Sort search timeline order

[hitenkoku]

What Changed

• Sorted search timeline order

Evidence

• main

> ./main.exe search -d ../hayabusa-sample-evtx/DeepBlueCLI -k "null"
...
2016-08-18T16:53:28.080953Z ‖ IE10Win7 ‖ Sec ‖ 4688 ‖ 5586 ‖ Process created ‖ CommandLine:  ¦ NewProcessId: 0xf98 ¦ NewProcessName: C:\Windows\System32\svchost.exe ¦ ProcessId: 0x1dc ¦ SubjectDomainName: WORKGROUP ¦ SubjectLogonId: 0x3e7 ¦ SubjectUserName: IE10WIN7$ ¦ SubjectUserSid: S-1-5-18 ¦ TokenElevationType: %%1936 ‖ ..\hayabusa-sample-evtx\DeepBlueCLI\many-events-security.evtx
2014-11-26T17:42:33.526375Z ‖ IE9Win7 ‖ Sec ‖ 1100 ‖ 4462 ‖ Event logging service shutdown ‖ xmlns: auto-ns3:http://schemas.microsoft.com/win/2004/08/events ‖ ..\hayabusa-sample-evtx\DeepBlueCLI\many-events-security.evtx
2013-10-23T19:16:51.447750Z ‖ IE8Win7 ‖ Sec ‖ 4907 ‖ 2452 ‖ Auditing settings on object changed ‖ HandleId: 0x1c ¦ NewSd: S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) ¦ ObjectName: C:\Windows\diagnostics\system\WindowsMediaPlayerPlayDVD\en-US\CL_LocalizationData.psd1 ¦ ObjectServer: Security ¦ ObjectType: File ¦ OldSd:  ¦ ProcessId: 0x794 ¦ ProcessName: C:\Windows\System32\poqexec.exe ¦ SubjectDomainName: WORKGROUP ¦ SubjectLogonId: 0x3e7 ¦ SubjectUserName: IE8WIN7$ ¦ SubjectUserSid: S-1-5-18 ‖ ..\hayabusa-sample-evtx\DeepBlueCLI\many-events-security.evtx
2014-11-26T23:26:42.291676Z ‖ IE10Win7 ‖ Sec ‖ 1100 ‖ 4626 ‖ Event logging service shutdown ‖ xmlns: auto-ns3:http://schemas.microsoft.com/win/2004/08/events ‖ ..\hayabusa-sample-evtx\DeepBlueCLI\many-events-security.evtx
2016-09-02T14:37:01.220336Z ‖ IE10Win7 ‖ Sec ‖ 4688 ‖ 9309 ‖ Process created ‖ CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 2a0 -NGENProcess 384 -Pipe 37c -Comment "NGen Worker Process" ¦ NewProcessId: 0x16ec ¦ NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe ¦ ProcessId: 0x1510 ¦ SubjectDomainName: WORKGROUP ¦ SubjectLogonId: 0x3e7 ¦ SubjectUserName: IE10WIN7$ ¦ SubjectUserSid: S-1-5-18 ¦ TokenElevationType: %%1936 ‖ ..\hayabusa-sample-evtx\DeepBlueCLI\many-events-security.evtx
2014-11-26T17:43:56.000000Z ‖ IE9Win7 ‖ Sys ‖ 7036 ‖ 4085 ‖ The service entered the running/stopped state ‖ Binary: 4D00700073005300760063002F0034000000 ¦ param1: Windows Firewall ¦ param2: running ‖ ..\hayabusa-sample-evtx\DeepBlueCLI\many-events-system.evtx
...

• This PR

> ./1033.exe search -d ../hayabusa-sample-evtx/DeepBlueCLI -k "null"
...
2020-09-14T14:47:36.087326Z ‖ Sec504Student ‖ Sec ‖ 4673 ‖ 39402 ‖ Privileged service called ‖ ObjectServer: NT Local Security Authority / Authentication Service ¦ PrivilegeList: SeTcbPrivilege ¦ ProcessId: 0x240 ¦ ProcessName: C:\Windows\System32\lsass.exe ¦ Service: LsaRegisterLogonProcess() ¦ SubjectDomainName: SEC504 ¦ SubjectLogonId: 0x3e7 ¦ SubjectUserName: SEC504STUDENT$ ¦ SubjectUserSid: S-1-5-18 ‖ ..\hayabusa-sample-evtx\DeepBlueCLI\eventlog-dac.evtx
2020-09-14T14:47:36.150289Z ‖ Sec504Student ‖ Sec ‖ 4673 ‖ 39403 ‖ Privileged service called ‖ ObjectServer: NT Local Security Authority / Authentication Service ¦ PrivilegeList: SeTcbPrivilege ¦ ProcessId: 0x240 ¦ ProcessName: C:\Windows\System32\lsass.exe ¦ Service: LsaRegisterLogonProcess() ¦ SubjectDomainName: SEC504 ¦ SubjectLogonId: 0x3e7 ¦ SubjectUserName: SEC504STUDENT$ ¦ SubjectUserSid: S-1-5-18 ‖ ..\hayabusa-sample-evtx\DeepBlueCLI\eventlog-dac.evtx
2020-09-14T14:47:56.548315Z ‖ Sec504Student ‖ Sec ‖ 4673 ‖ 39404 ‖ Privileged service called ‖ ObjectServer: NT Local Security Authority / Authentication Service ¦ PrivilegeList: SeTcbPrivilege ¦ ProcessId: 0x240 ¦ ProcessName: C:\Windows\System32\lsass.exe ¦ Service: LsaRegisterLogonProcess() ¦ SubjectDomainName: SEC504 ¦ SubjectLogonId: 0x3e7 ¦ SubjectUserName: SEC504STUDENT$ ¦ SubjectUserSid: S-1-5-18 ‖ ..\hayabusa-sample-evtx\DeepBlueCLI\eventlog-dac.evtx
2020-09-14T14:47:56.604177Z ‖ Sec504Student ‖ Sec ‖ 4673 ‖ 39405 ‖ Privileged service called ‖ ObjectServer: NT Local Security Authority / Authentication Service ¦ PrivilegeList: SeTcbPrivilege ¦ ProcessId: 0x240 ¦ ProcessName: C:\Windows\System32\lsass.exe ¦ Service: LsaRegisterLogonProcess() ¦ SubjectDomainName: SEC504 ¦ SubjectLogonId: 0x3e7 ¦ SubjectUserName: SEC504STUDENT$ ¦ SubjectUserSid: S-1-5-18 ‖ ..\hayabusa-sample-evtx\DeepBlueCLI\eventlog-dac.evtx
2020-09-14T14:48:28.683048Z ‖ Sec504Student ‖ Sec ‖ 4674 ‖ 39406 ‖ Privileged object operation attempt ‖ AccessMask: %%1539 ¦ HandleId: 0xffff820cb1d95928 ¦ ObjectName: nginx ¦ ObjectServer: SC Manager ¦ ObjectType: SERVICE OBJECT ¦ PrivilegeList: SeSecurityPrivilege ¦ ProcessId: 0x21c ¦ ProcessName: C:\Windows\System32\services.exe ¦ SubjectDomainName: SEC504STUDENT ¦ SubjectLogonId: 0x99e3d ¦ SubjectUserName: Sec504 ¦ SubjectUserSid: S-1-5-21-2977773840-2930198165-1551093962-1000 ‖ ..\hayabusa-sample-evtx\DeepBlueCLI\eventlog-dac.evtx
2020-09-14T14:48:33.269272Z ‖ Sec504Student ‖ Sec ‖ 4673 ‖ 39407 ‖ Privileged service called ‖ ObjectServer: NT Local Security Authority / Authentication Service ¦ PrivilegeList: SeTcbPrivilege ¦ ProcessId: 0x240 ¦ ProcessName: C:\Windows\System32\lsass.exe ¦ Service: LsaRegisterLogonProcess() ¦ SubjectDomainName: SEC504 ¦ SubjectLogonId: 0x3e7 ¦ SubjectUserName: SEC504STUDENT$ ¦ SubjectUserSid: S-1-5-18 ‖ ..\hayabusa-sample-evtx\DeepBlueCLI\eventlog-dac.evtx
2020-09-14T14:48:33.327039Z ‖ Sec504Student ‖ Sec ‖ 4673 ‖ 39408 ‖ Privileged service called ‖ ObjectServer: NT Local Security Authority / Authentication Service ¦ PrivilegeList: SeTcbPrivilege ¦ ProcessId: 0x240 ¦ ProcessName: C:\Windows\System32\lsass.exe ¦ Service: LsaRegisterLogonProcess() ¦ SubjectDomainName: SEC504 ¦ SubjectLogonId: 0x3e7 ¦ SubjectUserName: SEC504STUDENT$ ¦ SubjectUserSid: S-1-5-18 ‖ ..\hayabusa-sample-evtx\DeepBlueCLI\eventlog-dac.evtx
2020-09-14T14:48:39.875499Z ‖ Sec504Student ‖ Sec ‖ 4673 ‖ 39409 ‖ Privileged service called ‖ ObjectServer: NT Local Security Authority / Authentication Service ¦ PrivilegeList: SeTcbPrivilege ¦ ProcessId: 0x240 ¦ ProcessName: C:\Windows\System32\lsass.exe ¦ Service: LsaRegisterLogonProcess() ¦ SubjectDomainName: SEC504 ¦ SubjectLogonId: 0x3e7 ¦ SubjectUserName: SEC504STUDENT$ ¦ SubjectUserSid: S-1-5-18 ‖ ..\hayabusa-sample-evtx\DeepBlueCLI\eventlog-dac.evtx
2020-09-14T14:48:43.435750Z ‖ Sec504Student ‖ Sec ‖ 4673 ‖ 39410 ‖ Privileged service called ‖ ObjectServer: Security ¦ PrivilegeList: SeTcbPrivilege ¦ ProcessId: 0x2f4 ¦ ProcessName: C:\Windows\System32\svchost.exe ¦ Service: - ¦ SubjectDomainName: SEC504STUDENT ¦ SubjectLogonId: 0x99e5b ¦ SubjectUserName: Sec504 ¦ SubjectUserSid: S-1-5-21-2977773840-2930198165-1551093962-1000 ‖ ..\hayabusa-sample-evtx\DeepBlueCLI\eventlog-dac.evtx
2020-09-14T14:50:22.503205Z ‖ Sec504Student ‖ Sec ‖ 4673 ‖ 39411 ‖ Privileged service called ‖ ObjectServer: Security ¦ PrivilegeList: SeIncreaseBasePriorityPrivilege ¦ ProcessId: 0x1a4c ¦ ProcessName: C:\Windows\System32\audiodg.exe ¦ Service: - ¦ SubjectDomainName: NT AUTHORITY ¦ SubjectLogonId: 0x3e5 ¦ SubjectUserName: LOCAL SERVICE ¦ SubjectUserSid: S-1-5-19 ‖ ..\hayabusa-sample-evtx\DeepBlueCLI\eventlog-dac.evtx
2020-09-14T14:50:55.857558Z ‖ Sec504Student ‖ Sec ‖ 4798 ‖ 39412 ‖ - ‖ CallerProcessId: 0x10a4 ¦ CallerProcessName: C:\Windows\System32\mmc.exe ¦ SubjectDomainName: SEC504STUDENT ¦ SubjectLogonId: 0x99e3d ¦ SubjectUserName: Sec504 ¦ SubjectUserSid: S-1-5-21-2977773840-2930198165-1551093962-1000 ¦ TargetDomainName: SEC504STUDENT ¦ TargetSid: S-1-5-21-2977773840-2930198165-1551093962-1000 ¦ TargetUserName: Sec504 ‖ ..\hayabusa-sample-evtx\DeepBlueCLI\eventlog-dac.evtx
2020-09-14T14:50:55.907662Z ‖ Sec504Student ‖ Sec ‖ 4673 ‖ 39413 ‖ Privileged service called ‖ ObjectServer: Security ¦ PrivilegeList: SeTcbPrivilege ¦ ProcessId: 0x10a4 ¦ ProcessName: C:\Windows\System32\mmc.exe ¦ Service: - ¦ SubjectDomainName: SEC504STUDENT ¦ SubjectLogonId: 0x99e3d ¦ SubjectUserName: Sec504 ¦ SubjectUserSid: S-1-5-21-2977773840-2930198165-1551093962-1000 ‖ ..\hayabusa-sample-evtx\DeepBlueCLI\eventlog-dac.evtx
...

I would appreciate it if you could review.

[itiB]

I think this implementation is sufficient since it only sorts the search results and wouldn't take long time. Although I did consider implementing an option to sort the results, I believe it is unnecessary. LGTM👍

1033-sort-search-timeline-order❯ time ./target/debug/hayabusa search -d ../hayabusa-sample-evtx -k "mimikatz"

.......

Total findings: 35

Elapsed time: 00:01:04.255

./target/debug/hayabusa search -d ../hayabusa-sample-evtx -k "mimikatz"  67.06s user 5.50s system 112% cpu 1:04.71 total

main ❯ time ./target/debug/hayabusa search -d ../hayabusa-sample-evtx -k "mimikatz"

........

Total findings: 35


Elapsed time: 00:01:06.453

./target/debug/hayabusa search -d ../hayabusa-sample-evtx -k "mimikatz"  67.75s user 4.95s system 108% cpu 1:07.00 total

[YamatoSecurity]

@hitenkoku Looks great! Thanks so much! Now timeline analysis is much easier.