From 551963abf0c62848c940e35d060ae0beb5e7fd1e Mon Sep 17 00:00:00 2001
From: siamease <tomoomi@gmail.com>
Date: Sun, 25 Oct 2020 03:11:54 +0900
Subject: [PATCH] fix

---
 src/detections/sysmon.rs | 53 +++++++++++++++++++---------------------
 1 file changed, 25 insertions(+), 28 deletions(-)

diff --git a/src/detections/sysmon.rs b/src/detections/sysmon.rs
index 7c450161..31d0ea7a 100644
--- a/src/detections/sysmon.rs
+++ b/src/detections/sysmon.rs
@@ -1,8 +1,6 @@
 use crate::detections::utils::check_command;
 use crate::models::event;
 use std::collections::HashMap;
-use std::fs::File;
-use std::io::prelude::*;
 
 pub struct Sysmon {
     empty_str: String,
@@ -40,17 +38,8 @@ impl Sysmon {
             }
             println!("Log     : Sysmon");
             let minlength = 1000;
-            //let mut f = File::open("whitelist.txt").expect("file not found");
-            //let mut contents = String::new();
-            //f.read_to_string(&mut contents);
-            //let rdr = csv::Reader::from_reader(contents.as_bytes());
-            if let Some(_creater) = event_data.get("ParentImage") {
-                //check_command(1, _command_line, minlength, 0, "", _creater, rdr);
-                check_command(1, _command_line, minlength, 0, "", _creater);
-            } else {
-                //check_command(1, _command_line, minlength, 0, "", "", rdr);
-                check_command(1, _command_line, minlength, 0, "", "");
-            }
+            let _creater = event_data.get("ParentImage").unwrap_or(&self.empty_str);
+            check_command(1, _command_line, minlength, 0, "", _creater);
         }
     }
 
@@ -67,22 +56,30 @@ impl Sysmon {
         // This can be very chatty, so it's disabled.
         // Set $checkunsigned to 1 (global variable section) to enable:
         if self.checkunsigned == 1 {
-            if let Some(_signed) = event_data.get("Signed") {
-                if _signed == "false" {
-                    if let Some(_date) = event_data.get("UtcTime") {
-                        println!("Date    : {} (UTC)", _date);
-                    }
-                    println!("Log     : Sysmon");
-                    println!("EventID : 7");
-                    println!("Message : Unsigned Image (DLL)");
-                    if let Some(_image) = event_data.get("Image") {
-                        println!("Result  : Loaded by: {}", _image);
-                    }
-                    if let Some(_command_line) = event_data.get("ImageLoaded") {
-                        println!("Command : {}", _command_line);
-                    }
-                }
+            let _signed = event_data.get("Signed").unwrap_or(&self.empty_str);
+            if _signed == "false" {
+                let _date = event_data.get("UtcTime").unwrap_or(&self.empty_str);
+                println!("Date    : {} (UTC)", _date);
+                println!("Log     : Sysmon");
+                println!("EventID : 7");
+                println!("Message : Unsigned Image (DLL)");
+                let _image = event_data.get("Image").unwrap_or(&self.empty_str);
+                println!("Result  : Loaded by: {}", _image);
+                let _command_line = event_data.get("ImageLoaded").unwrap_or(&self.empty_str);
+                println!("Command : {}", _command_line);
             }
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    extern crate quick_xml;
+    use crate::detections::sysmon;
+    use crate::models::event;
+
+    #[test]
+    fn test_skelton_hit() {
+        assert_eq!(1, 1);
+    }
+}