Fix: <utils.rs-check_command()> get rdr by reference

src/detections/detection.rs

@@ -2,13 +2,16 @@ extern crate quick_xml;
 
 use crate::detections::application;
 use crate::detections::common;
+use crate::detections::powershell;
 use crate::detections::security;
 use crate::detections::system;
-use crate::detections::powershell;
 use crate::models::event;
 use evtx::EvtxParser;
 use quick_xml::de::DeError;
 use std::collections::BTreeMap;
+use std::fs::File;
+use std::io::prelude::*;
+extern crate csv;
 
 #[derive(Debug)]
 pub struct Detection {
@@ -29,6 +32,12 @@ impl Detection {
         let mut application = application::Application::new();
         let mut powershell = powershell::PowerShell::new();
 
+        let mut f = File::open("whitelist.txt").expect("file not found");
+        let mut contents = String::new();
+        let _ = f.read_to_string(&mut contents);
+
+        let mut rdr = csv::Reader::from_reader(contents.as_bytes());
+
         for record in parser.records() {
             match record {
                 Ok(r) => {
@@ -46,7 +55,7 @@ impl Detection {
                     } else if channel == "Application" {
                         &application.detection(event_id, &event.system, event_data);
                     } else if channel == "Microsoft-Windows-PowerShell/Operational" {
-                        &powershell.detection(event_id, &event.system, event_data);
+                        &powershell.detection(event_id, &event.system, event_data, &mut rdr);
                     } else {
                         //&other.detection();
                     }