Skip to content

Commit fb80b57

Browse files
qjeromeqjerome
committed
MISP integration
1 parent fc0e9c8 commit fb80b57

File tree

5 files changed

+134
-51
lines changed

5 files changed

+134
-51
lines changed

‎collector/manager.go

Lines changed: 47 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ import (
1616
"time"
1717

1818
"github.com/0xrawsec/gene/engine"
19+
"github.com/0xrawsec/golang-misp/misp"
1920
"github.com/0xrawsec/golang-utils/datastructs"
2021
"github.com/0xrawsec/golang-utils/fsutil"
2122
"github.com/0xrawsec/golang-utils/fsutil/fswalker"
@@ -38,9 +39,12 @@ const (
3839
)
3940

4041
var (
41-
guidRe = regexp.MustCompile(`\{[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12}\}`)
42-
eventHashRe = regexp.MustCompile(`[a-f0-9]{32,}`) // at least md5
42+
guidRe = regexp.MustCompile(`(?i:\{[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}\})`)
43+
eventHashRe = regexp.MustCompile(`(?i:[a-f0-9]{32,})`) // at least md5
4344
filenameRe = regexp.MustCompile(`[\w\s\.-]+`)
45+
// MISP container related
46+
mispContName = "misp"
47+
mispTextExports = []string{"md5", "sha1", "sha256", "domain", "hostname"}
4448
)
4549

4650
//////////////////////// FileUpload
@@ -157,15 +161,16 @@ func KeyGen(size int) string {
157161

158162
// ManagerConfig defines manager's configuration structure
159163
type ManagerConfig struct {
160-
Host string `json:"host"`
161-
Port int `json:"port"`
162-
Logfile string `json:"logfile"`
163-
Key string `json:"key"`
164-
Authorized []string `json:"authorized"`
165-
TLS TLSConfig `json:"tls"`
166-
RulesDir string `json:"rules-dir"`
167-
DumpDir string `json:"dump-dir"`
168-
ContainersDir string `json:"containers-dir"`
164+
Host string `json:"host"`
165+
Port int `json:"port"`
166+
Logfile string `json:"logfile"`
167+
Key string `json:"key"`
168+
Authorized []string `json:"authorized"`
169+
TLS TLSConfig `json:"tls"`
170+
MISP misp.MispConfig `json:"misp"`
171+
RulesDir string `json:"rules-dir"`
172+
DumpDir string `json:"dump-dir"`
173+
ContainersDir string `json:"containers-dir"`
169174
}
170175

171176
// Manager structure definition
@@ -179,6 +184,7 @@ type Manager struct {
179184
authorized datastructs.SyncedSet
180185
logfile logfile.LogFile
181186
tls TLSConfig
187+
misp misp.MispConfig
182188
srv *http.Server
183189
stop chan bool
184190
done bool
@@ -208,7 +214,9 @@ func NewManager(c *ManagerConfig) (*Manager, error) {
208214
if err = c.TLS.Verify(); err != nil && !c.TLS.Empty() {
209215
return nil, err
210216
}
217+
211218
m.tls = c.TLS
219+
m.misp = c.MISP
212220

213221
// Containers initialization
214222
m.containersDir = c.ContainersDir
@@ -286,6 +294,24 @@ func (m *Manager) updateRules() {
286294
m.rulesSha256 = hex.EncodeToString(sha256.Sum(nil))
287295
}
288296

297+
func (m *Manager) updateMispContainer() {
298+
c := misp.NewCon(m.misp.Proto, m.misp.Host, m.misp.APIKey)
299+
mispContainer := make([]string, 0)
300+
for _, expType := range mispTextExports {
301+
log.Infof("Downloading %s attributes from MISP", expType)
302+
exps, err := c.TextExport(expType)
303+
if err != nil {
304+
log.Errorf("MISP failed to export %s IDS attributes: %s", expType, err)
305+
log.Errorf("Aborting MISP container update")
306+
return
307+
}
308+
mispContainer = append(mispContainer, exps...)
309+
}
310+
// Update the MISP container
311+
m.containers[mispContName] = mispContainer
312+
m.containersSha256[mispContName] = Sha256StringArray(mispContainer)
313+
}
314+
289315
// AddAuthKey adds an authorized key to access the manager
290316
func (m *Manager) AddAuthKey(key string) {
291317
m.authorized.Add(key)
@@ -340,6 +366,16 @@ func (m *Manager) authorizationMiddleware(next http.Handler) http.Handler {
340366

341367
// Run starts a new thread spinning the receiver
342368
func (m *Manager) Run() {
369+
go func() {
370+
for !m.done {
371+
if m.misp.Host != "" {
372+
log.Infof("Starting MISP container update routine")
373+
m.updateMispContainer()
374+
log.Infof("MISP container update routine finished")
375+
}
376+
time.Sleep(time.Hour)
377+
}
378+
}()
343379
go func() {
344380
// If we fail due to server crash we properly shutdown
345381
// the receiver to avoid log corruption

‎go.mod

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,13 @@ module github.com/0xrawsec/whids
33
require (
44
github.com/0xrawsec/gene v1.6.2
55
github.com/0xrawsec/golang-evtx v1.2.1
6+
github.com/0xrawsec/golang-misp v1.0.3
67
github.com/0xrawsec/golang-utils v1.1.8
78
github.com/0xrawsec/golang-win32 v1.0.3
89
github.com/0xrawsec/mux v1.6.2
910
github.com/DataDog/zstd v1.4.1 // indirect
1011
github.com/pierrec/lz4 v2.2.6+incompatible // indirect
1112
github.com/segmentio/kafka-go v0.3.2 // indirect
12-
golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586 // indirect
13-
golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7 // indirect
14-
golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a
15-
golang.org/x/tools v0.0.0-20190821162956-65e3620a7ae7 // indirect
13+
golang.org/x/sys v0.0.0-20190909082730-f460065e899a
1614
golang.org/x/tools/gopls v0.1.0 // indirect
1715
)

‎go.sum

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,10 @@ github.com/0xrawsec/golang-evtx v1.2.0 h1:SFv2zXo3Z9PWsY4yLIWcM8KkEsib2LnWsYgcC8
1818
github.com/0xrawsec/golang-evtx v1.2.0/go.mod h1:RD+lv9ndoM/7XwvS5XViI51yAp5PDtVVJf8FM6Muro0=
1919
github.com/0xrawsec/golang-evtx v1.2.1 h1:mPwUavxoQx8r1EZN3Qre9vAEzDnIiHJQ/qufpsOT4fo=
2020
github.com/0xrawsec/golang-evtx v1.2.1/go.mod h1:RD+lv9ndoM/7XwvS5XViI51yAp5PDtVVJf8FM6Muro0=
21+
github.com/0xrawsec/golang-misp v1.0.2 h1:p41LDUEVujHgh2TUuYKIBE14+n9JQen4MMiK5dV0/do=
22+
github.com/0xrawsec/golang-misp v1.0.2/go.mod h1:bF7MZPgPQFPtsXPvRLcIdrs09fZV7zYDRBKpLltd6oA=
23+
github.com/0xrawsec/golang-misp v1.0.3 h1:Y8fciKDbcRFPfmWOqlEaSOjJwe5Khx9v6FE5VDCCgNI=
24+
github.com/0xrawsec/golang-misp v1.0.3/go.mod h1:bF7MZPgPQFPtsXPvRLcIdrs09fZV7zYDRBKpLltd6oA=
2125
github.com/0xrawsec/golang-utils v1.1.0 h1:opQAwRONEfxOOl4nxhpPkXiTYgzAw0/wFATAffNjdII=
2226
github.com/0xrawsec/golang-utils v1.1.0/go.mod h1:DADTtCFY10qXjWmUVhhJqQIZdSweaHH4soYUDEi8mj0=
2327
github.com/0xrawsec/golang-utils v1.1.1 h1:HlwVs5lHl5rK2DhB1eDlf+J9hOKBHEObQCWXFcQ4GE0=
@@ -48,15 +52,23 @@ github.com/0xrawsec/mux v1.6.2 h1:cc2OyJTxRmXxsmQe2ulp0VndXV8vZIRrc1JqQzJ4BMI=
4852
github.com/0xrawsec/mux v1.6.2/go.mod h1:CiOvEAd+RMn8YOtCs1b5QfWe7P8G4olvTmzzNbERonY=
4953
github.com/DataDog/zstd v1.4.0/go.mod h1:1jcaCB/ufaK+sKp1NBhlGmpz41jOoPQ35bpF36t7BBo=
5054
github.com/DataDog/zstd v1.4.1/go.mod h1:1jcaCB/ufaK+sKp1NBhlGmpz41jOoPQ35bpF36t7BBo=
55+
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
56+
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
5157
github.com/eapache/go-xerial-snappy v0.0.0-20180814174437-776d5712da21/go.mod h1:+020luEh2TKB4/GOp8oxxtq0Daoen/Cii55CzbTV6DU=
5258
github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
5359
github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
5460
github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
5561
github.com/pierrec/lz4 v2.2.6+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
5662
github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
5763
github.com/pkg/sftp v1.10.0/go.mod h1:NxmoDg/QLVWluQDUYG7XBZTLUpKeFa8e3aMf1BfjyHk=
64+
github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI=
65+
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
5866
github.com/segmentio/kafka-go v0.2.2/go.mod h1:X6itGqS9L4jDletMsxZ7Dz+JFWxM6JHfPOCvTvk+EJo=
5967
github.com/segmentio/kafka-go v0.3.2/go.mod h1:OT5KXBPbaJJTcvokhWR2KFmm0niEx3mnccTwjmLvSi4=
68+
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
69+
github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
70+
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
71+
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
6072
github.com/xdg/scram v0.0.0-20180814205039-7eeb5667e42c/go.mod h1:lB8K/P019DLNhemzwFU4jHLhdvlE6uDZjXFejJXr49I=
6173
github.com/xdg/stringprep v1.0.0/go.mod h1:Jhud4/sHMO4oL310DaZAKk9ZaJ08SJfe+sJh0HrGL1Y=
6274
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
@@ -68,6 +80,8 @@ golang.org/x/crypto v0.0.0-20190513172903-22d7a77e9e5f/go.mod h1:yigFU9vqHzYiE8U
6880
golang.org/x/crypto v0.0.0-20190621222207-cc06ce4a13d4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
6981
golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
7082
golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
83+
golang.org/x/crypto v0.0.0-20190909091759-094676da4a83/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
84+
golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
7185
golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
7286
golang.org/x/net v0.0.0-20190320064053-1272bf9dcd53/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
7387
golang.org/x/net v0.0.0-20190326090315-15845e8f865b/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@@ -78,7 +92,10 @@ golang.org/x/net v0.0.0-20190522155817-f3200d17e092/go.mod h1:HSz+uSET+XFnRR8LxR
7892
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
7993
golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
8094
golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
95+
golang.org/x/net v0.0.0-20190909003024-a7b16738d86b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
96+
golang.org/x/net v0.0.0-20190912160710-24e19bdeb0f2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
8197
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
98+
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
8299
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
83100
golang.org/x/sys v0.0.0-20190321052220-f7bb7a8bee54/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
84101
golang.org/x/sys v0.0.0-20190322080309-f49334f85ddc/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -100,6 +117,14 @@ golang.org/x/sys v0.0.0-20190712062909-fae7ac547cb7 h1:LepdCS8Gf/MVejFIt8lsiexZA
100117
golang.org/x/sys v0.0.0-20190712062909-fae7ac547cb7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
101118
golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a h1:aYOabOQFp6Vj6W1F80affTUvO9UxmJRx8K0gsfABByQ=
102119
golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
120+
golang.org/x/sys v0.0.0-20190909082730-f460065e899a h1:mIzbOulag9/gXacgxKlFVwpCOWSfBT3/pDyyCwGA9as=
121+
golang.org/x/sys v0.0.0-20190909082730-f460065e899a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
122+
golang.org/x/sys v0.0.0-20190910064555-bbd175535a8b h1:3S2h5FadpNr0zUUCVZjlKIEYF+KaX/OBplTGo89CYHI=
123+
golang.org/x/sys v0.0.0-20190910064555-bbd175535a8b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
124+
golang.org/x/sys v0.0.0-20190911201528-7ad0cfa0b7b5 h1:SW/0nsKCUaozCUtZTakri5laocGx/5bkDSSLrFUsa5s=
125+
golang.org/x/sys v0.0.0-20190911201528-7ad0cfa0b7b5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
126+
golang.org/x/sys v0.0.0-20190912141932-bc967efca4b8 h1:41hwlulw1prEMBxLQSlMSux1zxJf07B3WPsdjJlKZxE=
127+
golang.org/x/sys v0.0.0-20190912141932-bc967efca4b8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
103128
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
104129
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
105130
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -120,5 +145,12 @@ golang.org/x/tools v0.0.0-20190718200317-82a3ea8a504c/go.mod h1:jcCCGcm9btYwXyDq
120145
golang.org/x/tools v0.0.0-20190719005602-e377ae9d6386/go.mod h1:jcCCGcm9btYwXyDqrUWc6MKQKKGJCWEQ3AfLSRIbEuI=
121146
golang.org/x/tools v0.0.0-20190820203921-3aeeb259764d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
122147
golang.org/x/tools v0.0.0-20190821162956-65e3620a7ae7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
148+
golang.org/x/tools v0.0.0-20190909194007-75be6cdcda07/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
149+
golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
150+
golang.org/x/tools v0.0.0-20190911202209-63a3583f646f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
151+
golang.org/x/tools v0.0.0-20190912185636-87d9f09c5d89/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
123152
golang.org/x/tools/gopls v0.1.0/go.mod h1:p8Q0IUu6EEeGxqmoN/g6Et3gReLCGA7PtNRdyOxcWJE=
124153
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
154+
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
155+
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
156+
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

‎tools/whids/hookdefs.go

Lines changed: 51 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -714,7 +714,7 @@ func hookSetValueSize(e *evtx.GoEvtxMap) {
714714
}
715715
}
716716

717-
func hookNetwork(e *evtx.GoEvtxMap) {
717+
/*func hookNetwork(e *evtx.GoEvtxMap) {
718718
// Default value
719719
e.Set(&pathSysmonCommandLine, "?")
720720
if guid, err := e.GetString(&pathSysmonProcessGUID); err == nil {
@@ -723,7 +723,7 @@ func hookNetwork(e *evtx.GoEvtxMap) {
723723
e.Set(&pathSysmonCommandLine, pt.CommandLine)
724724
}
725725
}
726-
}
726+
}*/
727727

728728
func hookEnrichAnySysmon(e *evtx.GoEvtxMap) {
729729
eventID := e.EventID()
@@ -762,14 +762,25 @@ func hookEnrichAnySysmon(e *evtx.GoEvtxMap) {
762762
}
763763
}
764764
}
765+
break
765766

766767
default:
768+
hasComLine := true
767769
// Default Values for the fields
768770
e.Set(&pathSysmonUser, "?")
769771
e.Set(&pathSysmonIntegrityLevel, "?")
770772

773+
if _, err := e.GetString(&pathSysmonCommandLine); err != nil {
774+
e.Set(&pathSysmonCommandLine, "?")
775+
hasComLine = false
776+
}
777+
771778
if guid, err := e.GetString(&pathSysmonProcessGUID); err == nil {
772779
if track := processTracker.GetByGuid(guid); track != nil {
780+
// if event does not have command line
781+
if !hasComLine {
782+
e.Set(&pathSysmonCommandLine, track.CommandLine)
783+
}
773784
e.Set(&pathSysmonUser, track.User)
774785
e.Set(&pathSysmonIntegrityLevel, track.IntegrityLevel)
775786
}
@@ -980,57 +991,28 @@ func hookDumpFile(e *evtx.GoEvtxMap) {
980991
dumpEventAndCompress(e, guid)
981992

982993
switch e.EventID() {
983-
case 1:
984-
if cl, err := e.GetString(&pathSysmonCommandLine); err == nil {
985-
if cwd, err := e.GetString(&pathSysmonCurrentDirectory); err == nil {
986-
if argv, err := utils.ArgvFromCommandLine(cl); err == nil {
987-
if len(argv) > 1 {
988-
for _, arg := range argv[1:] {
989-
if fsutil.IsFile(arg) && !utils.IsPipePath(arg) {
990-
if err = dumpFileAndCompress(arg, dumpPath); err != nil {
991-
log.Errorf("Error dumping file from EventID=%d \"%s\": %s", e.EventID(), arg, err)
992-
}
993-
}
994-
// try to dump a path relative to CWD
995-
relarg := filepath.Join(cwd, arg)
996-
if fsutil.IsFile(relarg) && !utils.IsPipePath(relarg) {
997-
if err = dumpFileAndCompress(relarg, dumpPath); err != nil {
998-
log.Errorf("Error dumping file from EventID=%d \"%s\": %s", e.EventID(), relarg, err)
999-
}
1000-
}
1001-
}
1002-
}
1003-
}
1004-
}
1005-
}
1006-
if im, err := e.GetString(&pathSysmonImage); err == nil {
1007-
if err = dumpFileAndCompress(im, dumpPath); err != nil {
1008-
log.Errorf("Error dumping file from EventID=%d \"%s\": %s", e.EventID(), im, err)
1009-
}
1010-
}
1011-
if pim, err := e.GetString(&pathSysmonParentImage); err == nil {
1012-
if err = dumpFileAndCompress(pim, dumpPath); err != nil {
1013-
log.Errorf("Error dumping file from EventID=%d \"%s\": %s", e.EventID(), pim, err)
1014-
}
1015-
}
994+
1016995
case 2, 11, 15:
1017996
if target, err := e.GetString(&pathSysmonTargetFilename); err == nil {
1018997
if err = dumpFileAndCompress(target, dumpPath); err != nil {
1019998
log.Errorf("Error dumping file from EventID=%d \"%s\": %s", e.EventID(), target, err)
1020999
}
10211000
}
1001+
10221002
case 6:
10231003
if im, err := e.GetString(&pathSysmonImageLoaded); err == nil {
10241004
if err = dumpFileAndCompress(im, dumpPath); err != nil {
10251005
log.Errorf("Error dumping file from EventID=%d \"%s\": %s", e.EventID(), im, err)
10261006
}
10271007
}
1008+
10281009
case 10:
10291010
if sim, err := e.GetString(&pathSysmonSourceImage); err == nil {
10301011
if err = dumpFileAndCompress(sim, dumpPath); err != nil {
10311012
log.Errorf("Error dumping file from EventID=%d \"%s\": %s", e.EventID(), sim, err)
10321013
}
10331014
}
1015+
10341016
case 13, 20:
10351017
// for event ID 13
10361018
path := &pathSysmonDetails
@@ -1049,6 +1031,40 @@ func hookDumpFile(e *evtx.GoEvtxMap) {
10491031
}
10501032
}
10511033
}
1034+
1035+
default:
1036+
if cl, err := e.GetString(&pathSysmonCommandLine); err == nil {
1037+
if cwd, err := e.GetString(&pathSysmonCurrentDirectory); err == nil {
1038+
if argv, err := utils.ArgvFromCommandLine(cl); err == nil {
1039+
if len(argv) > 1 {
1040+
for _, arg := range argv[1:] {
1041+
if fsutil.IsFile(arg) && !utils.IsPipePath(arg) {
1042+
if err = dumpFileAndCompress(arg, dumpPath); err != nil {
1043+
log.Errorf("Error dumping file from EventID=%d \"%s\": %s", e.EventID(), arg, err)
1044+
}
1045+
}
1046+
// try to dump a path relative to CWD
1047+
relarg := filepath.Join(cwd, arg)
1048+
if fsutil.IsFile(relarg) && !utils.IsPipePath(relarg) {
1049+
if err = dumpFileAndCompress(relarg, dumpPath); err != nil {
1050+
log.Errorf("Error dumping file from EventID=%d \"%s\": %s", e.EventID(), relarg, err)
1051+
}
1052+
}
1053+
}
1054+
}
1055+
}
1056+
}
1057+
}
1058+
if im, err := e.GetString(&pathSysmonImage); err == nil {
1059+
if err = dumpFileAndCompress(im, dumpPath); err != nil {
1060+
log.Errorf("Error dumping file from EventID=%d \"%s\": %s", e.EventID(), im, err)
1061+
}
1062+
}
1063+
if pim, err := e.GetString(&pathSysmonParentImage); err == nil {
1064+
if err = dumpFileAndCompress(pim, dumpPath); err != nil {
1065+
log.Errorf("Error dumping file from EventID=%d \"%s\": %s", e.EventID(), pim, err)
1066+
}
1067+
}
10521068
}
10531069
}()
10541070
}

‎tools/whids/whids.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -298,7 +298,8 @@ func (h *HIDS) initHooks(advanced bool) {
298298
h.preHooks.Hook(hookEnrichServices, fltAnySysmon)
299299
// Not needed anymore enrich sysmon embeds necessary information
300300
//h.preHooks.Hook(hookProcessAccess, fltProcessAccess)
301-
h.preHooks.Hook(hookNetwork, fltNetworkConnect)
301+
// should be treated by hookEnrichAnySysmon
302+
//h.preHooks.Hook(hookNetwork, fltNetworkConnect)
302303
h.preHooks.Hook(hookEnrichAnySysmon, fltAnySysmon)
303304
//h.preHooks.Hook(hookSetValueSize, fltRegSetValue)
304305

0 commit comments

Comments
 (0)