CSEC_PUBLIC/hayabusa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix

Browse Source
This commit is contained in:
Kazuminn
2020-09-26 22:07:47 +09:00
parent d42276ada9
commit af1843b8a9
1 changed files with 15 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
src/detections/application.rs
View File

@@ -17,11 +17,12 @@ impl Application {
system: &event::System,
event_data: HashMap<String, String>,
) {
let _emet = String::from("EMET");
if event_id == "2" {
match &system.provider.name {
Some(_emet) => {
&self.emet(system, event_data);
Some(name) => {
if (name == "EMET") {
&self.emet(system, event_data);
}
}
None => (),
}
@@ -32,16 +33,18 @@ impl Application {
match &system.message {
Some(message) => {
let message_split: Vec<&str> = message.split("\n").collect();
let text = message_split[0];
let application = message_split[3];
let re = Regex::new(r"^Application: ").unwrap();
let command = re.replace_all(application, "");
let username = message_split[4];
if !message_split.is_empty() {
let text = message_split[0];
let application = message_split[3];
let re = Regex::new(r"^Application: ").unwrap();
let command = re.replace_all(application, "");
let username = message_split[4];
println!("Message EMET Block");
println!("Command {}", command);
println!("Results {}", text);
println!("Results {}", username);
println!("Message EMET Block");
println!("Command {}", command);
println!("Results {}", text);
println!("Results {}", username);
}
}
None => {
println!("Warning: EMET Message field is blank. Install EMET locally to see full details of this alert");