create configs

src/detections/configs.rs

@@ -0,0 +1,50 @@
+use std::fs::File;
+use std::io::prelude::*;
+use std::sync::Once;
+
+#[derive(Clone)]
+pub struct SingletonReader {
+    pub regex: Vec<Vec<String>>,
+    pub whitelist: Vec<Vec<String>>,
+}
+
+pub fn get_instance() -> Box<SingletonReader> {
+    static mut SINGLETON: Option<Box<SingletonReader>> = Option::None;
+    static ONCE: Once = Once::new();
+
+    unsafe {
+        ONCE.call_once(|| {
+            let singleton = SingletonReader {
+                regex: read_csv("regexes.txt"),
+                whitelist: read_csv("whitelist.txt"),
+            };
+
+            SINGLETON = Some(Box::new(singleton));
+        });
+
+        return SINGLETON.clone().unwrap();
+    }
+}
+
+fn read_csv(filename: &str) -> Vec<Vec<String>> {
+    let mut f = File::open(filename).expect("file not found!!!");
+    let mut contents: String = String::new();
+    let mut ret = vec![];
+    if f.read_to_string(&mut contents).is_err() {
+        return ret;
+    }
+
+    let mut rdr = csv::Reader::from_reader(contents.as_bytes());
+    rdr.records().for_each(|r| {
+        if r.is_err() {
+            return;
+        }
+
+        let line = r.unwrap();
+        let mut v = vec![];
+        line.iter().for_each(|s| v.push(s.to_string()));
+        ret.push(v);
+    });
+
+    return ret;
+}

src/detections/detection.rs

@@ -11,8 +11,6 @@ use crate::models::event;
 use evtx::EvtxParser;
 use quick_xml::de::DeError;
 use std::collections::BTreeMap;
-use std::fs::File;
-use std::io::prelude::*;
 
 #[derive(Debug)]
 pub struct Detection {
@@ -34,12 +32,6 @@ impl Detection {
         let mut sysmon = sysmon::Sysmon::new();
         let mut powershell = powershell::PowerShell::new();
 
-        let mut f = File::open("whitelist.txt").expect("file not found");
-        let mut contents = String::new();
-        let _ = f.read_to_string(&mut contents);
-
-        let mut rdr = csv::Reader::from_reader(contents.as_bytes());
-
         for record in parser.records() {
             match record {
                 Ok(r) => {
@@ -57,7 +49,7 @@ impl Detection {
                     } else if channel == "Application" {
                         &application.detection(event_id, &event.system, event_data);
                     } else if channel == "Microsoft-Windows-PowerShell/Operational" {
-                        &powershell.detection(event_id, &event.system, event_data, &mut rdr);
+                        &powershell.detection(event_id, &event.system, event_data);
                     } else if channel == "Microsoft-Windows-Sysmon/Operational" {
                         &sysmon.detection(event_id, &event.system, event_data);
                     } else {

src/detections/mod.rs

@@ -1,5 +1,6 @@
 mod application;
 mod common;
+mod configs;
 pub mod detection;
 mod powershell;
 mod security;

src/detections/powershell.rs

@@ -16,20 +16,15 @@ impl PowerShell {
         event_id: String,
         _system: &event::System,
         event_data: HashMap<String, String>,
-        rdr: &mut csv::Reader<&[u8]>,
     ) {
         if event_id == "4103" {
-            &self.execute_pipeline(&event_data, rdr);
+            &self.execute_pipeline(&event_data);
         } else if event_id == "4104" {
-            &self.execute_remote_command(&event_data, rdr);
+            &self.execute_remote_command(&event_data);
         }
     }
 
-    fn execute_pipeline(
+    fn execute_pipeline(&mut self, event_data: &HashMap<String, String>) {
-        &mut self,
-        event_data: &HashMap<String, String>,
-        rdr: &mut csv::Reader<&[u8]>,
-    ) {
         // パイプライン実行をしています
         let default = String::from("");
         let commandline = event_data.get("ContextInfo").unwrap_or(&default);
@@ -45,23 +40,19 @@ impl PowerShell {
             let command = rm_after.replace_all(&temp_command_with_extra, "");
 
             if command != "" {
-                utils::check_command(4103, &command, 1000, 0, &default, &default, rdr);
+                utils::check_command(4103, &command, 1000, 0, &default, &default);
             }
         }
     }
 
-    fn execute_remote_command(
+    fn execute_remote_command(&mut self, event_data: &HashMap<String, String>) {
-        &mut self,
-        event_data: &HashMap<String, String>,
-        rdr: &mut csv::Reader<&[u8]>,
-    ) {
         // リモートコマンドを実行します
         let default = String::from("");
         let message_num = event_data.get("MessageNumber");
         let commandline = event_data.get("ScriptBlockText").unwrap_or(&default);
 
         if let Some(_) = message_num {
-            utils::check_command(4104, &commandline, 1000, 0, &default, &default, rdr);
+            utils::check_command(4104, &commandline, 1000, 0, &default, &default);
         }
     }
 }

src/detections/utils.rs

@@ -2,9 +2,9 @@ extern crate base64;
 extern crate csv;
 extern crate regex;
 
+use crate::detections::configs;
 use flate2::read::GzDecoder;
 use regex::Regex;
-use std::fs::File;
 use std::io::prelude::*;
 use std::str;
 use std::string::String;
@@ -16,20 +16,23 @@ pub fn check_command(
     servicecmd: usize,
     servicename: &str,
     creator: &str,
-    rdr: &mut csv::Reader<&[u8]>,
 ) {
     let mut text = "".to_string();
     let mut base64 = "".to_string();
 
-    for entry in rdr.records() {
+    let empty = "".to_string();
-        if let Ok(_data) = entry {
+    for line in configs::get_instance().whitelist {
-            if let Ok(_re) = Regex::new(&_data[0]) {
+        let r_str = line.get(0).unwrap_or(&empty);
-                if _re.is_match(commandline) {
+        if r_str.is_empty() {
+            continue;
+        }
+
+        let r = Regex::new(r_str);
+        if r.is_ok() && r.unwrap().is_match(commandline) {
             return;
         }
     }
-        }
+
-    }
     if commandline.len() > minlength {
         text.push_str("Long Command Line: greater than ");
         text.push_str(&minlength.to_string());
@@ -146,33 +149,33 @@ fn check_obfu(string: &str) -> std::string::String {
 }
 
 fn check_regex(string: &str, r#type: usize) -> std::string::String {
-    let mut f = File::open("regexes.txt").expect("file not found");
+    let empty = "".to_string();
-    let mut contents = String::new();
+    let mut regextext = "".to_string();
-    let ret = f.read_to_string(&mut contents);
+    for line in configs::get_instance().regex {
-    if let Err(_) = ret {
+        let type_str = line.get(0).unwrap_or(&empty);
-        return "".to_string();
+        if type_str != &r#type.to_string() {
+            continue;
         }
 
-    let mut rdr = csv::Reader::from_reader(contents.as_bytes());
+        let regex_str = line.get(1).unwrap_or(&empty);
+        if regex_str.is_empty() {
+            continue;
+        }
 
-    let mut regextext = "".to_string();
+        let re = Regex::new(regex_str);
-    for regex in rdr.records() {
+        if re.is_err() || re.unwrap().is_match(string) == false {
-        if let Ok(_data) = regex {
+            continue;
-            /*
+        }
-            data[0] is type in csv.
+
-            data[1] is regex in csv.
+        let text = line.get(2).unwrap_or(&empty);
-            data[2] is string in csv.
+        if text.is_empty() {
-            */
+            continue;
-            if &_data[0] == r#type.to_string() {
+        }
-                if let Ok(_re) = Regex::new(&_data[1]) {
+
-                    if _re.is_match(string) {
+        regextext.push_str(text);
-                        regextext.push_str(&_data[2]);
         regextext.push_str("\n");
     }
-                }
+
-            }
-        }
-    }
     return regextext;
 }
 
@@ -197,8 +200,6 @@ fn check_creator(command: &str, creator: &str) -> std::string::String {
 #[cfg(test)]
 mod tests {
     use crate::detections::utils;
-    use std::fs::File;
-    use std::io::Read;
     #[test]
     fn test_check_regex() {
         let regextext = utils::check_regex("\\cvtres.exe", 0);
@@ -221,12 +222,7 @@ mod tests {
 
     #[test]
     fn test_check_command() {
-        let mut f = File::open("whitelist.txt").expect("file not found");
+        utils::check_command(1, "dir", 100, 100, "dir", "dir");
-        let mut contents = String::new();
-        f.read_to_string(&mut contents);
-
-        let mut rdr = csv::Reader::from_reader(contents.as_bytes());
-        utils::check_command(1, "dir", 100, 100, "dir", "dir", &mut rdr);
 
         //test return with whitelist.
         utils::check_command(
@@ -236,7 +232,6 @@ mod tests {
             100,
             "dir",
             "dir",
-            &mut rdr,
         );
     }
 }