SEP: Use of YAML anchors

[frack113]

Author(s)

François @frack113

SEP Type

Format Enhancements (YAML structure, syntax improvements)

Abstract

This proposal introduces the use of YAML anchors

Problem Statement

It sometimes uses the same list several times in the same rule, which makes it difficult to maintain.

Use Cases

Rules use the exact duplicated list.

detection:
    selection:
        - Image|endswith:
            - '\pwsh.exe'
            - '\powershell.exe'
            - '\powershell_ise.exe'
            - '\wscript.exe'
        - ParentImage|endswith:
            - '\pwsh.exe'
            - '\powershell.exe'
            - '\powershell_ise.exe'
            - '\wscript.exe'
    condition: selection    

Detailed Specification

Use of YAML anchors.
https://yaml.org/spec/1.2.2/#3222-anchors-and-aliases

Syntax Examples

detection:
    selection:
        # Define an anchor for the list of binaries
        - Image|endswith: &binary_list
            - '\pwsh.exe'
            - '\powershell.exe'
            - '\powershell_ise.exe'
            - '\wscript.exe'
        # Use the anchor for ParentImage
        - ParentImage|endswith: *binary_list
    condition: selection   

Backward Compatibility Impact

Requires minor rule updates

Implementation Areas

• YAML structure changes
• Sigma conversion tools (pySigma)
• Backend updates
• Documentation

Submitter Checklist

• I have searched existing issues and SEPs to avoid duplicates
• I have provided concrete examples and use cases
• I have considered backward compatibility implications
• I have thought about implementation complexity

Implementation Assistance

Yes, I can help with implementation

Additional Context

No response

[Res260]

Wow I did not know this was a thing. I love it.
Solves a practical use case (that we have as well and fixed in another way) and requires little work, it's a no brainer to me.

[nasbench]

Tagging this as approved as this is an extension of the spec and was approved already internally.