CSEC_PUBLIC/hayabusa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'feature/sysmon3' of https://github.com/YamatoSecurity/YamatoEventAnalyzer into feature/sysmon3

Browse Source
This commit is contained in:
kazuminn
2020-11-01 16:07:49 +09:00
parent 52a165ea19 ea56104c0f
commit 42309b14be
2 changed files with 35 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/detections/detection.rs
View File

@@ -51,7 +51,7 @@ impl Detection {
&application.detection(event_id, &event.system, event_data); &application.detection(event_id, &event.system, event_data);
} else if channel == "Microsoft-Windows-PowerShell/Operational" { } else if channel == "Microsoft-Windows-PowerShell/Operational" {
&powershell.detection(event_id, &event.system, event_data); &powershell.detection(event_id, &event.system, event_data);
} else if channel == "Microsoft-Windows-Sysmon/Operational" { } else if channel == "Microsoft-Windows-AppLocker/EXE and DLL" {
&sysmon.detection(event_id, &event.system, event_data); &sysmon.detection(event_id, &event.system, event_data);
} else if channel == "Microsoft-Windows-Applocker/Operational" { } else if channel == "Microsoft-Windows-Applocker/Operational" {
&applocker.detection(event_id, &event.system, event_data); &applocker.detection(event_id, &event.system, event_data);

91
src/detections/sysmon.rs
View File

@@ -1,82 +1,59 @@
use crate::detections::utils::check_command;
use crate::models::event; use crate::models::event;
use std::collections::HashMap; use std::collections::HashMap;
pub struct Sysmon { pub struct Sysmon {
checkunsigned: u64, checkunsigned: u16,
} }
impl Sysmon { impl Sysmon {
pub fn new() -> Sysmon { pub fn new() -> Sysmon {
Sysmon { Sysmon { checkunsigned: 0 }
//checkunsigned: 0, // DeepBlueでは0固定
checkunsigned: 1, // 開発用に1
}
} }
pub fn detection( pub fn detection(
&mut self, &mut self,
event_id: String, event_id: String,
system: &event::System, _system: &event::System,
event_data: HashMap<String, String>, event_data: HashMap<String, String>,
) { ) {
if event_id == "1" { self.check_command_lines(&event_id, &event_data);
&self.check_command_lines(event_data); self.check_for_unsigned_files(&event_id, &event_data);
} else if event_id == "7" {
&self.check_for_unsigned_files(event_data);
}
} }
fn check_command_lines(&mut self, event_data: HashMap<String, String>) { fn check_command_lines(&mut self, event_id: &String, event_data: &HashMap<String, String>) {
// Check command lines if event_id != "1" {
return;
}
if let Some(_command_line) = event_data.get("CommandLine") { if let Some(_command_line) = event_data.get("CommandLine") {
if let Some(_date) = event_data.get("UtcTime") { let default = "".to_string();
println!("Date : {} (UTC)", _date); let _creater = event_data.get("ParentImage").unwrap_or(&default);
}
println!("Log : Sysmon"); check_command(1, _command_line, 1000, 0, "", _creater);
//if let Some(_creater) = event_data.get("ParentImage") {
// println!("_creater : {}", _image);
//}
self.check_command("1".to_string(), _command_line.to_string());
println!("");
} }
} }
fn check_for_unsigned_files(&mut self, event_data: HashMap<String, String>) { fn check_for_unsigned_files(
// Check for unsigned EXEs/DLLs: &mut self,
// This can be very chatty, so it's disabled. event_id: &String,
// Set $checkunsigned to 1 (global variable section) to enable: event_data: &HashMap<String, String>,
) {
if event_id != "7" {
return;
}
if self.checkunsigned == 1 { if self.checkunsigned == 1 {
if let Some(_signed) = event_data.get("Signed") { let default = "".to_string();
if _signed == "false" { let _signed = event_data.get("Signed").unwrap_or(&default);
if let Some(_date) = event_data.get("UtcTime") { if _signed == "false" {
println!("Date : {} (UTC)", _date); let _image = event_data.get("Image").unwrap_or(&default);
} let _command_line = event_data.get("ImageLoaded").unwrap_or(&default);
println!("Log : Sysmon");
println!("EventID : 7"); println!("Message : Unsigned Image (DLL)");
println!("Message : Unsigned Image (DLL)"); println!("Result : Loaded by: {}", _image);
if let Some(_image) = event_data.get("Image") { println!("Command : {}", _command_line);
println!("Result : Loaded by: {}", _image);
}
if let Some(_command_line) = event_data.get("ImageLoaded") {
println!("Command : {}", _command_line);
}
println!("");
}
} }
} };
}
fn check_command(&mut self, _event_id: String, _command_line: String) {
let _result = "(TBD)";
let _decoded = "(TBD)";
// TBD
// Write-Output $obj
println!("EventID : {}", _event_id);
println!("Message : Suspicious Command Line");
println!("Result : {}", _result);
println!("Command : {}", _command_line);
println!("Decoded : {}", _decoded);
} }
} }