Detection¶

Rustinel has three detector paths:

• Sigma for behavioral rules on normalized events
• YARA for executable scans on process-start events
• IOC for inline indicators plus background file hashing

All detection hits are written as ECS NDJSON alerts. The same alerts can also feed the optional response engine.

Runtime Flow¶

Sigma¶

Rule Loading and Classification¶

• Rules load recursively from scanner.sigma_rules_path.
• Multi-document YAML with action: global is supported.
• Rules are classified at load time by normalized product, service, and category.
• product mismatches are skipped.
• Known Linux service families that are not implemented yet are marked as deferred instead of unknown.
• Unknown logsource shapes are skipped.
• Known but inactive collectors can still load for compatibility, but they will not match until the sensor emits that telemetry family.

Supported Logsource Families¶

Field Model¶

• Sigma evaluates the shared NormalizedEvent model with Sysmon-style field names.
• Shared process fields include Image, CommandLine, User, ProcessId, ParentImage, and ParentCommandLine.
• Shared network fields include DestinationIp, DestinationPort, SourceIp, SourcePort, and DestinationHostname.
• Shared file fields include TargetFilename, Image, ProcessId, and User.
• DNS rules can use either Sysmon-style names such as QueryName and QueryResults or the generic aliases query, answer, and record_type.

DNS field availability differs by platform:

On Linux, the current eBPF DNS path does not extract QueryName or QueryResults, so generic DNS rules that depend on domain names or resolved answers are much more effective on Windows today.

After a Sigma hit, Rustinel enriches non-process alerts with process_context from the process cache when that context is available.

Supported Modifiers¶

Wildcard * and ? matching is also supported for string patterns.

Match Debug¶

alerts.match_debug controls how much match metadata is attached to Sigma alerts:

• off: no match_details
• summary: adds a short summary, the rule condition, selection results, and matched field or keyword descriptors without the matched field values
• full: adds the matched field values as well

Rustinel truncates long match metadata to keep alerts bounded.

Severity¶

YARA¶

YARA scanning is shared across both supported platforms.

Behavior¶

• Rules compile from top-level .yar and .yara files in scanner.yara_rules_path.
• Rule loading is not recursive.
• Only process-start events queue YARA scans.
• On Windows, raw ETW paths are normalized before scanning so the worker can open the file.
• Trusted path prefixes are skipped before queueing and checked again in the worker.
• Results are cached by file identity with a 10,000-entry cap and a 6-hour TTL.
• Each matching YARA rule emits its own alert.

Match Debug¶

alerts.match_debug also affects YARA alerts:

• off: no match_details
• summary: includes the matched rule name and structured rule metadata such as tags and namespace
• full: also includes matched string IDs, offsets, and snippets

Severity¶

Every YARA match is emitted as a critical alert.

IOC¶

The IOC engine hot reloads indicator files and splits work between inline event checks and a background hash worker.

Indicator Types¶

Runtime Notes¶

• Hashing only runs when at least one hash IOC is loaded.
• Hashing is triggered from process-start events.
• Trusted path prefixes and ioc.max_file_size_mb are enforced before hashing.
• Hash results are cached by file identity with a 10,000-entry cap and a 6-hour TTL.
• Inline IOC matching can emit multiple alerts from a single event.

Windows currently has much better IOC coverage for domains and DNS-answer IPs because its DNS events carry QueryName and QueryResults. Linux eBPF DNS events do not currently populate those fields.

IOC File Format¶

• Lines beginning with # or // are comments.
• Empty lines are ignored.
• ;comment suffixes are optional.
• Hashes are auto-detected by length as MD5, SHA1, or SHA256.
• Domain entries without a leading . are exact matches.
• Domain entries with a leading . match the suffix and all subdomains.
• Domain entries with a leading *. are normalized to suffix matching.
• Path regexes are compiled case-insensitive.

Example:

203.0.113.1;C2 endpoint
.example.org;Suspicious zone
^/tmp/evil(/.*)?$;Linux staging path

Severity¶

ioc.default_severity maps IOC alerts to critical, high, medium, or low. Unknown values fall back to high.

Overall Severity Mapping¶