Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(matchers): added en-dash and other permutations for windash modifier #1393

Merged
merged 6 commits into from
Aug 11, 2024
Merged

feat(matchers): added en-dash and other permutations for windash modifier #1393

merged 6 commits into from
Aug 11, 2024

Conversation

hitenkoku
Copy link
Collaborator

What Changed

  • added en-dash and other permutations for windash modifier

@hitenkoku hitenkoku linked an issue Aug 9, 2024 that may be closed by this pull request
Support en-dash and other permutations for windash #1392
Closed
@hitenkoku hitenkoku self-assigned this Aug 9, 2024
fukusuket
fukusuket reviewed Aug 9, 2024
View reviewed changes
Copy link
Collaborator

@fukusuket fukusuket left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@hitenkoku
I confirmed there is no diff between main and this PR!
https://github.com/Yamato-Security/hayabusa/actions/runs/10320299127

Also, I confirmed with following rules!

title: Windash TEST
id: 0550d910-7787-4892-9791-c1c6a26ec16a
status: test
author: TEST
logsource:
    product: windows
    category: application
detection:
    selection:
        EventID: 1
        Channel: Application
        Data|contains|windash: "test -a"
    condition: selection
level: informational
eventcreate /t INFORMATION /id 1 /d "windash test -a "
eventcreate /t INFORMATION /id 1 /d "windash test –a (en dash)"
eventcreate /t INFORMATION /id 1 /d "windash test —a (em dash)"
eventcreate /t INFORMATION /id 1 /d "windash test ―a (horizontal bar) "
eventcreate /t INFORMATION /id 1 /d "windash test /a "

>hayabusa.exe csv-timeline -l -r test.yml -w
Timestamp · RuleTitle · Level · Computer · Channel · EventID · RecordID · Details · ExtraFieldInfo
2024-08-09 23:06:49.369 +09:00 · Windash TEST · info · mouse · App · 1 · 14711 · Data[1]: windash test -a · Data[1]: windash test -a
2024-08-09 23:06:49.379 +09:00 · Windash TEST · info · mouse · App · 1 · 14712 · Data[1]: windash test -a (en dash) · Data[1]: windash test -a (en dash)
2024-08-09 23:06:49.393 +09:00 · Windash TEST · info · mouse · App · 1 · 14713 · Data[1]: windash test -a (em dash) · Data[1]: windash test -a (em dash)
2024-08-09 23:06:50.370 +09:00 · Windash TEST · info · mouse · App · 1 · 14715 · Data[1]: windash test /a · Data[1]: windash test /a

Looking at the Eventviewer XML data, it appears that the ―a (horizontal bar) has been created.

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
  <Provider Name="EventCreate" /> 
  <EventID Qualifiers="0">1</EventID> 
  <Version>0</Version> 
  <Level>4</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2024-08-09T14:06:49.4075162Z" /> 
  <EventRecordID>14714</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="14108" ThreadID="0" /> 
  <Channel>Application</Channel> 
  <Computer>mouse</Computer> 
  <Security UserID="S-1-5-21-2349003748-4255172932-178375392-1002" /> 
  </System>
- <EventData>
  <Data>windash test ―a (horizontal bar)</Data> 
  </EventData>
  </Event>

For some reason, only the ― (horizontal bar) doesn't seem to be a hit🤔 Could you please check?(Sorry if I have made a mistake in the procedure)

@YamatoSecurity
Copy link
Collaborator

@fukusuket Thanks for testing this out! Could you DM @hitenkoku the .evtx file you created so he can test?

@hitenkoku
Copy link
Collaborator Author

@fukusuket Thanks for your comment. I fixed following point outs in 090e153.

Would you recheck it?

@hitenkoku I confirmed there is no diff between main and this PR! https://github.com/Yamato-Security/hayabusa/actions/runs/10320299127

Also, I confirmed with following rules!

title: Windash TEST
id: 0550d910-7787-4892-9791-c1c6a26ec16a
status: test
author: TEST
logsource:
    product: windows
    category: application
detection:
    selection:
        EventID: 1
        Channel: Application
        Data|contains|windash: "test -a"
    condition: selection
level: informational
eventcreate /t INFORMATION /id 1 /d "windash test -a "
eventcreate /t INFORMATION /id 1 /d "windash test –a (en dash)"
eventcreate /t INFORMATION /id 1 /d "windash test —a (em dash)"
eventcreate /t INFORMATION /id 1 /d "windash test ―a (horizontal bar) "
eventcreate /t INFORMATION /id 1 /d "windash test /a "

>hayabusa.exe csv-timeline -l -r test.yml -w
Timestamp · RuleTitle · Level · Computer · Channel · EventID · RecordID · Details · ExtraFieldInfo
2024-08-09 23:06:49.369 +09:00 · Windash TEST · info · mouse · App · 1 · 14711 · Data[1]: windash test -a · Data[1]: windash test -a
2024-08-09 23:06:49.379 +09:00 · Windash TEST · info · mouse · App · 1 · 14712 · Data[1]: windash test -a (en dash) · Data[1]: windash test -a (en dash)
2024-08-09 23:06:49.393 +09:00 · Windash TEST · info · mouse · App · 1 · 14713 · Data[1]: windash test -a (em dash) · Data[1]: windash test -a (em dash)
2024-08-09 23:06:50.370 +09:00 · Windash TEST · info · mouse · App · 1 · 14715 · Data[1]: windash test /a · Data[1]: windash test /a

Looking at the Eventviewer XML data, it appears that the ―a (horizontal bar) has been created.

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
  <Provider Name="EventCreate" /> 
  <EventID Qualifiers="0">1</EventID> 
  <Version>0</Version> 
  <Level>4</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2024-08-09T14:06:49.4075162Z" /> 
  <EventRecordID>14714</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="14108" ThreadID="0" /> 
  <Channel>Application</Channel> 
  <Computer>mouse</Computer> 
  <Security UserID="S-1-5-21-2349003748-4255172932-178375392-1002" /> 
  </System>
- <EventData>
  <Data>windash test ―a (horizontal bar)</Data> 
  </EventData>
  </Event>

For some reason, only the ― (horizontal bar) doesn't seem to be a hit🤔 Could you please check?(Sorry if I have made a mistake in the procedure)

fukusuket
fukusuket approved these changes Aug 10, 2024
View reviewed changes
Copy link
Collaborator

@fukusuket fukusuket left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@hitenkoku
Thank you so much for quick fix! I confirmed horizontal bar detected as follows! LGTM!!🚀

Timestamp · RuleTitle · Level · Computer · Channel · EventID · RecordID · Details · ExtraFieldInfo
2024-08-09 23:06:49.369 +09:00 · Windash TEST · info · mouse · App · 1 · 14711 · Data[1]: windash test -a · Data[1]: windash test -a
2024-08-09 23:06:49.379 +09:00 · Windash TEST · info · mouse · App · 1 · 14712 · Data[1]: windash test -a (en dash) · Data[1]: windash test -a (en dash)
2024-08-09 23:06:49.393 +09:00 · Windash TEST · info · mouse · App · 1 · 14713 · Data[1]: windash test -a (em dash) · Data[1]: windash test -a (em dash)
2024-08-09 23:06:49.407 +09:00 · Windash TEST · info · mouse · App · 1 · 14714 · Data[1]: windash test ―a (horizontal bar) · Data[1]: windash test ―a (horizontal bar)
2024-08-09 23:06:50.370 +09:00 · Windash TEST · info · mouse · App · 1 · 14715 · Data[1]: windash test /a · Data[1]: windash test /a
2024-08-09 23:09:26.231 +09:00 · Windash TEST · info · mouse · App · 1 · 14716 · Data[1]: windash test ―a (horizontal bar) · Data[1]: windash test ―a (horizontal bar)

@codecov Codecov
Copy link

codecov bot commented Aug 10, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 81.18%. Comparing base (25c1200) to head (370be60).
Report is 4 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #1393      +/-   ##
==========================================
+ Coverage   81.14%   81.18%   +0.04%     
==========================================
  Files          28       28              
  Lines       25946    26229     +283     
==========================================
+ Hits        21053    21295     +242     
- Misses       4893     4934      +41

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

YamatoSecurity
YamatoSecurity approved these changes Aug 11, 2024
View reviewed changes
Copy link
Collaborator

@YamatoSecurity YamatoSecurity left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@hitenkoku LGTM! Thanks so much!

@YamatoSecurity YamatoSecurity merged commit 5ac0bec into main Aug 11, 2024
9 of 10 checks passed
@YamatoSecurity YamatoSecurity deleted the 1392-support-en-dash-and-other-permutations-for-windash branch August 11, 2024 07:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@YamatoSecurity YamatoSecurity YamatoSecurity approved these changes

@fukusuket fukusuket fukusuket approved these changes

Assignees

@hitenkoku hitenkoku

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Support en-dash and other permutations for windash
3 participants
@hitenkoku @YamatoSecurity @fukusuket