misp-modules 2.4.196__py3-none-any.whl

misp_modules/modules/expansion/socialscan.py

@@ -0,0 +1,108 @@
+import json
+from socialscan.platforms import Platforms
+from socialscan.util import sync_execute_queries
+
+moduleinfo = {
+    'version': '1',
+    'author': 'Christian Studer',
+    'description': 'A hover module to get information on the availability of an email address or username on some online platforms.',
+    'module-type': ['hover'],
+    'name': 'Socialscan Lookup',
+    'logo': '',
+    'requirements': ['The socialscan python library'],
+    'features': 'The module takes an email address or username as input and check its availability on some online platforms. The results for each platform are then returned to see if the email address or the username is used, available or if there is an issue with it.',
+    'references': ['https://github.com/iojw/socialscan'],
+    'input': 'An email address or usename attribute.',
+    'output': 'Text containing information about the availability of an email address or a username in some online platforms.',
+}
+mispattributes = {
+    'input': [
+        'github-username',
+        'target-user',
+        'email',
+        'email-src',
+        'email-dst',
+        'target-email',
+        'whois-registrant-email'
+    ],
+    'output': ['text']
+}
+moduleconfig = []
+
+_PLATFORMS = [
+    Platforms.INSTAGRAM,
+    Platforms.TWITTER,
+    Platforms.GITHUB,
+    Platforms.TUMBLR,
+    Platforms.LASTFM
+]
+_EMAIL_PLATFORMS = [
+    Platforms.PINTEREST,
+    Platforms.SPOTIFY,
+    Platforms.FIREFOX
+]
+_EMAIL_PLATFORMS.extend(_PLATFORMS)
+_USERNAME_PLATFORMS = [
+    Platforms.SNAPCHAT,
+    Platforms.GITLAB,
+    Platforms.REDDIT,
+    Platforms.YAHOO
+]
+_USERNAME_PLATFORMS.extend(_PLATFORMS)
+
+
+def parse_results(query_results, feature):
+    results = []
+    for result in query_results:
+        if not result.success:
+            results.append(f'Unable to retrieve the {feature} on {result.platform}.')
+            continue
+        if not result.valid:
+            results.append(f'Invalid response from {result.platform}, or invalid {feature}.')
+            continue
+        statement = 'No account' if result.available else 'There is an account'
+        results.append(f'{statement} linked to the {feature} on {result.platform}.')
+    to_return = [
+        {
+            'types': mispattributes['output'],
+            'values': result
+        } for result in results
+    ]
+    return {'results': to_return}
+
+
+def parse_email(email):
+    results = sync_execute_queries([email], platforms=_EMAIL_PLATFORMS)
+    return parse_results(results, 'email address')
+
+
+def parse_username(username, platforms=_USERNAME_PLATFORMS):
+    results = sync_execute_queries([username], platforms=platforms)
+    return parse_results(results, 'username')
+
+
+def parse_github_username(username):
+    return parse_username(username, platforms=[Platforms.GITHUB])
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if request.get('github-username'):
+        return parse_github_username(request['github-username'])
+    if request.get('target-user'):
+        return parse_username(request['target-user'])
+    for attribute_type in mispattributes['input'][2:]:
+        if request.get(attribute_type):
+            return parse_email(request[attribute_type])
+    return {'error': 'Unsupported attributes type'}
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/sophoslabs_intelix.py

@@ -0,0 +1,146 @@
+import json
+import requests
+import base64
+from . import check_input_attribute, checking_error, standard_error_message
+from pymisp import MISPEvent, MISPObject
+from urllib.parse import quote
+
+moduleinfo = {
+    'version': '1.0',
+    'author': 'Ben Verschaeren',
+    'description': 'An expansion module to query the Sophoslabs intelix API to get additional information about an ip address, url, domain or sha256 attribute.',
+    'module-type': ['expansion'],
+    'name': 'SophosLabs Intelix Lookup',
+    'logo': 'sophoslabs_intelix.svg',
+    'requirements': ['A client_id and client_secret pair to authenticate to the SophosLabs Intelix API'],
+    'features': 'The module takes an ip address, url, domain or sha256 attribute and queries the SophosLabs Intelix API with the attribute value. The result of this query is a SophosLabs Intelix hash report, or an ip or url lookup, that is then parsed and returned in a MISP object.',
+    'references': ['https://aws.amazon.com/marketplace/pp/B07SLZPMCS'],
+    'input': 'An ip address, url, domain or sha256 attribute.',
+    'output': 'SophosLabs Intelix report and lookup objects',
+}
+
+moduleconfig = ['client_id', 'client_secret']
+
+misperrors = {'error': 'Error'}
+
+misp_types_in = ['sha256', 'ip', 'ip-src', 'ip-dst', 'uri', 'url', 'domain', 'hostname']
+
+mispattributes = {'input': misp_types_in,
+                  'format': 'misp_standard'}
+
+
+class SophosLabsApi():
+    def __init__(self, client_id, client_secret):
+        self.misp_event = MISPEvent()
+        self.client_id = client_id
+        self.client_secret = client_secret
+        self.authToken = f"{self.client_id}:{self.client_secret}"
+        self.baseurl = 'de.api.labs.sophos.com'
+        d = {'grant_type': 'client_credentials'}
+        h = {'Authorization': f"Basic {base64.b64encode(self.authToken.encode('UTF-8')).decode('ascii')}",
+             'Content-Type': 'application/x-www-form-urlencoded'}
+        r = requests.post('https://api.labs.sophos.com/oauth2/token', headers=h, data=d)
+        if r.status_code == 200:
+            j = json.loads(r.text)
+            self.accessToken = j['access_token']
+
+    def get_result(self):
+        event = json.loads(self.misp_event.to_json())
+        results = {key: event[key] for key in ('Attribute', 'Object') if (key in event and event[key])}
+        return {'results': results}
+
+    def hash_lookup(self, filehash):
+        sophos_object = MISPObject('SOPHOSLabs Intelix SHA256 Report')
+        h = {"Authorization": f"{self.accessToken}"}
+        r = requests.get(f"https://{self.baseurl}/lookup/files/v1/{filehash}", headers=h)
+        if r.status_code == 200:
+            j = json.loads(r.text)
+            if 'reputationScore' in j:
+                sophos_object.add_attribute('Reputation Score', type='text', value=j['reputationScore'])
+                if 0 <= j['reputationScore'] <= 19:
+                    sophos_object.add_attribute('Decision', type='text', value='This file is malicious')
+                if 20 <= j['reputationScore'] <= 29:
+                    sophos_object.add_attribute('Decision', type='text', value='This file is potentially unwanted')
+                if 30 <= j['reputationScore'] <= 69:
+                    sophos_object.add_attribute('Decision', type='text', value='This file is unknown and suspicious')
+                if 70 <= j['reputationScore'] <= 100:
+                    sophos_object.add_attribute('Decision', type='text', value='This file is known good')
+            if 'detectionName' in j:
+                sophos_object.add_attribute('Detection Name', type='text', value=j['detectionName'])
+            else:
+                sophos_object.add_attribute('Detection Name', type='text', value='No name associated with this IoC')
+        self.misp_event.add_object(**sophos_object)
+
+    def ip_lookup(self, ip):
+        sophos_object = MISPObject('SOPHOSLabs Intelix IP Category Lookup')
+        h = {"Authorization": f"{self.accessToken}"}
+        r = requests.get(f"https://{self.baseurl}/lookup/ips/v1/{ip}", headers=h)
+        if r.status_code == 200:
+            j = json.loads(r.text)
+            if 'category' in j:
+                for c in j['category']:
+                    sophos_object.add_attribute('IP Address Categorisation', type='text', value=c)
+            else:
+                sophos_object.add_attribute('IP Address Categorisation', type='text', value='No category assocaited with IoC')
+        self.misp_event.add_object(**sophos_object)
+
+    def url_lookup(self, url):
+        sophos_object = MISPObject('SOPHOSLabs Intelix URL Lookup')
+        h = {"Authorization": f"{self.accessToken}"}
+        r = requests.get(f"https://{self.baseurl}/lookup/urls/v1/{quote(url, safe='')}", headers=h)
+        if r.status_code == 200:
+            j = json.loads(r.text)
+            if 'productivityCategory' in j:
+                sophos_object.add_attribute('URL Categorisation', type='text', value=j['productivityCategory'])
+            else:
+                sophos_object.add_attribute('URL Categorisation', type='text', value='No category assocaited with IoC')
+
+            if 'riskLevel' in j:
+                sophos_object.add_attribute('URL Risk Level', type='text', value=j['riskLevel'])
+            else:
+                sophos_object.add_attribute('URL Risk Level', type='text', value='No risk level associated with IoC')
+
+            if 'securityCategory' in j:
+                sophos_object.add_attribute('URL Security Category', type='text', value=j['securityCategory'])
+            else:
+                sophos_object.add_attribute('URL Security Category', type='text', value='No Security Category associated with IoC')
+        self.misp_event.add_object(**sophos_object)
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    j = json.loads(q)
+    if not j.get('config') or not j['config'].get('client_id') or not j['config'].get('client_secret'):
+        misperrors['error'] = "Missing client_id or client_secret value for SOPHOSLabs Intelix. \
+            It's free to sign up here https://aws.amazon.com/marketplace/pp/B07SLZPMCS."
+        return misperrors
+    to_check = (('type', 'value'), ('type', 'value1'))
+    if not j.get('attribute') or not any(check_input_attribute(j['attribute'], requirements=check) for check in to_check):
+        return {'error': f'{standard_error_message}, {checking_error}.'}
+    attribute = j['attribute']
+    if attribute['type'] not in misp_types_in:
+        return {'error': 'Unsupported attribute type.'}
+    client = SophosLabsApi(j['config']['client_id'], j['config']['client_secret'])
+    mapping = {
+        'sha256': 'hash_lookup',
+        'ip-dst': 'ip_lookup',
+        'ip-src': 'ip_lookup',
+        'ip': 'ip_lookup',
+        'uri': 'url_lookup',
+        'url': 'url_lookup',
+        'domain': 'url_lookup',
+        'hostname': 'url_lookup'
+    }
+    attribute_value = attribute['value'] if 'value' in attribute else attribute['value1']
+    getattr(client, mapping[attribute['type']])(attribute_value)
+    return client.get_result()
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/sourcecache.py

@@ -0,0 +1,57 @@
+import json
+from url_archiver import url_archiver
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['link', 'url'], 'output': ['attachment', 'malware-sample']}
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Alexandre Dulaunoy',
+    'description': 'Module to cache web pages of analysis reports, OSINT sources. The module returns a link of the cached page.',
+    'module-type': ['expansion'],
+    'name': 'URL Archiver',
+    'logo': '',
+    'requirements': ['urlarchiver: python library to fetch and archive URL on the file-system'],
+    'features': 'This module takes a link or url attribute as input and caches the related web page. It returns then a link of the cached page.',
+    'references': ['https://github.com/adulau/url_archiver'],
+    'input': 'A link or url attribute.',
+    'output': 'A malware-sample attribute describing the cached page.',
+}
+moduleconfig = ['archivepath']
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if (request.get('config')):
+        archive_path = request['config']['archivepath']
+    else:
+        archive_path = '/tmp/'
+    if request.get('link'):
+        tocache = request['link']
+        data = __archiveLink(archive_path, tocache)
+        mispattributes['output'] = ['attachment']
+    elif request.get('url'):
+        tocache = request['url']
+        data = __archiveLink(archive_path, tocache)
+        mispattributes['output'] = ['malware-sample']
+    else:
+        misperrors['error'] = "Link is missing"
+        return misperrors
+    enc_data = data.decode('ascii')
+    r = {'results': [{'types': mispattributes['output'], 'values': tocache, 'data': enc_data}]}
+    return r
+
+
+def __archiveLink(archive_path, tocache):
+    archiver = url_archiver.Archive(archive_path=archive_path)
+    return archiver.fetch(url=tocache, armor=True)
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/stairwell.py

@@ -0,0 +1,156 @@
+import json
+import re
+import requests
+from pymisp import MISPEvent, MISPObject
+from . import check_input_attribute, checking_error, standard_error_message
+
+
+misperrors = {
+    'error': 'Error'
+}
+mispattributes = {
+    'input': [
+        'md5',
+        'sha1',
+        'sha256'
+    ],
+    'format': 'misp_standard'
+}
+moduleinfo = {
+    'version': '0.1',
+    'author': 'goodlandsecurity',
+    'description': 'Module to query the Stairwell API to get additional information about the input hash attribute',
+    'module-type': ['expansion'],
+    'name': 'Stairwell Lookup',
+    'logo': 'stairwell.png',
+    'requirements': ['Access to Stairwell platform (apikey)'],
+    'features': "The module takes a hash attribute as input and queries Stariwell's API to fetch additional data about it. The result, if the payload is observed in Stariwell, is a file object describing the file the input hash is related to.",
+    'references': ['https://stairwell.com', 'https://docs.stairwell.com'],
+    'input': 'A hash attribute (md5, sha1, sha256).',
+    'output': 'File object related to the input attribute found on Stairwell platform.',
+}
+moduleconfig = ["apikey"]
+
+
+def parse_response(response: dict):
+    attribute_mapping = {
+        'environments': {'type': 'comment', 'object_relation': 'environment', 'distribution': 5},
+        'imphash': {'type': 'imphash', 'object_relation': 'impash', 'distribution': 5},
+        'magic': {'type': 'comment', 'object_relation': 'magic', 'distribution': 5},
+        'malEval': {
+            'probabilityBucket': {'type': 'comment', 'object_relation': 'malEval-probability', 'distribution': 5},
+            'severity': {'type': 'comment', 'object_relation': 'malEval-severity', 'distribution': 5}
+        },
+        'md5': {'type': 'md5', 'object_relation': 'md5', 'distribution': 5},
+        'mimeType': {'type': 'mime-type', 'object_relation': 'mime-type', 'distribution': 5},
+        'sha1': {'type': 'sha1', 'object_relation': 'sha1', 'distribution': 5},
+        'sha256': {'type': 'sha256', 'object_relation': 'sha256', 'distribution': 5},
+        'shannonEntropy': {'type': 'float', 'object_relation': 'entropy', 'distribution': 5},
+        'size': {'type': 'size-in-bytes', 'object_relation': 'size-in-bytes', 'distribution': 5},
+        'stairwellFirstSeenTime': {'type': 'datetime', 'object_relation': 'stairwell-first-seen', 'distribution': 5},
+        'tlsh': {'type': 'tlsh', 'object_relation': 'tlsh', 'distribution': 5},
+        'yaraRuleMatches': {'type': 'text', 'object_relation': 'yara-rule-match', 'comment': 'matching Stairwell yara rule name', 'distribution': 5}
+    }
+    environments_mapping = {
+        "NCS2SM-YHB2KT-SAFUDX-JC7F6WYA": "Florian's Open Rules",
+        "VR9Z98-4KU7ZC-PCNFEG-FURQ66FW": "Jotti",
+        "D7W6M6-BA9BS4-BQ23Z4-NKCNWQ96": "Malshare",
+        "D4447Q-WJJL6P-W7ME89-WHXJK8TW": "Malware Bazaar",
+        "XAKLND-DKWP3Z-56RL88-6XJ5NH46": "Pro Rules",
+        "GMEELM-K226XF-F95XZL-7VEJFKZ6": "Public Samples",
+        "5HEG8N-9T7UPG-8SZJ7T-2J4XSDC6": "RH-ISAC",
+        "2NN2BJ-HDVQHS-49824H-2SEDBBLJ": "RH-ISAC Malware Sharing",
+        "VCZTNF-8S76AK-LUU53W-2SWFFZWJ": "Stairwell Experimental Rules",
+        "GEG6FU-MRARGF-TLTM6X-H6MGDT5E": "Stairwell Methodology Rules",
+        "EB3DXY-3ZYFVH-6HNKJQ-GAPKHESS": "Stairwell OSINT Rules",
+        "NQNJM6-5LSCAF-3MC5FJ-W8EKGW6N": "Stairwell Research Rules",
+        "TT9GM5-JUMD8H-9828FL-GAW5NNXE": "stairwell-public-verdicts",
+        "MKYSAR-3XN9MB-3VAK3R-888ZJUTJ": "Threat Report Feeds",
+        "6HP5R3-ZM7DAN-RB4732-X6QPCJ36": "Virusshare",
+        "TV6WCV-7Y79LE-BK79EY-C8GUEY46": "vxintel"
+    }
+
+    misp_event = MISPEvent()
+    misp_object = MISPObject('stairwell')
+    for feature, attribute in attribute_mapping.items():
+        if feature in response.keys() and response[feature]:
+            if feature == 'yaraRuleMatches':
+                for rule in response[feature]:
+                    env_pattern = r'\b[A-Z0-9]{6}-[A-Z0-9]{6}-[A-Z0-9]{6}-[A-Z0-9]{8}\b'
+                    env = re.findall(env_pattern, rule.split('yaraRules/')[0])[0]
+                    misp_attribute = {
+                        'value': rule.split('yaraRules/')[1],
+                        'comment': f'Rule from: {environments_mapping.get(env, "Unknown UUID!")}'
+                    }
+                    misp_attribute.update(attribute)
+                    misp_object.add_attribute(**misp_attribute)
+            elif feature == 'environments':
+                for env in response[feature]:
+                    misp_attribute = {
+                        'value': environments_mapping.get(env, f'Unknown Environment: {env}'),
+                        'comment': 'Hash observed in'
+                    }
+                    misp_attribute.update(attribute)
+                    misp_object.add_attribute(**misp_attribute)
+            elif feature == 'malEval':
+                for attr in attribute:
+                    misp_attribute = {'value': response[feature][attr]}
+                    misp_attribute.update(attribute[attr])
+                    misp_object.add_attribute(**misp_attribute)
+            else:
+                misp_attribute = {'value': response[feature]}
+                misp_attribute.update(attribute)
+                attr = misp_object.add_attribute(**misp_attribute)
+                if feature in ('md5', 'sha1', 'sha256'):
+                    for label in response['malEval']['labels']:
+                        attr.add_tag(label)
+    misp_event.add_object(**misp_object)
+
+    event = json.loads(misp_event.to_json())
+    results = {'Object': event['Object']}
+
+    return {'results': results}
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if not request.get('config') or not request['config'].get('apikey'):
+        misperrors['error'] = 'A Stairwell api key is required for this module!'
+        return misperrors
+    if not request.get('attribute') or not check_input_attribute(request['attribute'], requirements=('type', 'value')):
+        misperrors['error'] = f'{standard_error_message}, {checking_error}.'
+        return misperrors
+    attribute = request['attribute']
+    if attribute['type'] not in mispattributes['input']:
+        misperrors['error'] = 'Unsupported attribute type!'
+        return misperrors
+
+    headers = {
+        "Accept": "application/json",
+        "Authorization": request['config']['apikey'],
+        "User-Agent": f"misp-module {__file__} {moduleinfo['version']}"
+    }
+    url = f"https://app.stairwell.com/v1/objects/{attribute['value']}/metadata"
+    response = requests.get(url=url, headers=headers).json()
+
+    if response.get('code') == 16:  # bad auth
+        return {'error': f"{response['message']} Is api key valid?"}
+    elif response.get('code') == 5:  # not found
+        return {'error': f"{attribute['type']}:{attribute['value']} {response['message']}"}
+    elif response.get('code') == 2:  # encoding/hex: invalid byte
+        return {'error': response['message']}
+    elif response.get('code'):  # catchall for potential unforeseen errors
+        return {'error': response['message'], 'code': response['code']}
+    else:
+        return parse_response(response)
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/stix2_pattern_syntax_validator.py

@@ -0,0 +1,56 @@
+import json
+try:
+    from stix2patterns.validator import run_validator
+except ImportError:
+    print("stix2 patterns python library is missing, use 'pip3 install stix2-patterns' to install it.")
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['stix2-pattern'], 'output': ['text']}
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Christian Studer',
+    'module-type': ['hover'],
+    'name': 'STIX2 Pattern Syntax Validator',
+    'description': 'An expansion hover module to perform a syntax check on stix2 patterns.',
+    'logo': 'stix.png',
+    'requirements': ['stix2patterns python library'],
+    'features': 'This module takes a STIX2 pattern attribute as input and performs a syntax check on it.\n\nIt displays then that the rule is valid if it is the case, and the error related to the rule otherwise.',
+    'references': ['[STIX2.0 patterning specifications](http://docs.oasis-open.org/cti/stix/v2.0/cs01/part5-stix-patterning/stix-v2.0-cs01-part5-stix-patterning.html)'],
+    'input': 'A STIX2 pattern attribute.',
+    'output': 'Text describing the validity of the STIX2 pattern.',
+}
+moduleconfig = []
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if not request.get('stix2-pattern'):
+        misperrors['error'] = 'STIX2 pattern missing'
+        return misperrors
+    pattern = request.get('stix2-pattern')
+    syntax_errors = []
+    for p in pattern[1:-1].split(' AND '):
+        syntax_validator = run_validator("[{}]".format(p))
+        if syntax_validator:
+            for error in syntax_validator:
+                syntax_errors.append(error)
+    if syntax_errors:
+        s = 's' if len(syntax_errors) > 1 else ''
+        s_errors = ""
+        for error in syntax_errors:
+            s_errors += "{}\n".format(error[6:])
+        result = "Syntax error{}: \n{}".format(s, s_errors[:-1])
+    else:
+        result = "Syntax valid"
+    return {'results': [{'types': mispattributes['output'], 'values': result}]}
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo