INNER CODE UNIT · Python

sorted_case_insensitive_unique

magicsword-io/LOLRMM · bin/generate_detections.py:42

def sorted_case_insensitive_unique(values):
    """Pick the same spelling regardless of discovery or record order."""
    unique = {}
    for value in sorted(values, key=lambda value: (value.casefold(), value)):
        unique.setdefault(value.casefold(), value)
    return list(unique.values())


def generate_sigma_rule():
    """Generate a generic Sigma rule for RMM detection"""

    # Get a list of common RMM executables from YAML files
    yaml_dir = os.path.join(
        os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "yaml"
    )
    yaml_files = glob.glob(os.path.join(yaml_dir, "*.y*ml"))

    exe_list = []

View source record →