CSEC_PUBLIC/hayabusa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

create configs

Browse Source
This commit is contained in:
ichiichi11
2020-10-11 23:40:08 +09:00
parent 0663f8403d
commit 261676574a
5 changed files with 95 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
src/detections/configs.rs Normal file
View File

@@ -0,0 +1,50 @@
use std::fs::File;
use std::io::prelude::*;
use std::sync::Once;
#[derive(Clone)]
pub struct SingletonReader {
pub regex: Vec<Vec<String>>,
pub whitelist: Vec<Vec<String>>,
}
pub fn get_instance() -> Box<SingletonReader> {
static mut SINGLETON: Option<Box<SingletonReader>> = Option::None;
static ONCE: Once = Once::new();
unsafe {
ONCE.call_once(|| {
let singleton = SingletonReader {
regex: read_csv("regexes.txt"),
whitelist: read_csv("whitelist.txt"),
};
SINGLETON = Some(Box::new(singleton));
});
return SINGLETON.clone().unwrap();
}
}
fn read_csv(filename: &str) -> Vec<Vec<String>> {
let mut f = File::open(filename).expect("file not found!!!");
let mut contents: String = String::new();
let mut ret = vec![];
if f.read_to_string(&mut contents).is_err() {
return ret;
}
let mut rdr = csv::Reader::from_reader(contents.as_bytes());
rdr.records().for_each(|r| {
if r.is_err() {
return;
}
let line = r.unwrap();
let mut v = vec![];
line.iter().for_each(|s| v.push(s.to_string()));
ret.push(v);
});
return ret;
}

10
src/detections/detection.rs
View File

@@ -11,8 +11,6 @@ use crate::models::event;
use evtx::EvtxParser;
use quick_xml::de::DeError;
use std::collections::BTreeMap;
use std::fs::File;
use std::io::prelude::*;
#[derive(Debug)]
pub struct Detection {
@@ -34,12 +32,6 @@ impl Detection {
let mut sysmon = sysmon::Sysmon::new();
let mut powershell = powershell::PowerShell::new();
let mut f = File::open("whitelist.txt").expect("file not found");
let mut contents = String::new();
let _ = f.read_to_string(&mut contents);
let mut rdr = csv::Reader::from_reader(contents.as_bytes());
for record in parser.records() {
match record {
Ok(r) => {
@@ -57,7 +49,7 @@ impl Detection {
} else if channel == "Application" {
&application.detection(event_id, &event.system, event_data);
} else if channel == "Microsoft-Windows-PowerShell/Operational" {
&powershell.detection(event_id, &event.system, event_data, &mut rdr);
&powershell.detection(event_id, &event.system, event_data);
} else if channel == "Microsoft-Windows-Sysmon/Operational" {
&sysmon.detection(event_id, &event.system, event_data);
} else {

1
src/detections/mod.rs
View File

@@ -1,5 +1,6 @@
mod application;
mod common;
mod configs;
pub mod detection;
mod powershell;
mod security;

21
src/detections/powershell.rs
View File

@@ -16,20 +16,15 @@ impl PowerShell {
event_id: String,
_system: &event::System,
event_data: HashMap<String, String>,
rdr: &mut csv::Reader<&[u8]>,
) {
if event_id == "4103" {
&self.execute_pipeline(&event_data, rdr);
&self.execute_pipeline(&event_data);
} else if event_id == "4104" {
&self.execute_remote_command(&event_data, rdr);
&self.execute_remote_command(&event_data);
}
}
fn execute_pipeline(
&mut self,
event_data: &HashMap<String, String>,
rdr: &mut csv::Reader<&[u8]>,
) {
fn execute_pipeline(&mut self, event_data: &HashMap<String, String>) {
// パイプライン実行をしています
let default = String::from("");
let commandline = event_data.get("ContextInfo").unwrap_or(&default);
@@ -45,23 +40,19 @@ impl PowerShell {
let command = rm_after.replace_all(&temp_command_with_extra, "");
if command != "" {
utils::check_command(4103, &command, 1000, 0, &default, &default, rdr);
utils::check_command(4103, &command, 1000, 0, &default, &default);
}
}
}
fn execute_remote_command(
&mut self,
event_data: &HashMap<String, String>,
rdr: &mut csv::Reader<&[u8]>,
) {
fn execute_remote_command(&mut self, event_data: &HashMap<String, String>) {
// リモートコマンドを実行します
let default = String::from("");
let message_num = event_data.get("MessageNumber");
let commandline = event_data.get("ScriptBlockText").unwrap_or(&default);
if let Some(_) = message_num {
utils::check_command(4104, &commandline, 1000, 0, &default, &default, rdr);
utils::check_command(4104, &commandline, 1000, 0, &default, &default);
}
}
}

73
src/detections/utils.rs
View File

@@ -2,9 +2,9 @@ extern crate base64;
extern crate csv;
extern crate regex;
use crate::detections::configs;
use flate2::read::GzDecoder;
use regex::Regex;
use std::fs::File;
use std::io::prelude::*;
use std::str;
use std::string::String;
@@ -16,20 +16,23 @@ pub fn check_command(
servicecmd: usize,
servicename: &str,
creator: &str,
rdr: &mut csv::Reader<&[u8]>,
) {
let mut text = "".to_string();
let mut base64 = "".to_string();
for entry in rdr.records() {
if let Ok(_data) = entry {
if let Ok(_re) = Regex::new(&_data[0]) {
if _re.is_match(commandline) {
let empty = "".to_string();
for line in configs::get_instance().whitelist {
let r_str = line.get(0).unwrap_or(&empty);
if r_str.is_empty() {
continue;
}
let r = Regex::new(r_str);
if r.is_ok() && r.unwrap().is_match(commandline) {
return;
}
}
}
}
if commandline.len() > minlength {
text.push_str("Long Command Line: greater than ");
text.push_str(&minlength.to_string());
@@ -146,33 +149,33 @@ fn check_obfu(string: &str) -> std::string::String {
}
fn check_regex(string: &str, r#type: usize) -> std::string::String {
let mut f = File::open("regexes.txt").expect("file not found");
let mut contents = String::new();
let ret = f.read_to_string(&mut contents);
if let Err(_) = ret {
return "".to_string();
let empty = "".to_string();
let mut regextext = "".to_string();
for line in configs::get_instance().regex {
let type_str = line.get(0).unwrap_or(&empty);
if type_str != &r#type.to_string() {
continue;
}
let mut rdr = csv::Reader::from_reader(contents.as_bytes());
let regex_str = line.get(1).unwrap_or(&empty);
if regex_str.is_empty() {
continue;
}
let mut regextext = "".to_string();
for regex in rdr.records() {
if let Ok(_data) = regex {
/*
data[0] is type in csv.
data[1] is regex in csv.
data[2] is string in csv.
*/
if &_data[0] == r#type.to_string() {
if let Ok(_re) = Regex::new(&_data[1]) {
if _re.is_match(string) {
regextext.push_str(&_data[2]);
let re = Regex::new(regex_str);
if re.is_err() || re.unwrap().is_match(string) == false {
continue;
}
let text = line.get(2).unwrap_or(&empty);
if text.is_empty() {
continue;
}
regextext.push_str(text);
regextext.push_str("\n");
}
}
}
}
}
return regextext;
}
@@ -197,8 +200,6 @@ fn check_creator(command: &str, creator: &str) -> std::string::String {
#[cfg(test)]
mod tests {
use crate::detections::utils;
use std::fs::File;
use std::io::Read;
#[test]
fn test_check_regex() {
let regextext = utils::check_regex("\\cvtres.exe", 0);
@@ -221,12 +222,7 @@ mod tests {
#[test]
fn test_check_command() {
let mut f = File::open("whitelist.txt").expect("file not found");
let mut contents = String::new();
f.read_to_string(&mut contents);
let mut rdr = csv::Reader::from_reader(contents.as_bytes());
utils::check_command(1, "dir", 100, 100, "dir", "dir", &mut rdr);
utils::check_command(1, "dir", 100, 100, "dir", "dir");
//test return with whitelist.
utils::check_command(
@@ -236,7 +232,6 @@ mod tests {
100,
"dir",
"dir",
&mut rdr,
);
}
}