Escaping backticks in LogQL

Oct 13, 2025 by talynt.org 144 views

Introduction

When converting Sigma rules to Loki rules, some generated rules may fail to evaluate due to syntax errors in the LogQL query. This issue is particularly common when dealing with rules that contain special characters, such as backticks, which are used for escaping in LogQL. In this article, we will explore the problem of LogQL's inability to escape backticks and provide guidance on how to escape them correctly.

Understanding the issue

The problem arises from the fact that LogQL uses backticks to denote strings, whereas Sigma rules use backslashes to escape special characters. When converting Sigma rules to Loki rules, the backslashes are replaced with backticks, but LogQL does not support escaping backticks. This results in syntax errors and prevents the rule from evaluating correctly.

Example 1: Potential PowerShell Command Line Obfuscation

The first rule that fails is the "Potential PowerShell Command Line Obfuscation" rule. The error message indicates a syntax error at line 1, column 662, with the message "parse error at line 1, col 662: syntax error: unexpected .". However, the issue is not with the dot (.) character, but rather with the last CommandLine regex in the Sigma rule.

alert: Potential_PowerShell_Command_Line_Obfuscation
expr: '(sum(count_over_time({job=~"windows_eventlog"} | json | label_format Message="{{
  .message | replace \"\\\\\" \"\\\\\\\\\" | replace \"\\\"\" \"\\\\\\\"\" }}" | line_format
  "{{ regexReplaceAll \"([^:]+): ?((?:[^\\\\r]*|$))(\\r\\n|$)\" .Message \"${1}=\\\"${2}\\\"
  \"}}" | logfmt | ( ( ( ( ( ( event_id==1 , ( ( ( Image=~`(?i).*\\powershell\.exe$`
  or Image=~`(?i).*\\pwsh\.exe$` ) or OriginalFileName=~`(?i)^PowerShell\.EXE$` )
  or OriginalFileName=~`(?i)^pwsh\.dll$` ) ) , ( ( ( ( CommandLine=~`\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+`
  or CommandLine=~`\{.*\{.*\{.*\{.*\{.*\{.*\{.*\{.*\{.*\{` ) or CommandLine=~`\^.*\^.*\^.*\^.*\^`
  ) or CommandLine=~``.*`.*`.*`.*`` ) ) , ParentImage!~"(?i)^C:\\\\Program\\ Files\\\\Amazon\\\\SSM\\\\ssm\\-document\\-worker\\.exe$"
  ) , CommandLine!~"(?i).*new\\ EventSource\\(\"Microsoft\\.Windows\\.Sense\\.Client\\.Management\".*"
  ) , CommandLine!~"(?i).*public\\ static\\ extern\\ bool\\ InstallELAMCertificateInfo\\(SafeFileHandle\\
  handle\\);.*" )[1m])) or (vector(0.000000) > 0))'
labels:
  severity: high
annotations:
  author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton
    (fp)
  description: Detects the PowerShell command lines with special characters
  summary: Potential PowerShell Command Line Obfuscation

Escaping backticks in LogQL

According to the Grafana blog post on escaping special characters with LogQL, backticks can be escaped by doubling them up. However, this does not seem to work in the case of the "Potential PowerShell Command Line Obfuscation" rule.

Example 2: PowerShell Script

The second rule that fails is the "PowerShell Script" rule. The error message indicates a syntax error at line 1, column 93, with the message "parse error at line 1, col 93: syntax error: unexpected IDENTIFIER". This rule also contains a CommandLine regex that uses backticks.

alert: PowerShell_Script
expr: '(sum(count_over_time({job=~"windows_eventlog"} | json | label_format Message="{{
  .message | replace \"\\\\\" \"\\\\\\\\\" | replace \"\\\"\" \"\\\\\\\"\" }}" | line_format
  "{{ regexReplaceAll \"([^:]+): ?((?:[^\\\\r]*|$))(\\r\\n|$)\" .Message \"${1}=\\\"${2}\\\"
  \"}}" | logfmt | ( ( ( ( ( ( event_id==1 , ( ( ( Image=~`(?i).*\\powershell\.exe$`
  or Image=~`(?i).*\\pwsh\.exe$` ) or OriginalFileName=~`(?i)^PowerShell\.EXE$` )
  or OriginalFileName=~`(?i)^pwsh\.dll$` ) ) , ( ( ( ( CommandLine=~`\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+`
  or CommandLine=~`\{.*\{.*\{.*\{.*\{.*\{.*\{.*\{.*\{.*\{` ) or CommandLine=~`\^.*\^.*\^.*\^.*\^`
  ) or CommandLine=~``.*`.*`.*`.*`` ) ) , ParentImage!~"(?i)^C:\\\\Program\\ Files\\\\Amazon\\\\SSM\\\\ssm\\-document\\-worker\\.exe$"
  ) , CommandLine!~"(?i).*new\\ EventSource\\(\"Microsoft\\.Windows\\.Sense\\.Client\\.Management\".*"
  ) , CommandLine!~"(?i).*public\\ static\\ extern\\ bool\\ InstallELAMCertificateInfo\\(SafeFileHandle\\
  handle\\);.*" )[1m])) or (vector(0.000000) > 0))'
labels:
  severity: high
annotations:
  author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton
    (fp)
  description: Detects the PowerShell script
  summary: PowerShell Script

Escaping backticks in LogQL (continued)

As mentioned earlier, doubling up the backticks does not seem to work in this case. It is possible that the issue is not with the escaping of backticks, but rather with the syntax of the LogQL query.

Example 3: PowerShell Token Obfuscation

The third rule that fails is the "PowerShell Token Obfuscation" rule. The error message indicates a syntax error at line 1, column 323, with the message "parse error at line 1, col 323: syntax error: unexpected IDENTIFIER". This rule also contains a CommandLine regex that uses backticks.

alert: PowerShell_Token_Obfuscation
expr: '(sum(count_over_time({job=~"windows_eventlog"} | json | label_format Message="{{
  .message | replace \"\\\\\" \"\\\\\\\\\" | replace \"\\\"\" \"\\\\\\\"\" }}" | line_format
  "{{ regexReplaceAll \"([^:]+): ?((?:[^\\\\r]*|$))(\\r\\n|$)\" .Message \"${1}=\\\"${2}\\\"
  \"}}" | logfmt | ( ( ( ( ( ( event_id==1 , ( ( ( Image=~`(?i).*\\powershell\.exe$`
  or Image=~`(?i).*\\pwsh\.exe$` ) or OriginalFileName=~`(?i)^PowerShell\.EXE$` )
  or OriginalFileName=~`(?i)^pwsh\.dll$` ) ) , ( ( ( ( CommandLine=~`\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+`
  or CommandLine=~`\{.*\{.*\{.*\{.*\{.*\{.*\{.*\{.*\{.*\{` ) or CommandLine=~`\^.*\^.*\^.*\^.*\^`
  ) or CommandLine=~``.*`.*`.*`.*`` ) ) , ParentImage!~"(?i)^C:\\\\Program\\ Files\\\\Amazon\\\\SSM\\\\ssm\\-document\\-worker\\.exe$"
  ) , CommandLine!~"(?i).*new\\ EventSource\\(\"Microsoft\\.Windows\\.Sense\\.Client\\.Management\".*"
  ) , CommandLine!~"(?i).*public\\ static\\ extern\\ bool\\ InstallELAMCertificateInfo\\(SafeFileHandle\\
  handle\\);.*" )[1m])) or (vector(0.000000) > 0))'
labels:
  severity: high
annotations:
  author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton
    (fp)
  description: Detects the PowerShell token obfuscation
  summary: PowerShell Token Obfuscation

Escaping backticks in LogQL (continued)

As mentioned earlier, doubling up the backticks does not seem to work in this case. It is possible that the issue is not with the escaping of backticks, but rather with the syntax of the LogQL query.

Conclusion

In conclusion, the issue of LogQL's inability

Introduction

In our previous article, we explored the issue of LogQL's inability to escape backticks and its impact on generated rules. We also discussed the problem of syntax errors in LogQL queries and how it affects the evaluation of rules. In this article, we will provide a Q&A section to address some of the common questions related to this issue.

Q: What is the issue with LogQL's ability to escape backticks?

A: LogQL uses backticks to denote strings, whereas Sigma rules use backslashes to escape special characters. When converting Sigma rules to Loki rules, the backslashes are replaced with backticks, but LogQL does not support escaping backticks. This results in syntax errors and prevents the rule from evaluating correctly.

Q: How can I escape backticks in LogQL?

A: According to the Grafana blog post on escaping special characters with LogQL, backticks can be escaped by doubling them up. However, this does not seem to work in all cases. It is possible that the issue is not with the escaping of backticks, but rather with the syntax of the LogQL query.

Q: What are some common syntax errors in LogQL queries?

A: Some common syntax errors in LogQL queries include:

Unexpected IDENTIFIER errors
Syntax errors due to missing or mismatched parentheses
Errors caused by incorrect use of special characters, such as backticks or dollar signs

Q: How can I troubleshoot syntax errors in LogQL queries?

A: To troubleshoot syntax errors in LogQL queries, you can try the following:

Check the error message for any clues about the location of the error
Review the query syntax and ensure that all parentheses are properly matched
Use a syntax checker or validator to identify any syntax errors
Test the query in a sandbox environment to ensure that it works as expected

Q: Can I use a different syntax for escaping special characters in LogQL?

A: Yes, you can use a different syntax for escaping special characters in LogQL. For example, you can use the {{ syntax to escape special characters, as shown in the following example:

expr: '{{ regexReplaceAll "([^:]+): ?((?:[^\\\\r]*|$))(\\r\\n|$)" .Message "${1}=\\\"${2}\" }}'

Q: How can I convert Sigma rules to Loki rules without encountering syntax errors?

A: To convert Sigma rules to Loki rules without encountering syntax errors, you can try the following:

Use a conversion tool or script that is specifically designed for converting Sigma rules to Loki rules
Review the converted rule carefully to ensure that it works as expected
Test the rule in a sandbox environment to ensure that it works as expected
Use a syntax checker or validator to identify any syntax errors

Q: What are some best practices for writing LogQL queries?

A: Some best practices for writing LogQL queries include:

Using clear and concise syntax
Avoiding unnecessary complexity
Using meaningful variable names
Testing the query in a sandbox environment before deploying it to production
Using a syntax checker or validator to identify any syntax errors

Conclusion

In conclusion, the issue of LogQL's inability to escape backticks and its impact on generated rules is a complex problem that requires careful attention to syntax and query structure. By following the best practices outlined in this article, you can write effective LogQL queries that work as expected and help you achieve your monitoring and analytics goals.