diff --git a/src/detections/detection.rs b/src/detections/detection.rs index fbb6e111..aec7c3e8 100644 --- a/src/detections/detection.rs +++ b/src/detections/detection.rs @@ -2,6 +2,7 @@ extern crate csv; extern crate quick_xml; use crate::detections::application; +use crate::detections::applocker; use crate::detections::common; use crate::detections::powershell; use crate::detections::security; @@ -29,6 +30,7 @@ impl Detection { let mut security = security::Security::new(); let mut system = system::System::new(); let mut application = application::Application::new(); + let mut applocker = applocker::AppLocker::new(); let mut sysmon = sysmon::Sysmon::new(); let mut powershell = powershell::PowerShell::new(); @@ -41,7 +43,6 @@ impl Detection { let event_data = event.parse_event_data(); &common.detection(&event.system, &event_data); - //&common.detection(&event.system, &event_data); if channel == "Security" { &security.detection(event_id, &event.system, &event.user_data, event_data); } else if channel == "System" { @@ -52,6 +53,8 @@ impl Detection { &powershell.detection(event_id, &event.system, event_data); } else if channel == "Microsoft-Windows-Sysmon/Operational" { &sysmon.detection(event_id, &event.system, event_data); + } else if channel == "Microsoft-Windows-Applocker/Operational" { + &applocker.detection(event_id, &event.system, event_data); } else { //&other.detection(); }