CSEC_PUBLIC/hayabusa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #1 from YamatoSecurity/future/application_EMET

Browse Source 
add DeepBlueCLI application's EMET rule
This commit is contained in:
nishikawaakira
2020-09-28 17:30:14 +09:00
committed by GitHub
parent a5b1268878 2f03e502d1
commit a542406ee5
11 changed files with 137 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
Cargo.lock generated
View File

@@ -1110,6 +1110,7 @@ dependencies = [
"clap",
"evtx",
"quick-xml 0.17.2",
"regex",
"serde",
"serde_json",
]

1
Cargo.toml
View File

@@ -12,3 +12,4 @@ quick-xml = {version = "0.17", features = ["serialize"] }
serde = { version = "1.0", features = ["derive"] }
serde_json = { version = "1.0"}
clap = "*"
regex = "1"

52
src/detections/application.rs
View File

@@ -1,15 +1,55 @@
extern crate regex;
pub struct Application {
}
use crate::models::event;
use regex::Regex;
use std::collections::HashMap;
pub struct Application {}
impl Application {
pub fn new() -> Application {
Application{}
Application {}
}
pub fn detection(&self) {
pub fn detection(
&mut self,
event_id: String,
system: &event::System,
event_data: HashMap<String, String>,
) {
if event_id == "2" {
&self.emet(system, event_data);
}
}
fn emet(&mut self, system: &event::System, event_data: HashMap<String, String>) {
match &system.provider.name {
Some(name) => {
if (name != "EMET") {
return;
}
}
None => return,
}
match &system.message {
Some(message) => {
let message_split: Vec<&str> = message.split("\n").collect();
if !message_split.is_empty() && message_split.len() >= 5 {
let text = message_split[0];
let application = message_split[3];
let re = Regex::new(r"^Application: ").unwrap();
let command = re.replace_all(application, "");
let username = message_split[4];
println!("Message EMET Block");
println!("Command : {}", command);
println!("Results : {}", text);
println!("Results : {}", username);
}
}
None => {
println!("Warning: EMET Message field is blank. Install EMET locally to see full details of this alert");
}
}
}
}

18
src/detections/common.rs
View File

@@ -1,15 +1,14 @@
use std::collections::HashMap;
use crate::models::event;
use std::collections::HashMap;
#[derive(Debug)]
pub struct Common {
record_id: u64,
date: String,
record_id_list : HashMap<String, String>,
record_id_list: HashMap<String, String>,
}
impl Common {
pub fn new() -> Common {
Common {
record_id: 0,
@@ -19,30 +18,27 @@ impl Common {
}
pub fn disp(&self) {
for (record_id, date) in self.record_id_list.iter() {
for (record_id, date) in self.record_id_list.iter() {
println!("date:{:?} record-id: {:?}", date, record_id);
}
}
pub fn detection(&mut self, system: &event::System, event_data: &HashMap<String, String>) {
&self.check_record_id(system);
}
//
// Record IDがシーケンスになっているかチェック
//
fn check_record_id(&mut self, system: &event::System) {
let event_record_id: u64 = system.event_record_id.parse().unwrap();
if self.record_id > 0 && event_record_id - self.record_id > 1 {
self.record_id_list.insert(self.record_id.to_string() + " - " + &system.event_record_id.to_string(),
self.date.to_string() + " - " + &system.time_created.system_time.to_string());
self.record_id_list.insert(
self.record_id.to_string() + " - " + &system.event_record_id.to_string(),
self.date.to_string() + " - " + &system.time_created.system_time.to_string(),
);
}
self.record_id = event_record_id;
self.date = system.time_created.system_time.to_string();
}
}

32
src/detections/detection.rs
View File

@@ -1,22 +1,21 @@
extern crate quick_xml;
use std::collections::BTreeMap;
use std::collections::HashMap;
use crate::models::event;
use evtx::EvtxParser;
use crate::detections::application;
use crate::detections::common;
use crate::detections::security;
use crate::detections::system;
use crate::detections::application;
use quick_xml::de::{DeError};
use crate::models::event;
use evtx::EvtxParser;
use quick_xml::de::DeError;
use std::collections::BTreeMap;
use std::collections::HashMap;
#[derive(Debug)]
pub struct Detection {
timeline_list : BTreeMap<String, String>,
timeline_list: BTreeMap<String, String>,
}
impl Detection {
pub fn new() -> Detection {
Detection {
timeline_list: BTreeMap::new(),
@@ -24,12 +23,11 @@ impl Detection {
}
pub fn start(&mut self, mut parser: EvtxParser<std::fs::File>) -> Result<(), DeError> {
let mut common: common::Common = common::Common::new();
let mut security = security::Security::new();
let mut system = system::System::new();
let mut application = application::Application::new();
for record in parser.records() {
match record {
Ok(r) => {
@@ -37,19 +35,19 @@ impl Detection {
let event_id = event.system.event_id.to_string();
let channel = event.system.channel.to_string();
let event_data = event.parse_event_data();
&common.detection(&event.system, &event_data);
//&common.detection(&event.system, &event_data);
//&common.detection(&event.system, &event_data);
if channel == "Security" {
&security.detection(event_id, &event.system, event_data);
} else if channel == "System" {
&system.detection();
} else if channel == "Application" {
&application.detection();
&application.detection(event_id, &event.system, event_data);
} else {
//&other.detection();
}
},
}
Err(e) => eprintln!("{}", e),
}
}
@@ -59,9 +57,7 @@ impl Detection {
////////////////////////////
common.disp();
security.disp();
return Ok(())
return Ok(());
}
}

4
src/detections/mod.rs
View File

@@ -1,5 +1,5 @@
mod application;
mod common;
pub mod detection;
mod security;
mod system;
mod application;
pub mod detection;

50
src/detections/security.rs
View File

@@ -1,5 +1,5 @@
use std::collections::HashMap;
use crate::models::event;
use std::collections::HashMap;
#[derive(Debug)]
pub struct Security {
@@ -11,7 +11,7 @@ pub struct Security {
impl Security {
pub fn new() -> Security {
Security{
Security {
alert_all_admin: 0,
total_admin_logons: 0,
admin_logons: HashMap::new(),
@@ -27,8 +27,12 @@ impl Security {
}
}
pub fn detection(&mut self, event_id: String, system: &event::System, event_data: HashMap<String, String>) {
pub fn detection(
&mut self,
event_id: String,
system: &event::System,
event_data: HashMap<String, String>,
) {
if event_id == "4672" {
&self.se_debug_privilege(event_data);
}
@@ -38,12 +42,10 @@ impl Security {
// Special privileges assigned to new logon (possible admin access)
//
fn se_debug_privilege(&mut self, event_data: HashMap<String, String>) {
match event_data.get("PrivilegeList") {
Some(privileage_list) => {
match privileage_list.find("SeDebugPrivilege") {
Some(_data) => {
// alert_all_adminが有効であれば、標準出力して知らせる
// DeepBlueCLIでは必ず0になっていて、基本的には表示されない。
if self.alert_all_admin == 1 {
@@ -53,39 +55,43 @@ impl Security {
println!("User SID:{}", event_data["SubjectUserSid"]);
println!("Domain:{}", event_data["PrivilegeList"]);
}
self.total_admin_logons += 1;
// admin_logons配列にusernameが含まれているか確認
match self.admin_logons.get(&event_data["SubjectUserName"]) {
Some(sid) => {
// 含まれていれば、マルチユーザが管理者としてログインしているか確認
// マルチログオンのデータをセット
if event_data["SubjectUserName"] != event_data["SubjectUserSid"] { // One username with multiple admin logon SIDs
self.multiple_admin_logons.insert(event_data["SubjectUserName"].to_string(),1);
if event_data["SubjectUserName"] != event_data["SubjectUserSid"] {
// One username with multiple admin logon SIDs
self.multiple_admin_logons
.insert(event_data["SubjectUserName"].to_string(), 1);
let mut count_hash: HashMap<String, i32> = HashMap::new();
count_hash.insert(event_data["SubjectUserSid"].to_string(), sid[&event_data["SubjectUserSid"]] + 1);
self.admin_logons.insert(event_data["SubjectUserName"].to_string(), count_hash);
count_hash.insert(
event_data["SubjectUserSid"].to_string(),
sid[&event_data["SubjectUserSid"]] + 1,
);
self.admin_logons.insert(
event_data["SubjectUserName"].to_string(),
count_hash,
);
}
},
}
None => {
// admin_logons配列にセットUserNameとSIDとカウンタをセット
let mut count_hash: HashMap<String, i32> = HashMap::new();
count_hash.insert(event_data["SubjectUserSid"].to_string(), 1);
self.admin_logons.insert(event_data["SubjectUserName"].to_string(), count_hash);
self.admin_logons
.insert(event_data["SubjectUserName"].to_string(), count_hash);
}
}
},
}
None => (),
}
},
}
None => (),
}
}
}

14
src/detections/system.rs
View File

@@ -1,15 +1,9 @@
pub struct System {
}
pub struct System {}
impl System {
pub fn new() -> System {
System{}
System {}
}
pub fn detection(&self) {
}
}
pub fn detection(&self) {}
}

2
src/lib.rs
View File

@@ -1,2 +1,2 @@
pub mod models;
pub mod detections;
pub mod models;

26
src/main.rs
View File

@@ -1,19 +1,19 @@
extern crate serde;
extern crate clap;
extern crate serde;
use evtx::EvtxParser;
use std::{env, process, path::PathBuf};
use quick_xml::de::{DeError};
use yamato_event_analyzer::detections::detection;
use clap::{App, AppSettings, Arg};
use evtx::EvtxParser;
use quick_xml::de::DeError;
use std::{env, path::PathBuf, process};
use yamato_event_analyzer::detections::detection;
fn build_app() -> clap::App<'static, 'static> {
let program = std::env::args()
.nth(0)
.and_then(|s| {
std::path::PathBuf::from(s)
.file_stem()
.map(|s| s.to_string_lossy().into_owned())
.file_stem()
.map(|s| s.to_string_lossy().into_owned())
})
.unwrap();
@@ -32,19 +32,17 @@ fn build_app() -> clap::App<'static, 'static> {
.arg(Arg::from_usage("-s --statistics 'event statistics'"))
.arg(Arg::from_usage("-u --update 'signature update'"))
.arg(Arg::from_usage("--credits 'Zachary Mathis, Akira Nishikawa'"))
}
fn main() -> Result<(), DeError> {
let args = build_app().get_matches();
let filepath : Option<&str> = args.value_of("filepath");
let filepath: Option<&str> = args.value_of("filepath");
match filepath {
Some(filepath) => parse_file(filepath),
None => (),
}
Ok(())
}
@@ -55,9 +53,9 @@ fn parse_file(filepath: &str) {
Err(e) => {
eprintln!("{}", e);
process::exit(1);
},
}
};
let mut detection = detection::Detection::new();
&detection.start(parser);
}

43
src/models/event.rs
View File

@@ -25,9 +25,9 @@ struct Execution {
}
#[derive(Debug, Deserialize, PartialEq)]
struct Provider {
pub struct Provider {
#[serde(rename = "Name")]
name: Option<String>,
pub name: Option<String>,
#[serde(rename = "Guid")]
guid: Option<String>,
}
@@ -35,7 +35,7 @@ struct Provider {
#[derive(Debug, Deserialize, PartialEq)]
pub struct System {
#[serde(rename = "Provider")]
provider: Provider,
pub provider: Provider,
#[serde(rename = "EventID")]
pub event_id: String,
#[serde(rename = "Version")]
@@ -62,6 +62,8 @@ pub struct System {
computer: String,
#[serde(rename = "Security")]
security: String,
#[serde(rename = "Message")]
pub message: Option<String>,
}
#[derive(Debug, Deserialize, PartialEq)]
@@ -79,44 +81,41 @@ pub struct Evtx {
}
impl Evtx {
//
// 文字列データを取得する
//
fn get_string(v: &Data) -> String {
match &v.text {
Some(text) => {
return text.to_string();
},
}
_ => return "".to_string(),
}
}
//
// EventDataをHashMapとして取得する
//
pub fn parse_event_data(&self) -> HashMap<String,String> {
pub fn parse_event_data(&self) -> HashMap<String, String> {
let mut values = HashMap::new();
match &self.event_data {
Some(event_data) =>
match &event_data.data {
Some(data) => {
for v in data.iter() {
match &v.name {
Some(name) => {
values.insert(name.to_string(), Evtx::get_string(v));
},
None => (),
Some(event_data) => match &event_data.data {
Some(data) => {
for v in data.iter() {
match &v.name {
Some(name) => {
values.insert(name.to_string(), Evtx::get_string(v));
}
None => (),
}
},
None => (),
},
}
}
None => (),
},
None => (),
}
values
}
}