Skip to content

Add field data mapping to search command #1626

@YamatoSecurity

Description

@YamatoSecurity

It would be nice to have field data mapping working in the search command.
It would be on be default and can be disabled with --no-field-data-mapping Disable field data mapping under Output in the menu.

Now:
./target/release/hayabusa search -d ../hayabusa-sample-evtx -k hi

2021-12-14 23:42:48.817 +09:00 · Computer account created · rootdc1.offsec.lan · Sec · 4741 · 237294524 · AccountExpires: %%1794 ¦ AllowedToDelegateTo: - ¦ DisplayName: %%1793 ¦ DnsHostName: - ¦ HomeDirectory: %%1793 ¦ HomePath: %%1793 ¦ LogonHours: %%1793 ¦ NewUacValue: 0x84 ¦ OldUacValue: 0x0 ¦ PasswordLastSet: %%1794 ¦ PrimaryGroupId: 515 ¦ PrivilegeList: SeMachineAccountPrivilege ¦ ProfilePath: %%1793 ¦ SamAccountName: compnay-88$ ¦ ScriptPath: %%1793 ¦ ServicePrincipalNames: - ¦ SidHistory: - ¦ SubjectDomainName: OFFSEC ¦ SubjectLogonId: 0x308fb82ad ¦ SubjectUserName: hack1 ¦ SubjectUserSid: S-1-5-21-4230534742-2542757381-3142984815-1234 ¦ TargetDomainName: OFFSEC ¦ TargetSid: S-1-5-21-4230534742-2542757381-3142984815-1296 ¦ TargetUserName: compnay-88$ ¦ UserAccountControl: %%2082 %%2087 ¦ UserParameters: %%1792 ¦ UserPrincipalName: - ¦ UserWorkstations: %%1793 · ../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1136-Create account/ID4741-Computer account created with privileges.evtx

There are many %%1793 values that should be mapped according to the .yaml config files in the ./rules/config/data_mapping folder just like we do in csv-timeline and json-timeline.

Metadata

Metadata

Assignees

Labels

enhancementNew feature or request

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions