cargo fmt --all

Cargo.lock

@@ -1110,6 +1110,7 @@ dependencies = [
  "clap",
  "evtx",
  "quick-xml 0.17.2",
+ "regex",
  "serde",
  "serde_json",
 ]

src/detections/common.rs

@@ -1,5 +1,5 @@
-use std::collections::HashMap;
 use crate::models::event;
+use std::collections::HashMap;
 
 #[derive(Debug)]
 pub struct Common {
@@ -9,7 +9,6 @@ pub struct Common {
 }
 
 impl Common {
-
     pub fn new() -> Common {
         Common {
             record_id: 0,
@@ -25,24 +24,21 @@ impl Common {
     }
 
     pub fn detection(&mut self, system: &event::System, event_data: &HashMap<String, String>) {
-    
         &self.check_record_id(system);
-
     }
 
     //
     // Record IDがシーケンスになっているかチェック
     //
     fn check_record_id(&mut self, system: &event::System) {
-    
         let event_record_id: u64 = system.event_record_id.parse().unwrap();
         if self.record_id > 0 && event_record_id - self.record_id > 1 {
-            self.record_id_list.insert(self.record_id.to_string() + " - " + &system.event_record_id.to_string(), 
+            self.record_id_list.insert(
-                self.date.to_string() + " - " + &system.time_created.system_time.to_string());
+                self.record_id.to_string() + " - " + &system.event_record_id.to_string(),
+                self.date.to_string() + " - " + &system.time_created.system_time.to_string(),
+            );
         }
         self.record_id = event_record_id;
         self.date = system.time_created.system_time.to_string();
     }
-
 }
-

src/detections/detection.rs

@@ -1,14 +1,14 @@
 extern crate quick_xml;
 
-use std::collections::BTreeMap;
+use crate::detections::application;
-use std::collections::HashMap;
-use crate::models::event;
-use evtx::EvtxParser;
 use crate::detections::common;
 use crate::detections::security;
 use crate::detections::system;
-use crate::detections::application;
+use crate::models::event;
-use quick_xml::de::{DeError};
+use evtx::EvtxParser;
+use quick_xml::de::DeError;
+use std::collections::BTreeMap;
+use std::collections::HashMap;
 
 #[derive(Debug)]
 pub struct Detection {
@@ -16,7 +16,6 @@ pub struct Detection {
 }
 
 impl Detection {
-
     pub fn new() -> Detection {
         Detection {
             timeline_list: BTreeMap::new(),
@@ -24,7 +23,6 @@ impl Detection {
     }
 
     pub fn start(&mut self, mut parser: EvtxParser<std::fs::File>) -> Result<(), DeError> {
-    
         let mut common: common::Common = common::Common::new();
         let mut security = security::Security::new();
         let mut system = system::System::new();
@@ -45,11 +43,11 @@ impl Detection {
                     } else if channel == "System" {
                         &system.detection();
                     } else if channel == "Application" {
-                        &application.detection();
+                        &application.detection(event_id, &event.system, event_data);
                     } else {
                         //&other.detection();
                     }
-                },
+                }
                 Err(e) => eprintln!("{}", e),
             }
         }
@@ -60,8 +58,6 @@ impl Detection {
         common.disp();
         security.disp();
 
-        return Ok(())
+        return Ok(());
     }
-
 }
-

src/detections/mod.rs

@@ -1,5 +1,5 @@
+mod application;
 mod common;
+pub mod detection;
 mod security;
 mod system;
-mod application;
-pub mod detection;

src/detections/security.rs

@@ -1,5 +1,5 @@
-use std::collections::HashMap;
 use crate::models::event;
+use std::collections::HashMap;
 
 #[derive(Debug)]
 pub struct Security {
@@ -27,8 +27,12 @@ impl Security {
         }
     }
 
-    pub fn detection(&mut self, event_id: String, system: &event::System, event_data: HashMap<String, String>) {
+    pub fn detection(
-    
+        &mut self,
+        event_id: String,
+        system: &event::System,
+        event_data: HashMap<String, String>,
+    ) {
         if event_id == "4672" {
             &self.se_debug_privilege(event_data);
         }
@@ -38,12 +42,10 @@ impl Security {
     // Special privileges assigned to new logon (possible admin access)
     //
     fn se_debug_privilege(&mut self, event_data: HashMap<String, String>) {
-    
         match event_data.get("PrivilegeList") {
             Some(privileage_list) => {
                 match privileage_list.find("SeDebugPrivilege") {
                     Some(_data) => {
-    
                         // alert_all_adminが有効であれば、標準出力して知らせる
                         // DeepBlueCLIでは必ず0になっていて、基本的には表示されない。
                         if self.alert_all_admin == 1 {
@@ -61,31 +63,35 @@ impl Security {
                             Some(sid) => {
                                 // 含まれていれば、マルチユーザが管理者としてログインしているか確認
                                 // マルチログオンのデータをセット
-                                if event_data["SubjectUserName"] != event_data["SubjectUserSid"] { // One username with multiple admin logon SIDs 
+                                if event_data["SubjectUserName"] != event_data["SubjectUserSid"] {
-                                    self.multiple_admin_logons.insert(event_data["SubjectUserName"].to_string(),1);
+                                    // One username with multiple admin logon SIDs
+                                    self.multiple_admin_logons
+                                        .insert(event_data["SubjectUserName"].to_string(), 1);
 
                                     let mut count_hash: HashMap<String, i32> = HashMap::new();
-                                    count_hash.insert(event_data["SubjectUserSid"].to_string(), sid[&event_data["SubjectUserSid"]] + 1);
+                                    count_hash.insert(
-                                    self.admin_logons.insert(event_data["SubjectUserName"].to_string(), count_hash);
+                                        event_data["SubjectUserSid"].to_string(),
+                                        sid[&event_data["SubjectUserSid"]] + 1,
+                                    );
+                                    self.admin_logons.insert(
+                                        event_data["SubjectUserName"].to_string(),
+                                        count_hash,
+                                    );
+                                }
                             }
-                            },
                             None => {
                                 // admin_logons配列にセットUserNameとSIDとカウンタをセット
                                 let mut count_hash: HashMap<String, i32> = HashMap::new();
                                 count_hash.insert(event_data["SubjectUserSid"].to_string(), 1);
-                                self.admin_logons.insert(event_data["SubjectUserName"].to_string(), count_hash);
+                                self.admin_logons
-                                
+                                    .insert(event_data["SubjectUserName"].to_string(), count_hash);
+                            }
                         }
                     }
-                    },
                     None => (),
                 }
-            },
+            }
             None => (),
-            
         }
-        
     }
-
 }
-

src/detections/system.rs

@@ -1,15 +1,9 @@
-
+pub struct System {}
-pub struct System {
-    
-}
 
 impl System {
-
     pub fn new() -> System {
         System {}
     }
 
-    pub fn detection(&self) {
+    pub fn detection(&self) {}
-
-    }
 }

src/lib.rs

@@ -1,2 +1,2 @@
-pub mod models;
 pub mod detections;
+pub mod models;

src/main.rs

@@ -1,11 +1,11 @@
-extern crate serde;
 extern crate clap;
+extern crate serde;
 
-use evtx::EvtxParser;
-use std::{env, process, path::PathBuf};
-use quick_xml::de::{DeError};
-use yamato_event_analyzer::detections::detection;
 use clap::{App, AppSettings, Arg};
+use evtx::EvtxParser;
+use quick_xml::de::DeError;
+use std::{env, path::PathBuf, process};
+use yamato_event_analyzer::detections::detection;
 
 fn build_app() -> clap::App<'static, 'static> {
     let program = std::env::args()
@@ -32,11 +32,9 @@ fn build_app() -> clap::App<'static, 'static> {
         .arg(Arg::from_usage("-s --statistics 'event statistics'"))
         .arg(Arg::from_usage("-u --update 'signature update'"))
         .arg(Arg::from_usage("--credits 'Zachary Mathis, Akira Nishikawa'"))
-
 }
 
 fn main() -> Result<(), DeError> {
-
     let args = build_app().get_matches();
     let filepath: Option<&str> = args.value_of("filepath");
 
@@ -55,7 +53,7 @@ fn parse_file(filepath: &str) {
         Err(e) => {
             eprintln!("{}", e);
             process::exit(1);
-        },
+        }
     };
 
     let mut detection = detection::Detection::new();