Bad translation of rule (I guess?)

[gpedras]

(Bad trnaslation of* Rule) title misstyping

Hi,
Straight to the point: I translated this rule to elastalert-dsl (https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_svchost.yml):

title: Suspicious Svchost Process
id: 01d2e2a1-5f09-44f7-9fc1-24faa7479b6d
status: experimental
description: Detects a suspicious svchost process start
tags:
    - attack.defense_evasion
    - attack.t1036.005
author: Florian Roth
date: 2017/08/15
modified: 2022/02/09
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\svchost.exe'
    filter:
        ParentImage|endswith:
            - '\services.exe'
            - '\MsMpEng.exe'
            - '\Mrt.exe'
            - '\rpcnet.exe'
            - '\svchost.exe'
            - '\ngen.exe'
            - '\TiWorker.exe'
    filter_null1:
        ParentImage: null
    filter_null2:
        ParentImage: ''
    filter_emptysysmon:
        ParentImage: '-'
    condition: selection and not 1 of filter*
fields:
    - CommandLine
    - ParentCommandLine
falsepositives:
    - Unknown
level: high

It gets translated to (I removed the ".keyword" because is the only way to match wildcards in my case):

 alert:
- debug
description: Detects a suspicious svchost process start
filter:
- query:
    constant_score:
      filter:
        bool:
          must:
          - match_phrase:
              EventID: '1'
          - wildcard:
              Image: '*\\svchost.exe'
          - bool:
              must_not:
              - bool:
                  should:
                  - bool:
                      must:
                      - bool:
                          should:
                          - wildcard:
                              ParentImage: '*\\services.exe'
                          - wildcard:
                              ParentImage: '*\\MsMpEng.exe'
                          - wildcard:
                              ParentImage: '*\\Mrt.exe'
                          - wildcard:
                              ParentImage: '*\\rpcnet.exe'
                          - wildcard:
                              ParentImage: '*\\svchost.exe'
                          - wildcard:
                              ParentImage: '*\\ngen.exe'
                          - wildcard:
                              ParentImage: '*\\TiWorker.exe'
                  - bool:
                      must:
                      - bool:
                          must_not:
                            exists:
                              field: ParentImage
                  - bool:
                      must:
                      - match_phrase:
                          ParentImage: ''
                  - bool:
                      must:
                      - match_phrase:
                          ParentImage: '-'
index: xxxxxxxxxxxxxxxxxxxxxxx*
name: Suspicious Svchost Process
priority: 2
realert:
  minutes: 0
type: any

As my understanding the eventlog must contain one of the entries in selection and not match the filters. Although this document triggers this alert (redacted for obvious reasons):

{
 "EventID": "1",
 "Image": "C:\\Windows\\System32\\svchost.exe",
 "ParentImage": "C:\\Windows\\System32\\services.exe"
}

Am I missing something?

[gpedras]

Ok nvm, I was using an additional escape string on ParentImage, now it's working fine.

RIP