Use new properties according to I1104 implementation.

vastlimits · Jan 19, 2024 · cb3aca0 · cb3aca0
1 parent 0782a2b
commit cb3aca0
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/pyproject.toml b/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "pySigma-backend-uberAgent"
-version = "0.3.62"
+version = "0.3.63"
 description = "pySigma uAQL backend"
 authors = ["vast limits GmbH <info@vastlimits.com>"]
 license = "MIT"

diff --git a/sigma/pipelines/uberagent/uberagent.py b/sigma/pipelines/uberagent/uberagent.py
@@ -161,8 +161,10 @@
     # ""                    : Field(UA_VERSION_6_0, "Reg.File.Name"),
     # ""                    : Field(UA_VERSION_6_0, "Reg.Key.Sddl"),
     # ""                    : Field(UA_VERSION_6_0, "Reg.Key.Hive"),
-    "targetobject"          : Field(UA_VERSION_6_2, "Reg.Key.Target"),
+    "targetobject"          : Field(UA_VERSION_DEVELOP, "Reg.TargetObject"),
     "details"               : Field(UA_VERSION_DEVELOP, "Reg.Value.Data"),
+    # ""                    : Field(UA_VERSION_DEVELOP, "Reg.Value.Data.Number")
+    # ""                    : Field(UA_VERSION_DEVELOP, "Reg.Value.Data.String")
     "eventtype"             : Field(UA_VERSION_DEVELOP, "Reg.EventType")
     # ""                    : Field(UA_VERSION_7_1, "Reg.Value.Type")
 }