misp-modules 2.4.196__py3-none-any.whl

misp_modules/modules/expansion/threatcrowd.py

@@ -0,0 +1,170 @@
+import json
+import requests
+import re
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ["hostname", "domain", "ip-src", "ip-dst", "md5", "sha1", "sha256", "sha512", "whois-registrant-email"],
+                  'output': ["domain", "ip-src", "ip-dst", "text", "md5", "sha1", "sha256", "sha512", "hostname", "whois-registrant-email"]
+                  }
+
+# possible module-types: 'expansion', 'hover' or both
+moduleinfo = {
+    'version': '1',
+    'author': 'chrisdoman',
+    'description': 'Module to get information from ThreatCrowd.',
+    'module-type': ['expansion'],
+    'name': 'ThreatCrowd Lookup',
+    'logo': 'threatcrowd.png',
+    'requirements': [],
+    'features': 'This module takes a MISP attribute as input and queries ThreatCrowd with it.\n\nThe result of this query is then parsed and some data is mapped into MISP attributes in order to enrich the input attribute.',
+    'references': ['https://www.threatcrowd.org/'],
+    'input': 'A MISP attribute included in the following list:\n- hostname\n- domain\n- ip-src\n- ip-dst\n- md5\n- sha1\n- sha256\n- sha512\n- whois-registrant-email',
+    'output': 'MISP attributes mapped from the result of the query on ThreatCrowd, included in the following list:\n- domain\n- ip-src\n- ip-dst\n- text\n- md5\n- sha1\n- sha256\n- sha512\n- hostname\n- whois-registrant-email',
+}
+
+moduleconfig = []
+
+
+# Avoid adding windows update to enrichment etc.
+def isBlacklisted(value):
+    blacklist = ['8.8.8.8', '255.255.255.255', '192.168.56.', 'time.windows.com']
+
+    for b in blacklist:
+        if value in b:
+            return True
+
+    return False
+
+
+def valid_ip(ip):
+    m = re.match(r"^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$", ip)
+    return bool(m) and all(map(lambda n: 0 <= int(n) <= 255, m.groups()))
+
+
+def valid_domain(hostname):
+    if len(hostname) > 255:
+        return False
+    if hostname[-1] == ".":
+        hostname = hostname[:-1]  # strip exactly one dot from the right, if present
+    allowed = re.compile(r"(?!-)[A-Z\d-]{1,63}(?<!-)$", re.IGNORECASE)
+    return all(allowed.match(x) for x in hostname.split("."))
+
+
+def valid_email(email):
+    return bool(re.search(r"^[\w\.\+\-]+\@[\w]+\.[a-z]{2,3}$", email))
+
+
+def handler(q=False):
+    if q is False:
+        return False
+
+    q = json.loads(q)
+
+    r = {"results": []}
+
+    if "ip-src" in q:
+        r["results"] += getIP(q["ip-src"])
+    if "ip-dst" in q:
+        r["results"] += getIP(q["ip-dst"])
+    if "domain" in q:
+        r["results"] += getDomain(q["domain"])
+    if 'hostname' in q:
+        r["results"] += getDomain(q['hostname'])
+    if 'md5' in q:
+        r["results"] += getHash(q['md5'])
+    if 'sha1' in q:
+        r["results"] += getHash(q['sha1'])
+    if 'sha256' in q:
+        r["results"] += getHash(q['sha256'])
+    if 'sha512' in q:
+        r["results"] += getHash(q['sha512'])
+    if 'whois-registrant-email' in q:
+        r["results"] += getEmail(q['whois-registrant-email'])
+
+    uniq = []
+    for res in r["results"]:
+        if res not in uniq:
+            uniq.append(res)
+    r["results"] = uniq
+    return r
+
+
+def getHash(hash):
+
+    ret = []
+    req = json.loads(requests.get("https://www.threatcrowd.org/searchApi/v2/file/report/?resource=" + hash).text)
+
+    if "domains" in req:
+        domains = req["domains"]
+        for domain in domains:
+            if not isBlacklisted(domain) and valid_domain(domain):
+                ret.append({"types": ["hostname"], "values": [domain]})
+
+    if "ips" in req:
+        ips = req["ips"]
+        for ip in ips:
+            if not isBlacklisted(ip):
+                ret.append({"types": ["ip-dst"], "values": [ip]})
+
+    return ret
+
+
+def getIP(ip):
+    ret = []
+    req = json.loads(requests.get("https://www.threatcrowd.org/searchApi/v2/ip/report/?ip=" + ip).text)
+
+    if "resolutions" in req:
+        for dns in req["resolutions"]:
+            if "domain" in dns:
+                if valid_domain(dns["domain"]):
+                    ret.append({"types": ["hostname"], "values": [dns["domain"]]})
+
+    if "hashes" in req:
+        for hash in req["hashes"]:
+            ret.append({"types": ["md5"], "values": [hash]})
+
+    return ret
+
+
+def getEmail(email):
+    ret = []
+    j = requests.get("https://www.threatcrowd.org/searchApi/v2/email/report/?email=" + email).text
+    req = json.loads(j)
+
+    if "domains" in req:
+        domains = req["domains"]
+        for domain in domains:
+            if not isBlacklisted(domain) and valid_domain(domain):
+                ret.append({"types": ["hostname"], "values": [domain]})
+
+    return ret
+
+
+def getDomain(domain):
+
+    ret = []
+    req = json.loads(requests.get("https://www.threatcrowd.org/searchApi/v2/domain/report/?domain=" + domain).text)
+
+    if "resolutions" in req:
+        for dns in req["resolutions"]:
+            if "ip_address" in dns:
+                ret.append({"types": ["ip-dst"], "values": [dns["ip_address"]]})
+
+    if "emails" in req:
+        for email in req["emails"]:
+            ret.append({"types": ["whois-registrant-email"], "values": [email]})
+
+    if "hashes" in req:
+        for hash in req["hashes"]:
+            ret.append({"types": ["md5"], "values": [hash]})
+
+    return ret
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/threatfox.py

@@ -0,0 +1,75 @@
+# -*- coding: utf-8 -*-
+import requests
+import json
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['md5', 'sha1', 'sha256', 'domain', 'url', 'email-src', 'ip-dst|port', 'ip-src|port'], 'output': ['text']}
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Corsin Camichel',
+    'description': 'Module to search for an IOC on ThreatFox by abuse.ch.',
+    'module-type': ['hover', 'expansion'],
+    'name': 'ThreadFox Lookup',
+    'logo': '',
+    'requirements': [],
+    'features': '',
+    'references': [],
+    'input': '',
+    'output': '',
+}
+moduleconfig = []
+
+API_URL = "https://threatfox-api.abuse.ch/api/v1/"
+
+
+# copied from
+# https://github.com/marjatech/threatfox2misp/blob/main/threatfox2misp.py
+def confidence_level_to_tag(level: int) -> str:
+    confidence_tagging = {
+        0: 'misp:confidence-level="unconfident"',
+        10: 'misp:confidence-level="rarely-confident"',
+        37: 'misp:confidence-level="fairly-confident"',
+        63: 'misp:confidence-level="usually-confident"',
+        90: 'misp:confidence-level="completely-confident"',
+    }
+
+    confidence_tag = ""
+    for tag_minvalue, tag in confidence_tagging.items():
+        if level >= tag_minvalue:
+            confidence_tag = tag
+    return confidence_tag
+
+
+def handler(q=False):
+    if q is False:
+        return False
+
+    request = json.loads(q)
+    ret_val = ""
+
+    for input_type in mispattributes['input']:
+        if input_type in request:
+            to_query = request[input_type]
+            break
+    else:
+        misperrors['error'] = "Unsupported attributes type:"
+        return misperrors
+
+    data = {"query": "search_ioc", "search_term": f"{to_query}"}
+    response = requests.post(API_URL, data=json.dumps(data))
+    if response.status_code == 200:
+        result = json.loads(response.text)
+        if(result["query_status"] == "ok"):
+            confidence_tag = confidence_level_to_tag(result["data"][0]["confidence_level"])
+            ret_val = {'results': [{'types': mispattributes['output'], 'values': [result["data"][0]["threat_type_desc"]], 'tags': [result["data"][0]["malware"], result["data"][0]["malware_printable"], confidence_tag]}]}
+
+    return ret_val
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/threatminer.py

@@ -0,0 +1,152 @@
+import json
+import requests
+from collections import defaultdict
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['hostname', 'domain', 'ip-src', 'ip-dst', 'md5', 'sha1', 'sha256', 'sha512'],
+                  'output': ['domain', 'ip-src', 'ip-dst', 'text', 'md5', 'sha1', 'sha256', 'sha512', 'ssdeep',
+                             'authentihash', 'filename', 'whois-registrant-email', 'url', 'link']
+                  }
+
+# possible module-types: 'expansion', 'hover' or both
+moduleinfo = {
+    'version': '1',
+    'author': 'KX499',
+    'description': 'Module to get information from ThreatMiner.',
+    'module-type': ['expansion'],
+    'name': 'ThreatMiner Lookup',
+    'logo': 'threatminer.png',
+    'requirements': [],
+    'features': 'This module takes a MISP attribute as input and queries ThreatMiner with it.\n\nThe result of this query is then parsed and some data is mapped into MISP attributes in order to enrich the input attribute.',
+    'references': ['https://www.threatminer.org/'],
+    'input': 'A MISP attribute included in the following list:\n- hostname\n- domain\n- ip-src\n- ip-dst\n- md5\n- sha1\n- sha256\n- sha512',
+    'output': 'MISP attributes mapped from the result of the query on ThreatMiner, included in the following list:\n- domain\n- ip-src\n- ip-dst\n- text\n- md5\n- sha1\n- sha256\n- sha512\n- ssdeep\n- authentihash\n- filename\n- whois-registrant-email\n- url\n- link',
+}
+
+
+class ThreatMiner():
+    def __init__(self):
+        self.results = defaultdict(set)
+        self.comment = '{}: Threatminer - {}'
+        self.types_mapping = {'domain': '_get_domain', 'hostname': '_get_domain',
+                              'ip-dst': '_get_ip', 'ip-src': '_get_ip',
+                              'md5': '_get_hash', 'sha1': '_get_hash',
+                              'sha256': '_get_hash', 'sha512': '_get_hash'}
+
+    @property
+    def parsed_results(self):
+        to_return = []
+        for key, values in self.results.items():
+            if values:
+                input_value, comment = key[:2]
+                types = [k for k in key[2:]]
+                to_return.append({'types': types, 'values': list(values),
+                                  'comment': self.comment.format(input_value, comment)})
+        return to_return
+
+    def parse_query(self, request):
+        for input_type, to_call in self.types_mapping.items():
+            if request.get(input_type):
+                getattr(self, to_call)(request[input_type])
+
+    def _get_domain(self, q):
+        queries_mapping = {1: ('_add_whois', 'whois'), 2: ('_add_ip', 'pdns'),
+                           3: ('_add_uri', 'uri'), 4: ('_add_hash', 'samples'),
+                           5: ('_add_domain', 'subdomain'), 6: ('_add_link', 'report')}
+        for flag, mapped in queries_mapping.items():
+            req = requests.get('https://www.threatminer.org/domain.php', params={'q': q, 'api': 'True', 'rt': flag})
+            if not req.status_code == 200:
+                continue
+            results = req.json().get('results')
+            if not results:
+                continue
+            to_call, comment = mapped
+            getattr(self, to_call)(results, q, comment)
+
+    def _get_hash(self, q):
+        queries_mapping = {1: ('_add_filename', 'file'), 3: ('_add_network', 'network'),
+                           6: ('_add_text', 'detection'), 7: ('_add_hash', 'report')}
+        for flag, mapped in queries_mapping.items():
+            req = requests.get('https://www.threatminer.org/sample.php', params={'q': q, 'api': 'True', 'rt': flag})
+            if not req.status_code == 200:
+                continue
+            results = req.json().get('results')
+            if not results:
+                continue
+            to_call, comment = mapped
+            getattr(self, to_call)(results, q, comment)
+
+    def _get_ip(self, q):
+        queries_mapping = {1: ('_add_whois', 'whois'), 2: ('_add_ip', 'pdns'),
+                           3: ('_add_uri', 'uri'), 4: ('_add_hash', 'samples'),
+                           5: ('_add_x509', 'ssl'), 6: ('_add_link', 'report')}
+        for flag, mapped in queries_mapping.items():
+            req = requests.get('https://www.threatminer.org/host.php', params={'q': q, 'api': 'True', 'rt': flag})
+            if not req.status_code == 200:
+                continue
+            results = req.json().get('results')
+            if not results:
+                continue
+            to_call, comment = mapped
+            getattr(self, to_call)(results, q, comment)
+
+    def _add_domain(self, results, q, comment):
+        self.results[(q, comment, 'domain')].update({result for result in results if isinstance(result, str)})
+
+    def _add_filename(self, results, q, comment):
+        self.results[(q, comment, 'filename')].update({result['file_name'] for result in results if result.get('file_name')})
+
+    def _add_hash(self, results, q, comment):
+        self.results[(q, comment, 'sha256')].update({result for result in results if isinstance(result, str)})
+
+    def _add_ip(self, results, q, comment):
+        self.results[(q, comment, 'ip-src', 'ip-dst')].update({result['ip'] for result in results if result.get('ip')})
+
+    def _add_link(self, results, q, comment):
+        self.results[(q, comment, 'link')].update({result['URL'] for result in results if result.get('URL')})
+
+    def _add_network(self, results, q, comment):
+        for result in results:
+            domains = result.get('domains')
+            if domains:
+                self.results[(q, comment, 'domain')].update({domain['domain'] for domain in domains if domain.get('domain')})
+            hosts = result.get('hosts')
+            if hosts:
+                self.results[(q, comment, 'ip-src', 'ip-dst')].update({host for host in hosts if isinstance(host, str)})
+
+    def _add_text(self, results, q, comment):
+        for result in results:
+            detections = result.get('av_detections')
+            if detections:
+                self.results[(q, comment, 'text')].update({d['detection'] for d in detections if d.get('detection')})
+
+    def _add_uri(self, results, q, comment):
+        self.results[(q, comment, 'url')].update({result['uri'] for result in results if result.get('uri')})
+
+    def _add_whois(self, results, q, comment):
+        for result in results:
+            emails = result.get('whois', {}).get('emails')
+            if emails:
+                self.results[(q, comment, 'whois-registrant-email')].update({email for em_type, email in emails.items() if em_type == 'registrant' and email})
+
+    def _add_x509(self, results, q, comment):
+        self.results[(q, comment, 'x509-fingerprint-sha1')].update({result for result in results if isinstance(result, str)})
+
+
+def handler(q=False):
+    if q is False:
+        return False
+
+    q = json.loads(q)
+
+    parser = ThreatMiner()
+    parser.parse_query(q)
+    return {'results': parser.parsed_results}
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    return moduleinfo

misp_modules/modules/expansion/triage_submit.py

@@ -0,0 +1,119 @@
+import json
+import requests
+import base64
+import io
+import zipfile
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['attachment', 'malware-sample', 'url'], 'output': ['link']}
+moduleinfo = {
+    'version': '1',
+    'author': 'Karen Yousefi',
+    'description': 'Module to submit samples to tria.ge',
+    'module-type': ['expansion', 'hover'],
+    'name': 'Triage Submit',
+    'logo': '',
+}
+
+moduleconfig = ['apikey', 'url_mode']
+
+
+def handler(q=False):
+    if q is False:
+        return False
+
+    request = json.loads(q)
+
+    if request.get('config', {}).get('apikey') is None:
+        misperrors['error'] = 'tria.ge API key is missing'
+        return misperrors
+
+    api_key = request['config']['apikey']
+    url_mode = request['config'].get('url_mode', 'submit')  # 'submit' or 'fetch'
+    base_url = 'https://tria.ge/api/v0/samples'
+    headers = {'Authorization': f'Bearer {api_key}'}
+
+    if 'attachment' in request:
+        data = request['data']
+        filename = request['attachment']
+        return submit_file(headers, base_url, data, filename)
+    elif 'malware-sample' in request:
+        data = request['data']
+        filename = request['malware-sample'].split('|')[0]
+        return submit_file(headers, base_url, data, filename, is_malware_sample=True)
+    elif 'url' in request:
+        url = request['url']
+        return submit_url(headers, base_url, url, url_mode)
+    else:
+        misperrors['error'] = 'Unsupported input type'
+        return misperrors
+
+
+def submit_file(headers, base_url, data, filename, is_malware_sample=False):
+    try:
+        if is_malware_sample:
+            file_data = base64.b64decode(data)
+            zip_file = zipfile.ZipFile(io.BytesIO(file_data))
+            file_data = zip_file.read(zip_file.namelist()[0], pwd=b'infected')
+        else:
+            file_data = base64.b64decode(data)
+
+        files = {'file': (filename, file_data)}
+        response = requests.post(base_url, headers=headers, files=files)
+        response.raise_for_status()
+        result = response.json()
+
+        sample_id = result['id']
+        sample_url = f'https://tria.ge/{sample_id}'
+
+        return {
+            'results': [
+                {
+                    'types': 'link',
+                    'values': sample_url,
+                    'comment': 'Link to tria.ge analysis',
+                }
+            ]
+        }
+
+    except Exception as e:
+        misperrors['error'] = f'Error submitting to tria.ge: {str(e)}'
+        return misperrors
+
+
+def submit_url(headers, base_url, url, mode):
+    try:
+        if mode == 'fetch':
+            data = {'kind': 'fetch', 'url': url}
+        else:  # submit
+            data = {'kind': 'url', 'url': url}
+
+        response = requests.post(base_url, headers=headers, json=data)
+        response.raise_for_status()
+        result = response.json()
+
+        sample_id = result['id']
+        sample_url = f'https://tria.ge/{sample_id}'
+
+        return {
+            'results': [
+                {
+                    'types': 'link',
+                    'values': sample_url,
+                    'comment': f'Link to tria.ge analysis ({mode} mode)',
+                }
+            ]
+        }
+
+    except Exception as e:
+        misperrors['error'] = f'Error submitting to tria.ge: {str(e)}'
+        return misperrors
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo