Security module Implemented without 4674

src/detections/detection.rs

@@ -38,7 +38,7 @@ impl Detection {
                     &common.detection(&event.system, &event_data);
                     //&common.detection(&event.system, &event_data);
                     if channel == "Security" {
-                        &security.detection(event_id, &event.system, event_data);
+                        &security.detection(event_id, &event.system, &event.user_data, event_data);
                     } else if channel == "System" {
                         &system.detection(event_id, &event.system, event_data);
                     } else if channel == "Application" {

src/detections/security.rs

@@ -1,92 +1,308 @@
-use crate::models::event;
+use crate::models::event;
-use std::collections::HashMap;
+use std::collections::HashMap;
-
+
-#[derive(Debug)]
+// eventlogが用意できていない
-pub struct Security {
+// 4674
-    alert_all_admin: i32,
+// 4756
-    total_admin_logons: i32,
+
-    admin_logons: HashMap<String, HashMap<String, i32>>,
+#[derive(Debug)]
-    multiple_admin_logons: HashMap<String, i32>,
+pub struct Security {
-}
+    max_total_sensitive_privuse: i32,
-
+    max_passspray_login: i32,
-impl Security {
+    max_passspray_uniquser: i32,
-    pub fn new() -> Security {
+    max_failed_logons: i32,
-        Security {
+    alert_all_admin: i32,
-            alert_all_admin: 0,
+    total_admin_logons: i32,
-            total_admin_logons: 0,
+    total_failed_logons: i32,
-            admin_logons: HashMap::new(),
+    total_failed_account: i32,
-            multiple_admin_logons: HashMap::new(),
+    total_sensitive_privuse: i32,
-        }
+    admin_logons: HashMap<String, HashMap<String, i32>>,
-    }
+    multiple_admin_logons: HashMap<String, i32>,
-
+    account_2_failedcnt: HashMap<String, i32>,
-    pub fn disp(&self) {
+    passspray_2_user: HashMap<String, i32>,
-        if self.total_admin_logons > 0 {
+    empty_str: String,
-            println!("total_admin_logons:{}", self.total_admin_logons);
+}
-            println!("admin_logons:{:?}", self.admin_logons);
+
-            println!("multiple_admin_logons:{:?}", self.multiple_admin_logons);
+impl Security {
-        }
+    pub fn new() -> Security {
-    }
+        Security {
-
+            max_total_sensitive_privuse: 4,
-    pub fn detection(
+            max_passspray_login: 6,
-        &mut self,
+            max_passspray_uniquser: 6,
-        event_id: String,
+            max_failed_logons: 5,
-        system: &event::System,
+            alert_all_admin: 0,
-        event_data: HashMap<String, String>,
+            total_admin_logons: 0,
-    ) {
+            total_failed_logons: 0,
-        if event_id == "4672" {
+            total_failed_account: 0,
-            &self.se_debug_privilege(event_data);
+            total_sensitive_privuse: 0,
-        }
+            admin_logons: HashMap::new(),
-    }
+            multiple_admin_logons: HashMap::new(),
-
+            account_2_failedcnt: HashMap::new(),
-    //
+            passspray_2_user: HashMap::new(),
-    // Special privileges assigned to new logon (possible admin access)
+            empty_str: String::default(),
-    //
+        }
-    fn se_debug_privilege(&mut self, event_data: HashMap<String, String>) {
+    }
-
+
-        if let Some(privileage_list) = event_data.get("PrivilegeList") {
+    pub fn disp(&self) {
-            if let Some(_data) = privileage_list.find("SeDebugPrivilege") {
+        if self.total_admin_logons > 0 {
-                // alert_all_adminが有効であれば、標準出力して知らせる
+            println!("total_admin_logons:{}", self.total_admin_logons);
-                // DeepBlueCLIでは必ず0になっていて、基本的には表示されない。
+            println!("admin_logons:{:?}", self.admin_logons);
-                if self.alert_all_admin == 1 {
+            println!("multiple_admin_logons:{:?}\n", self.multiple_admin_logons);
-                    println!("Logon with SeDebugPrivilege (admin access)");
+        }
-                    println!("Username:{}", event_data["SubjectUserName"]);
+
-                    println!("Domain:{}", event_data["SubjectDomainName"]);
+        let exceed_failed_logons = self.total_failed_logons > self.max_failed_logons;
-                    println!("User SID:{}", event_data["SubjectUserSid"]);
+        let exist_failed_account = self.account_2_failedcnt.keys().count() as i32 > 1;
-                    println!("Domain:{}", event_data["PrivilegeList"]);
+        if exceed_failed_logons && exist_failed_account {
-                }
+            println!("High number of total logon failures for multiple accounts");
-
+            println!(
-                self.total_admin_logons += 1;
+                "Total accounts: {}",
-
+                self.account_2_failedcnt.keys().count()
-                // admin_logons配列にusernameが含まれているか確認
+            );
-                match self.admin_logons.get(&event_data["SubjectUserName"]) {
+            println!("Total logon failures: {}\n", self.total_failed_logons);
-                    Some(sid) => {
+        }
-                        // 含まれていれば、マルチユーザが管理者としてログインしているか確認
+    }
-                        // マルチログオンのデータをセット
+
-                        if event_data["SubjectUserName"] != event_data["SubjectUserSid"] {
+    pub fn detection(
-                            // One username with multiple admin logon SIDs
+        &mut self,
-                            self.multiple_admin_logons
+        event_id: String,
-                                .insert(event_data["SubjectUserName"].to_string(), 1);
+        _system: &event::System,
-
+        user_data: &Option<event::UserData>,
-                            let mut count_hash: HashMap<String, i32> = HashMap::new();
+        event_data: HashMap<String, String>,
-                            count_hash.insert(
+    ) {
-                                event_data["SubjectUserSid"].to_string(),
+        self.process_craeted(&event_id, &event_data);
-                                sid[&event_data["SubjectUserSid"]] + 1,
+        self.se_debug_privilege(&event_id, &event_data);
-                            );
+        self.account_created(&event_id, &event_data);
-                            self.admin_logons.insert(
+        self.add_member_security_group(&event_id, &event_data);
-                                event_data["SubjectUserName"].to_string(),
+        self.failed_logon(&event_id, &event_data);
-                                count_hash,
+        self.sensitive_priviledge(&event_id, &event_data);
-                            );
+        self.attempt_priviledge(&event_id, &event_data);
-                        }
+        self.pass_spray(&event_id, &event_data);
-                    }
+        self.audit_log_cleared(&event_id, &user_data);
-                    None => {
+    }
-                        // admin_logons配列にセットUserNameとSIDとカウンタをセット
+
-                        let mut count_hash: HashMap<String, i32> = HashMap::new();
+    fn process_craeted(&mut self, event_id: &String, _event_data: &HashMap<String, String>) {
-                        count_hash.insert(event_data["SubjectUserSid"].to_string(), 1);
+        if event_id != "4688" {
-                        self.admin_logons
+            return;
-                            .insert(event_data["SubjectUserName"].to_string(), count_hash);
+        }
-                    }
+        // TODO Check-Commnad
-                }
+        return;
-            }
+    }
-        }
+
-    }
+    //
-}
+    // Special privileges assigned to new logon (possible admin access)
+    //
+    fn se_debug_privilege(&mut self, event_id: &String, event_data: &HashMap<String, String>) {
+        if event_id != "4672" {
+            return;
+        }
+
+        if let Some(privileage_list) = event_data.get("PrivilegeList") {
+            if let Some(_data) = privileage_list.find("SeDebugPrivilege") {
+                // alert_all_adminが有効であれば、標準出力して知らせる
+                // DeepBlueCLIでは必ず0になっていて、基本的には表示されない。
+                if self.alert_all_admin == 1 {
+                    println!("Logon with SeDebugPrivilege (admin access)");
+                    println!("Username:{}", event_data["SubjectUserName"]);
+                    println!("Domain:{}", event_data["SubjectDomainName"]);
+                    println!("User SID:{}", event_data["SubjectUserSid"]);
+                    println!("Domain:{}", event_data["PrivilegeList"]);
+                }
+
+                self.total_admin_logons += 1;
+
+                // admin_logons配列にusernameが含まれているか確認
+                match self.admin_logons.get(&event_data["SubjectUserName"]) {
+                    Some(sid) => {
+                        // 含まれていれば、マルチユーザが管理者としてログインしているか確認
+                        // マルチログオンのデータをセット
+                        if event_data["SubjectUserName"] != event_data["SubjectUserSid"] {
+                            // One username with multiple admin logon SIDs
+                            self.multiple_admin_logons
+                                .insert(event_data["SubjectUserName"].to_string(), 1);
+
+                            let mut count_hash: HashMap<String, i32> = HashMap::new();
+                            count_hash.insert(
+                                event_data["SubjectUserSid"].to_string(),
+                                sid[&event_data["SubjectUserSid"]] + 1,
+                            );
+                            self.admin_logons
+                                .insert(event_data["SubjectUserName"].to_string(), count_hash);
+                        }
+                    }
+                    None => {
+                        // admin_logons配列にセットUserNameとSIDとカウンタをセット
+                        let mut count_hash: HashMap<String, i32> = HashMap::new();
+                        count_hash.insert(event_data["SubjectUserSid"].to_string(), 1);
+                        self.admin_logons
+                            .insert(event_data["SubjectUserName"].to_string(), count_hash);
+                    }
+                }
+            }
+        }
+    }
+
+    // account craeted:OK
+    fn account_created(&mut self, event_id: &String, event_data: &HashMap<String, String>) {
+        if event_id != "4720" {
+            return;
+        }
+
+        println!("New User Created");
+        println!(
+            "Username: {}",
+            event_data.get("TargetUserName").unwrap_or(&"".to_string())
+        );
+        println!(
+            "User SID:: {}\n",
+            event_data.get("TargetSid").unwrap_or(&"".to_string())
+        );
+    }
+
+    // add member to security group
+    fn add_member_security_group(
+        &mut self,
+        event_id: &String,
+        event_data: &HashMap<String, String>,
+    ) {
+        // check if group is Administrator, may later expand to all groups
+        if event_data.get("TargetUserName").unwrap_or(&self.empty_str) != "Administrators" {
+            return;
+        }
+
+        // A member was added to a security-enabled (global|local|universal) group.
+        if event_id == "4728" {
+            println!("User added to global Administrators group");
+        } else if event_id == "4732" {
+            println!("User added to local Administrators group");
+        } else if event_id == "4756" {
+            println!("User added to universal Administrators group");
+        } else {
+            return;
+        }
+
+        println!(
+            "Username: {}",
+            event_data.get("TargetUserName").unwrap_or(&"".to_string())
+        );
+        println!(
+            "User SID:: {}\n",
+            event_data.get("TargetSid").unwrap_or(&"".to_string())
+        );
+    }
+
+    // An account failed to log on.:OK
+    // Requires auditing logon failures
+    // https://technet.microsoft.com/en-us/library/cc976395.aspx
+    fn failed_logon(&mut self, event_id: &String, event_data: &HashMap<String, String>) {
+        if event_id != "4625" {
+            return;
+        }
+
+        // see fn disp()
+        self.total_failed_logons += 1;
+        let username = event_data.get("TargetUserName").unwrap_or(&self.empty_str);
+        let failed_cnt = self.account_2_failedcnt.get(username).unwrap_or(&0) + &1;
+        self.account_2_failedcnt
+            .insert(username.to_string(), failed_cnt);
+    }
+
+    // Sensitive Privilege Use (Mimikatz)
+    fn sensitive_priviledge(&mut self, event_id: &String, event_data: &HashMap<String, String>) {
+        if event_id != "4673" {
+            return;
+        }
+
+        self.total_sensitive_privuse += 1;
+        // use == operator here to avoid multiple log notices
+        if self.max_total_sensitive_privuse == self.total_sensitive_privuse {
+            println!("Sensititive Privilege Use Exceeds Threshold");
+            println!(
+                "Username: {}",
+                event_data.get("SubjectUserName").unwrap_or(&self.empty_str)
+            );
+            println!(
+                "Domain Name: {}",
+                event_data
+                    .get("SubjectDomainName")
+                    .unwrap_or(&self.empty_str)
+            );
+        }
+    }
+
+    fn attempt_priviledge(&mut self, _event_id: &String, _event_data: &HashMap<String, String>) {
+        // event log cannot get...
+    }
+
+    // A logon was attempted using explicit credentials.
+    fn pass_spray(&mut self, event_id: &String, event_data: &HashMap<String, String>) {
+        if event_id != "4648" {
+            return;
+        }
+
+        let targetusername = event_data.get("TargetUserName").unwrap_or(&self.empty_str);
+        let spray_cnt = self.passspray_2_user.get(targetusername).unwrap_or(&0) + 1;
+        self.passspray_2_user
+            .insert(targetusername.to_string(), spray_cnt);
+
+        // check targetuser's attempt count.
+        if self.passspray_2_user.get(targetusername).unwrap_or(&0) <= &self.max_passspray_login {
+            return;
+        }
+
+        // check exceeded targetuser count.
+        let spray_uniq_user = self
+            .passspray_2_user
+            .values()
+            .filter(|value| value > &&self.max_passspray_login)
+            .count() as i32;
+        if spray_uniq_user <= self.max_passspray_uniquser {
+            return;
+        }
+
+        let usernames: String = self.passspray_2_user.keys().fold(
+            self.empty_str.to_string(),
+            |mut acc: String, cur| -> String {
+                acc.push_str(cur);
+                acc.push_str(" ");
+                return acc;
+            },
+        );
+
+        println!("Distributed Account Explicit Credential Use (Password Spray Attack)");
+        println!("The use of multiple user account access attempts with explicit credentials is ");
+        println!("an indicator of a password spray attack.");
+        println!("Target Usernames: {}", usernames.trim());
+        println!(
+            "Accessing Username: {}",
+            event_data.get("SubjectUserName").unwrap_or(&self.empty_str)
+        );
+        println!(
+            "Accessing Host Name: {}\n\n",
+            event_data
+                .get("SubjectDomainName")
+                .unwrap_or(&self.empty_str)
+        );
+
+        // reset
+        self.passspray_2_user = HashMap::new();
+    }
+
+    fn audit_log_cleared(
+        &mut self,
+        event_id: &String,
+        user_data: &Option<event::UserData>
+    ) {
+        if event_id != "1102" {
+            return;
+        }
+
+        println!("Audit Log Clear");
+        println!("The Audit log was cleared.");
+        let username = user_data.as_ref().and_then(|u| {
+            u.log_file_cleared
+                .as_ref()
+                .and_then(|l| l.subject_user_name.as_ref())
+        });
+        println!("Security ID: {}", username.unwrap_or(&"".to_string()));
+    }
+}

src/models/event.rs

@@ -39,7 +39,7 @@ pub struct System {
     #[serde(rename = "EventID")]
     pub event_id: String,
     #[serde(rename = "Version")]
-    version: Option<String>,
+    pub version: Option<String>,
     #[serde(rename = "Level")]
     level: String,
     #[serde(rename = "Task")]
@@ -72,12 +72,32 @@ pub struct EventData {
     pub data: Option<Vec<Data>>,
 }
 
+#[derive(Debug, Deserialize, PartialEq)]
+pub struct UserData {
+    #[serde(rename = "LogFileCleared")]
+    pub log_file_cleared: Option<LogFileCleared>,
+}
+
+#[derive(Debug, Deserialize, PartialEq)]
+pub struct LogFileCleared {
+    #[serde(rename = "SubjectUserSid")]
+    pub subject_user_sid: Option<String>,
+    #[serde(rename = "SubjectUserName")]
+    pub subject_user_name: Option<String>,
+    #[serde(rename = "SubjectDomainName")]
+    pub subject_domain_name: Option<String>,
+    #[serde(rename = "SubjectLogonId")]
+    pub subject_logon_id: Option<String>,
+}
+
 #[derive(Debug, Deserialize, PartialEq)]
 pub struct Evtx {
     #[serde(rename = "System")]
     pub system: System,
     #[serde(rename = "EventData")]
     pub event_data: Option<EventData>,
+    #[serde(rename = "UserData")]
+    pub user_data: Option<UserData>,
 }
 
 impl Evtx {