Repository navigation
Chainsaw problem with 1 of selection* condition dropping all(...) in Sigma to Tau translation version 2.16.3 #235
Description
Hi, I’m experiencing an issue with Chainsaw 2.16.3 that was not present in version 2.15.0.
When a Sigma rule uses the 1 of selection condition, Chainsaw appears to interpret the condition incorrectly, which results in false positive detections.
2.15.0:
2.16.3:
As a result, a single condition inside the selection can be sufficient to match instead of requiring the complete selection, which may lead to false positives.
Activity
pakaczux3 commentedon Aug 19, 2026
Example
Sigma rule registry_set_creation_service_susp_folder.yml:
Detection with Chainsaw 2.16.3:
This shows that, in Chainsaw 2.16.3, a single condition inside the selection can be enough to produce a match, instead of requiring all conditions within that selection to be satisfied.
alexkornitzer commentedon Aug 19, 2026
Ah apologies I probably broke it when fixing another translation bug in
v2.16.1, I had really hoped I had not caused any regressions. Anyhow let me get a test case for the above in and i'll get a fix out ASAP.alexkornitzer commentedon Aug 19, 2026
That should now be fixed with
v2.16.4.fix: handle parsing regression with 1 of *