misp-modules 2.4.196__py3-none-any.whl

misp_modules/modules/export_mod/mass_eql_export.py

@@ -0,0 +1,106 @@
+"""
+Export module for converting MISP events into Endgame EQL queries
+"""
+import base64
+import io
+import json
+import logging
+
+misperrors = {"error": "Error"}
+
+moduleinfo = {
+    'version': '0.1',
+    'author': '92 COS DOM',
+    'description': 'Export MISP event in Event Query Language',
+    'module-type': ['export'],
+    'name': 'EQL Query Export',
+    'logo': 'eql.png',
+    'requirements': [],
+    'features': 'This module produces EQL queries for all relevant attributes in a MISP event.',
+    'references': ['https://eql.readthedocs.io/en/latest/'],
+    'input': 'MISP Event attributes',
+    'output': 'Text file containing one or more EQL queries',
+}
+
+# Map of MISP fields => Endgame fields
+fieldmap = {
+    "ip-src": "source_address",
+    "ip-dst": "destination_address",
+    "filename": "file_name"
+}
+
+# Describe what events have what fields
+event_types = {
+    "source_address": "network",
+    "destination_address": "network",
+    "file_name": "file"
+}
+
+# combine all the MISP fields from fieldmap into one big list
+mispattributes = {
+    "input": list(fieldmap.keys())
+}
+
+
+def handler(q=False):
+    """
+    Convert a MISP query into a CSV file matching the ThreatConnect Structured Import file format.
+    Input
+        q: Query dictionary
+    """
+    if q is False or not q:
+        return False
+
+    # Check if we were given a configuration
+    request = json.loads(q)
+    config = request.get("config", {"Default_Source": ""})
+    logging.info("Setting config to: %s", config)
+
+    response = io.StringIO()
+
+    # start parsing MISP data
+    queryDict = {}
+    for event in request["data"]:
+        for attribute in event["Attribute"]:
+            if attribute["type"] in mispattributes["input"]:
+                logging.debug("Adding %s to EQL query", attribute["value"])
+                event_type = event_types[fieldmap[attribute["type"]]]
+                if event_type not in queryDict.keys():
+                    queryDict[event_type] = {}
+                queryDict[event_type][attribute["value"]] = fieldmap[attribute["type"]]
+    i = 0
+    for query in queryDict.keys():
+        response.write("{} where\n".format(query))
+        for value in queryDict[query].keys():
+            if i != 0:
+                response.write(" or\n")
+            response.write("\t{} == \"{}\"".format(queryDict[query][value], value))
+            i += 1
+
+    return {"response": [], "data": str(base64.b64encode(bytes(response.getvalue(), 'utf-8')), 'utf-8')}
+
+
+def introspection():
+    """
+    Relay the supported attributes to MISP.
+    No Input
+    Output
+        Dictionary of supported MISP attributes
+    """
+    modulesetup = {
+        "responseType": "application/txt",
+        "outputFileExtension": "txt",
+        "userConfig": {},
+        "inputSource": []
+    }
+    return modulesetup
+
+
+def version():
+    """
+    Relay module version and associated metadata to MISP.
+    No Input
+    Output
+        moduleinfo: metadata output containing all potential configuration values
+    """
+    return moduleinfo

misp_modules/modules/export_mod/nexthinkexport.py

@@ -0,0 +1,131 @@
+"""
+Export module for coverting MISP events into Nexthink NXQL queries.
+Source: https://github.com/HacknowledgeCH/misp-modules/blob/master/misp_modules/modules/export_mod/nexthinkexport.py
+Config['Period'] : allows to define period over witch to look for IOC from now (15m, 1d, 2w, 30d, ...), see Nexthink data model documentation
+"""
+
+import base64
+import json
+
+misperrors = {"error": "Error"}
+
+types_to_use = ['sha1', 'sha256', 'md5', 'domain']
+
+userConfig = {
+
+}
+
+moduleconfig = ["Period"]
+inputSource = ['event']
+
+outputFileExtension = 'nxql'
+responseType = 'application/txt'
+
+moduleinfo = {
+    'version': '1.0',
+    'author': 'Julien Bachmann, Hacknowledge',
+    'description': 'Nexthink NXQL query export module',
+    'module-type': ['export'],
+    'name': 'Nexthink NXQL Export',
+    'logo': 'nexthink.svg',
+    'requirements': [],
+    'features': 'This module export an event as Nexthink NXQL queries that can then be used in your own python3 tool or from wget/powershell',
+    'references': ['https://doc.nexthink.com/Documentation/Nexthink/latest/APIAndIntegrations/IntroducingtheWebAPIV2'],
+    'input': 'MISP Event attributes',
+    'output': 'Nexthink NXQL queries',
+}
+
+
+def handle_sha1(value, period):
+    query = '''select ((binary (executable_name version)) (user (name)) (device (name last_ip_address)) (execution (binary_path start_time)))
+(from (binary user device execution)
+(where binary (eq sha1 (sha1 %s)))
+(between now-%s now))
+(limit 1000)
+    ''' % (value, period)
+    return query.replace('\n', ' ')
+
+
+def handle_sha256(value, period):
+    query = '''select ((binary (executable_name version)) (user (name)) (device (name last_ip_address)) (execution (binary_path start_time)))
+(from (binary user device execution)
+(where binary (eq sha256 (sha256 %s)))
+(between now-%s now))
+(limit 1000)
+    ''' % (value, period)
+    return query.replace('\n', ' ')
+
+
+def handle_md5(value, period):
+    query = '''select ((binary (executable_name version)) (user (name)) (device (name last_ip_address)) (execution (binary_path start_time)))
+(from (binary user device execution)
+(where binary (eq hash (md5 %s)))
+(between now-%s now))
+(limit 1000)
+    ''' % (value, period)
+    return query.replace('\n', ' ')
+
+
+def handle_domain(value, period):
+    query = '''select ((device name) (device (name last_ip_address)) (user name)(user department) (binary executable_name)(binary application_name)(binary description)(binary application_category)(binary (executable_name version)) (binary #"Suspicious binary")(binary first_seen)(binary last_seen)(binary threat_level)(binary hash) (binary paths)
+(destination name)(domain name) (domain domain_category)(domain hosting_country)(domain protocol)(domain threat_level) (port port_number)(web_request incoming_traffic)(web_request outgoing_traffic))
+(from (web_request device user binary executable destination domain port)
+(where domain (eq name(string %s)))
+(between now-%s now))
+(limit 1000)
+    ''' % (value, period)
+    return query.replace('\n', ' ')
+
+
+handlers = {
+    'sha1': handle_sha1,
+    'sha256': handle_sha256,
+    'md5': handle_md5,
+    'domain': handle_domain
+}
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    r = {'results': []}
+    request = json.loads(q)
+    config = request.get("config", {"Period": ""})
+    output = ''
+
+    for event in request["data"]:
+        for attribute in event["Attribute"]:
+            if attribute['type'] in types_to_use:
+                output = output + handlers[attribute['type']](attribute['value'], config['Period']) + '\n'
+    r = {"response": [], "data": str(base64.b64encode(bytes(output, 'utf-8')), 'utf-8')}
+    return r
+
+
+def introspection():
+    modulesetup = {}
+    try:
+        responseType
+        modulesetup['responseType'] = responseType
+    except NameError:
+        pass
+    try:
+        userConfig
+        modulesetup['userConfig'] = userConfig
+    except NameError:
+        pass
+    try:
+        outputFileExtension
+        modulesetup['outputFileExtension'] = outputFileExtension
+    except NameError:
+        pass
+    try:
+        inputSource
+        modulesetup['inputSource'] = inputSource
+    except NameError:
+        pass
+    return modulesetup
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/export_mod/osqueryexport.py

@@ -0,0 +1,125 @@
+"""
+Export module for coverting MISP events into OSQuery queries.
+Source: https://github.com/0xmilkmix/misp-modules/blob/master/misp_modules/modules/export_mod/osqueryexport.py
+"""
+
+import base64
+import json
+import re
+
+misperrors = {"error": "Error"}
+
+types_to_use = ['regkey', 'regkey|value', 'mutex', 'windows-service-displayname', 'windows-scheduled-task', 'yara']
+
+userConfig = {
+
+}
+
+moduleconfig = []
+inputSource = ['event']
+
+outputFileExtension = 'conf'
+responseType = 'application/txt'
+
+
+moduleinfo = {
+    'version': '1.0',
+    'author': 'Julien Bachmann, Hacknowledge',
+    'description': 'OSQuery export of a MISP event.',
+    'module-type': ['export'],
+    'name': 'OSQuery Export',
+    'logo': 'osquery.png',
+    'requirements': [],
+    'features': 'This module export an event as osquery queries that can be used in packs or in fleet management solution like Kolide.',
+    'references': [],
+    'input': 'MISP Event attributes',
+    'output': 'osquery SQL queries',
+}
+
+
+def handle_regkey(value):
+    rep = {'HKCU': 'HKEY_USERS\\%', 'HKLM': 'HKEY_LOCAL_MACHINE'}
+    rep = dict((re.escape(k), v) for k, v in rep.items())
+    pattern = re.compile("|".join(rep.keys()))
+    value = pattern.sub(lambda m: rep[re.escape(m.group(0))], value)
+    return 'SELECT * FROM registry WHERE path LIKE \'%s\';' % value
+
+
+def handle_regkeyvalue(value):
+    key, value = value.split('|')
+    rep = {'HKCU': 'HKEY_USERS\\%', 'HKLM': 'HKEY_LOCAL_MACHINE'}
+    rep = dict((re.escape(k), v) for k, v in rep.items())
+    pattern = re.compile("|".join(rep.keys()))
+    key = pattern.sub(lambda m: rep[re.escape(m.group(0))], key)
+    return 'SELECT * FROM registry WHERE path LIKE \'%s\' AND data LIKE \'%s\';' % (key, value)
+
+
+def handle_mutex(value):
+    return 'SELECT * FROM winbaseobj WHERE object_name LIKE \'%s\';' % value
+
+
+def handle_service(value):
+    return 'SELECT * FROM services WHERE display_name LIKE \'%s\' OR name like \'%s\';' % (value, value)
+
+
+def handle_yara(value):
+    return 'not implemented yet, not sure it\'s easily feasible w/o dropping the sig on the hosts first'
+
+
+def handle_scheduledtask(value):
+    return 'SELECT * FROM scheduled_tasks WHERE name LIKE \'%s\';' % value
+
+
+handlers = {
+    'regkey': handle_regkey,
+    'regkey|value': handle_regkeyvalue,
+    'mutex': handle_mutex,
+    'windows-service-displayname': handle_service,
+    'windows-scheduled-task': handle_scheduledtask,
+    'yara': handle_yara
+}
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    r = {'results': []}
+    request = json.loads(q)
+    output = ''
+
+    for event in request["data"]:
+        for attribute in event["Attribute"]:
+            if attribute['type'] in types_to_use:
+                output = output + handlers[attribute['type']](attribute['value']) + '\n'
+    r = {"response": [], "data": str(base64.b64encode(bytes(output, 'utf-8')), 'utf-8')}
+    return r
+
+
+def introspection():
+    modulesetup = {}
+    try:
+        responseType
+        modulesetup['responseType'] = responseType
+    except NameError:
+        pass
+    try:
+        userConfig
+        modulesetup['userConfig'] = userConfig
+    except NameError:
+        pass
+    try:
+        outputFileExtension
+        modulesetup['outputFileExtension'] = outputFileExtension
+    except NameError:
+        pass
+    try:
+        inputSource
+        modulesetup['inputSource'] = inputSource
+    except NameError:
+        pass
+    return modulesetup
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/export_mod/pdfexport.py

@@ -0,0 +1,107 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+import json
+
+from pymisp import MISPEvent
+from pymisp.tools import reportlab_generator
+
+misperrors = {'error': 'Error'}
+
+moduleinfo = {
+    'version': '2',
+    'author': 'Vincent Falconieri (prev. Raphaël Vinot)',
+    'description': 'Simple export of a MISP event to PDF.',
+    'module-type': ['export'],
+    'name': 'Event to PDF Export',
+    'require_standard_format': True,
+    'logo': '',
+    'requirements': ['PyMISP', 'reportlab'],
+    'features': "The module takes care of the PDF file building, and work with any MISP Event. Except the requirement of reportlab, used to create the file, there is no special feature concerning the Event. Some parameters can be given through the config dict. 'MISP_base_url_for_dynamic_link' is your MISP URL, to attach an hyperlink to your event on your MISP instance from the PDF. Keep it clear to avoid hyperlinks in the generated pdf.\n  'MISP_name_for_metadata' is your CERT or MISP instance name. Used as text in the PDF' metadata\n  'Activate_textual_description' is a boolean (True or void) to activate the textual description/header abstract of an event\n  'Activate_galaxy_description' is a boolean (True or void) to activate the description of event related galaxies.\n  'Activate_related_events' is a boolean (True or void) to activate the description of related event. Be aware this might leak information on confidential events linked to the current event !\n  'Activate_internationalization_fonts' is a boolean (True or void) to activate Noto fonts instead of default fonts (Helvetica). This allows the support of CJK alphabet. Be sure to have followed the procedure to download Noto fonts (~70Mo) in the right place (/tools/pdf_fonts/Noto_TTF), to allow PyMisp to find and use them during PDF generation.\n  'Custom_fonts_path' is a text (path or void) to the TTF file of your choice, to create the PDF with it. Be aware the PDF won't support bold/italic/special style anymore with this option ",
+    'references': ['https://acrobat.adobe.com/us/en/acrobat/about-adobe-pdf.html'],
+    'input': 'MISP Event',
+    'output': 'MISP Event in a PDF file.',
+}
+
+# config fields that your code expects from the site admin
+moduleconfig = ["MISP_base_url_for_dynamic_link", "MISP_name_for_metadata", "Activate_textual_description", "Activate_galaxy_description", "Activate_related_events", "Activate_internationalization_fonts", "Custom_fonts_path"]
+mispattributes = {}
+
+outputFileExtension = "pdf"
+responseType = "application/pdf"
+
+types_to_attach = ['ip-dst', 'url', 'domain']
+objects_to_attach = ['domain-ip']
+
+
+class ReportGenerator():
+    def __init__(self):
+        self.report = ''
+
+    def from_remote(self, event_id):
+        from pymisp import PyMISP
+        from keys import misp_url, misp_key, misp_verifycert
+        misp = PyMISP(misp_url, misp_key, misp_verifycert)
+        result = misp.get(event_id)
+        self.misp_event = MISPEvent()
+        self.misp_event.load(result)
+
+    def from_event(self, event):
+        self.misp_event = MISPEvent()
+        self.misp_event.load(event)
+
+
+def handler(q=False):
+    if q is False:
+        return False
+
+    request = json.loads(q)
+
+    if 'data' not in request:
+        return False
+
+    config = {}
+
+    # Construct config object for reportlab_generator
+    for config_item in moduleconfig:
+        if (request.get('config')) and (request['config'].get(config_item) is not None):
+            config[config_item] = request['config'].get(config_item)
+
+    for evt in request['data']:
+        misp_event = MISPEvent()
+        misp_event.load(evt)
+
+        pdf = reportlab_generator.get_base64_from_value(reportlab_generator.convert_event_in_pdf_buffer(misp_event, config))
+
+        return {'response': [], 'data': str(pdf, 'utf-8')}
+
+
+def introspection():
+    modulesetup = {}
+    try:
+        responseType
+        modulesetup['responseType'] = responseType
+    except NameError:
+        pass
+
+    try:
+        userConfig
+        modulesetup['userConfig'] = userConfig
+    except NameError:
+        pass
+    try:
+        outputFileExtension
+        modulesetup['outputFileExtension'] = outputFileExtension
+    except NameError:
+        pass
+    try:
+        inputSource
+        modulesetup['inputSource'] = inputSource
+    except NameError:
+        pass
+    return modulesetup
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/export_mod/testexport.py

@@ -0,0 +1,73 @@
+import json
+import base64
+
+misperrors = {'error': 'Error'}
+
+
+userConfig = {
+
+}
+
+moduleconfig = []
+
+# fixed for now, options in the future:
+# event, attribute, event-collection, attribute-collection
+inputSource = ['event']
+
+outputFileExtension = 'txt'
+responseType = 'application/txt'
+
+
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Andras Iklody',
+    'description': 'Skeleton export module.',
+    'name': 'Test Export',
+    'module-type': ['export'],
+    'logo': '',
+    'requirements': [],
+    'features': '',
+    'references': [],
+    'input': '',
+    'output': '',
+}
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    r = {'results': []}
+    result = json.loads(q)  # noqa
+    output = ''  # Insert your magic here!
+    r = {"data": base64.b64encode(output.encode('utf-8')).decode('utf-8')}
+    return r
+
+
+def introspection():
+    modulesetup = {}
+    try:
+        responseType
+        modulesetup['responseType'] = responseType
+    except NameError:
+        pass
+    try:
+        userConfig
+        modulesetup['userConfig'] = userConfig
+    except NameError:
+        pass
+    try:
+        outputFileExtension
+        modulesetup['outputFileExtension'] = outputFileExtension
+    except NameError:
+        pass
+    try:
+        inputSource
+        modulesetup['inputSource'] = inputSource
+    except NameError:
+        pass
+    return modulesetup
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/export_mod/threatStream_misp_export.py

@@ -0,0 +1,114 @@
+"""
+Export module for coverting MISP events into ThreatStream Structured Import files. Based of work by the CenturyLink CIRT.
+Source: https://github.com/MISP/misp-modules/blob/master/misp_modules/modules/export_mod/threat_connect_export.py
+"""
+
+import base64
+import csv
+import io
+import json
+import logging
+
+
+misperrors = {"error": "Error"}
+
+moduleinfo = {
+    'version': '1.0',
+    'author': 'Robert Nixon, based off of the ThreatConnect MISP Module written by the CenturyLink CIRT',
+    'description': 'Module to export a structured CSV file for uploading to threatStream.',
+    'module-type': ['export'],
+    'name': 'ThreatStream Export',
+    'logo': 'threatstream.png',
+    'requirements': ['csv'],
+    'features': 'The module takes a MISP event in input, to look every attribute. Each attribute matching with some predefined types is then exported in a CSV format recognized by ThreatStream.',
+    'references': ['https://www.anomali.com/platform/threatstream', 'https://github.com/threatstream'],
+    'input': 'MISP Event attributes',
+    'output': 'ThreatStream CSV format file',
+}
+
+
+moduleconfig = []
+
+
+# Map of MISP fields => ThreatStream itypes, you can modify this to your liking
+fieldmap = {
+    "domain": "mal_domain",
+    "hostname": "mal_domain",
+    "ip-src": "mal_ip",
+    "ip-dst": "mal_ip",
+    "email-src": "phish_email",
+    "url": "mal_url",
+    "md5": "mal_md5",
+}
+
+# combine all the MISP fields from fieldmap into one big list
+mispattributes = {
+    "input": list(fieldmap.keys())
+}
+
+
+def handler(q=False):
+    """
+    Convert a MISP query into a CSV file matching the ThreatStream Structured Import file format.
+    Input
+        q: Query dictionary
+    """
+    if q is False or not q:
+        return False
+
+    request = json.loads(q)
+
+    response = io.StringIO()
+    writer = csv.DictWriter(response, fieldnames=["value", "itype", "tags"])
+    writer.writeheader()
+
+    # start parsing MISP data
+    for event in request["data"]:
+        for attribute in event["Attribute"]:
+            if attribute["type"] in mispattributes["input"]:
+                logging.debug("Adding %s to structured CSV export of ThreatStream Export", attribute["value"])
+                if "|" in attribute["type"]:
+                    # if the attribute type has multiple values, line it up with the corresponding ThreatStream values in fieldmap
+                    indicators = tuple(attribute["value"].split("|"))
+                    ts_types = tuple(fieldmap[attribute["type"]].split("|"))
+                    for i, indicator in enumerate(indicators):
+                        writer.writerow({
+                            "value": indicator,
+                            "itype": ts_types[i],
+                            "tags": attribute["comment"]
+                        })
+                else:
+                    writer.writerow({
+                        "itype": fieldmap[attribute["type"]],
+                        "value": attribute["value"],
+                        "tags": attribute["comment"]
+                    })
+
+    return {"response": [], "data": str(base64.b64encode(bytes(response.getvalue(), 'utf-8')), 'utf-8')}
+
+
+def introspection():
+    """
+    Relay the supported attributes to MISP.
+    No Input
+    Output
+        Dictionary of supported MISP attributes
+    """
+    modulesetup = {
+        "responseType": "application/txt",
+        "outputFileExtension": "csv",
+        "userConfig": {},
+        "inputSource": []
+    }
+    return modulesetup
+
+
+def version():
+    """
+    Relay module version and associated metadata to MISP.
+    No Input
+    Output
+        moduleinfo: metadata output containing all potential configuration values
+    """
+    moduleinfo["config"] = moduleconfig
+    return moduleinfo