CSEC_PUBLIC/hayabusa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

refactor

Browse Source
This commit is contained in:
Kazuminn
2020-10-03 20:04:21 +09:00
parent 61049ce9a8
commit 6d57923ff2
1 changed files with 19 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
src/detections/utils.rs
View File

@@ -4,7 +4,6 @@ extern crate regex;
use flate2::read::GzDecoder; use flate2::read::GzDecoder;
use regex::Regex; use regex::Regex;
use std::env;
use std::fs::File; use std::fs::File;
use std::io::prelude::*; use std::io::prelude::*;
use std::str; use std::str;
@@ -42,25 +41,25 @@ pub fn check_command(
text.push_str(&check_obfu(commandline)); text.push_str(&check_obfu(commandline));
text.push_str(&check_regex(commandline, 0)); text.push_str(&check_regex(commandline, 0));
text.push_str(&check_creator(commandline, creator)); text.push_str(&check_creator(commandline, creator));
if (Regex::new(r"\-enc.*[A-Za-z0-9/+=]{100}") if Regex::new(r"\-enc.*[A-Za-z0-9/+=]{100}")
.unwrap() .unwrap()
.is_match(commandline)) .is_match(commandline)
{ {
let re = Regex::new(r"^.* \-Enc(odedCommand)? ").unwrap(); let re = Regex::new(r"^.* \-Enc(odedCommand)? ").unwrap();
base64.push_str(&re.replace_all(commandline, "")); base64.push_str(&re.replace_all(commandline, ""));
} else if (Regex::new(r":FromBase64String\(") } else if Regex::new(r":FromBase64String\(")
.unwrap() .unwrap()
.is_match(commandline)) .is_match(commandline)
{ {
let re = Regex::new(r"^^.*:FromBase64String\(\'*").unwrap(); let re = Regex::new(r"^^.*:FromBase64String\(\'*").unwrap();
base64.push_str(&re.replace_all(commandline, "")); base64.push_str(&re.replace_all(commandline, ""));
let re = Regex::new(r"\'.*$").unwrap(); let re = Regex::new(r"\'.*$").unwrap();
base64.push_str(&re.replace_all(&base64.to_string(), "")); base64.push_str(&re.replace_all(&base64.to_string(), ""));
} }
if (!base64.is_empty()) { if !base64.is_empty() {
if (Regex::new(r"Compression.GzipStream.*Decompress") if Regex::new(r"Compression.GzipStream.*Decompress")
.unwrap() .unwrap()
.is_match(commandline)) .is_match(commandline)
{ {
let decoded = base64::decode(base64).unwrap(); let decoded = base64::decode(base64).unwrap();
let mut d = GzDecoder::new(decoded.as_slice()); let mut d = GzDecoder::new(decoded.as_slice());
@@ -91,10 +90,10 @@ pub fn check_command(
fn check_obfu(string: &str) -> std::string::String { fn check_obfu(string: &str) -> std::string::String {
let mut obfutext = "".to_string(); let mut obfutext = "".to_string();
let mut lowercasestring = string.to_lowercase(); let lowercasestring = string.to_lowercase();
let mut length = lowercasestring.len(); let length = lowercasestring.len();
let mut minpercent = 0.65; let mut minpercent = 0.65;
let mut maxbinary = 0.50; let maxbinary = 0.50;
let mut re = Regex::new(r"[a-z0-9/¥;:|.]").unwrap(); let mut re = Regex::new(r"[a-z0-9/¥;:|.]").unwrap();
let mut noalphastring = ""; let mut noalphastring = "";
@@ -112,8 +111,8 @@ fn check_obfu(string: &str) -> std::string::String {
} }
} }
if (length > 0) { if length > 0 {
let mut percent = ((length - noalphastring.len()) / length); let mut percent = (length - noalphastring.len()) / length;
if ((length / 100) as f64) < minpercent { if ((length / 100) as f64) < minpercent {
minpercent = (length / 100) as f64; minpercent = (length / 100) as f64;
} }
@@ -130,8 +129,8 @@ fn check_obfu(string: &str) -> std::string::String {
obfutext.push_str("alphanumeric and common symbols\n"); obfutext.push_str("alphanumeric and common symbols\n");
} }
percent = ((nobinarystring.len().wrapping_sub(length) / length) / length); percent = (nobinarystring.len().wrapping_sub(length) / length) / length;
let mut binarypercent = 1_usize.wrapping_sub(percent); let binarypercent = 1_usize.wrapping_sub(percent);
if binarypercent > maxbinary as usize { if binarypercent > maxbinary as usize {
obfutext.push_str("Possible command obfuscation: "); obfutext.push_str("Possible command obfuscation: ");
@@ -179,13 +178,13 @@ fn check_regex(string: &str, r#type: usize) -> std::string::String {
fn check_creator(command: &str, creator: &str) -> std::string::String { fn check_creator(command: &str, creator: &str) -> std::string::String {
let mut creatortext = "".to_string(); let mut creatortext = "".to_string();
if (!creator.is_empty()) { if !creator.is_empty() {
if (command == "powershell") { if command == "powershell" {
if (creator == "PSEXESVC") { if creator == "PSEXESVC" {
creatortext.push_str("PowerShell launched via PsExec: "); creatortext.push_str("PowerShell launched via PsExec: ");
creatortext.push_str(creator); creatortext.push_str(creator);
creatortext.push_str("\n"); creatortext.push_str("\n");
} else if (creator == "WmiPrvSE") { } else if creator == "WmiPrvSE" {
creatortext.push_str("PowerShell launched via WMI: "); creatortext.push_str("PowerShell launched via WMI: ");
creatortext.push_str(creator); creatortext.push_str(creator);
creatortext.push_str("\n"); creatortext.push_str("\n");
@@ -214,7 +213,7 @@ mod tests {
#[test] #[test]
fn test_check_obfu() { fn test_check_obfu() {
let mut obfutext = utils::check_obfu("dir01"); let obfutext = utils::check_obfu("dir01");
assert!(obfutext == "Possible command obfuscation: zeroes and ones (possible numeric or binary encoding)\n"); assert!(obfutext == "Possible command obfuscation: zeroes and ones (possible numeric or binary encoding)\n");
} }