Merge pull request #45 from f-bader/bugfix/44

Add additional check if subTechnique already exists
f-bader · Jan 20, 2025 · b5e508c · b5e508c
2 parents 2f830cc + 5db240b
commit b5e508c
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 4 deletions.
diff --git a/README.md b/README.md
@@ -179,6 +179,12 @@ This way the following KQL query will be converted...
 
 ## Changelog
 
+### 2.4.4
+ * FIX: Duplicated MITRE subTechniques in rare cases
+
+### 2.4.3
+ * FIX: Fix upstream issues with [powershell-yaml](https://github.com/cloudbase/powershell-yaml)
+
 ### 2.4.2
  * FIX: Arm to YAML used `techniques` instead of `relevantTechniques`
 

diff --git a/src/SentinelARConverter.psd1 b/src/SentinelARConverter.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'SentinelARConverter.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '2.4.3'
+    ModuleVersion     = '2.4.4'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()

diff --git a/src/public/Convert-SentinelARArmToYaml.ps1 b/src/public/Convert-SentinelARArmToYaml.ps1
@@ -358,11 +358,14 @@ function Convert-SentinelARArmToYaml {
                             if ( -not $AnalyticsRuleCleaned.Contains($KeyName) ) {
                                 $AnalyticsRuleCleaned.Add($KeyName, @())
                             }
-                            # Add subTechnique if the mainTechnique is not already present
-                            if (-not($AnalyticsRuleCleaned[$KeyName].contains($technique))) {
+
+                            if ( $AnalyticsRuleCleaned[$KeyName].contains($value) ) {
+                                # Do nothing if subTechnique is already present
+                            } elseif (-not($AnalyticsRuleCleaned[$KeyName].contains($technique))) {
+                                # Add subTechnique if the mainTechnique is not already present
                                 $AnalyticsRuleCleaned[$KeyName] += $value
-                                # Replace mainTechnique with subTechnique
                             } else {
+                                # Replace mainTechnique with subTechnique
                                 $AnalyticsRuleCleaned[$KeyName][$AnalyticsRuleCleaned[$KeyName].indexOf($technique)] = $value
                             }
                         }