CSEC_PUBLIC/hayabusa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

matchを使わない形に修正

Browse Source
This commit is contained in:
akiranishikawa
2020-09-29 20:07:45 +09:00
parent a542406ee5
commit 9c8ca18b5f
4 changed files with 51 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/detections/detection.rs
View File

@@ -8,7 +8,6 @@ use crate::models::event;
use evtx::EvtxParser;
use quick_xml::de::DeError;
use std::collections::BTreeMap;
use std::collections::HashMap;
#[derive(Debug)]
pub struct Detection {

81
src/detections/security.rs
View File

@@ -42,56 +42,51 @@ impl Security {
// Special privileges assigned to new logon (possible admin access)
//
fn se_debug_privilege(&mut self, event_data: HashMap<String, String>) {
match event_data.get("PrivilegeList") {
Some(privileage_list) => {
match privileage_list.find("SeDebugPrivilege") {
Some(_data) => {
// alert_all_adminが有効であれば、標準出力して知らせる
// DeepBlueCLIでは必ず0になっていて、基本的には表示されない。
if self.alert_all_admin == 1 {
println!("Logon with SeDebugPrivilege (admin access)");
println!("Username:{}", event_data["SubjectUserName"]);
println!("Domain:{}", event_data["SubjectDomainName"]);
println!("User SID:{}", event_data["SubjectUserSid"]);
println!("Domain:{}", event_data["PrivilegeList"]);
}
self.total_admin_logons += 1;
if let Some(privileage_list) = event_data.get("PrivilegeList") {
if let Some(_data) = privileage_list.find("SeDebugPrivilege") {
// alert_all_adminが有効であれば、標準出力して知らせる
// DeepBlueCLIでは必ず0になっていて、基本的には表示されない。
if self.alert_all_admin == 1 {
println!("Logon with SeDebugPrivilege (admin access)");
println!("Username:{}", event_data["SubjectUserName"]);
println!("Domain:{}", event_data["SubjectDomainName"]);
println!("User SID:{}", event_data["SubjectUserSid"]);
println!("Domain:{}", event_data["PrivilegeList"]);
}
// admin_logons配列にusernameが含まれているか確認
match self.admin_logons.get(&event_data["SubjectUserName"]) {
Some(sid) => {
// 含まれていれば、マルチユーザが管理者としてログインしているか確認
// マルチログオンのデータをセット
if event_data["SubjectUserName"] != event_data["SubjectUserSid"] {
// One username with multiple admin logon SIDs
self.multiple_admin_logons
.insert(event_data["SubjectUserName"].to_string(), 1);
self.total_admin_logons += 1;
let mut count_hash: HashMap<String, i32> = HashMap::new();
count_hash.insert(
event_data["SubjectUserSid"].to_string(),
sid[&event_data["SubjectUserSid"]] + 1,
);
self.admin_logons.insert(
event_data["SubjectUserName"].to_string(),
count_hash,
);
}
}
None => {
// admin_logons配列にセットUserNameとSIDとカウンタをセット
let mut count_hash: HashMap<String, i32> = HashMap::new();
count_hash.insert(event_data["SubjectUserSid"].to_string(), 1);
self.admin_logons
.insert(event_data["SubjectUserName"].to_string(), count_hash);
}
// admin_logons配列にusernameが含まれているか確認
match self.admin_logons.get(&event_data["SubjectUserName"]) {
Some(sid) => {
// 含まれていれば、マルチユーザが管理者としてログインしているか確認
// マルチログオンのデータをセット
if event_data["SubjectUserName"] != event_data["SubjectUserSid"] {
// One username with multiple admin logon SIDs
self.multiple_admin_logons
.insert(event_data["SubjectUserName"].to_string(), 1);
let mut count_hash: HashMap<String, i32> = HashMap::new();
count_hash.insert(
event_data["SubjectUserSid"].to_string(),
sid[&event_data["SubjectUserSid"]] + 1,
);
self.admin_logons.insert(
event_data["SubjectUserName"].to_string(),
count_hash,
);
}
}
None => (),
None => {
// admin_logons配列にセットUserNameとSIDとカウンタをセット
let mut count_hash: HashMap<String, i32> = HashMap::new();
count_hash.insert(event_data["SubjectUserSid"].to_string(), 1);
self.admin_logons
.insert(event_data["SubjectUserName"].to_string(), count_hash);
}
}
}
None => (),
}
}
}

7
src/main.rs
View File

@@ -4,7 +4,7 @@ extern crate serde;
use clap::{App, AppSettings, Arg};
use evtx::EvtxParser;
use quick_xml::de::DeError;
use std::{env, path::PathBuf, process};
use std::{path::PathBuf, process};
use yamato_event_analyzer::detections::detection;
fn build_app() -> clap::App<'static, 'static> {
@@ -38,9 +38,8 @@ fn main() -> Result<(), DeError> {
let args = build_app().get_matches();
let filepath: Option<&str> = args.value_of("filepath");
match filepath {
Some(filepath) => parse_file(filepath),
None => (),
if let Some(filepath) = filepath {
parse_file(filepath);
}
Ok(())

28
src/models/event.rs
View File

@@ -85,12 +85,11 @@ impl Evtx {
// 文字列データを取得する
//
fn get_string(v: &Data) -> String {
match &v.text {
Some(text) => {
return text.to_string();
}
_ => return "".to_string(),
let mut ret = "".to_string();
if let Some(text) = &v.text {
ret = text.to_string();
}
return ret;
}
//
@@ -99,21 +98,14 @@ impl Evtx {
pub fn parse_event_data(&self) -> HashMap<String, String> {
let mut values = HashMap::new();
match &self.event_data {
Some(event_data) => match &event_data.data {
Some(data) => {
for v in data.iter() {
match &v.name {
Some(name) => {
values.insert(name.to_string(), Evtx::get_string(v));
}
None => (),
}
if let Some(event_data) = &self.event_data {
if let Some(data) = &event_data.data {
for v in data.iter() {
if let Some(name) = &v.name {
values.insert(name.to_string(), Evtx::get_string(v));
}
}
None => (),
},
None => (),
}
}
values