Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Field information is not outputted when the profile is all-field-info #1450

Closed
YamatoSecurity opened this issue Oct 14, 2024 · 1 comment · Fixed by #1452
Closed

Field information is not outputted when the profile is all-field-info #1450

YamatoSecurity opened this issue Oct 14, 2024 · 1 comment · Fixed by #1452
Assignees
Labels
bug Something isn't working

Comments

@YamatoSecurity
Copy link
Collaborator

@fukusuket Sorry for the many issues! I noticed there is a bug in both the correlation rules and the old count aggregation rules.
When using the all-field-info and all-field-info-verbose profiles which use the original field names, the field information does not get outputted.

Example:

./target/release/hayabusa csv-timeline -d ../hayabusa-sample-evtx -w -r ../hayabusa-rules/hayabusa/builtin/Security/LogonLogoff/Logon/Sec_4625_Med_LogonFail_WrongPW_PW-Guessing_Correlation.yml

gives the output:

2016-09-20 01:50:06.513 +09:00 · PW Guessing · med · DESKTOP-M5SN04R · Sec · 4625 · - · Count: 3558 ¦ TargetUserName: Administrator ¦ TargetDomainName: . ¦ IpAddress: 192.168.198.149 ¦ LogonType: 3 ¦ ProcessName: - ¦ LogonProcessName: NtLmSsp · -

However,

./target/release/hayabusa csv-timeline -d ../hayabusa-sample-evtx -w -r ../hayabusa-rules/hayabusa/builtin/Security/LogonLogoff/Logon/Sec_4625_Med_LogonFail_WrongPW_PW-Guessing_Correlation.yml -p all-field-info

gives:

2016-09-20 01:50:06.513 +09:00 · PW Guessing · med · DESKTOP-M5SN04R · Sec · 4625 · - · - · Sec_4625_Med_LogonFail_WrongPW_PW-Guessing_Correlation.yml · ../hayabusa-sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx

Same thing happens when using the ../hayabusa-rules/hayabusa/builtin/Security/LogonLogoff/Logon/Sec_4625_Med_LogonFail_WrongPW_PW-Guessing_Cnt_Deprecated.yml rule.

I would like to output the same regardless of what profile is being used.
These are the original field names and no name conversion is done so they are expected when all-field-info profiles are used.
In the future, I want to rename the fields like we do in details, etc.. but that will take some planning.
(See issue: #1445)

@YamatoSecurity YamatoSecurity added the bug Something isn't working label Oct 14, 2024
@YamatoSecurity YamatoSecurity added this to the 2.18.0 Sector Release milestone Oct 14, 2024
@fukusuket
Copy link
Collaborator

I see, it seems to be an omission in the implementation...😇 I'll fix it!💪

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants