Validate hash values

secureworks · Nov 8, 2023 · 53a577c · 53a577c
1 parent d764b05
commit 53a577c
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/cmd/harness/validate.go b/cmd/harness/validate.go
@@ -100,6 +100,8 @@ func CheckProcessEvent(testRun *SingleTestRun, evt *types.SimpleEvent, nativeJso
 				isMatch = CheckMatch(evt.ProcessFields.Env, fc.Op, fc.Value)
 			case "is_elevated":
 				isMatch = CheckMatch(BoolAsString(evt.ProcessFields.IsElevated), fc.Op, fc.Value)
+			case "hashes":
+				isMatch = CheckMatch(evt.ProcessFields.Hashes, fc.Op, fc.Value)
 			default:
 				fmt.Println("ERROR: unknown FieldName", fc)
 			}