Sigma rule triggers on incorrect provider

Hi! I'm hoping I've overlooked some configuration option and would be grateful for any assistance. I am currently trying to generate an alert dataset from a large log dataset ([DEDALE](https://fkie-cad.github.io/COMIDDS/content/datasets/dedale/)), but I'm stumbling over several alerts that are definitely invalid. As an example, the following rule ```yml title: Sysmon Blocked Executable id: 23b71bc5-953e-4971-be4c-c896cda73fc2 status: test description: Triggers on any Sysmon "FileBlockExecutable" event, which indicates a violation of the configured block policy references: - https://medium.com/@olafhartong/sysmon-14-0-fileblockexecutable-13d7ba3dff3e author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-16 modified: 2023-09-16 tags: - attack.defense-evasion logsource: product: windows service: sysmon detection: selection: EventID: 27 # this is fine, we want to match any FileBlockExecutable event condition: selection falsepositives: - Unlikely level: high ``` Triggered an alert on this log (and a couple hundred others) ```json { "@timestamp": "2025-01-17T08:29:48.065Z", "agent": { "ephemeral_id": "cdf04c3f-9874-4b3f-8b9d-fb892efb0b45", "hostname": "CLIENT14", "id": "c35095e9-5f9f-4084-a651-3aaa2966847a", "name": "CLIENT14", "type": "winlogbeat", "version": "7.10.2" }, "ecs": { "version": "1.5.0" }, "event": { "code": 27, "created": "2025-01-17T08:32:07.082Z", "kind": "event", "provider": "Microsoft-Windows-Kernel-Boot" }, "host": { "name": "CLIENT14.breach.local" }, "log": { "level": "information" }, "message": "The boot type was 0x0.", "winlog": { "api": "wineventlog", "channel": "System", "computer_name": "CLIENT14.breach.local", "event_data": { "BootType": "0", "LoadOptions": " NOEXECUTE=OPTIN" }, "event_id": 27, "opcode": "Info", "process": { "pid": 4, "thread": { "id": 8 } }, "provider_guid": "{15ca44ff-4d7a-4baa-bba5-0998955e531e}", "provider_name": "Microsoft-Windows-Kernel-Boot", "record_id": 3185, "task": "", "user": { "domain": "NT AUTHORITY", "identifier": "S-1-5-18", "name": "SYSTEM", "type": "User" }, "version": 1 } } ``` The initial problem is obvious: The rule triggers on Sysmon ID 27 (`FileBlockExecutable`), but this log is actually from the Microsoft-Windows-Kernel-Boot provider, which happens to use ID 27 for the event `The boot type was 0x0`. Alerts were generated with the following command ```bash python zircolite.py \ --evtx ../dedale/output/ \ --json-input \ --fileext jsonl \ --ruleset ./raw_sigma/rules/windows/ \ --template ../dedale/flat_alerts.jsonl.tmpl \ --templateOutput raw_alerts.jsonl ``` `raw_sigma` is simply the latest release of the Sigma ruleset. Why is this event triggering this rule? The problem occurs for several other rules as well. Any help would be much appreciated!