Merge branch 'main' into 603-bug-non-utf-8-byte-sequences-error-with-color-output

src/detections/configs.rs

@@ -8,6 +8,7 @@ use hashbrown::HashMap;
 use hashbrown::HashSet;
 use lazy_static::lazy_static;
 use regex::Regex;
+use std::env::current_exe;
 use std::path::PathBuf;
 use std::sync::RwLock;
 use terminal_size::{terminal_size, Height, Width};
@@ -32,6 +33,8 @@ lazy_static! {
     pub static ref TERM_SIZE: Option<(Width, Height)> = terminal_size();
     pub static ref TARGET_EXTENSIONS: HashSet<String> =
         get_target_extensions(CONFIG.read().unwrap().args.evtx_file_ext.as_ref());
+    pub static ref CURRENT_EXE_PATH: PathBuf =
+        current_exe().unwrap().parent().unwrap().to_path_buf();
     pub static ref EXCLUDE_STATUS: HashSet<String> =
         convert_option_vecs_to_hs(CONFIG.read().unwrap().args.exclude_status.as_ref());
 }
@@ -84,7 +87,7 @@ pub struct Config {
     /// Specify custom rule config folder (default: ./rules/config)
     #[clap(
         short = 'c',
-        long,
+        long = "rules-config",
         default_value = "./rules/config",
         hide_default_value = true,
         value_name = "RULE_CONFIG_DIRECTORY"
@@ -234,8 +237,18 @@ impl ConfigReader<'_> {
             app: build_cmd,
             args: parse,
             headless_help: String::default(),
-            event_timeline_config: load_eventcode_info("config/statistics_event_info.txt"),
-            target_eventids: load_target_ids("config/target_eventids.txt"),
+            event_timeline_config: load_eventcode_info(
+                CURRENT_EXE_PATH
+                    .join("config/statistics_event_info.txt")
+                    .to_str()
+                    .unwrap(),
+            ),
+            target_eventids: load_target_ids(
+                CURRENT_EXE_PATH
+                    .join("config/target_eventids.txt")
+                    .to_str()
+                    .unwrap(),
+            ),
         }
     }
 }

src/detections/print.rs

@@ -1,5 +1,6 @@
 extern crate lazy_static;
 use crate::detections::configs;
+use crate::detections::configs::CURRENT_EXE_PATH;
 use crate::detections::utils;
 use crate::detections::utils::get_serde_number_to_string;
 use crate::detections::utils::write_color_buffer;
@@ -53,12 +54,18 @@ lazy_static! {
     pub static ref STATISTICS_FLAG: bool = configs::CONFIG.read().unwrap().args.statistics;
     pub static ref LOGONSUMMARY_FLAG: bool = configs::CONFIG.read().unwrap().args.logon_summary;
     pub static ref TAGS_CONFIG: HashMap<String, String> = Message::create_output_filter_config(
-        "config/output_tag.txt",
+        CURRENT_EXE_PATH
+            .join("config/output_tag.txt")
+            .to_str()
+            .unwrap(),
         true,
         configs::CONFIG.read().unwrap().args.all_tags
     );
     pub static ref CH_CONFIG: HashMap<String, String> = Message::create_output_filter_config(
-        "config/channel_abbreviations.txt",
+        CURRENT_EXE_PATH
+            .join("config/channel_abbreviations.txt")
+            .to_str()
+            .unwrap(),
         false,
         configs::CONFIG.read().unwrap().args.all_tags
     );

src/detections/rule/matchers.rs

@@ -523,8 +523,8 @@ mod tests {
                     - ホスト アプリケーション
                 ImagePath:
                     min_length: 1234321
-                    regexes: ./rules/config/regex/detectlist_suspicous_services.txt
-                    allowlist: ./rules/config/regex/allowlist_legitimate_services.txt
+                    regexes: ./../../../rules/config/regex/detectlist_suspicous_services.txt
+                    allowlist: ./../../../rules/config/regex/allowlist_legitimate_services.txt
         falsepositives:
             - unknown
         level: medium
@@ -1111,7 +1111,7 @@ mod tests {
             selection:
                 EventID: 4103
                 Channel:
-                    - allowlist: ./rules/config/regex/allowlist_legitimate_services.txt
+                    - allowlist: ./../../../rules/config/regex/allowlist_legitimate_services.txt
         details: 'command=%CommandLine%'
         "#;
 
@@ -1145,7 +1145,7 @@ mod tests {
             selection:
                 EventID: 4103
                 Channel:
-                    - allowlist: ./rules/config/regex/allowlist_legitimate_services.txt
+                    - allowlist: ./../../../rules/config/regex/allowlist_legitimate_services.txt
         details: 'command=%CommandLine%'
         "#;
 
@@ -1179,7 +1179,7 @@ mod tests {
             selection:
                 EventID: 4103
                 Channel:
-                    - allowlist: ./rules/config/regex/allowlist_legitimate_services.txt
+                    - allowlist: ./../../../rules/config/regex/allowlist_legitimate_services.txt
         details: 'command=%CommandLine%'
         "#;
 

src/detections/utils.rs

@@ -3,6 +3,8 @@ extern crate csv;
 extern crate regex;
 
 use crate::detections::configs;
+use crate::detections::configs::CURRENT_EXE_PATH;
+
 use termcolor::Color;
 
 use tokio::runtime::Builder;
@@ -66,7 +68,16 @@ pub fn value_to_string(value: &Value) -> Option<String> {
 }
 
 pub fn read_txt(filename: &str) -> Result<Vec<String>, String> {
-    let f = File::open(filename);
+    let filepath = if filename.starts_with("./") {
+        CURRENT_EXE_PATH
+            .join(filename)
+            .to_str()
+            .unwrap()
+            .to_string()
+    } else {
+        filename.to_string()
+    };
+    let f = File::open(filepath);
     if f.is_err() {
         let errmsg = format!("Cannot open file. [file:{}]", filename);
         return Result::Err(errmsg);
@@ -437,7 +448,7 @@ mod tests {
     #[test]
     fn test_check_regex() {
         let regexes: Vec<Regex> =
-            utils::read_txt("./rules/config/regex/detectlist_suspicous_services.txt")
+            utils::read_txt("./../../../rules/config/regex/detectlist_suspicous_services.txt")
                 .unwrap()
                 .into_iter()
                 .map(|regex_str| Regex::new(&regex_str).unwrap())
@@ -453,7 +464,7 @@ mod tests {
     fn test_check_allowlist() {
         let commandline = "\"C:\\Program Files\\Google\\Update\\GoogleUpdate.exe\"";
         let allowlist: Vec<Regex> =
-            utils::read_txt("./rules/config/regex/allowlist_legitimate_services.txt")
+            utils::read_txt("./../../../rules/config/regex/allowlist_legitimate_services.txt")
                 .unwrap()
                 .into_iter()
                 .map(|allow_str| Regex::new(&allow_str).unwrap())