CSEC_PUBLIC/hayabusa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: solve thread

Browse Source
This commit is contained in:
itiB
2020-10-08 22:24:28 +09:00
parent c12090227e
commit 5f5251a4a4
3 changed files with 5 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/detections/powershell.rs
View File

@@ -41,14 +41,13 @@ impl PowerShell {
Regex::new("(?ms)^.*(ホスト アプリケーション|Host Application) = ").unwrap();
let rm_after = Regex::new("(?ms)\n.*$").unwrap();
let temp = rm_before.replace_all(commandline, "");
let command = rm_after.replace_all(&temp, "");
let temp_command_with_extra = rm_before.replace_all(commandline, "");
let command = rm_after.replace_all(&temp_command_with_extra, "");
if command != "" {
utils::check_command(4103, &command, 1000, 0, &default, &default, rdr);
}
}
return;
}
fn execute_remote_command(
@@ -61,11 +60,8 @@ impl PowerShell {
let message_num = event_data.get("MessageNumber");
let commandline = event_data.get("ScriptBlockText").unwrap_or(&default);
match message_num {
Some(_) => utils::check_command(4104, &commandline, 1000, 0, &default, &default, rdr),
_ => {}
if let Some(_) = message_num {
utils::check_command(4104, &commandline, 1000, 0, &default, &default, rdr);
}
return;
}
}