Hayabusa crashes with -n option

[YamatoSecurity]

Describe the bug
Hayabusa crashes when I specify -n

Step to Reproduce
./target/release/hayabusa -d ../hayabusa-sample-evtx -r ../hayabusa-rules -C ../hayabusa-rules/config -o sample-evtx.csv -n

Expected behavior
No crash

Screenshots

./target/release/hayabusa -d ../hayabusa-sample-evtx  -n -q
Analyzing event files: 573
Hayabusa rules: 116
Sigma rules: 1358
Ignored rules: 73
Rule parsing errors: 0
Total enabled detection rules: 1474

33 / 573 [==========>-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 5.76 % 44s thread 'yea-thread' panicked at 'called `Option::unwrap()` on a `None` value', src/detections/rule/matchers.rs:216:33
stack backtrace:
   0:        0x10ce184b6 - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::h4cae82d438451481
   1:        0x10ccbda2b - core::fmt::write::hb68c3045179d0cad
   2:        0x10ce16e30 - std::io::Write::write_fmt::haf84c797e63d79f0
   3:        0x10ce1bea2 - std::panicking::default_hook::{{closure}}::he18137441e51da1f
   4:        0x10ce1cecc - std::panicking::rust_panic_with_hook::h429a7ddefa5f0258
   5:        0x10ce1c90f - std::panicking::begin_panic_handler::{{closure}}::h9b033a6b15b84a74
   6:        0x10ce1c8a9 - std::sys_common::backtrace::__rust_end_short_backtrace::hcdd3bec8e0e38aa6
   7:        0x10ce1c865 - _rust_begin_unwind
   8:        0x10d020e63 - core::panicking::panic_fmt::hf7d6e5207e013f69
   9:        0x10d020f97 - core::panicking::panic::hdb1992cacba5f03a
  10:        0x10cd05c87 - <hayabusa::detections::rule::matchers::DefaultMatcher as hayabusa::detections::rule::matchers::LeafMatcher>::is_match::hdf8bbff68b4431fd
  11:        0x10cd05d69 - <hayabusa::detections::rule::selectionnodes::AndSelectionNode as hayabusa::detections::rule::selectionnodes::SelectionNode>::select::h4b13d6caa1dc3240
  12:        0x10cd05dc9 - <hayabusa::detections::rule::selectionnodes::OrSelectionNode as hayabusa::detections::rule::selectionnodes::SelectionNode>::select::h7df8ae3a4548decc
  13:        0x10cd062d1 - <hayabusa::detections::rule::selectionnodes::NotSelectionNode as hayabusa::detections::rule::selectionnodes::SelectionNode>::select::hf01e0c4ed4c1f45e
  14:        0x10cd05d69 - <hayabusa::detections::rule::selectionnodes::AndSelectionNode as hayabusa::detections::rule::selectionnodes::SelectionNode>::select::h4b13d6caa1dc3240
  15:        0x10cd05dc9 - <hayabusa::detections::rule::selectionnodes::OrSelectionNode as hayabusa::detections::rule::selectionnodes::SelectionNode>::select::h7df8ae3a4548decc
  16:        0x10cd500d0 - hayabusa::detections::rule::RuleNode::select::h6b42b5eb13638e58
  17:        0x10cd27959 - hayabusa::detections::detection::Detection::execute_rule::hffaf02a3d03c5fe9
  18:        0x10cd4a05e - tokio::runtime::task::harness::poll_future::h27681604da9f6e9e
  19:        0x10cd14ec7 - tokio::runtime::task::raw::poll::h64b3a71ff5b80b90
  20:        0x10ce34b04 - tokio::runtime::thread_pool::worker::Context::run_task::ha92dae581f8a3c7c
  21:        0x10ce39310 - tokio::runtime::task::raw::poll::ha94ef325c6f91a44
  22:        0x10ce287b4 - std::sys_common::backtrace::__rust_begin_short_backtrace::h8273369e087fee37
  23:        0x10ce21b7a - core::ops::function::FnOnce::call_once{{vtable.shim}}::h598f01d5c32c50f0
  24:        0x10ce1e609 - std::sys::unix::thread::Thread::new::thread_start::h9b70539161da4eaf
  25:     0x7ff809f8f4e1 - __pthread_start
thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: JoinError::Panic(...)', src/detections/detection.rs:147:41
stack backtrace:
   0:        0x10ce184b6 - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::h4cae82d438451481
   1:        0x10ccbda2b - core::fmt::write::hb68c3045179d0cad
   2:        0x10ce16e30 - std::io::Write::write_fmt::haf84c797e63d79f0
   3:        0x10ce1bea2 - std::panicking::default_hook::{{closure}}::he18137441e51da1f
   4:        0x10ce1cecc - std::panicking::rust_panic_with_hook::h429a7ddefa5f0258
   5:        0x10ce1c934 - std::panicking::begin_panic_handler::{{closure}}::h9b033a6b15b84a74
   6:        0x10ce1c8a9 - std::sys_common::backtrace::__rust_end_short_backtrace::hcdd3bec8e0e38aa6
   7:        0x10ce1c865 - _rust_begin_unwind
   8:        0x10d020e63 - core::panicking::panic_fmt::hf7d6e5207e013f69
   9:        0x10d021175 - core::result::unwrap_failed::h95d9e30ede493473
  10:        0x10cd2508b - <core::future::from_generator::GenFuture<T> as core::future::future::Future>::poll::h9f66300fdbc651ff
  11:        0x10cd255af - hayabusa::detections::detection::Detection::start::h99f0019509df7914
  12:        0x10cc51cab - hayabusa::App::analysis_files::hcf4fc3d1f55392e3
  13:        0x10cc41ca1 - hayabusa::App::exec::h6f96d2c6434794df
  14:        0x10cc3df83 - hayabusa::main::h4919bcdeb6ff6565
  15:        0x10cd737b6 - std::sys_common::backtrace::__rust_begin_short_backtrace::hb0cfaf3909830e29
  16:        0x10cc5e6ad - _main

Environment (please complete the following information):

• OS: Mac
• hayabusa version 1.2.0

[hitenkoku]

以下コマンドでWindows機でも確認できました。 -n をなくしたらエラーが出ていないので、特定のルールで何かしら問題が起こっていそうです。一旦、原因となっているルールがどれかを確認します。

./target/release/hayabusa -d ../hayabusa-sample-evtx -n -q

[hitenkoku]

-vをつけた際に ./hayabusa-sample-evtx\EVTX-ATTACK-SAMPLES\Command and Control\DE_sysmon-3-rdp-tun.evtx でエラーが出ていることを確認済み

./target/release/hayabusa -d ../hayabusa-sample-evtx -n -q -v
33 / 509 [=========>----------------------------------------------------------------------------------------------------------------------------------------] 6.48 % 2m
Checking target evtx FilePath: "./hayabusa-sample-evtx\EVTX-ATTACK-SAMPLES\Command and Control\DE_sysmon-3-rdp-tun.evtx"

[hitenkoku]

以下2つのnoisy_ruleを検知ルールとして加えたときにエラーが出ることを確認しました。

0090ea60-f4a2-43a8-8657-3a9a4ddcf547 # Sysmon 6 Driver Loaded - Unknown Signature. It is not possible to list up all good signatures so will be many false positives.
8b8db936-172e-4bb7-9f84-ccc954d51d93 # Sysmon 7 DLL Loaded - No Alerts

[YamatoSecurity]

原因特定ありがとうございます！
Sysmon 6 DriverのルールのSignature: の設定されていないところが怪しいので、修正してみます。
しかし、./target/release/hayabusa -d ../hayabusa-sample-evtx -r ../hayabusa-rules/hayabusa/sysmon/events/ -n　を実行しても、無事に終わるので、不思議・・

[YamatoSecurity]

@hitenkoku
多分、これで直ります。Yamato-Security/hayabusa-rules#49
ご確認下さい。
ルールミスで失礼しました。

[hitenkoku]

ご対応ありがとうございます。こちらでも確認して問題なければこのissueはクローズしておきます

[hitenkoku]

@YamatoSecurity 確認できました。hayabusa側のrulesの紐づけを変更するpull requestを出しますので承認のほどよろしくお願いいたします