diff --git a/Cargo.lock b/Cargo.lock index ab932e6f..990cbd86 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1191,6 +1191,7 @@ dependencies = [ "csv", "evtx", "flate2", + "lazy_static", "quick-xml 0.17.2", "regex", "serde", diff --git a/Cargo.toml b/Cargo.toml index b28772bf..435c9cf2 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -18,3 +18,4 @@ csv = "1.1" base64 = "*" flate2 = "1.0" toml = "0.5" +lazy_static = "1.4.0" diff --git a/rules/deep_blue_cli/powershell/powershell4103.toml b/rules/deep_blue_cli/powershell/powershell4103.toml new file mode 100644 index 00000000..dcd22977 --- /dev/null +++ b/rules/deep_blue_cli/powershell/powershell4103.toml @@ -0,0 +1,6 @@ +[rule] +severity = "high" +name = "4103" +messages = [ + ["4103", { ja = "パイプライン実行をしています", en = "Execute Pipeline" }] +] \ No newline at end of file diff --git a/rules/deep_blue_cli/powershell/powershell4104.toml b/rules/deep_blue_cli/powershell/powershell4104.toml new file mode 100644 index 00000000..83bba2ce --- /dev/null +++ b/rules/deep_blue_cli/powershell/powershell4104.toml @@ -0,0 +1,6 @@ +[rule] +severity = "high" +name = "4104" +messages = [ + ["4104", { ja = "リモートコマンドを実行します", en = "Excute Remote Command" }] +] \ No newline at end of file diff --git a/src/detections/powershell.rs b/src/detections/powershell.rs index c628a011..e9bfc05e 100644 --- a/src/detections/powershell.rs +++ b/src/detections/powershell.rs @@ -1,8 +1,8 @@ use crate::detections::utils; use crate::models::event; +use crate::detections::print::MESSAGES; use regex::Regex; use std::collections::HashMap; -extern crate csv; pub struct PowerShell {} @@ -25,6 +25,10 @@ impl PowerShell { if event_id != "4103" { return; } + + let message = MESSAGES.lock().unwrap(); + println!("{}", message.return_message("4103")); + let default = String::from(""); let commandline = event_data.get("ContextInfo").unwrap_or(&default); @@ -48,6 +52,9 @@ impl PowerShell { if event_id != "4104" { return; } + let message = MESSAGES.lock().unwrap(); + println!("{}", message.return_message("4104")); + let default = String::from(""); let path = event_data.get("Path").unwrap().to_string(); if path == "".to_string() { diff --git a/src/detections/print.rs b/src/detections/print.rs index c950f9a5..3fb83fbe 100644 --- a/src/detections/print.rs +++ b/src/detections/print.rs @@ -1,18 +1,20 @@ +extern crate lazy_static; use crate::detections::configs::{get_lang, Lang}; use std::collections::HashMap; +use crate::models::rule::MessageText; +use lazy_static::lazy_static; use std::fmt; - -#[derive(Debug)] -pub struct MessageText { - pub ja: String, - pub en: String, -} +use std::sync::Mutex; #[derive(Debug)] pub struct Message { map: HashMap, } +lazy_static! { + pub static ref MESSAGES: Mutex = Mutex::new(Message::new()); +} + impl Message { pub fn new() -> Self { let mut messages: HashMap = HashMap::new(); @@ -33,7 +35,9 @@ impl Message { /// メッセージを返す pub fn return_message(&self, message_num: &str) -> &MessageText { - self.map.get(message_num).unwrap_or(self.map.get("undefined").unwrap()) + self.map + .get(message_num) + .unwrap_or(self.map.get("undefined").unwrap()) } } @@ -60,7 +64,10 @@ fn test_create_and_read_message() { }, ); - let display = format!("{}", format_args!("{}", error_message.return_message("4103"))); + let display = format!( + "{}", + format_args!("{}", error_message.return_message("4103")) + ); assert_eq!(display, "Execute pipeline") } diff --git a/src/main.rs b/src/main.rs index 79a27530..84325960 100644 --- a/src/main.rs +++ b/src/main.rs @@ -5,12 +5,28 @@ use quick_xml::de::DeError; use std::{fs, path::PathBuf, process}; use yamato_event_analyzer::detections::configs; use yamato_event_analyzer::detections::detection; -use yamato_event_analyzer::detections::print; +use yamato_event_analyzer::detections::print::MESSAGES; use yamato_event_analyzer::omikuji::Omikuji; use yamato_event_analyzer::toml; fn main() -> Result<(), DeError> { configs::singleton(); + let mut toml = toml::ParseToml::new(); + &toml.read_dir("rules".to_string()); + + for rule in toml.rules { + match rule { + Ok(_rule) => { + let mut message = MESSAGES.lock().unwrap(); + if let Some(messages) = _rule.rule.messages { + for (key, texts) in messages { + message.insert_message(key, texts); + } + } + } + Err(_) => (), + } + } let filepath: String = configs::singleton() .args diff --git a/src/models/rule.rs b/src/models/rule.rs index 550bdc65..66f77e4a 100644 --- a/src/models/rule.rs +++ b/src/models/rule.rs @@ -5,6 +5,13 @@ use serde::Deserialize; pub struct Rule { pub severity: Option, pub name: Option, + pub messages: Option>, +} + +#[derive(Debug, Deserialize)] +pub struct MessageText { + pub ja: String, + pub en: String, } #[derive(Debug, Deserialize)]