Merge branch 'main' into 654-enhancement-output-to-json
This commit is contained in:
DastInDark
@@ -1,12 +1,38 @@
|
||||
# 変更点
|
||||
|
||||
## v1.5.0 [2022/XX/XX]
|
||||
# v1.5.2 [2022/XX/XX]
|
||||
|
||||
**新機能:**
|
||||
|
||||
- 解析結果をJSONに出力する機能を追加した (`-j` と `--json-timeline` )。 (#654) (@hitenkoku)
|
||||
|
||||
**改善:**
|
||||
|
||||
- XXX
|
||||
|
||||
**バグ修正:**
|
||||
|
||||
- XXX
|
||||
|
||||
## v1.5.1 [2022/08/20]
|
||||
|
||||
**改善:**
|
||||
|
||||
- TimesketchにインポートできるCSV形式を出力するプロファイルを追加して、v1.5.1を再リリースした。 (#668) (@YamatoSecurity)
|
||||
|
||||
## v1.5.1 [2022/08/19]
|
||||
|
||||
**バグ修正:**
|
||||
|
||||
- Critical, medium、lowレベルのアラートはカラーで出力されていなかった。 (#663) (@fukusuket)
|
||||
- `-f`で存在しないevtxファイルが指定された場合は、Hayabusaがクラッシュしていた。 (#664) (@fukusuket)
|
||||
|
||||
## v1.5.0 [2022/08/18]
|
||||
|
||||
**新機能:**
|
||||
|
||||
- `config/profiles.yaml`と`config/default_profile.yaml`の設定ファイルで、出力内容をカスタマイズできる。 (#165) (@hitenkoku)
|
||||
- 対象のフィールドがレコード内に存在しないことを確認する `null` キーワードに対応した。 (#643) (@hitenkoku)
|
||||
- 解析結果をJSONに出力する機能を追加した (`-j` と `--json-timeline` )。 (#654) (@hitenkoku)
|
||||
|
||||
**改善:**
|
||||
|
||||
@@ -19,7 +45,7 @@
|
||||
**バグ修正:**
|
||||
|
||||
- aggregation conditionのルール検知が原因で検知しなかったイベント数の集計に誤りがあったので修正した。 (#640) (@hitenkoku)
|
||||
- 検知の際に競合状態が発生して検知回数が安定しないバグを修正した。 (#639) (@fukusuket)
|
||||
- 一部のイベント（0.01%程度）が検出されないレースコンディションの不具合を修正した。 (#639 #660) (@fukusuket)
|
||||
|
||||
## v1.4.3 [2022/08/03]
|
||||
|
||||
|
||||
38
CHANGELOG.md
38
CHANGELOG.md
@@ -1,6 +1,34 @@
|
||||
# Changes
|
||||
|
||||
## v1.5.0 [2022/XX/XX]
|
||||
## v1.5.2 [2022/08/21]
|
||||
|
||||
**New Features:**
|
||||
|
||||
- Added output to JSON option (`-j` and `--json-timeline` ) (#654) (@hitenkoku)
|
||||
|
||||
**Enhancements:**
|
||||
|
||||
- XXX
|
||||
|
||||
**Bug Fixes:**
|
||||
|
||||
- XXX
|
||||
|
||||
|
||||
## v1.5.1 [2022/08/20]
|
||||
|
||||
**Enhancements:**
|
||||
|
||||
- Re-released v1.5.1 with an updated output profile that is compatible with Timesketch. (#668) (@YamatoSecurity)
|
||||
|
||||
## v1.5.1 [2022/08/19]
|
||||
|
||||
**Bug Fixes:**
|
||||
|
||||
- Critical, medium and low level alerts were not being displayed in color. (#663) (@fukusuket)
|
||||
- Hayabusa would crash when an evtx file specified with `-f` did not exist. (#664) (@fukusuket)
|
||||
|
||||
## v1.5.0 [2022/08/18]
|
||||
|
||||
**New Features:**
|
||||
|
||||
@@ -10,16 +38,16 @@
|
||||
|
||||
**Enhancements:**
|
||||
|
||||
- Removed ./ from rule path when updating. (#642) (@hitenkoku)
|
||||
- Added new output alias for MITRE ATT&CK tags and other tags. (#637) (@hitenkoku)
|
||||
- Organized menu when `-h` is used. (#651) (@YamatoSecurity and @hitenkoku)
|
||||
- Trimmed `./` from the rule path when updating. (#642) (@hitenkoku)
|
||||
- Added new output aliases for MITRE ATT&CK tags and other tags. (#637) (@hitenkoku)
|
||||
- Organized the menu output when `-h` is used. (#651) (@YamatoSecurity and @hitenkoku)
|
||||
- Added commas to summary numbers to make them easier to read. (#649) (@hitenkoku)
|
||||
- Added output percentage of detections in Result Summary. (#658) (@hitenkoku)
|
||||
|
||||
**Bug Fixes:**
|
||||
|
||||
- Fixed miscalculation of Data Reduction due to aggregation condition rule detection. (#640) (@hitenkoku)
|
||||
- Fixed race condition in detection. (#639) (@fukusuket)
|
||||
- Fixed a race condition bug where a few events (around 0.01%) would not be detected. (#639 #660) (@fukusuket)
|
||||
|
||||
## v1.4.3 [2022/08/03]
|
||||
|
||||
|
||||
220
Cargo.lock
generated
220
Cargo.lock
generated
@@ -14,7 +14,7 @@ version = "0.7.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "fcb51a0695d8f838b1ee009b3fbf66bda078cd64590202a864a8f3e8c4315c47"
|
||||
dependencies = [
|
||||
"getrandom 0.2.7",
|
||||
"getrandom",
|
||||
"once_cell",
|
||||
"version_check",
|
||||
]
|
||||
@@ -48,15 +48,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "anyhow"
|
||||
version = "1.0.61"
|
||||
version = "1.0.62"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "508b352bb5c066aac251f6daf6b36eccd03e8a88e8081cd44959ea277a3af9a8"
|
||||
|
||||
[[package]]
|
||||
name = "arrayref"
|
||||
version = "0.3.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "a4c527152e37cf757a3f78aae5a06fbeefdb07ccc535c980a3208ee3060dd544"
|
||||
checksum = "1485d4d2cc45e7b201ee3767015c96faa5904387c9d87c6efdd0fb511f12d305"
|
||||
|
||||
[[package]]
|
||||
name = "arrayvec"
|
||||
@@ -67,12 +61,6 @@ dependencies = [
|
||||
"nodrop",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "arrayvec"
|
||||
version = "0.5.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "23b62fc65de8e4e7f52534fb52b0f3ed04746ae267519eef2a83941e8085068b"
|
||||
|
||||
[[package]]
|
||||
name = "atty"
|
||||
version = "0.2.14"
|
||||
@@ -108,17 +96,6 @@ version = "1.3.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
|
||||
|
||||
[[package]]
|
||||
name = "blake2b_simd"
|
||||
version = "0.5.11"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "afa748e348ad3be8263be728124b24a24f268266f6f5d58af9d75f6a40b5c587"
|
||||
dependencies = [
|
||||
"arrayref",
|
||||
"arrayvec 0.5.2",
|
||||
"constant_time_eq",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "bstr"
|
||||
version = "0.2.17"
|
||||
@@ -133,9 +110,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "bumpalo"
|
||||
version = "3.10.0"
|
||||
version = "3.11.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "37ccbd214614c6783386c1af30caf03192f17891059cecc394b4fb119e363de3"
|
||||
checksum = "c1ad822118d20d2c234f427000d5acc36eabe1e29a348c89b63dd60b13f28e5d"
|
||||
|
||||
[[package]]
|
||||
name = "bytecount"
|
||||
@@ -163,9 +140,9 @@ checksum = "6c58ec36aac5066d5ca17df51b3e70279f5670a72102f5752cb7e7c856adfc70"
|
||||
|
||||
[[package]]
|
||||
name = "camino"
|
||||
version = "1.0.9"
|
||||
version = "1.1.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "869119e97797867fd90f5e22af7d0bd274bd4635ebb9eb68c04f3f513ae6c412"
|
||||
checksum = "88ad0e1e3e88dd237a156ab9f571021b8a158caa0ae44b1968a241efb5144c1e"
|
||||
dependencies = [
|
||||
"serde",
|
||||
]
|
||||
@@ -209,9 +186,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
|
||||
|
||||
[[package]]
|
||||
name = "chrono"
|
||||
version = "0.4.21"
|
||||
version = "0.4.22"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3f725f340c3854e3cb3ab736dc21f0cca183303acea3b3ffec30f141503ac8eb"
|
||||
checksum = "bfd4d1b31faaa3a89d7934dbded3111da0d2ef28e3ebccdb4f0179f5929d1ef1"
|
||||
dependencies = [
|
||||
"iana-time-zone",
|
||||
"js-sys",
|
||||
@@ -240,9 +217,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "clap"
|
||||
version = "3.2.16"
|
||||
version = "3.2.17"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "a3dbbb6653e7c55cc8595ad3e1f7be8f32aba4eb7ff7f0fd1163d4f3d137c0a9"
|
||||
checksum = "29e724a68d9319343bb3328c9cc2dfde263f4b3142ee1059a9980580171c954b"
|
||||
dependencies = [
|
||||
"atty",
|
||||
"bitflags",
|
||||
@@ -257,9 +234,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "clap_derive"
|
||||
version = "3.2.15"
|
||||
version = "3.2.17"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "9ba52acd3b0a5c33aeada5cdaa3267cdc7c594a98731d4268cdc1532f4264cb4"
|
||||
checksum = "13547f7012c01ab4a0e8f8967730ada8f9fdf419e8b6c792788f39cf4e46eefa"
|
||||
dependencies = [
|
||||
"heck",
|
||||
"proc-macro-error",
|
||||
@@ -283,7 +260,7 @@ version = "0.15.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "89eab4d20ce20cea182308bca13088fecea9c05f6776cf287205d41a0ed3c847"
|
||||
dependencies = [
|
||||
"encode_unicode",
|
||||
"encode_unicode 0.3.6",
|
||||
"libc",
|
||||
"once_cell",
|
||||
"terminal_size 0.1.17",
|
||||
@@ -297,22 +274,6 @@ version = "0.4.9"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "fbdcdcb6d86f71c5e97409ad45898af11cbc995b4ee8112d59095a28d376c935"
|
||||
|
||||
[[package]]
|
||||
name = "constant_time_eq"
|
||||
version = "0.1.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "245097e9a4535ee1e3e3931fcfcd55a796a44c643e8596ff6566d68f09b87bbc"
|
||||
|
||||
[[package]]
|
||||
name = "core-foundation"
|
||||
version = "0.9.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "194a7a9e6de53fa55116934067c844d9d749312f75c6f6d0980e8c252f8c2146"
|
||||
dependencies = [
|
||||
"core-foundation-sys",
|
||||
"libc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "core-foundation-sys"
|
||||
version = "0.8.3"
|
||||
@@ -420,10 +381,20 @@ dependencies = [
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "dirs"
|
||||
version = "1.0.5"
|
||||
name = "dirs-next"
|
||||
version = "2.0.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3fd78930633bd1c6e35c4b42b1df7b0cbc6bc191146e512bb3bedf243fcc3901"
|
||||
checksum = "b98cf8ebf19c3d1b223e151f99a4f9f0690dca41414773390fc824184ac833e1"
|
||||
dependencies = [
|
||||
"cfg-if",
|
||||
"dirs-sys-next",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "dirs-sys-next"
|
||||
version = "0.1.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4ebda144c4fe02d1f7ea1a7d9641b6fc6b580adcfa024ae48797ecdeb6825b4d"
|
||||
dependencies = [
|
||||
"libc",
|
||||
"redox_users",
|
||||
@@ -444,9 +415,9 @@ checksum = "9ea835d29036a4087793836fa931b08837ad5e957da9e23886b29586fb9b6650"
|
||||
|
||||
[[package]]
|
||||
name = "either"
|
||||
version = "1.7.0"
|
||||
version = "1.8.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3f107b87b6afc2a64fd13cac55fe06d6c8859f12d4b14cbcdd2c67d0976781be"
|
||||
checksum = "90e5c1c8368803113bf0c9584fc495a58b86dc8a29edbf8fe877d21d9507e797"
|
||||
|
||||
[[package]]
|
||||
name = "encode_unicode"
|
||||
@@ -454,6 +425,12 @@ version = "0.3.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "a357d28ed41a50f9c765dbfe56cbc04a64e53e5fc58ba79fbc34c10ef3df831f"
|
||||
|
||||
[[package]]
|
||||
name = "encode_unicode"
|
||||
version = "1.0.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
|
||||
|
||||
[[package]]
|
||||
name = "encoding"
|
||||
version = "0.2.33"
|
||||
@@ -564,7 +541,7 @@ dependencies = [
|
||||
[[package]]
|
||||
name = "evtx"
|
||||
version = "0.7.3"
|
||||
source = "git+https://github.com/Yamato-Security/hayabusa-evtx.git#cc2e4ec1c314daea1b0da11c908825140c42af4b"
|
||||
source = "git+https://github.com/Yamato-Security/hayabusa-evtx.git#f2689c0343d0487521b9572dc3b9e4c179bcc5c9"
|
||||
dependencies = [
|
||||
"anyhow",
|
||||
"bitflags",
|
||||
@@ -656,30 +633,30 @@ checksum = "2022715d62ab30faffd124d40b76f4134a550a87792276512b18d63272333394"
|
||||
|
||||
[[package]]
|
||||
name = "futures-channel"
|
||||
version = "0.3.21"
|
||||
version = "0.3.23"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "c3083ce4b914124575708913bca19bfe887522d6e2e6d0952943f5eac4a74010"
|
||||
checksum = "2bfc52cbddcfd745bf1740338492bb0bd83d76c67b445f91c5fb29fae29ecaa1"
|
||||
dependencies = [
|
||||
"futures-core",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "futures-core"
|
||||
version = "0.3.21"
|
||||
version = "0.3.23"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0c09fd04b7e4073ac7156a9539b57a484a8ea920f79c7c675d05d289ab6110d3"
|
||||
checksum = "d2acedae88d38235936c3922476b10fced7b2b68136f5e3c03c2d5be348a1115"
|
||||
|
||||
[[package]]
|
||||
name = "futures-task"
|
||||
version = "0.3.21"
|
||||
version = "0.3.23"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "57c66a976bf5909d801bbef33416c41372779507e7a6b3a5e25e4749c58f776a"
|
||||
checksum = "842fc63b931f4056a24d59de13fb1272134ce261816e063e634ad0c15cdc5306"
|
||||
|
||||
[[package]]
|
||||
name = "futures-util"
|
||||
version = "0.3.21"
|
||||
version = "0.3.23"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "d8b7abd5d659d9b90c8cba917f6ec750a74e2dc23902ef9cd4cc8c8b22e6036a"
|
||||
checksum = "f0828a5471e340229c11c77ca80017937ce3c58cb788a17e5f1c2d5c485a9577"
|
||||
dependencies = [
|
||||
"futures-core",
|
||||
"futures-task",
|
||||
@@ -687,17 +664,6 @@ dependencies = [
|
||||
"pin-utils",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "getrandom"
|
||||
version = "0.1.16"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce"
|
||||
dependencies = [
|
||||
"cfg-if",
|
||||
"libc",
|
||||
"wasi 0.9.0+wasi-snapshot-preview1",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "getrandom"
|
||||
version = "0.2.7"
|
||||
@@ -741,12 +707,12 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "hayabusa"
|
||||
version = "1.5.0-dev"
|
||||
version = "1.5.1"
|
||||
dependencies = [
|
||||
"base64",
|
||||
"bytesize",
|
||||
"chrono",
|
||||
"clap 3.2.16",
|
||||
"clap 3.2.17",
|
||||
"crossbeam-utils",
|
||||
"csv",
|
||||
"dashmap",
|
||||
@@ -880,12 +846,12 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "iana-time-zone"
|
||||
version = "0.1.42"
|
||||
version = "0.1.46"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "9512e544c25736b82aebbd2bf739a47c8a1c935dfcc3a6adcde10e35cd3cd468"
|
||||
checksum = "ad2bfd338099682614d3ee3fe0cd72e0b6a41ca6a87f6a74a3bd593c91650501"
|
||||
dependencies = [
|
||||
"android_system_properties",
|
||||
"core-foundation",
|
||||
"core-foundation-sys",
|
||||
"js-sys",
|
||||
"wasm-bindgen",
|
||||
"winapi",
|
||||
@@ -941,9 +907,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "io-lifetimes"
|
||||
version = "0.7.2"
|
||||
version = "0.7.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "24c3f4eff5495aee4c0399d7b6a0dc2b6e81be84242ffbfcf253ebacccc1d0cb"
|
||||
checksum = "1ea37f355c05dde75b84bba2d767906ad522e97cd9e2eef2be7a4ab7fb442c06"
|
||||
|
||||
[[package]]
|
||||
name = "is_elevated"
|
||||
@@ -1023,7 +989,7 @@ dependencies = [
|
||||
"anyhow",
|
||||
"atty",
|
||||
"chrono",
|
||||
"clap 3.2.16",
|
||||
"clap 3.2.17",
|
||||
"file-chunker",
|
||||
"indicatif",
|
||||
"memmap2",
|
||||
@@ -1043,9 +1009,9 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
|
||||
|
||||
[[package]]
|
||||
name = "libc"
|
||||
version = "0.2.129"
|
||||
version = "0.2.132"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "64de3cc433455c14174d42e554d4027ee631c4d046d43e3ecc6efc4636cdc7a7"
|
||||
checksum = "8371e4e5341c3a96db127eb2465ac681ced4c433e01dd0e938adbef26ba93ba5"
|
||||
|
||||
[[package]]
|
||||
name = "libgit2-sys"
|
||||
@@ -1132,9 +1098,9 @@ checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
|
||||
|
||||
[[package]]
|
||||
name = "memmap2"
|
||||
version = "0.5.5"
|
||||
version = "0.5.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3a79b39c93a7a5a27eeaf9a23b5ff43f1b9e0ad6b1cdd441140ae53c35613fc7"
|
||||
checksum = "95af15f345b17af2efc8ead6080fb8bc376f8cec1b35277b935637595fe77498"
|
||||
dependencies = [
|
||||
"libc",
|
||||
]
|
||||
@@ -1192,7 +1158,7 @@ version = "0.4.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "bafe4179722c2894288ee77a9f044f02811c86af699344c498b0840c698a2465"
|
||||
dependencies = [
|
||||
"arrayvec 0.4.12",
|
||||
"arrayvec",
|
||||
"itoa 0.4.8",
|
||||
]
|
||||
|
||||
@@ -1233,9 +1199,9 @@ checksum = "830b246a0e5f20af87141b25c173cd1b609bd7779a4617d6ec582abaf90870f3"
|
||||
|
||||
[[package]]
|
||||
name = "once_cell"
|
||||
version = "1.13.0"
|
||||
version = "1.13.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "18a6dbe30758c9f83eb00cbea4ac95966305f5a7772f3f42ebfc7fc7eddbd8e1"
|
||||
checksum = "074864da206b4973b84eb91683020dbefd6a8c3f0f38e054d93954e891935e4e"
|
||||
|
||||
[[package]]
|
||||
name = "openssl"
|
||||
@@ -1294,9 +1260,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "os_str_bytes"
|
||||
version = "6.2.0"
|
||||
version = "6.3.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "648001efe5d5c0102d8cea768e348da85d90af8ba91f0bea908f157951493cd4"
|
||||
checksum = "9ff7415e9ae3fff1225851df9e0d9e4e5479f947619774677a63572e55e80eff"
|
||||
|
||||
[[package]]
|
||||
name = "parking_lot"
|
||||
@@ -1316,7 +1282,7 @@ checksum = "09a279cbf25cb0757810394fbc1e359949b59e348145c643a939a525692e6929"
|
||||
dependencies = [
|
||||
"cfg-if",
|
||||
"libc",
|
||||
"redox_syscall 0.2.16",
|
||||
"redox_syscall",
|
||||
"smallvec",
|
||||
"windows-sys",
|
||||
]
|
||||
@@ -1365,13 +1331,13 @@ checksum = "eb9f9e6e233e5c4a35559a617bf40a4ec447db2e84c20b55a6f83167b7e57872"
|
||||
|
||||
[[package]]
|
||||
name = "prettytable-rs"
|
||||
version = "0.8.0"
|
||||
version = "0.9.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0fd04b170004fa2daccf418a7f8253aaf033c27760b5f225889024cf66d7ac2e"
|
||||
checksum = "5f375cb74c23b51d23937ffdeb48b1fbf5b6409d4b9979c1418c1de58bc8f801"
|
||||
dependencies = [
|
||||
"atty",
|
||||
"csv",
|
||||
"encode_unicode",
|
||||
"encode_unicode 1.0.0",
|
||||
"lazy_static",
|
||||
"term",
|
||||
"unicode-width",
|
||||
@@ -1485,7 +1451,7 @@ version = "0.6.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "d34f1408f55294453790c48b2f1ebbb1c5b4b7563eb1f418bcfcfdbb06ebb4e7"
|
||||
dependencies = [
|
||||
"getrandom 0.2.7",
|
||||
"getrandom",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -1512,12 +1478,6 @@ dependencies = [
|
||||
"num_cpus",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "redox_syscall"
|
||||
version = "0.1.57"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "41cc0f7e4d5d4544e8861606a285bb08d3e70712ccc7d2b84d7c0ccfaf4b05ce"
|
||||
|
||||
[[package]]
|
||||
name = "redox_syscall"
|
||||
version = "0.2.16"
|
||||
@@ -1529,13 +1489,13 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "redox_users"
|
||||
version = "0.3.5"
|
||||
version = "0.4.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "de0737333e7a9502c789a36d7c7fa6092a49895d4faa31ca5df163857ded2e9d"
|
||||
checksum = "b033d837a7cf162d7993aded9304e30a83213c648b6e389db233191f891e5c2b"
|
||||
dependencies = [
|
||||
"getrandom 0.1.16",
|
||||
"redox_syscall 0.1.57",
|
||||
"rust-argon2",
|
||||
"getrandom",
|
||||
"redox_syscall",
|
||||
"thiserror",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -1590,18 +1550,6 @@ dependencies = [
|
||||
"pkg-config",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "rust-argon2"
|
||||
version = "0.8.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4b18820d944b33caa75a71378964ac46f58517c92b6ae5f762636247c09e78fb"
|
||||
dependencies = [
|
||||
"base64",
|
||||
"blake2b_simd",
|
||||
"constant_time_eq",
|
||||
"crossbeam-utils",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "rustc_version"
|
||||
version = "0.2.3"
|
||||
@@ -1613,9 +1561,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "rustix"
|
||||
version = "0.35.7"
|
||||
version = "0.35.9"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "d51cc38aa10f6bbb377ed28197aa052aa4e2b762c22be9d3153d01822587e787"
|
||||
checksum = "72c825b8aa8010eb9ee99b75f05e10180b9278d161583034d7574c9d617aeada"
|
||||
dependencies = [
|
||||
"bitflags",
|
||||
"errno",
|
||||
@@ -1625,6 +1573,12 @@ dependencies = [
|
||||
"windows-sys",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "rustversion"
|
||||
version = "1.0.9"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "97477e48b4cf8603ad5f7aaf897467cf42ab4218a38ef76fb14c2d6773a6d6a8"
|
||||
|
||||
[[package]]
|
||||
name = "ryu"
|
||||
version = "1.0.11"
|
||||
@@ -1863,19 +1817,19 @@ dependencies = [
|
||||
"cfg-if",
|
||||
"fastrand",
|
||||
"libc",
|
||||
"redox_syscall 0.2.16",
|
||||
"redox_syscall",
|
||||
"remove_dir_all",
|
||||
"winapi",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "term"
|
||||
version = "0.5.2"
|
||||
version = "0.7.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "edd106a334b7657c10b7c540a0106114feadeb4dc314513e97df481d5d966f42"
|
||||
checksum = "c59df8ac95d96ff9bede18eb7300b0fda5e5d8d90960e76f8e14ae765eedbf1f"
|
||||
dependencies = [
|
||||
"byteorder",
|
||||
"dirs",
|
||||
"dirs-next",
|
||||
"rustversion",
|
||||
"winapi",
|
||||
]
|
||||
|
||||
@@ -2158,12 +2112,6 @@ dependencies = [
|
||||
"try-lock",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "wasi"
|
||||
version = "0.9.0+wasi-snapshot-preview1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
|
||||
|
||||
[[package]]
|
||||
name = "wasi"
|
||||
version = "0.10.0+wasi-snapshot-preview1"
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
[package]
|
||||
name = "hayabusa"
|
||||
version = "1.5.0-dev"
|
||||
version = "1.5.1"
|
||||
authors = ["Yamato Security @SecurityYamato"]
|
||||
edition = "2021"
|
||||
|
||||
|
||||
Binary file not shown.
Binary file not shown.
@@ -21,7 +21,7 @@
|
||||
|
||||
# Hayabusa について
|
||||
|
||||
Hayabusaは、日本の[Yamato Security](https://yamatosecurity.connpass.com/)グループによって作られた**Windowsイベントログのファストフォレンジックタイムライン生成**および**スレットハンティングツール**です。 Hayabusaは日本語で[「ハヤブサ」](https://en.wikipedia.org/wiki/Peregrine_falcon)を意味し、ハヤブサが世界で最も速く、狩猟(hunting)に優れ、とても訓練しやすい動物であることから選ばれました。[Rust](https://www.rust-lang.org/) で開発され、マルチスレッドに対応し、可能な限り高速に動作するよう配慮されています。[Sigma](https://github.com/SigmaHQ/Sigma)ルールをHayabusaルール形式に変換する[ツール](https://github.com/Yamato-Security/hayabusa-rules/tree/main/tools/sigmac)も提供しています。Hayabusaの検知ルールもSigmaと同様にYML形式であり、カスタマイズ性や拡張性に優れます。稼働中のシステムで実行してライブ調査することも、複数のシステムからログを収集してオフライン調査することも可能です。また、 [Velociraptor](https://docs.velociraptor.app/)と[Hayabusa artifact](https://docs.velociraptor.app/exchange/artifacts/pages/windows.eventlogs.hayabusa/)を用いることで企業向けの広範囲なスレットハンティングとインシデントレスポンスにも活用できます。出力は一つのCSVタイムラインにまとめられ、Excel、[Timeline Explorer](https://ericzimmerman.github.io/#!index.md)、[Elastic Stack](doc/ElasticStackImport/ElasticStackImport-Japanese.md)等で簡単に分析できるようになります。
|
||||
Hayabusaは、日本の[Yamato Security](https://yamatosecurity.connpass.com/)グループによって作られた**Windowsイベントログのファストフォレンジックタイムライン生成**および**スレットハンティングツール**です。 Hayabusaは日本語で[「ハヤブサ」](https://en.wikipedia.org/wiki/Peregrine_falcon)を意味し、ハヤブサが世界で最も速く、狩猟(hunting)に優れ、とても訓練しやすい動物であることから選ばれました。[Rust](https://www.rust-lang.org/) で開発され、マルチスレッドに対応し、可能な限り高速に動作するよう配慮されています。[Sigma](https://github.com/SigmaHQ/Sigma)ルールをHayabusaルール形式に変換する[ツール](https://github.com/Yamato-Security/hayabusa-rules/tree/main/tools/sigmac)も提供しています。Hayabusaの検知ルールもSigmaと同様にYML形式であり、カスタマイズ性や拡張性に優れます。稼働中のシステムで実行してライブ調査することも、複数のシステムからログを収集してオフライン調査することも可能です。また、 [Velociraptor](https://docs.velociraptor.app/)と[Hayabusa artifact](https://docs.velociraptor.app/exchange/artifacts/pages/windows.eventlogs.hayabusa/)を用いることで企業向けの広範囲なスレットハンティングとインシデントレスポンスにも活用できます。出力は一つのCSVタイムラインにまとめられ、Excel、[Timeline Explorer](https://ericzimmerman.github.io/#!index.md)、[Elastic Stack](doc/ElasticStackImport/ElasticStackImport-Japanese.md)、[Timesketch](https://timesketch.org/)等で簡単に分析できるようになります。
|
||||
|
||||
## 目次
|
||||
|
||||
@@ -39,6 +39,7 @@ Hayabusaは、日本の[Yamato Security](https://yamatosecurity.connpass.com/)
|
||||
- [Timeline Explorerでの解析](#timeline-explorerでの解析)
|
||||
- [Criticalアラートのフィルタリングとコンピュータごとのグルーピング](#criticalアラートのフィルタリングとコンピュータごとのグルーピング)
|
||||
- [Elastic Stackダッシュボードでの解析](#elastic-stackダッシュボードでの解析)
|
||||
- [Timesketchでの解析](#timesketchでの解析)
|
||||
- [タイムラインのサンプル結果](#タイムラインのサンプル結果)
|
||||
- [特徴＆機能](#特徴機能)
|
||||
- [ダウンロード](#ダウンロード)
|
||||
@@ -69,6 +70,7 @@ Hayabusaは、日本の[Yamato Security](https://yamatosecurity.connpass.com/)
|
||||
- [3. `verbose`プロファイルの出力](#3-verboseプロファイルの出力)
|
||||
- [4. `verbose-all-field-info`プロファイルの出力](#4-verbose-all-field-infoプロファイルの出力)
|
||||
- [5. `verbose-details-and-all-field-info`プロファイルの出力](#5-verbose-details-and-all-field-infoプロファイルの出力)
|
||||
- [6. `timesketch`プロファイルの出力](#6-timesketchプロファイルの出力)
|
||||
- [プロファイルの比較](#プロファイルの比較)
|
||||
- [Profile Field Aliases](#profile-field-aliases)
|
||||
- [Levelの省略](#levelの省略)
|
||||
@@ -100,7 +102,7 @@ Hayabusaは、日本の[Yamato Security](https://yamatosecurity.connpass.com/)
|
||||
|
||||
### スレット(脅威)ハンティングと企業向けの広範囲なDFIR
|
||||
|
||||
Hayabusaには現在、2300以上のSigmaルールと130以上のHayabusa検知ルールがあり、定期的にルールが追加されています。
|
||||
Hayabusaには現在、2600以上のSigmaルールと130以上のHayabusa検知ルールがあり、定期的にルールが追加されています。
|
||||
[Velociraptor](https://docs.velociraptor.app/)の[Hayabusa artifact](https://docs.velociraptor.app/exchange/artifacts/pages/windows.eventlogs.hayabusa/)を用いることで企業向けの広範囲なスレットハンティングだけでなくDFIR(デジタルフォレンジックとインシデントレスポンス)にも無料で利用することが可能です。この2つのオープンソースを組み合わせることで、SIEMが設定されていない環境でも実質的に遡及してSIEMを再現することができます。具体的な方法は[Eric Capuano](https://twitter.com/eric_capuano)の[こちら](https://www.youtube.com/watch?v=Q1IoGX--814)の動画で学ぶことができます。
|
||||
最終的な目標はインシデントレスポンスや定期的なスレットハンティングのために、HayabusaエージェントをすべてのWindows端末にインストールして、中央サーバーにアラートを返す仕組みを作ることです。
|
||||
|
||||
@@ -149,6 +151,10 @@ Hayabusaは従来のWindowsイベントログ分析解析と比較して、分
|
||||
|
||||
|
||||
|
||||
## Timesketchでの解析
|
||||
|
||||
|
||||
|
||||
# タイムラインのサンプル結果
|
||||
|
||||
CSVのタイムライン結果のサンプルは[こちら](https://github.com/Yamato-Security/hayabusa/tree/main/sample-results)で確認できます。
|
||||
@@ -157,6 +163,8 @@ CSVのタイムラインをExcelやTimeline Explorerで分析する方法は[こ
|
||||
|
||||
CSVのタイムラインをElastic Stackにインポートする方法は[こちら](doc/ElasticStackImport/ElasticStackImport-Japanese.md)で紹介しています。
|
||||
|
||||
CSVのタイムラインをTimesketchにインポートする方法は[こちら](doc/TimesketchImport/TimesketchImport-Japanese.md)で紹介しています。
|
||||
|
||||
# 特徴＆機能
|
||||
|
||||
* クロスプラットフォーム対応: Windows, Linux, macOS。
|
||||
@@ -194,7 +202,7 @@ git clone https://github.com/Yamato-Security/hayabusa.git --recursive
|
||||
`git pull --recurse-submodules`コマンド、もしくは以下のコマンドで`rules`フォルダを同期し、Hayabusaの最新のルールを更新することができます:
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -u
|
||||
hayabusa-1.5.1-win-x64.exe -u
|
||||
```
|
||||
|
||||
アップデートが失敗した場合は、`rules`フォルダの名前を変更してから、もう一回アップデートしてみて下さい。
|
||||
@@ -299,20 +307,20 @@ Windows PC起動後の初回実行時に時間がかかる場合があります
|
||||
|
||||
コマンドプロンプトやWindows Terminalから32ビットもしくは64ビットのWindowsバイナリをHayabusaのルートディレクトリから実行します。
|
||||
|
||||
例: `hayabusa-1.5.0-windows-x64.exe`
|
||||
例: `hayabusa-1.5.1-windows-x64.exe`
|
||||
|
||||
## Linux
|
||||
|
||||
まず、バイナリに実行権限を与える必要があります。
|
||||
|
||||
```bash
|
||||
chmod +x ./hayabusa-1.5.0-linux-x64-gnu
|
||||
chmod +x ./hayabusa-1.5.1-linux-x64-gnu
|
||||
```
|
||||
|
||||
次に、Hayabusaのルートディレクトリから実行します：
|
||||
|
||||
```bash
|
||||
./hayabusa-1.5.0-linux-x64-gnu
|
||||
./hayabusa-1.5.1-linux-x64-gnu
|
||||
```
|
||||
|
||||
## macOS
|
||||
@@ -320,13 +328,13 @@ chmod +x ./hayabusa-1.5.0-linux-x64-gnu
|
||||
まず、ターミナルやiTerm2からバイナリに実行権限を与える必要があります。
|
||||
|
||||
```bash
|
||||
chmod +x ./hayabusa-1.5.0-mac-intel
|
||||
chmod +x ./hayabusa-1.5.1-mac-intel
|
||||
```
|
||||
|
||||
次に、Hayabusaのルートディレクトリから実行してみてください：
|
||||
|
||||
```bash
|
||||
./hayabusa-1.5.0-mac-intel
|
||||
./hayabusa-1.5.1-mac-intel
|
||||
```
|
||||
|
||||
macOSの最新版では、以下のセキュリティ警告が出る可能性があります：
|
||||
@@ -340,7 +348,7 @@ macOSの環境設定から「セキュリティとプライバシー」を開き
|
||||
その後、ターミナルからもう一回実行してみてください：
|
||||
|
||||
```bash
|
||||
./hayabusa-1.5.0-mac-intel
|
||||
./hayabusa-1.5.1-mac-intel
|
||||
```
|
||||
|
||||
以下の警告が出るので、「開く」をクリックしてください。
|
||||
@@ -417,87 +425,87 @@ TIME-FORMAT:
|
||||
|
||||
## 使用例
|
||||
|
||||
* １つのWindowsイベントログファイルに対してHayabusaを実行します:
|
||||
* １つのWindowsイベントログファイルに対してHayabusaを実行する:
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -f eventlog.evtx
|
||||
hayabusa-1.5.1-win-x64.exe -f eventlog.evtx
|
||||
```
|
||||
|
||||
* `verbose`プロファイルで複数のWindowsイベントログファイルのあるsample-evtxディレクトリに対して、Hayabusaを実行します:
|
||||
* `verbose`プロファイルで複数のWindowsイベントログファイルのあるsample-evtxディレクトリに対して、Hayabusaを実行する:
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -d .\hayabusa-sample-evtx -P verbose
|
||||
hayabusa-1.5.1-win-x64.exe -d .\hayabusa-sample-evtx -P verbose
|
||||
```
|
||||
|
||||
* 全てのフィールド情報も含めて１つのCSVファイルにエクスポートして、Excel、Timeline Explorer、Elastic Stack等でさらに分析することができます(注意: `verbose-details-and-all-field-info`プロファイルを使すると、出力するファイルのサイズがとても大きくなります！):
|
||||
* 全てのフィールド情報も含めて１つのCSVファイルにエクスポートして、Excel、Timeline Explorer、Elastic Stack等でさらに分析することができる(注意: `verbose-details-and-all-field-info`プロファイルを使すると、出力するファイルのサイズがとても大きくなる！):
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -d .\hayabusa-sample-evtx -o results.csv -P `verbose-details-and-all-field-info`
|
||||
hayabusa-1.5.1-win-x64.exe -d .\hayabusa-sample-evtx -o results.csv -P `verbose-details-and-all-field-info`
|
||||
```
|
||||
|
||||
* Hayabusaルールのみを実行します（デフォルトでは`-r .\rules`にあるすべてのルールが利用されます）:
|
||||
* Hayabusaルールのみを実行する（デフォルトでは`-r .\rules`にあるすべてのルールが利用される）:
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -d .\hayabusa-sample-evtx -r .\rules\hayabusa -o results.csv
|
||||
hayabusa-1.5.1-win-x64.exe -d .\hayabusa-sample-evtx -r .\rules\hayabusa -o results.csv
|
||||
```
|
||||
|
||||
* Windowsでデフォルトで有効になっているログに対してのみ、Hayabusaルールを実行します:
|
||||
* Windowsでデフォルトで有効になっているログに対してのみ、Hayabusaルールを実行する:
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -d .\hayabusa-sample-evtx -r .\rules\hayabusa\default -o results.csv
|
||||
hayabusa-1.5.1-win-x64.exe -d .\hayabusa-sample-evtx -r .\rules\hayabusa\default -o results.csv
|
||||
```
|
||||
|
||||
* Sysmonログに対してのみHayabusaルールを実行します:
|
||||
* Sysmonログに対してのみHayabusaルールを実行する:
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -d .\hayabusa-sample-evtx -r .\rules\hayabusa\sysmon -o results.csv
|
||||
hayabusa-1.5.1-win-x64.exe -d .\hayabusa-sample-evtx -r .\rules\hayabusa\sysmon -o results.csv
|
||||
```
|
||||
|
||||
* Sigmaルールのみを実行します:
|
||||
* Sigmaルールのみを実行する:
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -d .\hayabusa-sample-evtx -r .\rules\sigma -o results.csv
|
||||
hayabusa-1.5.1-win-x64.exe -d .\hayabusa-sample-evtx -r .\rules\sigma -o results.csv
|
||||
```
|
||||
|
||||
* 廃棄(deprecated)されたルール(`status`が`deprecated`になっているルール)とノイジールール(`.\rules\config\noisy_rules.txt`にルールIDが書かれているルール)を有効にします:
|
||||
* 廃棄(deprecated)されたルール(`status`が`deprecated`になっているルール)とノイジールール(`.\rules\config\noisy_rules.txt`にルールIDが書かれているルール)を有効にする:
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -d .\hayabusa-sample-evtx --enable-deprecated-rules --enable-noisy-rules -o results.csv
|
||||
hayabusa-1.5.1-win-x64.exe -d .\hayabusa-sample-evtx --enable-deprecated-rules --enable-noisy-rules -o results.csv
|
||||
```
|
||||
|
||||
* ログオン情報を分析するルールのみを実行し、UTCタイムゾーンで出力します:
|
||||
* ログオン情報を分析するルールのみを実行し、UTCタイムゾーンで出力する:
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -d .\hayabusa-sample-evtx -r .\rules\hayabusa\default\events\Security\Logons -U -o results.csv
|
||||
hayabusa-1.5.1-win-x64.exe -d .\hayabusa-sample-evtx -r .\rules\hayabusa\default\events\Security\Logons -U -o results.csv
|
||||
```
|
||||
|
||||
* 起動中のWindows端末上で実行し（Administrator権限が必要）、アラート（悪意のある可能性のある動作）のみを検知します:
|
||||
* 起動中のWindows端末上で実行し（Administrator権限が必要）、アラート（悪意のある可能性のある動作）のみを検知する:
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -l -m low
|
||||
hayabusa-1.5.1-win-x64.exe -l -m low
|
||||
```
|
||||
|
||||
* criticalレベルのアラートからピボットキーワードの一覧を作成します(結果は結果毎に`keywords-Ip Address.txt`や`keywords-Users.txt`等に出力されます):
|
||||
* criticalレベルのアラートからピボットキーワードの一覧を作成する(結果は結果毎に`keywords-Ip Address.txt`や`keywords-Users.txt`等に出力される):
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -l -m critical -p -o keywords
|
||||
hayabusa-1.5.1-win-x64.exe -l -m critical -p -o keywords
|
||||
```
|
||||
|
||||
* イベントIDの統計情報を出力します:
|
||||
* イベントIDの統計情報を出力する:
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -f Security.evtx -s
|
||||
hayabusa-1.5.1-win-x64.exe -f Security.evtx -s
|
||||
```
|
||||
* ログオンサマリを出力します:
|
||||
* ログオンサマリを出力する:
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -L -f Security.evtx -s
|
||||
hayabusa-1.5.1-win-x64.exe -L -f Security.evtx -s
|
||||
```
|
||||
|
||||
* 詳細なメッセージを出力します(処理に時間がかかるファイル、パースエラー等を特定するのに便利):
|
||||
* 詳細なメッセージを出力する(処理に時間がかかるファイル、パースエラー等を特定するのに便利):
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -d .\hayabusa-sample-evtx -v
|
||||
hayabusa-1.5.1-win-x64.exe -d .\hayabusa-sample-evtx -v
|
||||
```
|
||||
|
||||
* Verbose出力の例:
|
||||
@@ -515,6 +523,12 @@ Checking target evtx FilePath: "./hayabusa-sample-evtx/YamatoSecurity/T1218.004_
|
||||
5 / 509 [=>------------------------------------------------------------------------------------------------------------------------------------------] 0.98 % 1s
|
||||
```
|
||||
|
||||
* 結果を[Timesketch](https://timesketch.org/)にインポートできるCSV形式に保存する:
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.1-win-x64.exe -d ../hayabusa-sample-evtx --RFC-3339 -o timesketch-import.csv -P timesketch -U
|
||||
```
|
||||
|
||||
* エラーログの出力をさせないようにする:
|
||||
デフォルトでは、Hayabusaはエラーメッセージをエラーログに保存します。
|
||||
エラーメッセージを保存したくない場合は、`-Q`を追加してください。
|
||||
@@ -590,6 +604,12 @@ Hayabusaの`config/profiles.yaml`設定ファイルでは、５つのプロフ
|
||||
|
||||
`%Timestamp%`, `%Computer%`, `%Channel%`, `%EventID%`, `%Level%`, `%MitreTactics`, `%MitreTags%`, `%OtherTags%`, `%RecordID%`, `%RuleTitle%`, `%Details%`, `%RuleFile%`, `%EvtxFile%`, `%AllFieldInfo%`
|
||||
|
||||
### 6. `timesketch`プロファイルの出力
|
||||
|
||||
[Timesketch](https://timesketch.org/)にインポートできる`verbose`プロファイル。
|
||||
|
||||
`%Timestamp%`, `hayabusa`, `%RuleTitle%`, `%Computer%`, `%Channel%`, `%EventID%`, `%Level%`, `%MitreTactics`, `%MitreTags%`, `%OtherTags%`, `%RecordID%`, `%Details%`, `%RuleFile%`, `%EvtxFile%`
|
||||
|
||||
### プロファイルの比較
|
||||
|
||||
以下のベンチマークは、2018年製のマックブックプロ上で7.5GBのEVTXデータに対して実施されました。
|
||||
@@ -599,6 +619,7 @@ Hayabusaの`config/profiles.yaml`設定ファイルでは、５つのプロフ
|
||||
| minimal | 16分18秒 | 690 MB |
|
||||
| standard | 16分23秒 | 710 MB |
|
||||
| verbose | 17分 | 990 MB |
|
||||
| timesketch | 17分 | 1015 MB |
|
||||
| verbose-all-field-info | 16分50秒 | 1.6 GB |
|
||||
| verbose-details-and-all-field-info | 17分12秒 | 2.1 GB |
|
||||
|
||||
@@ -769,7 +790,7 @@ Hayabusaルールは、Windowsのイベントログ解析専用に設計され
|
||||
## 検知レベルのlevelチューニング
|
||||
|
||||
Hayabusaルール、Sigmaルールはそれぞれの作者が検知した際のリスクレベルを決めています。
|
||||
ユーザが独自のリスクレベルに設定するには`./rules/config/level_tuning.txt`に変換情報を書き、`hayabusa-1.5.0-win-x64.exe --level-tuning`を実行することでルールファイルが書き換えられます。
|
||||
ユーザが独自のリスクレベルに設定するには`./rules/config/level_tuning.txt`に変換情報を書き、`hayabusa-1.5.1-win-x64.exe --level-tuning`を実行することでルールファイルが書き換えられます。
|
||||
ルールファイルが直接書き換えられることに注意して使用してください。
|
||||
|
||||
`./rules/config/level_tuning.txt`の例:
|
||||
|
||||
69
README.md
69
README.md
@@ -20,7 +20,7 @@
|
||||
|
||||
# About Hayabusa
|
||||
|
||||
Hayabusa is a **Windows event log fast forensics timeline generator** and **threat hunting tool** created by the [Yamato Security](https://yamatosecurity.connpass.com/) group in Japan. Hayabusa means ["peregrine falcon"](https://en.wikipedia.org/wiki/Peregrine_falcon") in Japanese and was chosen as peregrine falcons are the fastest animal in the world, great at hunting and highly trainable. It is written in [Rust](https://www.rust-lang.org/) and supports multi-threading in order to be as fast as possible. We have provided a [tool](https://github.com/Yamato-Security/hayabusa-rules/tree/main/tools/sigmac) to convert [Sigma](https://github.com/SigmaHQ/sigma) rules into Hayabusa rule format. The Sigma-compatible Hayabusa detection rules are written in YML in order to be as easily customizable and extensible as possible. Hayabusa can be run either on single running systems for live analysis, by gathering logs from single or multiple systems for offline analysis, or by running the [Hayabusa artifact](https://docs.velociraptor.app/exchange/artifacts/pages/windows.eventlogs.hayabusa/) with [Velociraptor](https://docs.velociraptor.app/) for enterprise-wide threat hunting and incident response. The output will be consolidated into a single CSV timeline for easy analysis in Excel, [Timeline Explorer](https://ericzimmerman.github.io/#!index.md), or [Elastic Stack](doc/ElasticStackImport/ElasticStackImport-English.md).
|
||||
Hayabusa is a **Windows event log fast forensics timeline generator** and **threat hunting tool** created by the [Yamato Security](https://yamatosecurity.connpass.com/) group in Japan. Hayabusa means ["peregrine falcon"](https://en.wikipedia.org/wiki/Peregrine_falcon") in Japanese and was chosen as peregrine falcons are the fastest animal in the world, great at hunting and highly trainable. It is written in [Rust](https://www.rust-lang.org/) and supports multi-threading in order to be as fast as possible. We have provided a [tool](https://github.com/Yamato-Security/hayabusa-rules/tree/main/tools/sigmac) to convert [Sigma](https://github.com/SigmaHQ/sigma) rules into Hayabusa rule format. The Sigma-compatible Hayabusa detection rules are written in YML in order to be as easily customizable and extensible as possible. Hayabusa can be run either on single running systems for live analysis, by gathering logs from single or multiple systems for offline analysis, or by running the [Hayabusa artifact](https://docs.velociraptor.app/exchange/artifacts/pages/windows.eventlogs.hayabusa/) with [Velociraptor](https://docs.velociraptor.app/) for enterprise-wide threat hunting and incident response. The output will be consolidated into a single CSV timeline for easy analysis in Excel, [Timeline Explorer](https://ericzimmerman.github.io/#!index.md), [Elastic Stack](doc/ElasticStackImport/ElasticStackImport-English.md), [Timesketch](https://timesketch.org/), etc...
|
||||
|
||||
## Table of Contents
|
||||
|
||||
@@ -38,6 +38,7 @@ Hayabusa is a **Windows event log fast forensics timeline generator** and **thre
|
||||
- [Analysis in Timeline Explorer](#analysis-in-timeline-explorer)
|
||||
- [Critical Alert Filtering and Computer Grouping in Timeline Explorer](#critical-alert-filtering-and-computer-grouping-in-timeline-explorer)
|
||||
- [Analysis with the Elastic Stack Dashboard](#analysis-with-the-elastic-stack-dashboard)
|
||||
- [Analysis in Timesketch](#analysis-in-timesketch)
|
||||
- [Analyzing Sample Timeline Results](#analyzing-sample-timeline-results)
|
||||
- [Features](#features)
|
||||
- [Downloads](#downloads)
|
||||
@@ -67,6 +68,7 @@ Hayabusa is a **Windows event log fast forensics timeline generator** and **thre
|
||||
- [3. `verbose` profile output](#3-verbose-profile-output)
|
||||
- [4. `verbose-all-field-info` profile output](#4-verbose-all-field-info-profile-output)
|
||||
- [5. `verbose-details-and-all-field-info` profile output](#5-verbose-details-and-all-field-info-profile-output)
|
||||
- [6. `timesketch` profile output](#6-timesketch-profile-output)
|
||||
- [Profile Comparison](#profile-comparison)
|
||||
- [Profile Field Aliases](#profile-field-aliases)
|
||||
- [Level Abbrevations](#level-abbrevations)
|
||||
@@ -98,7 +100,7 @@ Hayabusa is a **Windows event log fast forensics timeline generator** and **thre
|
||||
|
||||
### Threat Hunting and Enterprise-wide DFIR
|
||||
|
||||
Hayabusa currently has over 2400 Sigma rules and over 130 Hayabusa built-in detection rules with more rules being added regularly. It can be used for enterprise-wide proactive threat hunting as well as DFIR (Digital Forensics and Incident Response) for free with [Velociraptor](https://docs.velociraptor.app/)'s [Hayabusa artifact](https://docs.velociraptor.app/exchange/artifacts/pages/windows.eventlogs.hayabusa/). By combining these two open-source tools, you can essentially retroactively reproduce a SIEM when there is no SIEM setup in the environment. You can learn about how to do this by watching [Eric Capuano](https://twitter.com/eric_capuano)'s Velociraptor walkthrough [here](https://www.youtube.com/watch?v=Q1IoGX--814).
|
||||
Hayabusa currently has over 2600 Sigma rules and over 130 Hayabusa built-in detection rules with more rules being added regularly. It can be used for enterprise-wide proactive threat hunting as well as DFIR (Digital Forensics and Incident Response) for free with [Velociraptor](https://docs.velociraptor.app/)'s [Hayabusa artifact](https://docs.velociraptor.app/exchange/artifacts/pages/windows.eventlogs.hayabusa/). By combining these two open-source tools, you can essentially retroactively reproduce a SIEM when there is no SIEM setup in the environment. You can learn about how to do this by watching [Eric Capuano](https://twitter.com/eric_capuano)'s Velociraptor walkthrough [here](https://www.youtube.com/watch?v=Q1IoGX--814).
|
||||
|
||||
### Fast Forensics Timeline Generation
|
||||
|
||||
@@ -141,6 +143,10 @@ Hayabusa hopes to let analysts get 80% of their work done in 20% of the time whe
|
||||
|
||||
|
||||
|
||||
## Analysis in Timesketch
|
||||
|
||||
|
||||
|
||||
# Analyzing Sample Timeline Results
|
||||
|
||||
You can check out a sample CSV timeline [here](https://github.com/Yamato-Security/hayabusa/tree/main/sample-results).
|
||||
@@ -149,6 +155,8 @@ You can learn how to analyze CSV timelines in Excel and Timeline Explorer [here]
|
||||
|
||||
You can learn how to import CSV files into Elastic Stack [here](doc/ElasticStackImport/ElasticStackImport-English.md).
|
||||
|
||||
You can learn how to import CSV files into Timesketch [here](doc/TimesketchImport/TimesketchImport-English.md).
|
||||
|
||||
# Features
|
||||
|
||||
* Cross-platform support: Windows, Linux, macOS.
|
||||
@@ -186,7 +194,7 @@ Note: If you forget to use --recursive option, the `rules` folder, which is mana
|
||||
You can sync the `rules` folder and get latest Hayabusa rules with `git pull --recurse-submodules` or use the following command:
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -u
|
||||
hayabusa-1.5.1-win-x64.exe -u
|
||||
```
|
||||
|
||||
If the update fails, you may need to rename the `rules` folder and try again.
|
||||
@@ -291,20 +299,20 @@ You may experience slow runtime especially on the first run after a reboot due t
|
||||
|
||||
In a Command/PowerShell Prompt or Windows Terminal, just run the appropriate 32-bit or 64-bit Windows binary.
|
||||
|
||||
Example: `hayabusa-1.5.0-windows-x64.exe`
|
||||
Example: `hayabusa-1.5.1-windows-x64.exe`
|
||||
|
||||
## Linux
|
||||
|
||||
You first need to make the binary executable.
|
||||
|
||||
```bash
|
||||
chmod +x ./hayabusa-1.5.0-linux-x64-gnu
|
||||
chmod +x ./hayabusa-1.5.1-linux-x64-gnu
|
||||
```
|
||||
|
||||
Then run it from the Hayabusa root directory:
|
||||
|
||||
```bash
|
||||
./hayabusa-1.5.0-linux-x64-gnu
|
||||
./hayabusa-1.5.1-linux-x64-gnu
|
||||
```
|
||||
|
||||
## macOS
|
||||
@@ -312,13 +320,13 @@ Then run it from the Hayabusa root directory:
|
||||
From Terminal or iTerm2, you first need to make the binary executable.
|
||||
|
||||
```bash
|
||||
chmod +x ./hayabusa-1.5.0-mac-intel
|
||||
chmod +x ./hayabusa-1.5.1-mac-intel
|
||||
```
|
||||
|
||||
Then, try to run it from the Hayabusa root directory:
|
||||
|
||||
```bash
|
||||
./hayabusa-1.5.0-mac-intel
|
||||
./hayabusa-1.5.1-mac-intel
|
||||
```
|
||||
|
||||
On the latest version of macOS, you may receive the following security error when you try to run it:
|
||||
@@ -332,7 +340,7 @@ Click "Cancel" and then from System Preferences, open "Security & Privacy" and f
|
||||
After that, try to run it again.
|
||||
|
||||
```bash
|
||||
./hayabusa-1.5.0-mac-intel
|
||||
./hayabusa-1.5.1-mac-intel
|
||||
```
|
||||
|
||||
The following warning will pop up, so please click "Open".
|
||||
@@ -412,85 +420,85 @@ TIME-FORMAT:
|
||||
* Run hayabusa against one Windows event log file with default standard profile:
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -f eventlog.evtx
|
||||
hayabusa-1.5.1-win-x64.exe -f eventlog.evtx
|
||||
```
|
||||
|
||||
* Run hayabusa against the sample-evtx directory with multiple Windows event log files with the verbose profile:
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -d .\hayabusa-sample-evtx -P verbose
|
||||
hayabusa-1.5.1-win-x64.exe -d .\hayabusa-sample-evtx -P verbose
|
||||
```
|
||||
|
||||
* Export to a single CSV file for further analysis with excel, timeline explorer, elastic stack, etc... and include all field information (Warning: your file output size will become much larger with the `verbose-details-and-all-field-info` profile!):
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -d .\hayabusa-sample-evtx -o results.csv -F
|
||||
hayabusa-1.5.1-win-x64.exe -d .\hayabusa-sample-evtx -o results.csv -F
|
||||
```
|
||||
|
||||
* Only run hayabusa rules (the default is to run all the rules in `-r .\rules`):
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -d .\hayabusa-sample-evtx -r .\rules\hayabusa -o results.csv
|
||||
hayabusa-1.5.1-win-x64.exe -d .\hayabusa-sample-evtx -r .\rules\hayabusa -o results.csv
|
||||
```
|
||||
|
||||
* Only run hayabusa rules for logs that are enabled by default on Windows:
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -d .\hayabusa-sample-evtx -r .\rules\hayabusa\default -o results.csv
|
||||
hayabusa-1.5.1-win-x64.exe -d .\hayabusa-sample-evtx -r .\rules\hayabusa\default -o results.csv
|
||||
```
|
||||
|
||||
* Only run hayabusa rules for sysmon logs:
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -d .\hayabusa-sample-evtx -r .\rules\hayabusa\sysmon -o results.csv
|
||||
hayabusa-1.5.1-win-x64.exe -d .\hayabusa-sample-evtx -r .\rules\hayabusa\sysmon -o results.csv
|
||||
```
|
||||
|
||||
* Only run sigma rules:
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -d .\hayabusa-sample-evtx -r .\rules\sigma -o results.csv
|
||||
hayabusa-1.5.1-win-x64.exe -d .\hayabusa-sample-evtx -r .\rules\sigma -o results.csv
|
||||
```
|
||||
|
||||
* Enable deprecated rules (those with `status` marked as `deprecated`) and noisy rules (those whose rule ID is listed in `.\rules\config\noisy_rules.txt`):
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -d .\hayabusa-sample-evtx --enable-noisy-rules --enable-deprecated-rules -o results.csv
|
||||
hayabusa-1.5.1-win-x64.exe -d .\hayabusa-sample-evtx --enable-noisy-rules --enable-deprecated-rules -o results.csv
|
||||
```
|
||||
|
||||
* Only run rules to analyze logons and output in the UTC timezone:
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -d .\hayabusa-sample-evtx -r .\rules\hayabusa\default\events\Security\Logons -U -o results.csv
|
||||
hayabusa-1.5.1-win-x64.exe -d .\hayabusa-sample-evtx -r .\rules\hayabusa\default\events\Security\Logons -U -o results.csv
|
||||
```
|
||||
|
||||
* Run on a live Windows machine (requires Administrator privileges) and only detect alerts (potentially malicious behavior):
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -l -m low
|
||||
hayabusa-1.5.1-win-x64.exe -l -m low
|
||||
```
|
||||
|
||||
* Create a list of pivot keywords from critical alerts and save the results. (Results will be saved to `keywords-Ip Addresses.txt`, `keywords-Users.txt`, etc...):
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -l -m critical -p -o keywords
|
||||
hayabusa-1.5.1-win-x64.exe -l -m critical -p -o keywords
|
||||
```
|
||||
|
||||
* Print Event ID statistics:
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -f Security.evtx -s
|
||||
hayabusa-1.5.1-win-x64.exe -f Security.evtx -s
|
||||
```
|
||||
|
||||
* Print logon summary:
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -L -f Security.evtx -s
|
||||
hayabusa-1.5.1-win-x64.exe -L -f Security.evtx -s
|
||||
```
|
||||
|
||||
* Print verbose information (useful for determining which files take long to process, parsing errors, etc...):
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.0-win-x64.exe -d .\hayabusa-sample-evtx -v
|
||||
hayabusa-1.5.1-win-x64.exe -d .\hayabusa-sample-evtx -v
|
||||
```
|
||||
|
||||
* Verbose output example:
|
||||
@@ -508,6 +516,12 @@ Checking target evtx FilePath: "./hayabusa-sample-evtx/YamatoSecurity/T1218.004_
|
||||
5 / 509 [=>------------------------------------------------------------------------------------------------------------------------------------------] 0.98 % 1s
|
||||
```
|
||||
|
||||
* Output to a CSV format compatible to import into [Timesketch](https://timesketch.org/):
|
||||
|
||||
```bash
|
||||
hayabusa-1.5.1-win-x64.exe -d ../hayabusa-sample-evtx --RFC-3339 -o timesketch-import.csv -P timesketch -U
|
||||
```
|
||||
|
||||
* Quiet error mode:
|
||||
By default, hayabusa will save error messages to error log files.
|
||||
If you do not want to save error messages, please add `-Q`.
|
||||
@@ -584,6 +598,12 @@ Instead of outputting the minimal `details` information, all field information i
|
||||
|
||||
`%Timestamp%`, `%Computer%`, `%Channel%`, `%EventID%`, `%Level%`, `%MitreTactics`, `%MitreTags%`, `%OtherTags%`, `%RecordID%`, `%RuleTitle%`, `%Details%`, `%RuleFile%`, `%EvtxFile%`, `%AllFieldInfo%`
|
||||
|
||||
### 6. `timesketch` profile output
|
||||
|
||||
The `verbose` profile that is compatible with importing into [Timesketch](https://timesketch.org/).
|
||||
|
||||
`%Timestamp%`, `hayabusa`, `%RuleTitle%`, `%Computer%`, `%Channel%`, `%EventID%`, `%Level%`, `%MitreTactics`, `%MitreTags%`, `%OtherTags%`, `%RecordID%`, `%Details%`, `%RuleFile%`, `%EvtxFile%`
|
||||
|
||||
### Profile Comparison
|
||||
|
||||
The following benchmarks were conducted on a 2018 MBP with 7.5GB of evtx data.
|
||||
@@ -593,6 +613,7 @@ The following benchmarks were conducted on a 2018 MBP with 7.5GB of evtx data.
|
||||
| minimal | 16 minutes 18 seconds | 690 MB |
|
||||
| standard | 16 minutes 23 seconds | 710 MB |
|
||||
| verbose | 17 minutes | 990 MB |
|
||||
| timesketch | 17 minutes | 1015 MB |
|
||||
| verbose-all-field-info | 16 minutes 50 seconds | 1.6 GB |
|
||||
| verbose-details-and-all-field-info | 17 minutes 12 seconds | 2.1 GB |
|
||||
|
||||
@@ -762,7 +783,7 @@ You can also add a rule ID to `./rules/config/noisy_rules.txt` in order to ignor
|
||||
|
||||
Hayabusa and Sigma rule authors will determine the risk level of the alert when writing their rules.
|
||||
However, the actual risk level will differ between environments.
|
||||
You can tune the risk level of the rules by adding them to `./rules/config/level_tuning.txt` and executing `hayabusa-1.5.0-win-x64.exe --level-tuning` which will update the `level` line in the rule file.
|
||||
You can tune the risk level of the rules by adding them to `./rules/config/level_tuning.txt` and executing `hayabusa-1.5.1-win-x64.exe --level-tuning` which will update the `level` line in the rule file.
|
||||
Please note that the rule file will be updated directly.
|
||||
|
||||
`./rules/config/level_tuning.txt` sample line:
|
||||
|
||||
@@ -66,4 +66,22 @@ verbose-details-and-all-field-info:
|
||||
Details: "%Details%"
|
||||
RuleFile: "%RuleFile%"
|
||||
EvtxFile: "%EvtxFile%"
|
||||
AllFieldInfo: "%RecordInformation%"
|
||||
|
||||
#Output that is compatible to import the CSV into Timesketch
|
||||
timesketch:
|
||||
datetime: "%Timestamp%"
|
||||
timestamp_desc: "hayabusa"
|
||||
message: "%RuleTitle%"
|
||||
Computer: "%Computer%"
|
||||
Channel: "%Channel%"
|
||||
EventID: "%EventID%"
|
||||
Level: "%Level%"
|
||||
MitreTactics: "%MitreTactics%"
|
||||
MitreTags: "%MitreTags%"
|
||||
OtherTags: "%OtherTags%"
|
||||
RecordID: "%RecordID%"
|
||||
Details: "%Details%"
|
||||
RuleFile: "%RuleFile%"
|
||||
EvtxFile: "%EvtxFile%"
|
||||
AllFieldInfo: "%RecordInformation%"
|
||||
@@ -1,7 +1,7 @@
|
||||
Hayabusa was possible thanks to the following people (in alphabetical order):
|
||||
|
||||
Akira Nishikawa (@nishikawaakira): Previous lead developer, core hayabusa rule support, etc...
|
||||
Fukusuke Takahashi (fukuseket): Static compiling for Windows.
|
||||
Fukusuke Takahashi (fukuseket): Static compiling for Windows, race condition and other bug fixes.
|
||||
Garigariganzy (@garigariganzy31): Developer, event ID statistics implementation, etc...
|
||||
ItiB (@itiB_S144) : Core developer, sigmac hayabusa backend, rule creation, etc...
|
||||
James Takai / hachiyone(@hach1yon): Current lead developer, tokio multi-threading, sigma aggregation logic, sigmac backend, rule creation, sigma count implementation etc…
|
||||
|
||||
BIN
doc/TimesketchImport/01-TimesketchLogin.png
Normal file
BIN
doc/TimesketchImport/01-TimesketchLogin.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 69 KiB |
BIN
doc/TimesketchImport/02-NewInvestigation.png
Normal file
BIN
doc/TimesketchImport/02-NewInvestigation.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 49 KiB |
BIN
doc/TimesketchImport/03-TimesketchTimeline.png
Normal file
BIN
doc/TimesketchImport/03-TimesketchTimeline.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 307 KiB |
BIN
doc/TimesketchImport/04-TimelineWithColumns.png
Normal file
BIN
doc/TimesketchImport/04-TimelineWithColumns.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 508 KiB |
BIN
doc/TimesketchImport/05-FieldInformation.png
Normal file
BIN
doc/TimesketchImport/05-FieldInformation.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 298 KiB |
BIN
doc/TimesketchImport/06-MarkingEvents.png
Normal file
BIN
doc/TimesketchImport/06-MarkingEvents.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 12 KiB |
80
doc/TimesketchImport/TimesketchImport-English.md
Normal file
80
doc/TimesketchImport/TimesketchImport-English.md
Normal file
@@ -0,0 +1,80 @@
|
||||
# Importing Hayabusa Results Into Timesketch
|
||||
|
||||
## About
|
||||
|
||||
"[Timesketch](https://timesketch.org/) is an open-source tool for collaborative forensic timeline analysis. Using sketches you and your collaborators can easily organize your timelines and analyze them all at the same time. Add meaning to your raw data with rich annotations, comments, tags and stars."
|
||||
|
||||
|
||||
## Installing
|
||||
|
||||
We recommend using the Ubuntu 22.04 LTS Server edition.
|
||||
You can download it [here](https://ubuntu.com/download/server).
|
||||
Choose the minimal install when setting it up.
|
||||
You won't have `ifconfig` available, so install it with `sudo apt install net-tools`.
|
||||
|
||||
After that, follow the install instructions [here](https://timesketch.org/guides/admin/install/):
|
||||
|
||||
``` bash
|
||||
sudo apt install docker-compose
|
||||
curl -s -O https://raw.githubusercontent.com/google/timesketch/master/contrib/deploy_timesketch.sh
|
||||
chmod 755 deploy_timesketch.sh
|
||||
cd /opt
|
||||
sudo ~/deploy_timesketch.sh
|
||||
cd timesketch
|
||||
sudo docker-compose up -d
|
||||
sudo docker-compose exec timesketch-web tsctl create-user <USERNAME>
|
||||
```
|
||||
|
||||
## Prepared VM
|
||||
|
||||
We have pre-built a demo VM that you can use against the 2022 DEF CON 30 [OpenSOC](https://opensoc.io/) DFIR Challenge evidence hosted by [Recon InfoSec](https://www.reconinfosec.com/). (The evidence has already been imported.)
|
||||
You can download it [here](https://www.dropbox.com/s/3be3s5c2r22ux2z/Prebuilt-Timesketch.ova?dl=0).
|
||||
You can find the other evidence for this challenge [here](https://docs.google.com/document/d/1XM4Gfdojt8fCn_9B8JKk9bcUTXZc0_hzWRUH4mEr7dw/mobilebasic) and questions [here](https://docs.google.com/spreadsheets/d/1vKn8BgABuJsqH5WhhS9ebIGTBG4aoP-StINRi18abo4/htmlview).
|
||||
|
||||
The username for the VM is `user` and password is `password`.
|
||||
|
||||
## Logging in
|
||||
|
||||
Find out the IP address with `ifconfig` and open it with a web browser.
|
||||
You will be redirected to a login page as shown below:
|
||||
|
||||
|
||||
|
||||
Log in with the docker-compose user credentials you used when adding a user.
|
||||
|
||||
## Create a new sketch
|
||||
|
||||
Click on `New investiation` and create a name for the new sketch:
|
||||
|
||||
|
||||
|
||||
## Upload timeline
|
||||
|
||||
Click `Upload timeline` and upload a CSV file that you created with the following command:
|
||||
|
||||
`hayabusa-1.5.1-win-x64.exe -d ../hayabusa-sample-evtx --RFC-3339 -o timesketch-import.csv -P timesketch -U`
|
||||
|
||||
You can add `-m low` if you just want alerts and not include Windows events.
|
||||
|
||||
## Analyzing results
|
||||
|
||||
You should get the following screen:
|
||||
|
||||
|
||||
|
||||
By default, only the UTC timestamp and alert rule title will be displayed so click `Customize columns` to add more fields.
|
||||
|
||||
> Warning: In the current version, there is a bug in that a new column will be blank. Please add another column (and then delete it afterwards if not needed) to display new columns.
|
||||
|
||||
You can also filter on fields in the searchbox, such as `Level: crit` to only show critical alerts.
|
||||
|
||||
|
||||
|
||||
|
||||
If you click on an event, you can see all of the field information:
|
||||
|
||||
|
||||
|
||||
With the three icons to the left of the alert title, you can star events of interest, search +- 5 minutes to see the context of an event and add labels.
|
||||
|
||||
|
||||
80
doc/TimesketchImport/TimesketchImport-Japanese.md
Normal file
80
doc/TimesketchImport/TimesketchImport-Japanese.md
Normal file
@@ -0,0 +1,80 @@
|
||||
# TimesketchにHayabusa結果をインポートする方法
|
||||
|
||||
## Timesketchについて
|
||||
|
||||
"[Timesketch](https://timesketch.org/)は、フォレンジックタイムラインの共同解析のためのオープンソースツールです。スケッチを使うことで、あなたとあなたの共同作業者は、簡単にタイムラインを整理し、同時に分析することができます。リッチなアノテーション、コメント、タグ、スターで生データに意味を持たせることができます。"
|
||||
|
||||
|
||||
## インストール
|
||||
|
||||
Ubuntu 22.04 LTS Serverエディションの使用を推奨します。
|
||||
[こちら](https://ubuntu.com/download/server)からダウンロードできます。
|
||||
セットアップ時にミニマルインストールを選択してください。
|
||||
`ifconfig`はインストールされていないので、`sudo apt install net-tools`でインストールしてください。
|
||||
|
||||
その後、インストール手順[こちら](https://timesketch.org/guides/admin/install/)に従ってください:
|
||||
|
||||
``` bash
|
||||
sudo apt install docker-compose
|
||||
curl -s -O https://raw.githubusercontent.com/google/timesketch/master/contrib/deploy_timesketch.sh
|
||||
chmod 755 deploy_timesketch.sh
|
||||
cd /opt
|
||||
sudo ~/deploy_timesketch.sh
|
||||
cd timesketch
|
||||
sudo docker-compose up -d
|
||||
sudo docker-compose exec timesketch-web tsctl create-user <USERNAME>
|
||||
```
|
||||
|
||||
## 準備されたVM
|
||||
|
||||
[Recon InfoSec](https://www.reconinfosec.com/)主催の2022年のDEF CON 30 [OpenSOC](https://opensoc.io/) DFIR Challengeのエビデンスに対して使用できるデモ用VMを事前に構築しています。 (エビデンスは既にインポート済み。)
|
||||
[こちら](https://www.dropbox.com/s/3be3s5c2r22ux2z/Prebuilt-Timesketch.ova?dl=0)からダウンロードできます。
|
||||
このチャレンジの他のエビデンスは[こちら](https://docs.google.com/document/d/1XM4Gfdojt8fCn_9B8JKk9bcUTXZc0_hzWRUH4mEr7dw/mobilebasic)からダウンロードできます。
|
||||
問題は[こちら](https://docs.google.com/spreadsheets/d/1vKn8BgABuJsqH5WhhS9ebIGTBG4aoP-StINRi18abo4/htmlview)からダウンロードできます。
|
||||
|
||||
VMのユーザ名は`user`。パスワードは`password`。
|
||||
|
||||
## ログイン
|
||||
|
||||
`ifconfig`でIPアドレスを調べ、Webブラウザで開いてください。
|
||||
以下のようなログインページに移動されます:
|
||||
|
||||
|
||||
|
||||
docker-composeコマンドで作成したユーザの認証情報でログインしてください。
|
||||
|
||||
## 新しいsketch作成
|
||||
|
||||
`New investiation`をクリックし、新しいスケッチに名前を付けます。
|
||||
|
||||
|
||||
|
||||
## タイムラインのアップロード
|
||||
|
||||
`Upload timeline`をクリックし、以下のコマンドで作成したCSVファイルをアップロードします:
|
||||
|
||||
`hayabusa-1.5.1-win-x64.exe -d ../hayabusa-sample-evtx --RFC-3339 -o timesketch-import.csv -P timesketch -U`
|
||||
|
||||
Windowsのイベントを含めず、アラートだけでよい場合は、`-m low`を追加することができます。
|
||||
|
||||
## 結果の解析
|
||||
|
||||
以下のような画面が表示されるはずです:
|
||||
|
||||
|
||||
|
||||
デフォルトでは、UTCタイムスタンプとアラートルールのタイトル名のみが表示されますので、`Customize columns`をクリックし、他のフィールドを追加してください。
|
||||
|
||||
> 注意: 現在のバージョンでは、新しいカラムが空白になってしまうというバグがあります。新しいカラムを表示するには、別のカラムをまず追加してください（必要なければ後で削除してください。）
|
||||
|
||||
以下のように検索ボックスで`Level: crit`等を入力することで、クリティカルなアラートのみを表示させるようにフィルタリングできます。
|
||||
|
||||
|
||||
|
||||
イベントをクリックすると、すべてのフィールド情報を見ることができます:
|
||||
|
||||
|
||||
|
||||
アラートタイトルの左側にある3つのアイコンを使って、興味のあるイベントにスターをつけたり、イベントの文脈を見るために+-5分検索したり、ラベルを追加したりすることが可能です。
|
||||
|
||||
|
||||
2
rules
2
rules
Submodule rules updated: aa0a16b1d5...856316374c
BIN
screenshots/TimesketchAnalysis.png
Normal file
BIN
screenshots/TimesketchAnalysis.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 402 KiB |
@@ -249,7 +249,7 @@ fn emit_csv<W: std::io::Write>(
|
||||
&disp_wtr,
|
||||
get_writable_color(_get_output_color(
|
||||
&color_map,
|
||||
LEVEL_ABBR
|
||||
LEVEL_FULL
|
||||
.get(&detect_info.level)
|
||||
.unwrap_or(&String::default()),
|
||||
)),
|
||||
|
||||
@@ -213,6 +213,14 @@ impl App {
|
||||
}
|
||||
self.analysis_files(live_analysis_list.unwrap(), &time_filter);
|
||||
} else if let Some(filepath) = &configs::CONFIG.read().unwrap().args.filepath {
|
||||
if !filepath.exists() {
|
||||
AlertMessage::alert(&format!(
|
||||
" The file {} does not exist. Please specify a valid file path.",
|
||||
filepath.as_os_str().to_str().unwrap()
|
||||
))
|
||||
.ok();
|
||||
return;
|
||||
}
|
||||
if !TARGET_EXTENSIONS.contains(
|
||||
filepath
|
||||
.extension()
|
||||
|
||||
Reference in New Issue
Block a user