Sigma Type Conversion Defaults to String Issue

[NicoPang]

Version

2.4.170

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

48

Storage for /

4 TB

Storage for /nsm

2 TB

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Previous discussions and logs have indicated that Sigma rules can distinguish between numbers and strings by including quotes around the value. I've been trying to create a Sigma rule with the following detection:

detection:
    selection_port:
        dst_port:
            - 80
            - 443

However, when converting to EQL, it treats the destination.port field like a string:

(destination.port like~ (80, 443))

The same thing happens when only a single number is used:

detection:
    selection_port:
        dst_port: 443

becomes

destination.port:443

when it should be

destination.port==443

I've also found that every pre-built Sigma rule with numeric fields will also have a conversion issue and assumes everything is a string. Am I missing something?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.