Merge branch 'develop' into feature/level-tuning#390

src/main.rs

@@ -9,9 +9,12 @@ use chrono::{DateTime, Datelike, Local, TimeZone};
 use evtx::{EvtxParser, ParserSettings};
 use git2::Repository;
 use hashbrown::{HashMap, HashSet};
+use hayabusa::detections::configs::load_pivot_keywords;
 use hayabusa::detections::detection::{self, EvtxRecordInfo};
+use hayabusa::detections::pivot::PIVOT_KEYWORD;
 use hayabusa::detections::print::{
-    AlertMessage, ERROR_LOG_PATH, ERROR_LOG_STACK, QUIET_ERRORS_FLAG, STATISTICS_FLAG,
+    AlertMessage, ERROR_LOG_PATH, ERROR_LOG_STACK, PIVOT_KEYWORD_LIST_FLAG, QUIET_ERRORS_FLAG,
+    STATISTICS_FLAG,
 };
 use hayabusa::detections::rule::{get_detection_keys, RuleNode};
 use hayabusa::filter;
@@ -24,14 +27,15 @@ use hhmmss::Hhmmss;
 use pbr::ProgressBar;
 use serde_json::Value;
 use std::cmp::Ordering;
-use std::ffi::OsStr;
+use std::ffi::{OsStr, OsString};
 use std::fmt::Display;
 use std::fs::create_dir;
-use std::io::BufWriter;
+use std::io::{BufWriter, Write};
 use std::path::Path;
 use std::sync::Arc;
 use std::time::SystemTime;
 use std::{
+    env,
     fs::{self, File},
     path::PathBuf,
     vec,
@@ -41,7 +45,7 @@ use tokio::spawn;
 use tokio::task::JoinHandle;
 
 #[cfg(target_os = "windows")]
-use {is_elevated::is_elevated, std::env};
+use is_elevated::is_elevated;
 
 // 一度にtimelineやdetectionを実行する行数
 const MAX_DETECT_RECORDS: usize = 5000;
@@ -72,6 +76,10 @@ impl App {
     }
 
     fn exec(&mut self) {
+        if *PIVOT_KEYWORD_LIST_FLAG {
+            load_pivot_keywords("config/pivot_keywords.txt");
+        }
+
         let analysis_start_time: DateTime<Local> = Local::now();
 
         // Show usage when no arguments.
@@ -90,6 +98,17 @@ impl App {
                 &analysis_start_time.day().to_owned()
             ));
         }
+
+        if !self.is_matched_architecture_and_binary() {
+            AlertMessage::alert(
+                &mut BufWriter::new(std::io::stderr().lock()),
+                "The hayabusa version you ran does not match your PC architecture.\n Please use the correct architecture. (Binary ending in -x64.exe for 64-bit and -x86.exe for 32-bit.)",
+            )
+            .ok();
+            println!();
+            return;
+        }
+
         if configs::CONFIG
             .read()
             .unwrap()
@@ -124,6 +143,20 @@ impl App {
         }
 
         if let Some(csv_path) = configs::CONFIG.read().unwrap().args.value_of("output") {
+            for (key, _) in PIVOT_KEYWORD.read().unwrap().iter() {
+                let keywords_file_name = csv_path.to_owned() + "-" + key + ".txt";
+                if Path::new(&keywords_file_name).exists() {
+                    AlertMessage::alert(
+                        &mut BufWriter::new(std::io::stderr().lock()),
+                        &format!(
+                            " The file {} already exists. Please specify a different filename.",
+                            &keywords_file_name
+                        ),
+                    )
+                    .ok();
+                    return;
+                }
+            }
             if Path::new(csv_path).exists() {
                 AlertMessage::alert(
                     &mut BufWriter::new(std::io::stderr().lock()),
@@ -136,6 +169,7 @@ impl App {
                 return;
             }
         }
+
         if *STATISTICS_FLAG {
             println!("Generating Event ID Statistics");
             println!();
@@ -234,6 +268,60 @@ impl App {
         if ERROR_LOG_STACK.lock().unwrap().len() > 0 {
             AlertMessage::create_error_log(ERROR_LOG_PATH.to_string());
         }
+
+        if *PIVOT_KEYWORD_LIST_FLAG {
+            //ファイル出力の場合
+            if let Some(pivot_file) = configs::CONFIG.read().unwrap().args.value_of("output") {
+                for (key, pivot_keyword) in PIVOT_KEYWORD.read().unwrap().iter() {
+                    let mut f = BufWriter::new(
+                        fs::File::create(pivot_file.to_owned() + "-" + key + ".txt").unwrap(),
+                    );
+                    let mut output = "".to_string();
+                    output += &format!("{}: ", key).to_string();
+
+                    output += "( ";
+                    for i in pivot_keyword.fields.iter() {
+                        output += &format!("%{}% ", i).to_string();
+                    }
+                    output += "):";
+                    output += "\n";
+
+                    for i in pivot_keyword.keywords.iter() {
+                        output += &format!("{}\n", i).to_string();
+                    }
+
+                    f.write_all(output.as_bytes()).unwrap();
+                }
+
+                //output to stdout
+                let mut output =
+                    "Pivot keyword results saved to the following files:\n".to_string();
+                for (key, _) in PIVOT_KEYWORD.read().unwrap().iter() {
+                    output += &(pivot_file.to_owned() + "-" + key + ".txt" + "\n");
+                }
+                println!("{}", output);
+            } else {
+                //標準出力の場合
+                let mut output = "The following pivot keywords were found:\n".to_string();
+                for (key, pivot_keyword) in PIVOT_KEYWORD.read().unwrap().iter() {
+                    output += &format!("{}: ", key).to_string();
+
+                    output += "( ";
+                    for i in pivot_keyword.fields.iter() {
+                        output += &format!("%{}% ", i).to_string();
+                    }
+                    output += "):";
+                    output += "\n";
+
+                    for i in pivot_keyword.keywords.iter() {
+                        output += &format!("{}\n", i).to_string();
+                    }
+
+                    output += "\n";
+                }
+                print!("{}", output);
+            }
+        }
     }
 
     #[cfg(not(target_os = "windows"))]
@@ -368,7 +456,7 @@ impl App {
             pb.inc();
         }
         detection.add_aggcondition_msges(&self.rt);
-        if !*STATISTICS_FLAG {
+        if !*STATISTICS_FLAG && !*PIVOT_KEYWORD_LIST_FLAG {
             after_fact();
         }
     }
@@ -750,6 +838,22 @@ impl App {
             Ok("You currently have the latest rules.".to_string())
         }
     }
+
+    /// check architecture
+    fn is_matched_architecture_and_binary(&self) -> bool {
+        if cfg!(target_os = "windows") {
+            let is_processor_arch_32bit = env::var_os("PROCESSOR_ARCHITECTURE")
+                .unwrap_or_default()
+                .eq("x86");
+            // PROCESSOR_ARCHITEW6432は32bit環境には存在しないため、環境変数存在しなかった場合は32bit環境であると判断する
+            let not_wow_flag = env::var_os("PROCESSOR_ARCHITEW6432")
+                .unwrap_or_else(|| OsString::from("x86"))
+                .eq("x86");
+            return (cfg!(target_pointer_width = "64") && !is_processor_arch_32bit)
+                || (cfg!(target_pointer_width = "32") && is_processor_arch_32bit && not_wow_flag);
+        }
+        true
+    }
 }
 
 #[cfg(test)]