Yamato-Security / hayabusa

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
GNU General Public License v3.0
2.06k stars 182 forks source link

Support encrypted rules #1369

Open YamatoSecurity opened 1 week ago

YamatoSecurity commented 1 week ago

In order to prevent Windows defender from alerting on false positives on yml rules and to minimize the amount of files we need to save to the system, I would like to have hayabusa load the rules from an encrypted zip file that will be hosted at https://github.com/Yamato-Security/hayabusa-encrypted-rules Note: we should wait for https://github.com/Yamato-Security/hayabusa-encrypted-rules/issues/1 to be implemented before implementing this issue.

To implement:

  1. Add -e, --encrypted-rules Download encrypted rules to General Options in the update-rules command. This will delete all data in rules/* and download the rules.zip file from the hayabusa-encrypted-rules repository and save to the rules folder. (Note: I want to just download this specific file instead of git cloning the repository so we do not download unneeded files like the Readme, license, etc... The rules config files will also be in this file so Hayabusa should load the rules config file from the zip file. Since loading encrypted rules is mainly for using hayabusa when running on many PCs in a network, we do not need to worry about outputting the updated rules so we can skip the output of what rules were updated. We can just output the message The latest encrypted rules file was downloaded.
  2. When running Hayabusa, check if there is a rules.zip file in the rules directory. If there is, try to decrypt it with the yamato-security-hayabusa password and load the rules config and yml rules files and use those for scanning.

@hitenkoku Please tell me if this implementation sounds good or if you want to change something.

YamatoSecurity commented 1 week ago

Update: The encrypted rules.zip has been created through this issue: https://github.com/Yamato-Security/hayabusa-encrypted-rules/issues/1 So we can download the file from this URL: https://github.com/Yamato-Security/hayabusa-encrypted-rules/raw/main/rules.zip