misp-modules 2.4.196__py3-none-any.whl

misp_modules/modules/expansion/farsight_passivedns.py

@@ -0,0 +1,243 @@
+import dnsdb2
+import json
+from . import check_input_attribute, standard_error_message
+from datetime import datetime
+from pymisp import MISPEvent, MISPObject, Distribution
+
+misperrors = {'error': 'Error'}
+standard_query_input = [
+    'hostname',
+    'domain',
+    'ip-src',
+    'ip-dst'
+]
+flex_query_input = [
+    'btc',
+    'dkim',
+    'email',
+    'email-src',
+    'email-dst',
+    'domain|ip',
+    'hex',
+    'mac-address',
+    'mac-eui-64',
+    'other',
+    'pattern-filename',
+    'target-email',
+    'text',
+    'uri',
+    'url',
+    'whois-registrant-email',
+]
+mispattributes = {
+    'input': standard_query_input + flex_query_input,
+    'format': 'misp_standard'
+}
+moduleinfo = {
+    'version': '0.5',
+    'author': 'Christophe Vandeplas',
+    'description': 'Module to access Farsight DNSDB Passive DNS.',
+    'module-type': ['expansion', 'hover'],
+    'name': 'Farsight DNSDB Lookup',
+    'logo': 'farsight.png',
+    'requirements': ['An access to the Farsight Passive DNS API (apikey)'],
+    'features': 'This module takes a domain, hostname or IP address MISP attribute as input to query the Farsight Passive DNS API.\n  The results of rdata and rrset lookups are then returned and parsed into passive-dns objects.\n\nAn API key is required to submit queries to the API.\n  It is also possible to define a custom server URL, and to set a limit of results to get.\n  This limit is set for each lookup, which means we can have an up to the limit number of passive-dns objects resulting from an rdata query about an IP address, but an up to the limit number of passive-dns objects for each lookup queries about a domain or a hostname (== twice the limit).',
+    'references': ['https://www.farsightsecurity.com/', 'https://docs.dnsdb.info/dnsdb-api/'],
+    'input': 'A domain, hostname or IP address MISP attribute.',
+    'output': 'Passive-dns objects, resulting from the query on the Farsight Passive DNS API.',
+}
+moduleconfig = ['apikey', 'server', 'limit', 'flex_queries']
+
+DEFAULT_DNSDB_SERVER = 'https://api.dnsdb.info'
+DEFAULT_LIMIT = 10
+DEFAULT_DISTRIBUTION_SETTING = Distribution.your_organisation_only.value
+TYPE_TO_FEATURE = {
+    "btc": "Bitcoin address",
+    "dkim": "domainkeys identified mail",
+    "domain": "domain name",
+    "domain|ip": "domain name / IP address",
+    "hex": "value in hexadecimal format",
+    "hostname": "hostname",
+    "mac-address": "MAC address",
+    "mac-eui-64": "MAC EUI-64 address",
+    "pattern-filename": "pattern in the name of a file",
+    "target-email": "attack target email",
+    "uri": "Uniform Resource Identifier",
+    "url": "Uniform Resource Locator",
+    "whois-registrant-email": "email of a domain's registrant"
+}
+TYPE_TO_FEATURE.update(
+    dict.fromkeys(
+        ("ip-src", "ip-dst"),
+        "IP address"
+    )
+)
+TYPE_TO_FEATURE.update(
+    dict.fromkeys(
+        ("email", "email-src", "email-dst"),
+        "email address"
+    )
+)
+TYPE_TO_FEATURE.update(
+    dict.fromkeys(
+        ("other", "text"),
+        "text"
+    )
+)
+
+
+class FarsightDnsdbParser():
+    def __init__(self, attribute):
+        self.attribute = attribute
+        self.misp_event = MISPEvent()
+        self.misp_event.add_attribute(**attribute)
+        self.passivedns_mapping = {
+            'bailiwick': {'type': 'domain', 'object_relation': 'bailiwick'},
+            'count': {'type': 'counter', 'object_relation': 'count'},
+            'raw_rdata': {'type': 'text', 'object_relation': 'raw_rdata'},
+            'rdata': {'type': 'text', 'object_relation': 'rdata'},
+            'rrname': {'type': 'text', 'object_relation': 'rrname'},
+            'rrtype': {'type': 'text', 'object_relation': 'rrtype'},
+            'time_first': {'type': 'datetime', 'object_relation': 'time_first'},
+            'time_last': {'type': 'datetime', 'object_relation': 'time_last'},
+            'zone_time_first': {'type': 'datetime', 'object_relation': 'zone_time_first'},
+            'zone_time_last': {'type': 'datetime', 'object_relation': 'zone_time_last'}
+        }
+        self.comment = 'Result from a %s lookup on DNSDB about the %s: %s'
+
+    def parse_passivedns_results(self, query_response):
+        for query_type, results in query_response.items():
+            comment = self.comment % (query_type, TYPE_TO_FEATURE[self.attribute['type']], self.attribute['value'])
+            for result in results:
+                passivedns_object = MISPObject('passive-dns')
+                passivedns_object.distribution = DEFAULT_DISTRIBUTION_SETTING
+                if result.get('rdata') and isinstance(result['rdata'], list):
+                    for rdata in result.pop('rdata'):
+                        passivedns_object.add_attribute(**self._parse_attribute(comment, 'rdata', rdata))
+                for feature, value in result.items():
+                    passivedns_object.add_attribute(**self._parse_attribute(comment, feature, value))
+                if result.get('time_first'):
+                    passivedns_object.first_seen = result['time_first']
+                if result.get('time_last'):
+                    passivedns_object.last_seen = result['time_last']
+                passivedns_object.add_reference(self.attribute['uuid'], 'related-to')
+                self.misp_event.add_object(passivedns_object)
+
+    def get_results(self):
+        event = json.loads(self.misp_event.to_json())
+        results = {key: event[key] for key in ('Attribute', 'Object')}
+        return {'results': results}
+
+    def _parse_attribute(self, comment, feature, value):
+        attribute = {'value': value, 'comment': comment, 'distribution': DEFAULT_DISTRIBUTION_SETTING}
+        attribute.update(self.passivedns_mapping[feature])
+        return attribute
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if not request.get('config') or not request['config'].get('apikey'):
+        misperrors['error'] = 'Farsight DNSDB apikey is missing'
+        return misperrors
+    if not request.get('attribute') or not check_input_attribute(request['attribute']):
+        return {'error': f'{standard_error_message}, which should contain at least a type, a value and an uuid.'}
+    attribute = request['attribute']
+    if attribute['type'] not in mispattributes['input']:
+        return {'error': 'Unsupported attributes type'}
+    config = request['config']
+    if not config.get('server'):
+        config['server'] = DEFAULT_DNSDB_SERVER
+    client_args = {feature: config[feature] for feature in ('apikey', 'server')}
+    client = dnsdb2.Client(**client_args)
+    to_query, args = parse_input(attribute, config)
+    try:
+        response = to_query(client, *args)
+    except dnsdb2.DnsdbException as e:
+        return {'error': e.__str__()}
+    except dnsdb2.exceptions.QueryError:
+        return {'error': 'Communication error occurs while executing a query, or the server reports an error due to invalid arguments.'}
+    if not response:
+        return {'error': f"Empty results on Farsight DNSDB for the {TYPE_TO_FEATURE[attribute['type']]}: {attribute['value']}."}
+    parser = FarsightDnsdbParser(attribute)
+    parser.parse_passivedns_results(response)
+    return parser.get_results()
+
+
+def parse_input(attribute, config):
+    lookup_args = {
+        'limit': config['limit'] if config.get('limit') else DEFAULT_LIMIT,
+        'offset': 0,
+        'ignore_limited': True,
+        'humantime': True
+    }
+    if attribute.get('first_seen'):
+        lookup_args['time_first_after'] = parse_timestamp(attribute['first_seen'])
+    attribute_type = attribute['type']
+    if attribute_type in flex_query_input:
+        return flex_queries, (lookup_args, attribute['value'])
+    flex = add_flex_queries(config.get('flex_queries'))
+    to_query = lookup_ip if 'ip-' in attribute_type else lookup_name
+    return to_query, (lookup_args, attribute['value'], flex)
+
+
+def parse_timestamp(str_date):
+    datetime_date = datetime.strptime(str_date, '%Y-%m-%dT%H:%M:%S.%f%z')
+    return str(int(datetime_date.timestamp()))
+
+
+def add_flex_queries(flex):
+    if not flex:
+        return False
+    if flex in ('True', 'true', True, '1', 1):
+        return True
+    return False
+
+
+def flex_queries(client, lookup_args, name):
+    response = {}
+    name = name.replace('@', '.')
+    for feature in ('rdata', 'rrnames'):
+        to_call = getattr(client, f'flex_{feature}_regex')
+        results = list(to_call(name, **lookup_args))
+        for result in list(to_call(name.replace('.', '\\.'), **lookup_args)):
+            if result not in results:
+                results.append(result)
+        if results:
+            response[f'flex_{feature}'] = results
+    return response
+
+
+def lookup_name(client, lookup_args, name, flex):
+    response = {}
+    # RRSET = entries in the left-hand side of the domain name related labels
+    rrset_response = list(client.lookup_rrset(name, **lookup_args))
+    if rrset_response:
+        response['rrset'] = rrset_response
+    # RDATA = entries on the right-hand side of the domain name related labels
+    rdata_response = list(client.lookup_rdata_name(name, **lookup_args))
+    if rdata_response:
+        response['rdata'] = rdata_response
+    if flex:
+        response.update(flex_queries(client, lookup_args, name))
+    return response
+
+
+def lookup_ip(client, lookup_args, ip, flex):
+    response = {}
+    res = list(client.lookup_rdata_ip(ip, **lookup_args))
+    if res:
+        response['rdata'] = res
+    if flex:
+        response.update(flex_queries(client, lookup_args, ip))
+    return response
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/geoip_asn.py

@@ -0,0 +1,75 @@
+import json
+import geoip2.database
+import sys
+import logging
+
+log = logging.getLogger('geoip_asn')
+log.setLevel(logging.DEBUG)
+ch = logging.StreamHandler(sys.stdout)
+ch.setLevel(logging.DEBUG)
+formatter = logging.Formatter('%(asctime)s - %(name)s - %(levelname)s - %(message)s')
+ch.setFormatter(formatter)
+log.addHandler(ch)
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['ip-src', 'ip-dst', 'domain|ip'], 'output': ['freetext']}
+moduleconfig = ['local_geolite_db']
+# possible module-types: 'expansion', 'hover' or both
+moduleinfo = {
+    'version': '0.1',
+    'author': 'GlennHD',
+    'description': 'Query a local copy of the Maxmind Geolite ASN database (MMDB format)',
+    'module-type': ['expansion', 'hover'],
+    'name': 'GeoIP ASN Lookup',
+    'logo': 'maxmind.png',
+    'requirements': ["A local copy of Maxmind's Geolite database"],
+    'features': "The module takes an IP address attribute as input and queries a local copy of the Maxmind's Geolite database to get information about the related AS number.",
+    'references': ['https://www.maxmind.com/en/home'],
+    'input': 'An IP address MISP attribute.',
+    'output': 'Text containing information about the AS number of the IP address.',
+    'descrption': "An expansion module to query a local copy of Maxmind's Geolite database with an IP address, in order to get information about its related AS number.",
+}
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+
+    if not request.get('config') or not request['config'].get('local_geolite_db'):
+        return {'error': 'Please specify the path of your local copy of the Maxmind Geolite ASN database'}
+    path_to_geolite = request['config']['local_geolite_db']
+
+    if request.get('ip-dst'):
+        toquery = request['ip-dst']
+    elif request.get('ip-src'):
+        toquery = request['ip-src']
+    elif request.get('domain|ip'):
+        toquery = request['domain|ip'].split('|')[1]
+    else:
+        return False
+
+    try:
+        reader = geoip2.database.Reader(path_to_geolite)
+    except FileNotFoundError:
+        return {'error': f'Unable to locate the GeoLite database you specified ({path_to_geolite}).'}
+    log.debug(toquery)
+    try:
+        answer = reader.asn(toquery)
+        stringmap = 'ASN=' + str(answer.autonomous_system_number) + ', AS Org=' + str(answer.autonomous_system_organization)
+    except Exception as e:
+        misperrors['error'] = f"GeoIP resolving error: {e}"
+        return misperrors
+
+    r = {'results': [{'types': mispattributes['output'], 'values': stringmap}]}
+
+    return r
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/geoip_city.py

@@ -0,0 +1,75 @@
+import json
+import geoip2.database
+import sys
+import logging
+
+log = logging.getLogger('geoip_city')
+log.setLevel(logging.DEBUG)
+ch = logging.StreamHandler(sys.stdout)
+ch.setLevel(logging.DEBUG)
+formatter = logging.Formatter('%(asctime)s - %(name)s - %(levelname)s - %(message)s')
+ch.setFormatter(formatter)
+log.addHandler(ch)
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['ip-src', 'ip-dst', 'domain|ip'], 'output': ['freetext']}
+moduleconfig = ['local_geolite_db']
+# possible module-types: 'expansion', 'hover' or both
+moduleinfo = {
+    'version': '0.1',
+    'author': 'GlennHD',
+    'description': "An expansion module to query a local copy of Maxmind's Geolite database with an IP address, in order to get information about the city where it is located.",
+    'module-type': ['expansion', 'hover'],
+    'name': 'GeoIP City Lookup',
+    'logo': 'maxmind.png',
+    'requirements': ["A local copy of Maxmind's Geolite database"],
+    'features': "The module takes an IP address attribute as input and queries a local copy of the Maxmind's Geolite database to get information about the city where this IP address is located.",
+    'references': ['https://www.maxmind.com/en/home'],
+    'input': 'An IP address MISP attribute.',
+    'output': 'Text containing information about the city where the IP address is located.',
+}
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+
+    if not request.get('config') or not request['config'].get('local_geolite_db'):
+        return {'error': 'Please specify the path of your local copy of Maxminds Geolite database'}
+    path_to_geolite = request['config']['local_geolite_db']
+
+    if request.get('ip-dst'):
+        toquery = request['ip-dst']
+    elif request.get('ip-src'):
+        toquery = request['ip-src']
+    elif request.get('domain|ip'):
+        toquery = request['domain|ip'].split('|')[1]
+    else:
+        return False
+
+    try:
+        reader = geoip2.database.Reader(path_to_geolite)
+    except FileNotFoundError:
+        return {'error': f'Unable to locate the GeoLite database you specified ({path_to_geolite}).'}
+    log.debug(toquery)
+    try:
+        answer = reader.city(toquery)
+        stringmap = 'Continent=' + str(answer.continent.name) + ', Country=' + str(answer.country.name) + ', Subdivision=' + str(answer.subdivisions.most_specific.name) + ', City=' + str(answer.city.name)
+
+    except Exception as e:
+        misperrors['error'] = f"GeoIP resolving error: {e}"
+        return misperrors
+
+    r = {'results': [{'types': mispattributes['output'], 'values': stringmap}]}
+
+    return r
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/geoip_country.py

@@ -0,0 +1,73 @@
+import json
+import geoip2.database
+import sys
+import logging
+
+log = logging.getLogger('geoip_country')
+log.setLevel(logging.DEBUG)
+ch = logging.StreamHandler(sys.stdout)
+ch.setLevel(logging.DEBUG)
+formatter = logging.Formatter('%(asctime)s - %(name)s - %(levelname)s - %(message)s')
+ch.setFormatter(formatter)
+log.addHandler(ch)
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['ip-src', 'ip-dst', 'domain|ip'], 'output': ['freetext']}
+moduleconfig = ['local_geolite_db']
+# possible module-types: 'expansion', 'hover' or both
+moduleinfo = {
+    'version': '0.2',
+    'author': 'Andreas Muehlemann',
+    'description': 'Query a local copy of Maxminds Geolite database, updated for MMDB format',
+    'module-type': ['expansion', 'hover'],
+    'name': 'GeoIP Country Lookup',
+    'logo': 'maxmind.png',
+    'requirements': ["A local copy of Maxmind's Geolite database"],
+    'features': "This module takes an IP address MISP attribute as input and queries a local copy of the Maxmind's Geolite database to get information about the location of this IP address.\n\nPlease note that composite attributes domain|ip are also supported.",
+    'references': ['https://www.maxmind.com/en/home'],
+    'input': 'An IP address MISP Attribute.',
+    'output': 'Text containing information about the location of the IP address.',
+}
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+
+    if not request.get('config') or not request['config'].get('local_geolite_db'):
+        return {'error': 'Please specify the path of your local copy of Maxminds Geolite database'}
+    path_to_geolite = request['config']['local_geolite_db']
+
+    if request.get('ip-dst'):
+        toquery = request['ip-dst']
+    elif request.get('ip-src'):
+        toquery = request['ip-src']
+    elif request.get('domain|ip'):
+        toquery = request['domain|ip'].split('|')[1]
+    else:
+        return False
+
+    try:
+        reader = geoip2.database.Reader(path_to_geolite)
+    except FileNotFoundError:
+        return {'error': f'Unable to locate the GeoLite database you specified ({path_to_geolite}).'}
+    log.debug(toquery)
+    try:
+        answer = reader.country(toquery)
+    except Exception as e:
+        misperrors['error'] = f"GeoIP resolving error: {e}"
+        return misperrors
+
+    r = {'results': [{'types': mispattributes['output'], 'values': [answer.country.iso_code]}]}
+
+    return r
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/google_safe_browsing.py

@@ -0,0 +1,86 @@
+# import requests
+import json
+from pymisp import MISPObject, MISPAttribute, MISPEvent
+from . import check_input_attribute, checking_error, standard_error_message
+from pysafebrowsing import SafeBrowsing
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['url'], 'format': 'misp_standard'}
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Stephanie S',
+    'description': 'Google safe browsing expansion module',
+    'module-type': ['expansion', 'hover'],
+    'name': 'Google Safe Browsing Lookup',
+    'logo': '',
+    'requirements': [],
+    'features': '',
+    'references': [],
+    'input': '',
+    'output': '',
+}
+
+moduleconfig = ['api_key']
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+
+    if "config" not in request or "api_key" not in request["config"]:
+        return {"error": "Google Safe Browsing API key is missing"}
+    if not request.get('attribute') or not check_input_attribute(request['attribute'], requirements=('type', 'value')):
+        return {'error': f'{standard_error_message}, {checking_error}.'}
+    if request['attribute']['type'] not in mispattributes['input']:
+        return {'error': 'Unsupported attribute type.'}
+
+    api_key = request["config"]["api_key"]
+    url = request["attribute"]["value"]
+
+    s = SafeBrowsing(api_key)
+    try:
+        response = s.lookup_urls([url])
+
+        event = MISPEvent()
+        obj = MISPObject('google-safe-browsing')
+        event.add_attribute(**request['attribute'])
+
+        if (response[url]['malicious'] != False):
+            # gsb threat types: THREAT_TYPE_UNSPECIFIED, MALWARE, SOCIAL_ENGINEERING, UNWANTED_SOFTWARE, POTENTIALLY_HARMFUL_APPLICATION
+            gsb_circl_threat_taxonomy = {"MALWARE": 'malware', "SOCIAL_ENGINEERING": 'social-engineering'}
+
+            threats = response[url]['threats']
+            malicious = response[url]['malicious']
+            platforms = response[url]['platforms']
+
+            malicious_attribute = obj.add_attribute('malicious', **{'type': 'boolean', 'value': malicious})
+            malicious_attribute.add_tag(f'ioc:artifact-state="malicious"')
+            threat_attribute = obj.add_attribute('threats', **{'type': 'text', 'value': str(" ".join(threats))})
+            for threat in threats:
+                # If the threat exists as a key in taxonomy_dict, add that tag
+                if (gsb_circl_threat_taxonomy.get(threat) is not None):
+                    threat_attribute.add_tag(f'circl:incident="{gsb_circl_threat_taxonomy.get(threat)}"')
+                else:
+                    threat_attribute.add_tag(f'threat-type:{str(threat).lower()}')
+            obj.add_attribute('platforms', **{'type': 'text', 'value': str(" ".join(platforms))})
+
+        else:
+            malicious_attribute = obj.add_attribute('malicious', **{'type': 'boolean', 'value': 0}) # 0 == False
+            malicious_attribute.add_tag(f'ioc:artifact-state="not-malicious"')
+
+        obj.add_reference(request['attribute']['uuid'], "describes")
+        event.add_object(obj)
+
+        # Avoid serialization issue
+        event = json.loads(event.to_json())
+        return {"results": {'Object': event['Object'], 'Attribute': event['Attribute']}}
+
+    except Exception as error:
+        return {"error": "An error occurred: " + str(error)}
+
+def introspection():
+    return mispattributes
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/google_search.py

@@ -0,0 +1,57 @@
+import json
+import random
+import time
+try:
+    from googleapi import google
+except ImportError:
+    print("GoogleAPI not installed. Command : pip install git+https://github.com/abenassi/Google-Search-API")
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['url'], 'output': ['text']}
+moduleinfo = {
+    'author': 'Oun & Gindt',
+    'module-type': ['hover'],
+    'name': 'Google Search',
+    'description': 'An expansion hover module to expand google search information about an URL',
+    'version': '1.0',
+    'logo': 'google.png',
+    'requirements': ['The python Google Search API library'],
+    'features': 'The module takes an url as input to query the Google search API. The result of the query is then return as raw text.',
+    'references': ['https://github.com/abenassi/Google-Search-API'],
+    'input': 'An url attribute.',
+    'output': 'Text containing the result of a Google search on the input url.',
+}
+
+
+def sleep(retry):
+    time.sleep(random.uniform(0, min(40, 0.01 * 2 ** retry)))
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if not request.get('url'):
+        return {'error': "Unsupported attributes type"}
+    num_page = 1
+    res = ""
+    # The googleapi module sets a random useragent. The output depends on the useragent.
+    # It's better to retry 3 times.
+    for retry in range(3):
+        search_results = google.search(request['url'], num_page)
+        if len(search_results) > 0:
+            break
+        sleep(retry)
+    for i, search_result in enumerate(search_results):
+        res += "("+str(i+1)+")" + '\t'
+        res += json.dumps(search_result.description, ensure_ascii=False)
+        res += '\n\n'
+    return {'results': [{'types': mispattributes['output'], 'values':res}]}
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    return moduleinfo