CSEC_PUBLIC/hayabusa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

cargo fmt --all

Browse Source
This commit is contained in:
Kazuminn
2020-09-25 21:46:40 +09:00
parent 8b3ce3e071
commit d42276ada9
8 changed files with 69 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
Cargo.lock generated
View File

@@ -1110,6 +1110,7 @@ dependencies = [
"clap",
"evtx",
"quick-xml 0.17.2",
"regex",
"serde",
"serde_json",
]

16
src/detections/common.rs
View File

@@ -1,15 +1,14 @@
use std::collections::HashMap;
use crate::models::event;
use std::collections::HashMap;
#[derive(Debug)]
pub struct Common {
record_id: u64,
date: String,
record_id_list : HashMap<String, String>,
record_id_list: HashMap<String, String>,
}
impl Common {
pub fn new() -> Common {
Common {
record_id: 0,
@@ -25,24 +24,21 @@ impl Common {
}
pub fn detection(&mut self, system: &event::System, event_data: &HashMap<String, String>) {
&self.check_record_id(system);
}
//
// Record IDがシーケンスになっているかチェック
//
fn check_record_id(&mut self, system: &event::System) {
let event_record_id: u64 = system.event_record_id.parse().unwrap();
if self.record_id > 0 && event_record_id - self.record_id > 1 {
self.record_id_list.insert(self.record_id.to_string() + " - " + &system.event_record_id.to_string(),
self.date.to_string() + " - " + &system.time_created.system_time.to_string());
self.record_id_list.insert(
self.record_id.to_string() + " - " + &system.event_record_id.to_string(),
self.date.to_string() + " - " + &system.time_created.system_time.to_string(),
);
}
self.record_id = event_record_id;
self.date = system.time_created.system_time.to_string();
}
}

24
src/detections/detection.rs
View File

@@ -1,22 +1,21 @@
extern crate quick_xml;
use std::collections::BTreeMap;
use std::collections::HashMap;
use crate::models::event;
use evtx::EvtxParser;
use crate::detections::application;
use crate::detections::common;
use crate::detections::security;
use crate::detections::system;
use crate::detections::application;
use quick_xml::de::{DeError};
use crate::models::event;
use evtx::EvtxParser;
use quick_xml::de::DeError;
use std::collections::BTreeMap;
use std::collections::HashMap;
#[derive(Debug)]
pub struct Detection {
timeline_list : BTreeMap<String, String>,
timeline_list: BTreeMap<String, String>,
}
impl Detection {
pub fn new() -> Detection {
Detection {
timeline_list: BTreeMap::new(),
@@ -24,7 +23,6 @@ impl Detection {
}
pub fn start(&mut self, mut parser: EvtxParser<std::fs::File>) -> Result<(), DeError> {
let mut common: common::Common = common::Common::new();
let mut security = security::Security::new();
let mut system = system::System::new();
@@ -45,11 +43,11 @@ impl Detection {
} else if channel == "System" {
&system.detection();
} else if channel == "Application" {
&application.detection();
&application.detection(event_id, &event.system, event_data);
} else {
//&other.detection();
}
},
}
Err(e) => eprintln!("{}", e),
}
}
@@ -60,8 +58,6 @@ impl Detection {
common.disp();
security.disp();
return Ok(())
return Ok(());
}
}

4
src/detections/mod.rs
View File

@@ -1,5 +1,5 @@
mod application;
mod common;
pub mod detection;
mod security;
mod system;
mod application;
pub mod detection;

44
src/detections/security.rs
View File

@@ -1,5 +1,5 @@
use std::collections::HashMap;
use crate::models::event;
use std::collections::HashMap;
#[derive(Debug)]
pub struct Security {
@@ -11,7 +11,7 @@ pub struct Security {
impl Security {
pub fn new() -> Security {
Security{
Security {
alert_all_admin: 0,
total_admin_logons: 0,
admin_logons: HashMap::new(),
@@ -27,8 +27,12 @@ impl Security {
}
}
pub fn detection(&mut self, event_id: String, system: &event::System, event_data: HashMap<String, String>) {
pub fn detection(
&mut self,
event_id: String,
system: &event::System,
event_data: HashMap<String, String>,
) {
if event_id == "4672" {
&self.se_debug_privilege(event_data);
}
@@ -38,12 +42,10 @@ impl Security {
// Special privileges assigned to new logon (possible admin access)
//
fn se_debug_privilege(&mut self, event_data: HashMap<String, String>) {
match event_data.get("PrivilegeList") {
Some(privileage_list) => {
match privileage_list.find("SeDebugPrivilege") {
Some(_data) => {
// alert_all_adminが有効であれば、標準出力して知らせる
// DeepBlueCLIでは必ず0になっていて、基本的には表示されない。
if self.alert_all_admin == 1 {
@@ -61,31 +63,35 @@ impl Security {
Some(sid) => {
// 含まれていれば、マルチユーザが管理者としてログインしているか確認
// マルチログオンのデータをセット
if event_data["SubjectUserName"] != event_data["SubjectUserSid"] { // One username with multiple admin logon SIDs
self.multiple_admin_logons.insert(event_data["SubjectUserName"].to_string(),1);
if event_data["SubjectUserName"] != event_data["SubjectUserSid"] {
// One username with multiple admin logon SIDs
self.multiple_admin_logons
.insert(event_data["SubjectUserName"].to_string(), 1);
let mut count_hash: HashMap<String, i32> = HashMap::new();
count_hash.insert(event_data["SubjectUserSid"].to_string(), sid[&event_data["SubjectUserSid"]] + 1);
self.admin_logons.insert(event_data["SubjectUserName"].to_string(), count_hash);
count_hash.insert(
event_data["SubjectUserSid"].to_string(),
sid[&event_data["SubjectUserSid"]] + 1,
);
self.admin_logons.insert(
event_data["SubjectUserName"].to_string(),
count_hash,
);
}
}
},
None => {
// admin_logons配列にセットUserNameとSIDとカウンタをセット
let mut count_hash: HashMap<String, i32> = HashMap::new();
count_hash.insert(event_data["SubjectUserSid"].to_string(), 1);
self.admin_logons.insert(event_data["SubjectUserName"].to_string(), count_hash);
self.admin_logons
.insert(event_data["SubjectUserName"].to_string(), count_hash);
}
}
}
},
None => (),
}
},
}
None => (),
}
}
}

12
src/detections/system.rs
View File

@@ -1,15 +1,9 @@
pub struct System {
}
pub struct System {}
impl System {
pub fn new() -> System {
System{}
System {}
}
pub fn detection(&self) {
}
pub fn detection(&self) {}
}

2
src/lib.rs
View File

@@ -1,2 +1,2 @@
pub mod models;
pub mod detections;
pub mod models;

16
src/main.rs
View File

@@ -1,11 +1,11 @@
extern crate serde;
extern crate clap;
extern crate serde;
use evtx::EvtxParser;
use std::{env, process, path::PathBuf};
use quick_xml::de::{DeError};
use yamato_event_analyzer::detections::detection;
use clap::{App, AppSettings, Arg};
use evtx::EvtxParser;
use quick_xml::de::DeError;
use std::{env, path::PathBuf, process};
use yamato_event_analyzer::detections::detection;
fn build_app() -> clap::App<'static, 'static> {
let program = std::env::args()
@@ -32,13 +32,11 @@ fn build_app() -> clap::App<'static, 'static> {
.arg(Arg::from_usage("-s --statistics 'event statistics'"))
.arg(Arg::from_usage("-u --update 'signature update'"))
.arg(Arg::from_usage("--credits 'Zachary Mathis, Akira Nishikawa'"))
}
fn main() -> Result<(), DeError> {
let args = build_app().get_matches();
let filepath : Option<&str> = args.value_of("filepath");
let filepath: Option<&str> = args.value_of("filepath");
match filepath {
Some(filepath) => parse_file(filepath),
@@ -55,7 +53,7 @@ fn parse_file(filepath: &str) {
Err(e) => {
eprintln!("{}", e);
process::exit(1);
},
}
};
let mut detection = detection::Detection::new();