diff --git a/src/detections/configs.rs b/src/detections/configs.rs new file mode 100644 index 00000000..82c273de --- /dev/null +++ b/src/detections/configs.rs @@ -0,0 +1,50 @@ +use std::fs::File; +use std::io::prelude::*; +use std::sync::Once; + +#[derive(Clone)] +pub struct SingletonReader { + pub regex: Vec>, + pub whitelist: Vec>, +} + +pub fn get_instance() -> Box { + static mut SINGLETON: Option> = Option::None; + static ONCE: Once = Once::new(); + + unsafe { + ONCE.call_once(|| { + let singleton = SingletonReader { + regex: read_csv("regexes.txt"), + whitelist: read_csv("whitelist.txt"), + }; + + SINGLETON = Some(Box::new(singleton)); + }); + + return SINGLETON.clone().unwrap(); + } +} + +fn read_csv(filename: &str) -> Vec> { + let mut f = File::open(filename).expect("file not found!!!"); + let mut contents: String = String::new(); + let mut ret = vec![]; + if f.read_to_string(&mut contents).is_err() { + return ret; + } + + let mut rdr = csv::Reader::from_reader(contents.as_bytes()); + rdr.records().for_each(|r| { + if r.is_err() { + return; + } + + let line = r.unwrap(); + let mut v = vec![]; + line.iter().for_each(|s| v.push(s.to_string())); + ret.push(v); + }); + + return ret; +} diff --git a/src/detections/detection.rs b/src/detections/detection.rs index 90d9cc25..fbb6e111 100644 --- a/src/detections/detection.rs +++ b/src/detections/detection.rs @@ -11,8 +11,6 @@ use crate::models::event; use evtx::EvtxParser; use quick_xml::de::DeError; use std::collections::BTreeMap; -use std::fs::File; -use std::io::prelude::*; #[derive(Debug)] pub struct Detection { @@ -34,12 +32,6 @@ impl Detection { let mut sysmon = sysmon::Sysmon::new(); let mut powershell = powershell::PowerShell::new(); - let mut f = File::open("whitelist.txt").expect("file not found"); - let mut contents = String::new(); - let _ = f.read_to_string(&mut contents); - - let mut rdr = csv::Reader::from_reader(contents.as_bytes()); - for record in parser.records() { match record { Ok(r) => { @@ -57,7 +49,7 @@ impl Detection { } else if channel == "Application" { &application.detection(event_id, &event.system, event_data); } else if channel == "Microsoft-Windows-PowerShell/Operational" { - &powershell.detection(event_id, &event.system, event_data, &mut rdr); + &powershell.detection(event_id, &event.system, event_data); } else if channel == "Microsoft-Windows-Sysmon/Operational" { &sysmon.detection(event_id, &event.system, event_data); } else { diff --git a/src/detections/mod.rs b/src/detections/mod.rs index d2012ac3..11454f71 100644 --- a/src/detections/mod.rs +++ b/src/detections/mod.rs @@ -1,5 +1,6 @@ mod application; mod common; +mod configs; pub mod detection; mod powershell; mod security; diff --git a/src/detections/powershell.rs b/src/detections/powershell.rs index df9edf53..50bee2f3 100644 --- a/src/detections/powershell.rs +++ b/src/detections/powershell.rs @@ -16,20 +16,15 @@ impl PowerShell { event_id: String, _system: &event::System, event_data: HashMap, - rdr: &mut csv::Reader<&[u8]>, ) { if event_id == "4103" { - &self.execute_pipeline(&event_data, rdr); + &self.execute_pipeline(&event_data); } else if event_id == "4104" { - &self.execute_remote_command(&event_data, rdr); + &self.execute_remote_command(&event_data); } } - fn execute_pipeline( - &mut self, - event_data: &HashMap, - rdr: &mut csv::Reader<&[u8]>, - ) { + fn execute_pipeline(&mut self, event_data: &HashMap) { // パイプライン実行をしています let default = String::from(""); let commandline = event_data.get("ContextInfo").unwrap_or(&default); @@ -45,23 +40,19 @@ impl PowerShell { let command = rm_after.replace_all(&temp_command_with_extra, ""); if command != "" { - utils::check_command(4103, &command, 1000, 0, &default, &default, rdr); + utils::check_command(4103, &command, 1000, 0, &default, &default); } } } - fn execute_remote_command( - &mut self, - event_data: &HashMap, - rdr: &mut csv::Reader<&[u8]>, - ) { + fn execute_remote_command(&mut self, event_data: &HashMap) { // リモートコマンドを実行します let default = String::from(""); let message_num = event_data.get("MessageNumber"); let commandline = event_data.get("ScriptBlockText").unwrap_or(&default); if let Some(_) = message_num { - utils::check_command(4104, &commandline, 1000, 0, &default, &default, rdr); + utils::check_command(4104, &commandline, 1000, 0, &default, &default); } } } diff --git a/src/detections/utils.rs b/src/detections/utils.rs index ba9aaf39..daf68bbb 100644 --- a/src/detections/utils.rs +++ b/src/detections/utils.rs @@ -2,9 +2,9 @@ extern crate base64; extern crate csv; extern crate regex; +use crate::detections::configs; use flate2::read::GzDecoder; use regex::Regex; -use std::fs::File; use std::io::prelude::*; use std::str; use std::string::String; @@ -16,20 +16,23 @@ pub fn check_command( servicecmd: usize, servicename: &str, creator: &str, - rdr: &mut csv::Reader<&[u8]>, ) { let mut text = "".to_string(); let mut base64 = "".to_string(); - for entry in rdr.records() { - if let Ok(_data) = entry { - if let Ok(_re) = Regex::new(&_data[0]) { - if _re.is_match(commandline) { - return; - } - } + let empty = "".to_string(); + for line in configs::get_instance().whitelist { + let r_str = line.get(0).unwrap_or(&empty); + if r_str.is_empty() { + continue; + } + + let r = Regex::new(r_str); + if r.is_ok() && r.unwrap().is_match(commandline) { + return; } } + if commandline.len() > minlength { text.push_str("Long Command Line: greater than "); text.push_str(&minlength.to_string()); @@ -146,33 +149,33 @@ fn check_obfu(string: &str) -> std::string::String { } fn check_regex(string: &str, r#type: usize) -> std::string::String { - let mut f = File::open("regexes.txt").expect("file not found"); - let mut contents = String::new(); - let ret = f.read_to_string(&mut contents); - if let Err(_) = ret { - return "".to_string(); - } - - let mut rdr = csv::Reader::from_reader(contents.as_bytes()); - + let empty = "".to_string(); let mut regextext = "".to_string(); - for regex in rdr.records() { - if let Ok(_data) = regex { - /* - data[0] is type in csv. - data[1] is regex in csv. - data[2] is string in csv. - */ - if &_data[0] == r#type.to_string() { - if let Ok(_re) = Regex::new(&_data[1]) { - if _re.is_match(string) { - regextext.push_str(&_data[2]); - regextext.push_str("\n"); - } - } - } + for line in configs::get_instance().regex { + let type_str = line.get(0).unwrap_or(&empty); + if type_str != &r#type.to_string() { + continue; } + + let regex_str = line.get(1).unwrap_or(&empty); + if regex_str.is_empty() { + continue; + } + + let re = Regex::new(regex_str); + if re.is_err() || re.unwrap().is_match(string) == false { + continue; + } + + let text = line.get(2).unwrap_or(&empty); + if text.is_empty() { + continue; + } + + regextext.push_str(text); + regextext.push_str("\n"); } + return regextext; } @@ -197,8 +200,6 @@ fn check_creator(command: &str, creator: &str) -> std::string::String { #[cfg(test)] mod tests { use crate::detections::utils; - use std::fs::File; - use std::io::Read; #[test] fn test_check_regex() { let regextext = utils::check_regex("\\cvtres.exe", 0); @@ -221,12 +222,7 @@ mod tests { #[test] fn test_check_command() { - let mut f = File::open("whitelist.txt").expect("file not found"); - let mut contents = String::new(); - f.read_to_string(&mut contents); - - let mut rdr = csv::Reader::from_reader(contents.as_bytes()); - utils::check_command(1, "dir", 100, 100, "dir", "dir", &mut rdr); + utils::check_command(1, "dir", 100, 100, "dir", "dir"); //test return with whitelist. utils::check_command( @@ -236,7 +232,6 @@ mod tests { 100, "dir", "dir", - &mut rdr, ); } }