feat(filter): Add image.is_dotnet filter field

rabbitstack · rabbitstack · commit 4d625663ba65 · 2024-10-02T18:33:40.000+02:00
This field indicates if the loaded image is
a dotnet assembly by parsing the PE CLR metadata.
diff --git a/pkg/filter/_fixtures/mscorlib.dll b/pkg/filter/_fixtures/mscorlib.dll
diff --git a/pkg/filter/accessor_windows.go b/pkg/filter/accessor_windows.go
@@ -869,6 +869,12 @@ func (i *imageAccessor) Get(f fields.Field, kevt *kevent.Kevent) (kparams.Value,
 		return kevt.Kparams.GetBool(kparams.FileIsDriver)
 	case fields.ImageIsExecutable:
 		return kevt.Kparams.GetBool(kparams.FileIsExecutable)
+	case fields.ImageIsDotnet:
+		p, err := pe.ParseFile(kevt.GetParamAsString(kparams.ImageFilename), pe.WithCLR())
+		if err != nil {
+			return nil, err
+		}
+		return p.IsDotnet, nil
 	}
 	return nil, nil
 }
diff --git a/pkg/filter/fields/fields_windows.go b/pkg/filter/fields/fields_windows.go
@@ -433,6 +433,8 @@ const (
 	ImageIsDriver Field = "image.is_driver"
 	// ImageIsExecutable indicates if the loaded image is an executable
 	ImageIsExecutable Field = "image.is_exec"
+	// ImageIsDotnet indicates if the loaded image is a .NET assembly
+	ImageIsDotnet Field = "image.is_dotnet"
 
 	// MemBaseAddress identifies the field that denotes the allocation base address
 	MemBaseAddress Field = "mem.address"
@@ -703,6 +705,7 @@ var fields = map[Field]FieldInfo{
 	ImageIsDLL:              {ImageIsDLL, "indicates if the loaded image is a DLL", kparams.Bool, []string{"image.is_dll'"}, nil},
 	ImageIsDriver:           {ImageIsDriver, "indicates if the loaded image is a driver", kparams.Bool, []string{"image.is_driver'"}, nil},
 	ImageIsExecutable:       {ImageIsExecutable, "indicates if the loaded image is an executable", kparams.Bool, []string{"image.is_exec'"}, nil},
+	ImageIsDotnet:           {ImageIsDotnet, "indicates if the loaded image is a .NET assembly", kparams.Bool, []string{"image.is_dotnet'"}, nil},
 
 	FileObject:             {FileObject, "file object address", kparams.Uint64, []string{"file.object = 18446738026482168384"}, nil},
 	FileName:               {FileName, "full file name", kparams.UnicodeString, []string{"file.name contains 'mimikatz'"}, nil},
diff --git a/pkg/filter/filter_test.go b/pkg/filter/filter_test.go
@@ -672,6 +672,7 @@ func TestImageFilter(t *testing.T) {
 		{`image.base.address = '7ffb313833a3'`, true},
 		{`image.cert.issuer icontains 'Microsoft Windows'`, true},
 		{`image.cert.subject icontains 'Microsoft Corporation'`, true},
+		{`image.is_dotnet`, false},
 	}
 
 	for i, tt := range tests {
@@ -735,6 +736,41 @@ func TestImageFilter(t *testing.T) {
 	}
 
 	assert.NotNil(t, signature.GetSignatures().GetSignature(0x7ccb313833a3))
+
+	kevt2 := &kevent.Kevent{
+		Type:     ktypes.LoadImage,
+		Category: ktypes.Image,
+		Kparams: kevent.Kparams{
+			kparams.ImageFilename:       {Name: kparams.ImageFilename, Type: kparams.UnicodeString, Value: "_fixtures\\mscorlib.dll"},
+			kparams.ProcessID:           {Name: kparams.ProcessID, Type: kparams.PID, Value: uint32(1023)},
+			kparams.ImageCheckSum:       {Name: kparams.ImageCheckSum, Type: kparams.Uint32, Value: uint32(2323432)},
+			kparams.ImageBase:           {Name: kparams.ImageBase, Type: kparams.Address, Value: uint64(0xfff313833a3)},
+			kparams.ImageSignatureType:  {Name: kparams.ImageSignatureType, Type: kparams.Enum, Value: uint32(0), Enum: signature.Types},
+			kparams.ImageSignatureLevel: {Name: kparams.ImageSignatureLevel, Type: kparams.Enum, Value: uint32(0), Enum: signature.Levels},
+		},
+	}
+
+	var tests2 = []struct {
+		filter  string
+		matches bool
+	}{
+
+		{`image.pid = 1023`, true},
+		{`image.name endswith 'mscorlib.dll'`, true},
+		{`image.is_dotnet`, true},
+	}
+
+	for i, tt := range tests2 {
+		f := New(tt.filter, cfg)
+		err := f.Compile()
+		if err != nil {
+			t.Fatal(err)
+		}
+		matches := f.Run(kevt2)
+		if matches != tt.matches {
+			t.Errorf("%d. %q image filter mismatch: exp=%t got=%t", i, tt.filter, tt.matches, matches)
+		}
+	}
 }
 
 func TestPEFilter(t *testing.T) {

Original file line number	Diff line number	Diff line change
`@@ -869,6 +869,12 @@ func (i imageAccessor) Get(f fields.Field, kevt kevent.Kevent) (kparams.Value,`
`869`	`869`	`return kevt.Kparams.GetBool(kparams.FileIsDriver)`
`870`	`870`	`case fields.ImageIsExecutable:`
`871`	`871`	`return kevt.Kparams.GetBool(kparams.FileIsExecutable)`
	`872`	`+ case fields.ImageIsDotnet:`
	`873`	`+ p, err := pe.ParseFile(kevt.GetParamAsString(kparams.ImageFilename), pe.WithCLR())`
	`874`	`+ if err != nil {`
	`875`	`+ return nil, err`
	`876`	`+ }`
	`877`	`+ return p.IsDotnet, nil`
`872`	`878`	`}`
`873`	`879`	`return nil, nil`
`874`	`880`	`}`