72 lines
2.6 KiB
Rust
72 lines
2.6 KiB
Rust
extern crate csv;
|
|
extern crate quick_xml;
|
|
|
|
use crate::detections::application;
|
|
use crate::detections::common;
|
|
use crate::detections::powershell;
|
|
use crate::detections::security;
|
|
use crate::detections::sysmon;
|
|
use crate::detections::system;
|
|
use crate::models::event;
|
|
use evtx::EvtxParser;
|
|
use quick_xml::de::DeError;
|
|
use std::collections::BTreeMap;
|
|
|
|
#[derive(Debug)]
|
|
pub struct Detection {
|
|
timeline_list: BTreeMap<String, String>,
|
|
}
|
|
|
|
impl Detection {
|
|
pub fn new() -> Detection {
|
|
Detection {
|
|
timeline_list: BTreeMap::new(),
|
|
}
|
|
}
|
|
|
|
pub fn start(&mut self, mut parser: EvtxParser<std::fs::File>) -> Result<(), DeError> {
|
|
let mut common: common::Common = common::Common::new();
|
|
let mut security = security::Security::new();
|
|
let mut system = system::System::new();
|
|
let mut application = application::Application::new();
|
|
let mut sysmon = sysmon::Sysmon::new();
|
|
let mut powershell = powershell::PowerShell::new();
|
|
|
|
for record in parser.records() {
|
|
match record {
|
|
Ok(r) => {
|
|
let event: event::Evtx = quick_xml::de::from_str(&r.data)?;
|
|
let event_id = event.system.event_id.to_string();
|
|
let channel = event.system.channel.to_string();
|
|
let event_data = event.parse_event_data();
|
|
|
|
&common.detection(&event.system, &event_data);
|
|
//&common.detection(&event.system, &event_data);
|
|
if channel == "Security" {
|
|
&security.detection(event_id, &event.system, &event.user_data, event_data);
|
|
} else if channel == "System" {
|
|
&system.detection(event_id, &event.system, event_data);
|
|
} else if channel == "Application" {
|
|
&application.detection(event_id, &event.system, event_data);
|
|
} else if channel == "Microsoft-Windows-PowerShell/Operational" {
|
|
&powershell.detection(event_id, &event.system, event_data);
|
|
} else if channel == "Microsoft-Windows-Sysmon/Operational" {
|
|
&sysmon.detection(event_id, &event.system, event_data);
|
|
} else {
|
|
//&other.detection();
|
|
}
|
|
}
|
|
Err(e) => eprintln!("{}", e),
|
|
}
|
|
}
|
|
|
|
////////////////////////////
|
|
// 表示
|
|
////////////////////////////
|
|
common.disp();
|
|
security.disp();
|
|
|
|
return Ok(());
|
|
}
|
|
}
|