Search Examples

Following is a simple .audit file that looks for any .tns file that contains the word “Nessus” anywhere in the document.

When running this command, the following output is expected:

These results show that we found a match. The report says we “failed” because we found data we were not looking for. For example, if you are doing an audit for a Social Security number and had a positive match of the Social Security number on the public computer, although the match is positive, it is logged as a failure for compliance reasons.

Following is a simple .audit file that looks for any .tns file that contains the word “France” anywhere in the document.

The output we get this time is as follows:

We were able to “pass” the audit because none of the .tns files we audited had the word “France” in them.

Adding a second extension for file searches of Microsoft Word documents is very easy and shown below:

The results (on our test computer) were as follows:

We have the same “failure” as before with our test .tns file, but in this case, there was a second file that was a .doc that also had the word “Nessus” in it. If you are performing these tests on your own systems, you may or may not have a Word file that contains the word “Nessus” in it.

Now we will add in our first regular expression to match an 11-digit number. We just need to add in the regular expression with the regex keyword to the same .audit file as before.

Running this produces the following output:

The .doc file that matched in the last example is still being searched. Since it does not have the 11-digit number in it, it is not showing up anymore. Also, note that since we are using the regex keyword, we also get a match displayed in the data.

What if we needed to find a 10 digit number? The 11-digit number above has two 10-digit numbers in it (0123456789 and 1234567890). If we wanted to write a more exact match for just 11 digits, what we really want then is a regular expression that says:

“Match any 11 digit number not preceded or followed by any other numbers”.

To do this in regular expressions we can add the “not” operator like this:

Reading from left to right, we also see the “^” character and the dollar sign character a few times. The “^” sometimes means the start of a line and other times it means to match the negative. The dollar sign means the end of a line. The above regular expression basically means to look for any patterns that do not start with a number but potentially start on a new line, contains 11 numbers and then are not followed by any more numbers or has a line end. Regular expressions treat the beginning and end of a line as special cases, hence requiring the use of the “^” or “$” characters.

Adding the keyword only_show to our .audit file can limit the output. This can limit the auditors to only having access to the sensitive data they are looking for.

When matched, the data is obscured with “X” characters as shown below:

In this example, we will examine the use of the max_size keyword. In our test file, the word “Correlation” is more than 50 bytes into the file.

When running this, we get a passing match:

Change the max_size value from “50” to “50K” and rerun the scan. Now we get an error:

In this example, we will examine the use of the regex_replace keyword. Consider the following .audit file:

This check outputs as follows:

However, consider what can occur if we really needed to have a regular expression that matched on the “Passive” and “Scanner” parts, but we were only interested in returning the “Vulnerability” part. A new regular expression would look like this:

The check still returns the entire match of “Passive Vulnerability Scanner” because the regular expression statement treats the entire string as the first match. To get only the second match, we need to add in the regex_replace keyword.

The output from the scan is as follows:

We use a “\3” to indicate the second item in our matching because the first (“\1”) is the entire string. If we had used “\2”, we would have returned “Passive” and a “\4” would have returned “Scanner”.

Why does this feature exist? When searching for complex data patterns, such as credit card numbers, it is not always possible to get the first match to be the desired data. This keyword provides more flexibility in capturing the desired data with greater accuracy.

If you consider the .audit file from the third example, it returned a result for both a .tns file and a .doc file.

The results (on our test computer) were as follows:

The file_name keyword can also be used to filter out files we want or do not want. Adding it to the .audit file and asking it to only consider files with “tenable” in their name looks like this:

The output is as follows:

The matching .doc file is not present because it did not have the word “tenable” in its path.

The matching string is a regular expression, so it can be very flexible to match a wide variety of files we want and do not want. For example, we could have used the string “[Tt]enable” to match the word “Tenable” or “tenable”. Similarly, if we want to match an extension or a partial extension, we need to escape the dot with a slash such as “\.t” to look for any extensions that start with “t”.

The “include_paths” and “exclude_paths” keywords may be used to filter searches based on drive letter, directory and even file name exclusion.

The output is as follows:

Note that the output does not differ from a standard Windows file content search result, but, excludes the excluded path. If a single path is included using “include_paths” (e.g., “c:\”), all other paths are excluded automatically. Also, if a drive letter is excluded (e.g., “d:\”), but, a folder under that drive is included (e.g., “d:\users”), the “exclude_paths” keyword takes precedence and the drive will not be searched. However, you can include a drive C:\ and then exclude a subfolder within the drive (e.g., C:\users:).