceValidator(SigmaRuleValidator):
+    """Checks if a rule is missing the author field."""
+
+    def validate(self, rule: SigmaRuleBase) -> List[SigmaValidationIssue]:
+        if rule.author is None:
+            return [SigmahqAuthorExistenceIssue([rule])]
+        else:
+            return []
+
+
 @dataclass
 class SigmahqStatusIssue(SigmaValidationIssue):
     description: ClassVar[str] = (

sigma/validators/sigmahq/tags.py

@@ -9,6 +9,9 @@
     SigmaValidationIssue,
     SigmaValidationIssueSeverity,
 )
+
+from sigma.data.mitre_attack import mitre_attack_techniques_tactics_mapping
+
 from .config import ConfigHQ
 
 config = ConfigHQ()
@@ -91,3 +94,56 @@ def validate(self, rule: SigmaRuleBase) -> List[SigmaValidationIssue]:
             if tag.namespace == "tlp" and tag.name not in self.allowed_tlp:
                 return [SigmahqTagsTlpIssue([rule], tlp=tag.name)]
         return []
+
+
+@dataclass
+class SigmahqTagsTechniquesWithoutTacticsIssue(SigmaValidationIssue):
+    description: ClassVar[str] = (
+        "A MITRE ATT&CK technique tag was found without its corresponding tactic name. (e.g. when using 'attack.t1059' you have to add 'attack.execution' as well)"
+    )
+    severity: ClassVar[SigmaValidationIssueSeverity] = SigmaValidationIssueSeverity.HIGH
+    techniques: List[str]
+    missing_tactic: str
+
+
+class SigmahqTagsTechniquesWithoutTacticsValidator(SigmaRuleValidator):
+    """Ensures that MITRE ATT&CK technique tags have their corresponding tactic tags."""
+
+    def validate(self, rule: SigmaRuleBase) -> List[SigmaValidationIssue]:
+        issues = []
+
+        attack_tags = [tag for tag in rule.tags or [] if tag.namespace == "attack"]
+
+        technique_tags = [
+            tag.name
+            for tag in attack_tags
+            if tag.name.startswith("t") and any(c.isdigit() for c in tag.name)
+        ]
+        tactic_tags = [tag.name for tag in attack_tags if not tag.name.startswith("t")]
+
+        missing_tactics = []
+        for technique in technique_tags:
+            technique_upper = technique.upper()
+
+            if technique_upper in mitre_attack_techniques_tactics_mapping:
+                required_tactics = mitre_attack_techniques_tactics_mapping[technique_upper]
+                missing_tactics.extend(
+                    [tactic for tactic in required_tactics if tactic not in tactic_tags]
+                )
+
+        if missing_tactics:
+            for missing_tactic in set(missing_tactics):
+                techniques = [
+                    technique
+                    for technique in technique_tags
+                    if missing_tactic in mitre_attack_techniques_tactics_mapping[technique.upper()]
+                ]
+                issues.append(
+                    SigmahqTagsTechniquesWithoutTacticsIssue(
+                        [rule],
+                        techniques=["attack." + t for t in techniques],
+                        missing_tactic="attack." + missing_tactic,
+                    )
+                )
+
+        return issues

tests/test_metadata.py

@@ -7,6 +7,8 @@
 from sigma.validators.sigmahq.metadata import (
     SigmahqStatusExistenceIssue,
     SigmahqStatusExistenceValidator,
+    SigmahqAuthorExistenceIssue,
+    SigmahqAuthorExistenceValidator,
     SigmahqStatusIssue,
     SigmahqStatusValidator,
     SigmahqDateExistenceIssue,
@@ -157,6 +159,40 @@ def test_validator_SigmahqStatusExistence_valid():
     assert validator.validate(rule) == []
 
 
+def test_validator_SigmahqAuthorExistence():
+    validator = SigmahqAuthorExistenceValidator()
+    rule = SigmaRule.from_yaml(
+        """
+    title: Test
+    logsource:
+        category: test
+    detection:
+        sel:
+            field: value
+        condition: sel
+    """
+    )
+    assert validator.validate(rule) == [SigmahqAuthorExistenceIssue([rule])]
+
+
+def test_validator_SigmahqAuthorExistence_valid():
+    validator = SigmahqAuthorExistenceValidator()
+    rule = SigmaRule.from_yaml(
+        """
+    title: Test
+    author: test
+    status: test
+    logsource:
+        category: test
+    detection:
+        sel:
+            field: value
+        condition: sel
+    """
+    )
+    assert validator.validate(rule) == []
+
+
 def test_validator_SigmahqDescriptionExistence():
     validator = SigmahqDescriptionExistenceValidator()
     rule = SigmaRule.from_yaml(

tests/test_tags.py

@@ -12,6 +12,8 @@
     SigmahqTagsUniqueDetectionValidator,
     SigmahqTagsUniqueTlpIssue,
     SigmahqTagsUniqueTlpValidator,
+    SigmahqTagsTechniquesWithoutTacticsIssue,
+    SigmahqTagsTechniquesWithoutTacticsValidator,
 )
 
 
@@ -223,3 +225,53 @@ def test_validator_SigmahqTagsNoDetection():
     """
     )
     assert validator.validate(rule) == []
+
+
+def test_validator_SigmahqTagsTechniquesWithoutTactics():
+    validator = SigmahqTagsTechniquesWithoutTacticsValidator()
+    rule = SigmaRule.from_yaml(
+        """
+    title: test
+    status: unsupported
+    tags:
+        - attack.t1027.004
+        - attack.t1027.005
+    logsource:
+        category: test
+    detection:
+        sel:
+            field: path\\*something
+        condition: sel
+    """
+    )
+
+    assert validator.validate(rule) == [
+        SigmahqTagsTechniquesWithoutTacticsIssue(
+            [rule],
+            techniques=["attack.t1027.004", "attack.t1027.005"],
+            missing_tactic="attack.defense-evasion",
+        )
+    ]
+
+
+def test_validator_SigmahqTagsTechniquesWithoutTactics_valid():
+    validator = SigmahqTagsTechniquesWithoutTacticsValidator()
+    rule = SigmaRule.from_yaml(
+        """
+    title: test
+    status: unsupported
+    tags:
+        - attack.t1027.004
+        - attack.t1027.005
+        - attack.defense-evasion
+        - attack.t1003
+        - attack.credential-access
+    logsource:
+        category: test
+    detection:
+        sel:
+            field: path\\*something
+        condition: sel
+    """
+    )
+    assert validator.validate(rule) == []