misp-modules 2.4.196__py3-none-any.whl

misp_modules/modules/expansion/qintel_qsentry.py

@@ -0,0 +1,229 @@
+import logging
+import json
+
+from pymisp import MISPAttribute, MISPEvent, MISPTag,  MISPObject
+from . import check_input_attribute, checking_error, standard_error_message
+
+from qintel_helper import search_qsentry
+
+logger = logging.getLogger('qintel_qsentry')
+logger.setLevel(logging.DEBUG)
+
+moduleinfo = {
+    'version': '1.0',
+    'author': 'Qintel, LLC',
+    'description': 'A hover and expansion module which queries Qintel QSentry for ip reputation data',
+    'module-type': ['hover', 'expansion'],
+    'name': 'Qintel QSentry Lookup',
+    'logo': 'qintel.png',
+    'requirements': ['A Qintel API token'],
+    'features': 'This module takes an ip-address (ip-src or ip-dst) attribute as input, and queries the Qintel QSentry API to retrieve ip reputation data',
+    'references': ['https://www.qintel.com/products/qsentry/'],
+    'input': 'ip address attribute',
+    'output': '',
+    'ouput': 'Objects containing the enriched IP, threat tags, last seen attributes and associated Autonomous System information',
+}
+
+moduleconfig = ['token', 'remote']
+
+misperrors = {'error': 'Error'}
+
+mispattributes = {
+    'input': ['ip-src', 'ip-dst'],
+    'output': ['ip-src', 'ip-dst', 'AS', 'freetext'],
+    'format': 'misp_standard'
+}
+
+TAG_COLOR = {
+    'benign': '#27ae60',
+    'suspicious': '#e6a902',
+    'malicious': '#c0392b'
+}
+
+CLIENT_HEADERS = {
+        'User-Agent': f"MISP/{moduleinfo['version']}",
+}
+
+
+def _return_error(message):
+    misperrors['error'] = message
+    return misperrors
+
+
+def _make_tags(enriched_attr, result):
+
+    for tag in result['tags']:
+        color = TAG_COLOR['suspicious']
+        if tag == 'criminal':
+            color = TAG_COLOR['malicious']
+
+        t = MISPTag()
+        t.from_dict(**{
+            'name': f'qintel:tag="{tag}"',
+            'colour': color
+        })
+        enriched_attr.add_tag(**t)
+
+    return enriched_attr
+
+
+def _make_enriched_attr(event, result, orig_attr):
+
+    enriched_object = MISPObject('Qintel Threat Enrichment')
+    enriched_object.add_reference(orig_attr.uuid, 'related-to')
+
+    enriched_attr = MISPAttribute()
+    enriched_attr.from_dict(**{
+        'value': orig_attr.value,
+        'type': orig_attr.type,
+        'distribution': 0,
+        'object_relation': 'enriched-attr',
+        'to_ids': orig_attr.to_ids
+    })
+
+    enriched_attr = _make_tags(enriched_attr, result)
+    enriched_object.add_attribute(**enriched_attr)
+
+    comment_attr = MISPAttribute()
+    comment_attr.from_dict(**{
+        'value': '\n'.join(result.get('descriptions', [])),
+        'type': 'text',
+        'object_relation': 'descriptions',
+        'distribution': 0
+    })
+    enriched_object.add_attribute(**comment_attr)
+
+    last_seen = MISPAttribute()
+    last_seen.from_dict(**{
+        'value': result.get('last_seen'),
+        'type': 'datetime',
+        'object_relation': 'last-seen',
+        'distribution': 0
+    })
+    enriched_object.add_attribute(**last_seen)
+
+    event.add_attribute(**orig_attr)
+    event.add_object(**enriched_object)
+
+    return event
+
+
+def _make_asn_attr(event, result, orig_attr):
+
+    asn_object = MISPObject('asn')
+    asn_object.add_reference(orig_attr.uuid, 'related-to')
+
+    asn_attr = MISPAttribute()
+    asn_attr.from_dict(**{
+        'type': 'AS',
+        'value': result.get('asn'),
+        'object_relation': 'asn',
+        'distribution': 0
+    })
+    asn_object.add_attribute(**asn_attr)
+
+    org_attr = MISPAttribute()
+    org_attr.from_dict(**{
+        'type': 'text',
+        'value': result.get('asn_name', 'unknown').title(),
+        'object_relation': 'description',
+        'distribution': 0
+    })
+    asn_object.add_attribute(**org_attr)
+
+    event.add_object(**asn_object)
+
+    return event
+
+
+def _format_hover(event, result):
+
+    enriched_object = event.get_objects_by_name('Qintel Threat Enrichment')[0]
+
+    tags = ', '.join(result.get('tags'))
+    enriched_object.add_attribute('Tags', type='text', value=tags)
+
+    return event
+
+
+def _format_result(attribute, result):
+
+    event = MISPEvent()
+
+    orig_attr = MISPAttribute()
+    orig_attr.from_dict(**attribute)
+
+    event = _make_enriched_attr(event, result, orig_attr)
+    event = _make_asn_attr(event, result, orig_attr)
+
+    return event
+
+
+def _check_config(config):
+    if not config:
+        return False
+
+    if not isinstance(config, dict):
+        return False
+
+    if config.get('token', '') == '':
+        return False
+
+    return True
+
+
+def _check_request(request):
+    if not request.get('attribute'):
+        return f'{standard_error_message}, {checking_error}'
+
+    check_reqs = ('type', 'value')
+    if not check_input_attribute(request['attribute'],
+                                 requirements=check_reqs):
+        return f'{standard_error_message}, {checking_error}'
+
+    if request['attribute']['type'] not in mispattributes['input']:
+        return 'Unsupported attribute type'
+
+
+def handler(q=False):
+    if not q:
+        return False
+
+    request = json.loads(q)
+    config = request.get('config')
+
+    if not _check_config(config):
+        return _return_error('Missing Qintel token')
+
+    check_request_error = _check_request(request)
+    if check_request_error:
+        return _return_error(check_request_error)
+
+    search_args = {
+        'token': config['token'],
+        'remote': config.get('remote')
+    }
+
+    try:
+        result = search_qsentry(request['attribute']['value'], **search_args)
+    except Exception as e:
+        return _return_error(str(e))
+
+    event = _format_result(request['attribute'], result)
+    if not request.get('event_id'):
+        event = _format_hover(event, result)
+
+    event = json.loads(event.to_json())
+
+    ret_result = {key: event[key] for key in ('Attribute', 'Object') if key
+                  in event}
+    return {'results': ret_result}
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/qrcode.py

@@ -0,0 +1,99 @@
+import json
+from pyzbar import pyzbar
+import cv2
+import re
+import binascii
+import np
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['attachment'],
+                  'output': ['url', 'btc']}
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Sascha Rommelfangen',
+    'description': 'Module to decode QR codes.',
+    'module-type': ['expansion', 'hover'],
+    'name': 'QR Code Decode',
+    'logo': '',
+    'requirements': ['cv2: The OpenCV python library.', 'pyzbar: Python library to read QR codes.'],
+    'features': 'The module reads the QR code and returns the related address, which can be an URL or a bitcoin address.',
+    'references': [],
+    'input': 'A QR code stored as attachment attribute.',
+    'output': 'The URL or bitcoin address the QR code is pointing to.',
+}
+
+debug = True
+debug_prefix = "[DEBUG] QR Code module: "
+# format example: bitcoin:1GXZ6v7FZzYBEnoRaG77SJxhu7QkvQmFuh?amount=0.15424
+# format example: http://example.com
+cryptocurrencies = ['bitcoin']
+schemas = ['http://', 'https://', 'ftp://']
+moduleconfig = []
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    q = json.loads(q)
+    filename = q['attachment']
+    try:
+        img_array = np.frombuffer(binascii.a2b_base64(q['data']), np.uint8)
+    except Exception as e:
+        err = "Couldn't fetch attachment (JSON 'data' is empty). Are you using the 'Query enrichment' action?"
+        misperrors['error'] = err
+        print(err)
+        print(e)
+        return misperrors
+    image = cv2.imdecode(img_array, cv2.IMREAD_COLOR)
+    if q:
+        barcodes = pyzbar.decode(image)
+    for item in barcodes:
+        try:
+            result = item.data.decode()
+        except Exception as e:
+            print(e)
+            return
+        if debug:
+            print(debug_prefix + result)
+        for item in cryptocurrencies:
+            if item in result:
+                try:
+                    currency, address, extra = re.split(r'\:|\?', result)
+                except Exception as e:
+                    print(e)
+                if currency in cryptocurrencies:
+                    try:
+                        amount = re.split('=', extra)[1]
+                        if debug:
+                            print(debug_prefix + address)
+                            print(debug_prefix + amount)
+                        return {'results': [{'types': ['btc'], 'values': address, 'comment': "BTC: " + amount + " from file " + filename}]}
+                    except Exception as e:
+                        print(e)
+                else:
+                    print(address)
+        for item in schemas:
+            if item in result:
+                try:
+                    url = result
+                    if debug:
+                        print(debug_prefix + url)
+                    return {'results': [{'types': ['url'], 'values': url, 'comment': "from QR code of file " + filename}]}
+                except Exception as e:
+                    print(e)
+            else:
+                try:
+                    return {'results': [{'types': ['text'], 'values': result, 'comment': "from QR code of file " + filename}]}
+                except Exception as e:
+                    print(e)
+    misperrors['error'] = "Couldn't decode QR code in attachment."
+    return misperrors
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/ransomcoindb.py

@@ -0,0 +1,82 @@
+import json
+from . import check_input_attribute, checking_error, standard_error_message
+from ._ransomcoindb import ransomcoindb
+from pymisp import MISPObject
+
+copyright = """
+  Copyright 2019 (C) by Aaron Kaplan <aaron@lo-res.org>, all rights reserved.
+  This file is part of the ransomwarecoindDB project and licensed under the AGPL 3.0 license
+"""
+
+
+debug = False
+
+misperrors = {'error': 'Error'}
+# mispattributes = {'input': ['sha1', 'sha256', 'md5', 'btc', 'xmr', 'dash' ], 'output': ['btc', 'sha1', 'sha256', 'md5', 'freetext']}
+mispattributes = {'input': ['sha1', 'sha256', 'md5', 'btc'], 'output': ['btc', 'sha1', 'sha256', 'md5', 'freetext'], 'format': 'misp_standard'}
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Aaron Kaplan',
+    'description': 'Module to access the ransomcoinDB (see https://ransomcoindb.concinnity-risks.com)',
+    'module-type': ['expansion', 'hover'],
+    'name': 'RandomcoinDB Lookup',
+    'logo': '',
+    'requirements': ['A ransomcoinDB API key.'],
+    'features': 'The module takes either a hash attribute or a btc attribute as input to query the ransomcoinDB API for some additional data.\n\nIf the input is a btc address, we will get the associated hashes returned in a file MISP object. If we query ransomcoinDB with a hash, the response contains the associated btc addresses returned as single MISP btc attributes.',
+    'references': ['https://ransomcoindb.concinnity-risks.com'],
+    'input': 'A hash (md5, sha1 or sha256) or btc attribute.',
+    'output': 'Hashes associated to a btc address or btc addresses associated to a hash.',
+    'descrption': 'Module to access the ransomcoinDB with a hash or btc address attribute and get the associated btc address of hashes.',
+}
+moduleconfig = ['api-key']
+
+
+def handler(q=False):
+    """ the main handler function which gets a JSON dict as input and returns a results dict """
+
+    if q is False:
+        return False
+
+    q = json.loads(q)
+    if "config" not in q or "api-key" not in q["config"]:
+        return {"error": "Ransomcoindb API key is missing"}
+    if not q.get('attribute') or not check_input_attribute(q['attribute'], requirements=('type', 'value')):
+        return {'error': f'{standard_error_message}, {checking_error}.'}
+    if q['attribute']['type'] not in mispattributes['input']:
+        return {'error': 'Unsupported attribute type.'}
+    api_key = q["config"]["api-key"]
+    r = {"results": []}
+
+    """ the "q" query coming in should look something like this:
+        {'config': {'api-key': '<api key here>'},
+         'md5': 'md5 or sha1 or sha256 or btc',
+         'module': 'ransomcoindb',
+         'persistent': 1}
+    """
+    attribute = q['attribute']
+    answer = ransomcoindb.get_data_by('BTC', attribute['type'], attribute['value'], api_key)
+    """ The results data type should be:
+      r =  { 'results': [ {'types': 'md5', 'values': [ a list of all md5s or all binaries related to this btc address ]  } ] }
+    """
+    if attribute['type'] in ['md5', 'sha1', 'sha256']:
+        r['results'].append({'types': 'btc', 'values': [a['btc'] for a in answer]})
+    elif attribute['type'] == 'btc':
+        # better: create a MISP object
+        files = []
+        for a in answer:
+            obj = MISPObject('file')
+            obj.add_attribute('md5', a['md5'])
+            obj.add_attribute('sha1', a['sha1'])
+            obj.add_attribute('sha256', a['sha256'])
+            files.append(obj)
+        r['results'] = {'Object': [json.loads(f.to_json()) for f in files]}
+    return r
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/rbl.py

@@ -0,0 +1,126 @@
+import json
+import sys
+
+try:
+    import dns.resolver
+except ImportError:
+    print("dnspython3 is missing, use 'pip install dnspython3' to install it.")
+    sys.exit(0)
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['ip-src', 'ip-dst'], 'output': ['text']}
+moduleinfo = {
+    'version': '0.2',
+    'author': 'Christian Studer',
+    'description': 'Module to check an IPv4 address against known RBLs.',
+    'module-type': ['expansion', 'hover'],
+    'name': 'Real-time Blackhost Lists Lookup',
+    'logo': '',
+    'requirements': ['dnspython3: DNS python3 library'],
+    'features': 'This module takes an IP address attribute as input and queries multiple know Real-time Blackhost Lists to check if they have already seen this IP address.\n\nWe display then all the information we get from those different sources.',
+    'references': ['[RBLs list](https://github.com/MISP/misp-modules/blob/8817de476572a10a9c9d03258ec81ca70f3d926d/misp_modules/modules/expansion/rbl.py#L20)'],
+    'input': 'IP address attribute.',
+    'output': 'Text with additional data from Real-time Blackhost Lists about the IP address.',
+}
+moduleconfig = ['timeout']
+
+rbls = (
+    "spam.spamrats.com",
+    "spamguard.leadmon.net",
+    "rbl-plus.mail-abuse.org",
+    "web.dnsbl.sorbs.net",
+    "ix.dnsbl.manitu.net",
+    "virus.rbl.jp",
+    "dul.dnsbl.sorbs.net",
+    "bogons.cymru.com",
+    "psbl.surriel.com",
+    "misc.dnsbl.sorbs.net",
+    "httpbl.abuse.ch",
+    "combined.njabl.org",
+    "smtp.dnsbl.sorbs.net",
+    "korea.services.net",
+    "drone.abuse.ch",
+    "rbl.efnetrbl.org",
+    "cbl.anti-spam.org.cn",
+    "b.barracudacentral.org",
+    "bl.spamcannibal.org",
+    "xbl.spamhaus.org",
+    "zen.spamhaus.org",
+    "rbl.suresupport.com",
+    "db.wpbl.info",
+    "sbl.spamhaus.org",
+    "http.dnsbl.sorbs.net",
+    "csi.cloudmark.com",
+    "rbl.interserver.net",
+    "ubl.unsubscore.com",
+    "dnsbl.sorbs.net",
+    "virbl.bit.nl",
+    "pbl.spamhaus.org",
+    "socks.dnsbl.sorbs.net",
+    "short.rbl.jp",
+    "dnsbl.dronebl.org",
+    "blackholes.mail-abuse.org",
+    "truncate.gbudb.net",
+    "dyna.spamrats.com",
+    "spamrbl.imp.ch",
+    "spam.dnsbl.sorbs.net",
+    "wormrbl.imp.ch",
+    "query.senderbase.org",
+    "opm.tornevall.org",
+    "netblock.pedantic.org",
+    "access.redhawk.org",
+    "cdl.anti-spam.org.cn",
+    "multi.surbl.org",
+    "noptr.spamrats.com",
+    "dnsbl.inps.de",
+    "bl.spamcop.net",
+    "cbl.abuseat.org",
+    "dsn.rfc-ignorant.org",
+    "zombie.dnsbl.sorbs.net",
+    "dnsbl.njabl.org",
+    "relays.mail-abuse.org",
+    "rbl.spamlab.com",
+    "all.bl.blocklist.de"
+)
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if request.get('ip-src'):
+        ip = request['ip-src']
+    elif request.get('ip-dst'):
+        ip = request['ip-dst']
+    else:
+        misperrors['error'] = "Unsupported attributes type"
+        return misperrors
+    resolver = dns.resolver.Resolver()
+    try:
+        timeout = float(request['config']['timeout'])
+    except (KeyError, ValueError):
+        timeout = 0.4
+    resolver.timeout = timeout
+    resolver.lifetime = timeout
+    infos = {}
+    ipRev = '.'.join(ip.split('.')[::-1])
+    for rbl in rbls:
+        query = '{}.{}'.format(ipRev, rbl)
+        try:
+            txt = resolver.query(query, 'TXT')
+            infos[query] = [str(t) for t in txt]
+        except Exception:
+            continue
+    result = "\n".join([f"{rbl}: {'  -  '.join(info)}" for rbl, info in infos.items()])
+    if not result:
+        return {'error': 'No data found by querying known RBLs'}
+    return {'results': [{'types': mispattributes.get('output'), 'values': result}]}
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo