diff --git a/CHANGELOG-Japanese.md b/CHANGELOG-Japanese.md index c39e7f6f9..b5b5f5e42 100644 --- a/CHANGELOG-Japanese.md +++ b/CHANGELOG-Japanese.md @@ -5,6 +5,7 @@ **新機能:** - `fieldref`モディファイア(`equalsfield`モディファイアのエリアス)に対応した。(#1409) (@hitenkoku) +- `fieldref|endswith`モディファイアは、`endswithfield`をリプレースするためのエイリアスとして作成された。(#1437) (@fukusuket) - XORエンコードされたルールをサポートし、端末に置かれるファイルを最小限に抑えるとともに、ルールに過検知するアンチウイルス製品を回避する。(#1419) (@fukusuket) - リリースページで、この機能を設定済みのパッケージを含める予定。手動で設定したい場合は、[encoded_rules.yml](https://github.com/Yamato-Security/hayabusa-encoded-rules/raw/refs/heads/main/encoded_rules.yml)をダウンロードして、Hayabusaのルートフォルダに置いてください。このファイルは、hayabusa-rulesリポジトリ内のルールから作成されており、ルールが更新されるたびに自動的にアップデートされる。configディレクトリ以外のrulesフォルダ内のファイルは、まだ単一ファイルに含まれていないので削除してください。 - 注意: -Hオプションで生成されるレポートは、ルールへのリンクを作成せず、ルール名だけが出力される。 diff --git a/CHANGELOG.md b/CHANGELOG.md index a4093b315..b031583ec 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,7 @@ **New Features:** - Support for the `fieldref` modifier (alias to the `equalsfield` modifier). (#1409) (@hitenkoku) +- The `fieldref|endswith` modifier was created as an alias to `endswithfield` to replace it in the future. (#1437) (@fukusuket) - Support for XOR encoded rules to minimize files put on the system as well as bypass anti-virus products that give false positives on rules. (#1419) (@fukusuket) - We will include packages in the Releases page that are already configured to use this. If you wanted to manually configure this though, download [encoded_rules.yml](https://github.com/Yamato-Security/hayabusa-encoded-rules/raw/refs/heads/main/encoded_rules.yml) and place it in the Hayabusa's root folder. This file is created from the rules in the hayabusa-rules repository and is automatically updated anytime there is a rule update. Delete all of the files inside the `rules` folder except for the `config` directory as those files are not yet contained in a single file. - Note: The report generated by the `-H` option cannot create a link to the rule (only the rule name is outputted.) diff --git a/src/detections/rule/matchers.rs b/src/detections/rule/matchers.rs index bf436ffce..17faf3a89 100644 --- a/src/detections/rule/matchers.rs +++ b/src/detections/rule/matchers.rs @@ -362,15 +362,20 @@ impl LeafMatcher for DefaultMatcher { if keys_all[0].is_empty() && keys_all.len() == 2 && keys_all[1] == "all" { keys_all[1] = change_map["all"]; } - if keys_all.len() >= 3 && keys_all[1] == "re" { - if keys_all[2] == "i" { - keys_all[2] = change_map["i"]; - } else if keys_all[2] == "m" { - keys_all[2] = change_map["m"]; - } else if keys_all[2] == "s" { - keys_all[2] = change_map["s"]; - } - keys_all.remove(1); + if keys_all.len() >= 3 { + if keys_all[1] == "re" { + if keys_all[2] == "i" { + keys_all[2] = change_map["i"]; + } else if keys_all[2] == "m" { + keys_all[2] = change_map["m"]; + } else if keys_all[2] == "s" { + keys_all[2] = change_map["s"]; + } + keys_all.remove(1); + } else if keys_all[1] == "fieldref" && keys_all[2] == "endswith" { + keys_all[1] = "fieldrefendswith"; + keys_all.remove(2); + } } let keys_without_head = &keys_all[1..]; @@ -741,6 +746,7 @@ impl PipeElement { "equalsfield" => Option::Some(PipeElement::EqualsField(pattern.to_string())), "endswithfield" => Option::Some(PipeElement::Endswithfield(pattern.to_string())), "fieldref" => Option::Some(PipeElement::FieldRef(pattern.to_string())), + "fieldrefendswith" => Option::Some(PipeElement::Endswithfield(pattern.to_string())), // endswithfieldを廃止したらfieldrefに置き換え "base64offset" => Option::Some(PipeElement::Base64offset), "windash" => Option::Some(PipeElement::Windash), "cidr" => Option::Some(PipeElement::Cidr(IpCidr::from_str(pattern))), @@ -2468,6 +2474,43 @@ mod tests { check_select(rule_str, record_json_str, false); } + #[test] + fn test_eq_field_ref_endswith() { + // fieldrefで正しく検知できることを確認 + let rule_str = r#" + detection: + selection: + Channel|fieldref|endswith: Computer + details: 'command=%CommandLine%' + "#; + + let record_json_str = r#" + { + "Event": {"System": {"EventID": 4103, "Channel": "Security", "Computer": "rity" }}, + "Event_attributes": {"xmlns": "http://sc-allhemas.microsoft.com/win/2004/08/events/event"} + }"#; + + check_select(rule_str, record_json_str, true); + } + + #[test] + fn test_eq_field_ref_notdetect_endswith() { + // fieldrefの検知できないパターン + let rule_str = r#" + detection: + selection: + Channel|fieldref: Computer + details: 'command=%CommandLine%' + "#; + + let record_json_str = r#" + { + "Event": {"System": {"EventID": 4103, "Channel": "Security", "Computer": "Powershell" }}, + "Event_attributes": {"xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"} + }"#; + check_select(rule_str, record_json_str, false); + } + #[test] fn test_eq_field() { // equalsfieldsで正しく検知できることを確認