Support Ordered Temporal Proximity correlation

[YamatoSecurity]

Support Ordered Temporal Proximity correlation

https://github.com/SigmaHQ/sigma-specification/blob/main/specification/sigma-correlation-rules-specification.md#ordered-temporal-proximity-temporal_ordered

Sample rule:

correlation:
    type: temporal_ordered
    rules:
        - e87bd730-df45-4ae9-85de-6c75369c5d29 # Logon Failure (Wrong Password)
        - successful_login
    group-by:
        - Computer
        - TargetUserName
    timespan: 1h

[YamatoSecurity]

@fukusuket Since you are now the correlations rules master, 😉 can I ask you to do this one too?

I will send you a sample evtx file to test with over slack.
I created a rule that works well with temporal:

title: Successful password spray
id: 23179f25-6fce-4827-bae1-b219deaf563a
author: yamatosecurity
correlation:
  type: temporal
  rules:
    - many_failed_logins
    - successful_login
  group-by:
    - Computer
  timespan: 1m
  generate: true
level: critical
ruletype: Hayabusa
---
id: 5dbf63ae-07a2-4b47-b75d-e8430e686a29
title: Many Failed Logons!
author: author1
name: many_failed_logins
level: high
logsource:
  product: windows
  service: security
correlation:
    #generate: true
    type: value_count
    rules:
        - failed_logins
    group-by:
        - IpAddress
        - Computer
    timespan: 5m
    condition:
        gte: 5
        field: TargetUserName
---
id: 23179f25-6fce-4827-bae1-b219deaf563c
title: Failed Logon
author: author1
name: failed_logins
level: medium
logsource:
  product: windows
  service: security
detection:
  selection:
    Channel: Security
    EventID: 4625
  condition: selection
---
id: 23179f25-6fce-4827-bae1-b219deaf563x
title: Successful Login
author: author2
name: successful_login
level: informational
logsource:
  product: windows
  service: security
detection:
  selection:
    Channel: Security
    EventID: 4624
  condition: selection

Results:

╭─────────────────────────────────────────────────────────╮
│ Top critical alerts:            Top high alerts:        │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ Successful password spray (2)   Many Failed Logons! (1) │
│ n/a                             n/a                     │
│ n/a                             n/a                     │
│ n/a                             n/a                     │
│ n/a                             n/a                     │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ Top medium alerts:              Top low alerts:         │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ n/a                             n/a                     │
│ n/a                             n/a                     │
│ n/a                             n/a                     │
│ n/a                             n/a                     │
│ n/a                             n/a                     │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ Top informational alerts:                               │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ Successful Login (6)            n/a                     │
│ n/a                             n/a                     │
│ n/a                             n/a                     │
│ n/a                             n/a                     │
│ n/a                             n/a                     │
╰───────────────────────────────╌─────────────────────────╯

Now, we just need to change temporal to temporal_ordered and make sure it works when the rules are defined in this order:

    - many_failed_logins
    - successful_login

but does not work in this order:

    - successful_login
    - many_failed_logins

since there are only 4 days left until release don't worry about rushing. We can include this in the next 3.1 release if it will take time.