misp-modules 2.4.196__py3-none-any.whl

misp_modules/modules/expansion/cve.py

@@ -0,0 +1,57 @@
+import json
+import requests
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['vulnerability'], 'output': ['text']}
+moduleinfo = {
+    'version': '0.4',
+    'author': 'Alexandre Dulaunoy',
+    'description': 'An expansion hover module to expand information about CVE id.',
+    'module-type': ['hover'],
+    'name': 'CVE Lookup',
+    'logo': 'cve.png',
+    'requirements': [],
+    'features': 'The module takes a vulnerability attribute as input and queries the CIRCL CVE search API to get information about the vulnerability as it is described in the list of CVEs.',
+    'references': ['https://vulnerability.circl.lu/', 'https://cve.mitre.org/'],
+    'input': 'Vulnerability attribute.',
+    'output': 'Text giving information about the CVE related to the Vulnerability.',
+}
+moduleconfig = ["custom_API"]
+cveapi_url = 'https://vulnerability.circl.lu/api/cve/'
+
+
+def check_url(url):
+    return "{}/".format(url) if not url.endswith('/') else url
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if not request.get('vulnerability'):
+        misperrors['error'] = 'Vulnerability id missing'
+        return misperrors
+
+    api_url = check_url(request['config']['custom_API']) if request.get('config') and request['config'].get('custom_API') else cveapi_url
+    r = requests.get("{}{}".format(api_url, request.get('vulnerability')))
+    if r.status_code == 200:
+        vulnerability = json.loads(r.text)
+        try:
+            summary = vulnerability['containers']['cna']['descriptions'][0]['value']
+        except Exception:
+            summary = 'Non existing CVE'
+    else:
+        misperrors['error'] = 'API not accessible'
+        return misperrors['error']
+
+    r = {'results': [{'types': mispattributes['output'], 'values': summary}]}
+    return r
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/cve_advanced.py

@@ -0,0 +1,185 @@
+import json
+import requests
+from . import check_input_attribute, standard_error_message
+from collections import defaultdict
+from pymisp import MISPAttribute, MISPEvent, MISPObject
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['vulnerability'], 'format': 'misp_standard'}
+moduleinfo = {
+    'version': '2',
+    'author': 'Christian Studer',
+    'description': 'An expansion module to query the CIRCL CVE search API for more information about a vulnerability (CVE).',
+    'module-type': ['expansion', 'hover'],
+    'name': 'CVE Advanced Lookup',
+    'logo': 'cve.png',
+    'requirements': [],
+    'features': 'The module takes a vulnerability attribute as input and queries the CIRCL CVE search API to gather additional information.\n\nThe result of the query is then parsed to return additional information about the vulnerability, like its cvss score or some references, as well as the potential related weaknesses and attack patterns.\n\nThe vulnerability additional data is returned in a vulnerability MISP object, and the related additional information are put into weakness and attack-pattern MISP objects.',
+    'references': ['https://vulnerability.circl.lu', 'https://cve/mitre.org/'],
+    'input': 'Vulnerability attribute.',
+    'output': 'Additional information about the vulnerability, such as its cvss score, some references, or the related weaknesses and attack patterns.',
+}
+moduleconfig = ["custom_API"]
+cveapi_url = 'https://cvepremium.circl.lu/api/'
+
+
+class VulnerabilityParser():
+    def __init__(self, attribute, api_url):
+        misp_attribute = MISPAttribute()
+        misp_attribute.from_dict(**attribute)
+        misp_event = MISPEvent()
+        misp_event.add_attribute(**misp_attribute)
+        self.__misp_attribute = misp_attribute
+        self.__misp_event = misp_event
+        self.__api_url = api_url
+        self.references = defaultdict(list)
+        self.__capec_features = ('id', 'name', 'summary', 'prerequisites', 'solutions')
+        self.__vulnerability_mapping = {
+            'id': 'id', 'summary': 'summary',
+            'Modified': 'modified', 'cvss3': 'cvss-score',
+            'cvss3-vector': 'cvss-string'
+        }
+        self.__vulnerability_multiple_mapping = {
+            'vulnerable_configuration': 'vulnerable-configuration',
+            'vulnerable_configuration_cpe_2_2': 'vulnerable-configuration',
+            'references': 'references'
+        }
+        self.__weakness_mapping = {
+            'name': 'name', 'description_summary': 'description',
+            'status': 'status', 'weaknessabs': 'weakness-abs'
+        }
+
+    @property
+    def api_url(self) -> str:
+        return self.__api_url
+
+    @property
+    def capec_features(self) -> tuple:
+        return self.__capec_features
+
+    @property
+    def misp_attribute(self) -> MISPAttribute:
+        return self.__misp_attribute
+
+    @property
+    def misp_event(self) -> MISPEvent:
+        return self.__misp_event
+
+    @property
+    def vulnerability_mapping(self) -> dict:
+        return self.__vulnerability_mapping
+
+    @property
+    def vulnerability_multiple_mapping(self) -> dict:
+        return self.__vulnerability_multiple_mapping
+
+    @property
+    def weakness_mapping(self) -> dict:
+        return self.__weakness_mapping
+
+    def get_result(self):
+        if self.references:
+            self.__build_references()
+        event = json.loads(self.misp_event.to_json())
+        results = {key: event[key] for key in ('Attribute', 'Object') if (key in event and event[key])}
+        return {'results': results}
+
+    def parse_vulnerability_information(self, vulnerability):
+        vulnerability_object = MISPObject('vulnerability')
+        for feature, relation in self.vulnerability_mapping.items():
+            if vulnerability.get(feature):
+                vulnerability_object.add_attribute(relation, vulnerability[feature])
+        if 'Published' in vulnerability:
+            vulnerability_object.add_attribute('published', vulnerability['Published'])
+            vulnerability_object.add_attribute('state', 'Published')
+        for feature, relation in self.vulnerability_multiple_mapping.items():
+            if feature in vulnerability:
+                for value in vulnerability[feature]:
+                    if isinstance(value, dict):
+                        value = value['title']
+                    vulnerability_object.add_attribute(relation, value)
+        vulnerability_object.add_reference(self.misp_attribute.uuid, 'related-to')
+        self.misp_event.add_object(vulnerability_object)
+        if 'cwe' in vulnerability and vulnerability['cwe'] not in ('Unknown', 'NVD-CWE-noinfo'):
+            self.__parse_weakness(vulnerability['cwe'], vulnerability_object.uuid)
+        if 'capec' in vulnerability:
+            self.__parse_capec(vulnerability['capec'], vulnerability_object.uuid)
+
+    def __build_references(self):
+        for object_uuid, references in self.references.items():
+            for misp_object in self.misp_event.objects:
+                if misp_object.uuid == object_uuid:
+                    for reference in references:
+                        misp_object.add_reference(**reference)
+                    break
+
+    def __parse_capec(self, capec_values, vulnerability_uuid):
+        for capec in capec_values:
+            capec_object = MISPObject('attack-pattern')
+            for feature in self.capec_features:
+                capec_object.add_attribute(feature, capec[feature])
+            for related_weakness in capec['related_weakness']:
+                capec_object.add_attribute('related-weakness', f"CWE-{related_weakness}")
+            self.misp_event.add_object(capec_object)
+            self.references[vulnerability_uuid].append(
+                {
+                    'referenced_uuid': capec_object.uuid,
+                    'relationship_type': 'targeted-by'
+                }
+            )
+
+    def __parse_weakness(self, cwe_value, vulnerability_uuid):
+        cwe_string, cwe_id = cwe_value.split('-')[:2]
+        cwe = requests.get(f'{self.api_url}cwe/{cwe_id}')
+        if cwe.status_code == 200:
+            cwe = cwe.json()
+            weakness_object = MISPObject('weakness')
+            weakness_object.add_attribute('id', f'{cwe_string}-{cwe_id}')
+            for feature, relation in self.weakness_mapping.items():
+                if cwe.get(feature):
+                    weakness_object.add_attribute(relation, cwe[feature])
+            self.misp_event.add_object(weakness_object)
+            self.references[vulnerability_uuid].append(
+                {
+                    'referenced_uuid': weakness_object.uuid,
+                    'relationship_type': 'weakened-by'
+                }
+            )
+
+
+def check_url(url):
+    return f"{url}/" if not url.endswith('/') else url
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if not request.get('attribute') or not check_input_attribute(request['attribute']):
+        return {'error': f'{standard_error_message}, which should contain at least a type, a value and an uuid.'}
+    attribute = request['attribute']
+    if attribute.get('type') != 'vulnerability':
+        misperrors['error'] = 'Vulnerability id missing.'
+        return misperrors
+    api_url = check_url(request['config']['custom_API']) if request.get('config', {}).get('custom_API') else cveapi_url
+    r = requests.get(f"{api_url}cve/{attribute['value']}")
+    if r.status_code == 200:
+        vulnerability = r.json()
+        if not vulnerability:
+            misperrors['error'] = 'Non existing CVE'
+            return misperrors['error']
+    else:
+        misperrors['error'] = 'API not accessible'
+        return misperrors['error']
+    parser = VulnerabilityParser(attribute, api_url)
+    parser.parse_vulnerability_information(vulnerability)
+    return parser.get_result()
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/cytomic_orion.py

@@ -0,0 +1,196 @@
+#!/usr/bin/env python3
+
+'''
+Cytomic Orion MISP Module
+An expansion module to enrich attributes in MISP and share indicators of compromise with Cytomic Orion
+
+
+'''
+
+from . import check_input_attribute, standard_error_message
+from pymisp import MISPAttribute, MISPEvent, MISPObject
+import json
+import requests
+import sys
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['md5'], 'format': 'misp_standard'}
+moduleinfo = {
+    'version': '0.3',
+    'author': 'Koen Van Impe',
+    'description': 'An expansion module to enrich attributes in MISP by quering the Cytomic Orion API',
+    'module-type': ['expansion'],
+    'name': 'Cytomic Orion Lookup',
+    'logo': 'cytomic_orion.png',
+    'requirements': ['Access (license) to Cytomic Orion'],
+    'features': 'This module takes an MD5 hash and searches for occurrences of this hash in the Cytomic Orion database. Returns observed files and machines.',
+    'references': ['https://www.vanimpe.eu/2020/03/10/integrating-misp-and-cytomic-orion/', 'https://www.cytomicmodel.com/solutions/'],
+    'input': 'MD5, hash of the sample / malware to search for.',
+    'output': 'MISP objects with sightings of the hash in Cytomic Orion. Includes files and machines.',
+}
+moduleconfig = ['api_url', 'token_url', 'clientid', 'clientsecret', 'clientsecret', 'username', 'password', 'upload_timeframe', 'upload_tag', 'delete_tag', 'upload_ttlDays', 'upload_threat_level_id', 'limit_upload_events', 'limit_upload_attributes']
+# There are more config settings in this module than used by the enrichment
+# There is also a PyMISP module which reuses the module config, and requires additional configuration, for example used for pushing indicators to the API
+
+
+class CytomicParser():
+    def __init__(self, attribute, config_object):
+        self.misp_event = MISPEvent()
+        self.attribute = MISPAttribute()
+        self.attribute.from_dict(**attribute)
+        self.misp_event.add_attribute(**self.attribute)
+
+        self.config_object = config_object
+
+        if self.config_object:
+            self.token = self.get_token()
+        else:
+            sys.exit('Missing configuration')
+
+    def get_token(self):
+        try:
+            scope = self.config_object['scope']
+            grant_type = self.config_object['grant_type']
+            username = self.config_object['username']
+            password = self.config_object['password']
+            token_url = self.config_object['token_url']
+            clientid = self.config_object['clientid']
+            clientsecret = self.config_object['clientsecret']
+
+            if scope and grant_type and username and password:
+                data = {'scope': scope, 'grant_type': grant_type, 'username': username, 'password': password}
+
+                if token_url and clientid and clientsecret:
+                    access_token_response = requests.post(token_url, data=data, verify=False, allow_redirects=False, auth=(clientid, clientsecret))
+                    tokens = json.loads(access_token_response.text)
+                    if 'access_token' in tokens:
+                        return tokens['access_token']
+                    else:
+                        self.result = {'error': 'No token received.'}
+                        return
+                else:
+                    self.result = {'error': 'No token_url, clientid or clientsecret supplied.'}
+                    return
+            else:
+                self.result = {'error': 'No scope, grant_type, username or password supplied.'}
+                return
+        except Exception:
+            self.result = {'error': 'Unable to connect to token_url.'}
+            return
+
+    def get_results(self):
+        if hasattr(self, 'result'):
+            return self.result
+        event = json.loads(self.misp_event.to_json())
+        results = {key: event[key] for key in ('Attribute', 'Object')}
+        return {'results': results}
+
+    def parse(self, searchkey):
+
+        if self.token:
+
+            endpoint_fileinformation = self.config_object['endpoint_fileinformation']
+            endpoint_machines = self.config_object['endpoint_machines']
+            endpoint_machines_client = self.config_object['endpoint_machines_client']
+            query_machines = self.config_object['query_machines']
+            query_machine_info = self.config_object['query_machine_info']
+
+            # Update endpoint URLs
+            query_endpoint_fileinformation = endpoint_fileinformation.format(md5=searchkey)
+            query_endpoint_machines = endpoint_machines.format(md5=searchkey)
+
+            # API calls
+            api_call_headers = {'Authorization': 'Bearer ' + self.token}
+            result_query_endpoint_fileinformation = requests.get(query_endpoint_fileinformation, headers=api_call_headers, verify=False)
+            json_result_query_endpoint_fileinformation = json.loads(result_query_endpoint_fileinformation.text)
+
+            if json_result_query_endpoint_fileinformation:
+
+                cytomic_object = MISPObject('cytomic-orion-file')
+
+                cytomic_object.add_attribute('fileName', type='text', value=json_result_query_endpoint_fileinformation['fileName'])
+                cytomic_object.add_attribute('fileSize', type='text', value=json_result_query_endpoint_fileinformation['fileSize'])
+                cytomic_object.add_attribute('last-seen', type='datetime', value=json_result_query_endpoint_fileinformation['lastSeen'])
+                cytomic_object.add_attribute('first-seen', type='datetime', value=json_result_query_endpoint_fileinformation['firstSeen'])
+                cytomic_object.add_attribute('classification', type='text', value=json_result_query_endpoint_fileinformation['classification'])
+                cytomic_object.add_attribute('classificationName', type='text', value=json_result_query_endpoint_fileinformation['classificationName'])
+                self.misp_event.add_object(**cytomic_object)
+
+                result_query_endpoint_machines = requests.get(query_endpoint_machines, headers=api_call_headers, verify=False)
+                json_result_query_endpoint_machines = json.loads(result_query_endpoint_machines.text)
+
+                if query_machines and json_result_query_endpoint_machines and len(json_result_query_endpoint_machines) > 0:
+                    for machine in json_result_query_endpoint_machines:
+
+                        if query_machine_info and machine['muid']:
+                            query_endpoint_machines_client = endpoint_machines_client.format(muid=machine['muid'])
+                            result_endpoint_machines_client = requests.get(query_endpoint_machines_client, headers=api_call_headers, verify=False)
+                            json_result_endpoint_machines_client = json.loads(result_endpoint_machines_client.text)
+
+                            if json_result_endpoint_machines_client:
+
+                                cytomic_machine_object = MISPObject('cytomic-orion-machine')
+
+                                clienttag = [{'name': json_result_endpoint_machines_client['clientName']}]
+
+                                cytomic_machine_object.add_attribute('machineName', type='target-machine', value=json_result_endpoint_machines_client['machineName'], Tag=clienttag)
+                                cytomic_machine_object.add_attribute('machineMuid', type='text', value=machine['muid'])
+                                cytomic_machine_object.add_attribute('clientName', type='target-org', value=json_result_endpoint_machines_client['clientName'], Tag=clienttag)
+                                cytomic_machine_object.add_attribute('clientId', type='text', value=machine['clientId'])
+                                cytomic_machine_object.add_attribute('machinePath', type='text', value=machine['lastPath'])
+                                cytomic_machine_object.add_attribute('first-seen', type='datetime', value=machine['firstSeen'])
+                                cytomic_machine_object.add_attribute('last-seen', type='datetime', value=machine['lastSeen'])
+                                cytomic_machine_object.add_attribute('creationDate', type='datetime', value=json_result_endpoint_machines_client['creationDate'])
+                                cytomic_machine_object.add_attribute('clientCreationDateUTC', type='datetime', value=json_result_endpoint_machines_client['clientCreationDateUTC'])
+                                cytomic_machine_object.add_attribute('lastSeenUtc', type='datetime', value=json_result_endpoint_machines_client['lastSeenUtc'])
+                                self.misp_event.add_object(**cytomic_machine_object)
+        else:
+            self.result = {'error': 'No (valid) token.'}
+            return
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+
+    if not request.get('attribute'):
+        return {'error': 'Unsupported input.'}
+
+    if not request.get('attribute') or not check_input_attribute(request['attribute']):
+        return {'error': f'{standard_error_message}, which should contain at least a type, a value and an uuid.'}
+    attribute = request['attribute']
+    if not any(input_type == attribute['type'] for input_type in mispattributes['input']):
+        return {'error': 'Unsupported attribute type.'}
+
+    if not request.get('config'):
+        return {'error': 'Missing configuration'}
+
+    config_object = {
+        'clientid': request["config"].get("clientid"),
+        'clientsecret': request["config"].get("clientsecret"),
+        'scope': 'orion.api',
+        'password': request["config"].get("password"),
+        'username': request["config"].get("username"),
+        'grant_type': 'password',
+        'token_url': request["config"].get("token_url"),
+        'endpoint_fileinformation': '{api_url}{endpoint}'.format(api_url=request["config"].get("api_url"), endpoint='/forensics/md5/{md5}/info'),
+        'endpoint_machines': '{api_url}{endpoint}'.format(api_url=request["config"].get("api_url"), endpoint='/forensics/md5/{md5}/muids'),
+        'endpoint_machines_client': '{api_url}{endpoint}'.format(api_url=request["config"].get("api_url"), endpoint='/forensics/muid/{muid}/info'),
+        'query_machines': True,
+        'query_machine_info': True
+    }
+
+    cytomic_parser = CytomicParser(attribute, config_object)
+    cytomic_parser.parse(attribute['value'])
+
+    return cytomic_parser.get_results()
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/dbl_spamhaus.py

@@ -0,0 +1,78 @@
+import json
+import sys
+
+try:
+    original_path = sys.path
+    sys.path = original_path[1:]
+    import dns.resolver
+    sys.path = original_path
+    resolver = dns.resolver.Resolver()
+    resolver.timeout = 0.2
+    resolver.lifetime = 0.2
+except ImportError:
+    print("dnspython3 is missing, use 'pip install dnspython3' to install it.")
+    sys.exit(0)
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['domain', 'domain|ip', 'hostname', 'hostname|port'], 'output': ['text']}
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Christian Studer',
+    'description': 'Checks Spamhaus DBL for a domain name.',
+    'module-type': ['expansion', 'hover'],
+    'name': 'DBL Spamhaus Lookup',
+    'logo': 'spamhaus.jpg',
+    'requirements': ['dnspython3: DNS python3 library'],
+    'features': 'This modules takes a domain or a hostname in input and queries the Domain Block List provided by Spamhaus to determine what kind of domain it is.\n\nDBL then returns a response code corresponding to a certain classification of the domain we display. If the queried domain is not in the list, it is also mentionned.\n\nPlease note that composite MISP attributes containing domain or hostname are supported as well.',
+    'references': ['https://www.spamhaus.org/faq/section/Spamhaus%20DBL'],
+    'input': 'Domain or hostname attribute.',
+    'output': 'Information about the nature of the input.',
+}
+moduleconfig = []
+
+dbl = 'dbl.spamhaus.org'
+dbl_mapping = {'127.0.1.2': 'spam domain',
+               '127.0.1.4': 'phish domain',
+               '127.0.1.5': 'malware domain',
+               '127.0.1.6': 'botnet C&C domain',
+               '127.0.1.102': 'abused legit spam',
+               '127.0.1.103': 'abused spammed redirector domain',
+               '127.0.1.104': 'abused legit phish',
+               '127.0.1.105': 'abused legit malware',
+               '127.0.1.106': 'abused legit botnet C&C',
+               '127.0.1.255': 'IP queries prohibited!'}
+
+
+def fetch_requested_value(request):
+    for attribute_type in mispattributes['input']:
+        if request.get(attribute_type):
+            return request[attribute_type].split('|')[0]
+    return None
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    requested_value = fetch_requested_value(request)
+    if requested_value is None:
+        misperrors['error'] = "Unsupported attributes type"
+        return misperrors
+    query = "{}.{}".format(requested_value, dbl)
+    try:
+        query_result = resolver.resolve(query, 'A')[0]
+        result = "{} - {}".format(requested_value, dbl_mapping[str(query_result)])
+    except dns.resolver.NXDOMAIN as e:
+        result = e.msg
+    except Exception:
+        return {'error': 'Not able to reach dbl.spamhaus.org or something went wrong'}
+    return {'results': [{'types': mispattributes.get('output'), 'values': result}]}
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/dns.py

@@ -0,0 +1,71 @@
+import json
+import dns.resolver
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['hostname', 'domain', 'domain|ip'], 'output': ['ip-src',
+                                                                           'ip-dst']}
+moduleinfo = {
+    'version': '0.3',
+    'author': 'Alexandre Dulaunoy',
+    'description': 'jj',
+    'module-type': ['expansion', 'hover'],
+    'name': 'DNS Resolver',
+    'logo': '',
+    'requirements': ['dnspython3: DNS python3 library'],
+    'features': 'The module takes a domain of hostname attribute as input, and tries to resolve it. If no error is encountered, the IP address that resolves the domain is returned, otherwise the origin of the error is displayed.\n\nThe address of the DNS resolver to use is also configurable, but if no configuration is set, we use the Google public DNS address (8.8.8.8).\n\nPlease note that composite MISP attributes containing domain or hostname are supported as well.',
+    'references': [],
+    'input': 'Domain or hostname attribute.',
+    'output': 'IP address resolving the input.',
+}
+
+moduleconfig = ['nameserver']
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if request.get('hostname'):
+        toquery = request['hostname']
+    elif request.get('domain'):
+        toquery = request['domain']
+    elif request.get('domain|ip'):
+        toquery = request['domain|ip'].split('|')[0]
+    else:
+        return False
+    r = dns.resolver.Resolver()
+    r.timeout = 2
+    r.lifetime = 2
+
+    if request.get('config'):
+        if request['config'].get('nameserver'):
+            nameservers = []
+            nameservers.append(request['config'].get('nameserver'))
+            r.nameservers = nameservers
+    else:
+        r.nameservers = ['8.8.8.8']
+
+    try:
+        answer = r.resolve(toquery, 'A')
+    except dns.resolver.NXDOMAIN:
+        misperrors['error'] = "NXDOMAIN"
+        return misperrors
+    except dns.exception.Timeout:
+        misperrors['error'] = "Timeout"
+        return misperrors
+    except Exception as e:
+        misperrors['error'] = f'DNS resolving error {e}'
+        return misperrors
+
+    r = {'results': [{'types': mispattributes['output'],
+                      'values':[str(answer[0])]}]}
+    return r
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/docx_enrich.py

@@ -0,0 +1,71 @@
+import json
+import binascii
+import np
+import docx
+import io
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['attachment'],
+                  'output': ['freetext', 'text']}
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Sascha Rommelfangen',
+    'description': 'Module to extract freetext from a .docx document.',
+    'module-type': ['expansion'],
+    'name': 'DOCX Enrich',
+    'logo': 'docx.png',
+    'requirements': ['docx python library'],
+    'features': 'The module reads the text contained in a .docx document. The result is passed to the freetext import parser so IoCs can be extracted out of it.',
+    'references': [],
+    'input': 'Attachment attribute containing a .docx document.',
+    'output': 'Text and freetext parsed from the document.',
+}
+
+moduleconfig = []
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    q = json.loads(q)
+    filename = q['attachment']
+    try:
+        docx_array = np.frombuffer(binascii.a2b_base64(q['data']), np.uint8)
+    except Exception as e:
+        print(e)
+        err = "Couldn't fetch attachment (JSON 'data' is empty). Are you using the 'Query enrichment' action?"
+        misperrors['error'] = err
+        print(err)
+        return misperrors
+
+    doc_content = ""
+    doc_file = io.BytesIO(docx_array)
+    try:
+        doc = docx.Document(doc_file)
+        for para in doc.paragraphs:
+            print(para.text)
+            doc_content = doc_content + "\n" + para.text
+        tables = doc.tables
+        for table in tables:
+            for row in table.rows:
+                for cell in row.cells:
+                    for para in cell.paragraphs:
+                        print(para.text)
+                        doc_content = doc_content + "\n" + para.text
+        print(doc_content)
+        return {'results': [{'types': ['freetext'], 'values': doc_content, 'comment': ".docx-to-text from file " + filename},
+                            {'types': ['text'], 'values': doc_content, 'comment': ".docx-to-text from file " + filename}]}
+    except Exception as e:
+        print(e)
+        err = "Couldn't analyze file as .docx. Error was: " + str(e)
+        misperrors['error'] = err
+        return misperrors
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo