pymisp 2.5.17__py3-none-any.whl → 2.5.17.2__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of pymisp might be problematic. Click here for more details.
- pymisp/data/misp-objects/objects/asn/definition.json +11 -1
- pymisp/data/misp-objects/objects/shadowserver-beacon-ttl-report/definition.json +110 -0
- pymisp/data/misp-objects/objects/spearphishing-campaign/definition.json +76 -0
- pymisp/data/misp-objects/objects/taranis-news-item/definition.json +66 -0
- pymisp/data/misp-objects/objects/taranis-story/definition.json +52 -0
- pymisp/data/misp-objects/objects/trusted-timestamp/definition.json +74 -0
- pymisp/tools/create_misp_object.py +5 -6
- pymisp/tools/elfobject.py +3 -3
- pymisp/tools/machoobject.py +3 -3
- pymisp/tools/peobject.py +3 -3
- {pymisp-2.5.17.dist-info → pymisp-2.5.17.2.dist-info}/METADATA +10 -9
- {pymisp-2.5.17.dist-info → pymisp-2.5.17.2.dist-info}/RECORD +14 -9
- {pymisp-2.5.17.dist-info → pymisp-2.5.17.2.dist-info}/WHEEL +1 -1
- {pymisp-2.5.17.dist-info → pymisp-2.5.17.2.dist-info/licenses}/LICENSE +0 -0
|
@@ -51,6 +51,16 @@
|
|
|
51
51
|
"multiple": true,
|
|
52
52
|
"ui-priority": 0
|
|
53
53
|
},
|
|
54
|
+
"name": {
|
|
55
|
+
"description": "The official name of the autonomous system",
|
|
56
|
+
"misp-attribute": "text",
|
|
57
|
+
"ui-priority": 1
|
|
58
|
+
},
|
|
59
|
+
"organization": {
|
|
60
|
+
"description": "The organization who the ASN is registered to",
|
|
61
|
+
"misp-attribute": "text",
|
|
62
|
+
"ui-priority": 1
|
|
63
|
+
},
|
|
54
64
|
"subnet-announced": {
|
|
55
65
|
"description": "Subnet announced",
|
|
56
66
|
"misp-attribute": "ip-src",
|
|
@@ -65,5 +75,5 @@
|
|
|
65
75
|
"asn"
|
|
66
76
|
],
|
|
67
77
|
"uuid": "4ec55cc6-9e49-4c64-b794-03c25c1a6587",
|
|
68
|
-
"version":
|
|
78
|
+
"version": 6
|
|
69
79
|
}
|
|
@@ -0,0 +1,110 @@
|
|
|
1
|
+
{
|
|
2
|
+
"attributes": {
|
|
3
|
+
"asn": {
|
|
4
|
+
"categories": [
|
|
5
|
+
"Network activity"
|
|
6
|
+
],
|
|
7
|
+
"description": "ASN where the IP resides",
|
|
8
|
+
"misp-attribute": "AS",
|
|
9
|
+
"ui-priority": 0
|
|
10
|
+
},
|
|
11
|
+
"asn_ttl": {
|
|
12
|
+
"categories": [
|
|
13
|
+
"Other"
|
|
14
|
+
],
|
|
15
|
+
"description": "TTL for the ASN and tag pair",
|
|
16
|
+
"disable_correlation": true,
|
|
17
|
+
"misp-attribute": "text",
|
|
18
|
+
"ui-priority": 0
|
|
19
|
+
},
|
|
20
|
+
"geo": {
|
|
21
|
+
"categories": [
|
|
22
|
+
"Other"
|
|
23
|
+
],
|
|
24
|
+
"description": "Country location of the IP",
|
|
25
|
+
"disable_correlation": true,
|
|
26
|
+
"misp-attribute": "text",
|
|
27
|
+
"ui-priority": 0
|
|
28
|
+
},
|
|
29
|
+
"hostname": {
|
|
30
|
+
"categories": [
|
|
31
|
+
"Network activity"
|
|
32
|
+
],
|
|
33
|
+
"description": "Reverse DNS name of the device in question",
|
|
34
|
+
"misp-attribute": "text",
|
|
35
|
+
"ui-priority": 0
|
|
36
|
+
},
|
|
37
|
+
"ip": {
|
|
38
|
+
"categories": [
|
|
39
|
+
"Network activity"
|
|
40
|
+
],
|
|
41
|
+
"description": "IP of the of the URL",
|
|
42
|
+
"misp-attribute": "ip-src",
|
|
43
|
+
"multiple": true,
|
|
44
|
+
"ui-priority": 0
|
|
45
|
+
},
|
|
46
|
+
"ip_ttl": {
|
|
47
|
+
"categories": [
|
|
48
|
+
"Other"
|
|
49
|
+
],
|
|
50
|
+
"description": "TTL for the IP and tag pair",
|
|
51
|
+
"disable_correlation": true,
|
|
52
|
+
"misp-attribute": "text",
|
|
53
|
+
"ui-priority": 0
|
|
54
|
+
},
|
|
55
|
+
"registrar": {
|
|
56
|
+
"categories": [
|
|
57
|
+
"Other"
|
|
58
|
+
],
|
|
59
|
+
"description": "Registrar responsible for the hostname",
|
|
60
|
+
"disable_correlation": true,
|
|
61
|
+
"misp-attribute": "text",
|
|
62
|
+
"ui-priority": 0
|
|
63
|
+
},
|
|
64
|
+
"registrar_ttl": {
|
|
65
|
+
"categories": [
|
|
66
|
+
"Other"
|
|
67
|
+
],
|
|
68
|
+
"description": "TTL for the registrar and tag pair",
|
|
69
|
+
"disable_correlation": true,
|
|
70
|
+
"misp-attribute": "text",
|
|
71
|
+
"ui-priority": 0
|
|
72
|
+
},
|
|
73
|
+
"tag": {
|
|
74
|
+
"categories": [
|
|
75
|
+
"Other"
|
|
76
|
+
],
|
|
77
|
+
"description": "Attribute tags",
|
|
78
|
+
"misp-attribute": "text",
|
|
79
|
+
"multiple": true,
|
|
80
|
+
"ui-priority": 0
|
|
81
|
+
},
|
|
82
|
+
"tld": {
|
|
83
|
+
"categories": [
|
|
84
|
+
"Other"
|
|
85
|
+
],
|
|
86
|
+
"description": "Top level domain of the hostname",
|
|
87
|
+
"disable_correlation": true,
|
|
88
|
+
"misp-attribute": "text",
|
|
89
|
+
"ui-priority": 0
|
|
90
|
+
},
|
|
91
|
+
"tld_ttl": {
|
|
92
|
+
"categories": [
|
|
93
|
+
"Other"
|
|
94
|
+
],
|
|
95
|
+
"description": "TTL for the TLD and tag pair",
|
|
96
|
+
"disable_correlation": true,
|
|
97
|
+
"misp-attribute": "text",
|
|
98
|
+
"ui-priority": 0
|
|
99
|
+
}
|
|
100
|
+
},
|
|
101
|
+
"description": "Shadowserver beacon TTL report",
|
|
102
|
+
"meta-category": "misc",
|
|
103
|
+
"name": "shadowserver-beacon-ttl-report",
|
|
104
|
+
"required": [
|
|
105
|
+
"ip",
|
|
106
|
+
"tag"
|
|
107
|
+
],
|
|
108
|
+
"uuid": "c3ae42bd-ab36-4c62-8154-e4f46a01135f",
|
|
109
|
+
"version": 1
|
|
110
|
+
}
|
|
@@ -0,0 +1,76 @@
|
|
|
1
|
+
{
|
|
2
|
+
"attributes": {
|
|
3
|
+
"comment": {
|
|
4
|
+
"description": "Free text comments about the campaign",
|
|
5
|
+
"misp-attribute": "comment",
|
|
6
|
+
"multiple": true,
|
|
7
|
+
"ui-priority": 1
|
|
8
|
+
},
|
|
9
|
+
"email-embedded-link": {
|
|
10
|
+
"description": "The malicious URL in the e-mail body.",
|
|
11
|
+
"misp-attribute": "url",
|
|
12
|
+
"multiple": true,
|
|
13
|
+
"ui-priority": 1
|
|
14
|
+
},
|
|
15
|
+
"email-sender": {
|
|
16
|
+
"description": "The source address from which the e-mail was sent.",
|
|
17
|
+
"misp-attribute": "email-src",
|
|
18
|
+
"multiple": true,
|
|
19
|
+
"ui-priority": 1
|
|
20
|
+
},
|
|
21
|
+
"email-sender-ip": {
|
|
22
|
+
"description": "The source IP from which the e-mail was sent.",
|
|
23
|
+
"misp-attribute": "ip-src",
|
|
24
|
+
"multiple": true,
|
|
25
|
+
"ui-priority": 1
|
|
26
|
+
},
|
|
27
|
+
"email-subject": {
|
|
28
|
+
"description": "The subject line of the e-mail.",
|
|
29
|
+
"misp-attribute": "email-subject",
|
|
30
|
+
"multiple": true,
|
|
31
|
+
"ui-priority": 1
|
|
32
|
+
},
|
|
33
|
+
"mitm-connect-back-ip": {
|
|
34
|
+
"description": "IP from where the TA attempts to log in",
|
|
35
|
+
"misp-attribute": "ip-src",
|
|
36
|
+
"multiple": true,
|
|
37
|
+
"ui-priority": 1
|
|
38
|
+
},
|
|
39
|
+
"mitm-connect-back-useragent": {
|
|
40
|
+
"description": "User-agent used by the TA for log in attempts",
|
|
41
|
+
"misp-attribute": "user-agent",
|
|
42
|
+
"multiple": true,
|
|
43
|
+
"ui-priority": 1
|
|
44
|
+
},
|
|
45
|
+
"phishing-domain": {
|
|
46
|
+
"description": "Domain where the phishing stages are hosted",
|
|
47
|
+
"misp-attribute": "domain",
|
|
48
|
+
"multiple": true,
|
|
49
|
+
"ui-priority": 1
|
|
50
|
+
},
|
|
51
|
+
"phishing-ip": {
|
|
52
|
+
"description": "IP address where the phishing stages are hosted",
|
|
53
|
+
"misp-attribute": "ip-dst",
|
|
54
|
+
"multiple": true,
|
|
55
|
+
"ui-priority": 1
|
|
56
|
+
},
|
|
57
|
+
"phishing-url": {
|
|
58
|
+
"description": "URLs of the various phishing stages",
|
|
59
|
+
"misp-attribute": "url",
|
|
60
|
+
"multiple": true,
|
|
61
|
+
"ui-priority": 1
|
|
62
|
+
}
|
|
63
|
+
},
|
|
64
|
+
"description": "Spearphishing template to describe a campaign from the email to the TA connect back IOC",
|
|
65
|
+
"meta-category": "network",
|
|
66
|
+
"name": "spearphishing-campaign",
|
|
67
|
+
"requiredOneOf": [
|
|
68
|
+
"email-sender",
|
|
69
|
+
"email-subject",
|
|
70
|
+
"phishing-url",
|
|
71
|
+
"phishing-ip",
|
|
72
|
+
"phishing-domain"
|
|
73
|
+
],
|
|
74
|
+
"uuid": "20241206-9e59-4b7d-9e88-951458f10a5f",
|
|
75
|
+
"version": 20250919
|
|
76
|
+
}
|
|
@@ -0,0 +1,66 @@
|
|
|
1
|
+
{
|
|
2
|
+
"attributes": {
|
|
3
|
+
"author": {
|
|
4
|
+
"description": "Author(s) of the news item",
|
|
5
|
+
"misp-attribute": "text",
|
|
6
|
+
"multiple": true,
|
|
7
|
+
"ui-priority": 0
|
|
8
|
+
},
|
|
9
|
+
"content": {
|
|
10
|
+
"description": "Content of the Taranis news item",
|
|
11
|
+
"misp-attribute": "text",
|
|
12
|
+
"multiple": true,
|
|
13
|
+
"ui-priority": 0
|
|
14
|
+
},
|
|
15
|
+
"hash": {
|
|
16
|
+
"description": "Hash of the news item",
|
|
17
|
+
"misp-attribute": "sha256",
|
|
18
|
+
"ui-priority": 0
|
|
19
|
+
},
|
|
20
|
+
"id": {
|
|
21
|
+
"description": "Unique identifier of the Taranis item",
|
|
22
|
+
"misp-attribute": "text",
|
|
23
|
+
"ui-priority": 0
|
|
24
|
+
},
|
|
25
|
+
"language": {
|
|
26
|
+
"description": "Language of the news item",
|
|
27
|
+
"misp-attribute": "text",
|
|
28
|
+
"ui-priority": 0
|
|
29
|
+
},
|
|
30
|
+
"link": {
|
|
31
|
+
"description": "URL address to the Taranis news item source.",
|
|
32
|
+
"misp-attribute": "link",
|
|
33
|
+
"ui-priority": 0
|
|
34
|
+
},
|
|
35
|
+
"osint_source_id": {
|
|
36
|
+
"description": "OSINT source unique identifier",
|
|
37
|
+
"misp-attribute": "text",
|
|
38
|
+
"ui-priority": 0
|
|
39
|
+
},
|
|
40
|
+
"review": {
|
|
41
|
+
"description": "Review or analysis notes of the news item",
|
|
42
|
+
"misp-attribute": "text",
|
|
43
|
+
"ui-priority": 0
|
|
44
|
+
},
|
|
45
|
+
"source": {
|
|
46
|
+
"description": "Source feed or page that provided the news item",
|
|
47
|
+
"misp-attribute": "link",
|
|
48
|
+
"ui-priority": 0
|
|
49
|
+
},
|
|
50
|
+
"story_id": {
|
|
51
|
+
"description": "Unique identifier for the story",
|
|
52
|
+
"misp-attribute": "text",
|
|
53
|
+
"ui-priority": 0
|
|
54
|
+
},
|
|
55
|
+
"title": {
|
|
56
|
+
"description": "Title of the Taranis news item",
|
|
57
|
+
"misp-attribute": "text",
|
|
58
|
+
"ui-priority": 0
|
|
59
|
+
}
|
|
60
|
+
},
|
|
61
|
+
"description": "An object describing a news item from Taranis AI",
|
|
62
|
+
"meta-category": "misc",
|
|
63
|
+
"name": "Taranis AI News Item",
|
|
64
|
+
"uuid": "e4b7e5e3-2c4c-4edf-b9a3-2c2a32844e62",
|
|
65
|
+
"version": 2
|
|
66
|
+
}
|
|
@@ -0,0 +1,52 @@
|
|
|
1
|
+
{
|
|
2
|
+
"attributes": {
|
|
3
|
+
"attributes": {
|
|
4
|
+
"description": "Attributes of the story",
|
|
5
|
+
"misp-attribute": "text",
|
|
6
|
+
"multiple": true,
|
|
7
|
+
"ui-priority": 0
|
|
8
|
+
},
|
|
9
|
+
"comments": {
|
|
10
|
+
"description": "User comments for the story",
|
|
11
|
+
"misp-attribute": "text",
|
|
12
|
+
"ui-priority": 0
|
|
13
|
+
},
|
|
14
|
+
"description": {
|
|
15
|
+
"description": "Longer descriptive text of the story",
|
|
16
|
+
"misp-attribute": "text",
|
|
17
|
+
"ui-priority": 0
|
|
18
|
+
},
|
|
19
|
+
"id": {
|
|
20
|
+
"description": "Unique identifier of the story",
|
|
21
|
+
"misp-attribute": "text",
|
|
22
|
+
"ui-priority": 0
|
|
23
|
+
},
|
|
24
|
+
"links": {
|
|
25
|
+
"description": "One or more links associated with the story",
|
|
26
|
+
"misp-attribute": "text",
|
|
27
|
+
"multiple": true,
|
|
28
|
+
"ui-priority": 0
|
|
29
|
+
},
|
|
30
|
+
"summary": {
|
|
31
|
+
"description": "Short summary of the story",
|
|
32
|
+
"misp-attribute": "text",
|
|
33
|
+
"ui-priority": 0
|
|
34
|
+
},
|
|
35
|
+
"tags": {
|
|
36
|
+
"description": "Tags or labels for the story",
|
|
37
|
+
"misp-attribute": "text",
|
|
38
|
+
"multiple": true,
|
|
39
|
+
"ui-priority": 0
|
|
40
|
+
},
|
|
41
|
+
"title": {
|
|
42
|
+
"description": "Title of the story",
|
|
43
|
+
"misp-attribute": "text",
|
|
44
|
+
"ui-priority": 0
|
|
45
|
+
}
|
|
46
|
+
},
|
|
47
|
+
"description": "An object describing a story item from Taranis or similar source",
|
|
48
|
+
"meta-category": "misc",
|
|
49
|
+
"name": "taranis-story",
|
|
50
|
+
"uuid": "a2716df6-920b-4c4e-85f7-79a009476f3d",
|
|
51
|
+
"version": 1
|
|
52
|
+
}
|
|
@@ -0,0 +1,74 @@
|
|
|
1
|
+
{
|
|
2
|
+
"attributes": {
|
|
3
|
+
"format": {
|
|
4
|
+
"categories": [
|
|
5
|
+
"Other"
|
|
6
|
+
],
|
|
7
|
+
"description": "The format of the TSR, most probaly RFC3161.",
|
|
8
|
+
"misp-attribute": "text",
|
|
9
|
+
"sane_default": [
|
|
10
|
+
"RFC3161",
|
|
11
|
+
"RFC5816",
|
|
12
|
+
"X9.95",
|
|
13
|
+
"ISO18014"
|
|
14
|
+
],
|
|
15
|
+
"to_ids": false,
|
|
16
|
+
"ui-priority": 1
|
|
17
|
+
},
|
|
18
|
+
"hash-sha256": {
|
|
19
|
+
"categories": [
|
|
20
|
+
"External analysis"
|
|
21
|
+
],
|
|
22
|
+
"description": "The signed hash (sha256)",
|
|
23
|
+
"misp-attribute": "sha256",
|
|
24
|
+
"to_ids": false,
|
|
25
|
+
"ui-priority": 1
|
|
26
|
+
},
|
|
27
|
+
"hash-sha512": {
|
|
28
|
+
"categories": [
|
|
29
|
+
"External analysis"
|
|
30
|
+
],
|
|
31
|
+
"description": "The signed hash (sha512)",
|
|
32
|
+
"misp-attribute": "sha512",
|
|
33
|
+
"to_ids": false,
|
|
34
|
+
"ui-priority": 1
|
|
35
|
+
},
|
|
36
|
+
"timestamp": {
|
|
37
|
+
"categories": [
|
|
38
|
+
"External analysis"
|
|
39
|
+
],
|
|
40
|
+
"description": "The timestamp of the request",
|
|
41
|
+
"misp-attribute": "datetime",
|
|
42
|
+
"to_ids": false,
|
|
43
|
+
"ui-priority": 1
|
|
44
|
+
},
|
|
45
|
+
"trusted-timestamp-response": {
|
|
46
|
+
"categories": [
|
|
47
|
+
"External analysis"
|
|
48
|
+
],
|
|
49
|
+
"description": "Trusted timestamp response (TSR).",
|
|
50
|
+
"misp-attribute": "attachment",
|
|
51
|
+
"multiple": false,
|
|
52
|
+
"to_ids": false,
|
|
53
|
+
"ui-priority": 1
|
|
54
|
+
},
|
|
55
|
+
"tsa-certificates": {
|
|
56
|
+
"categories": [
|
|
57
|
+
"External analysis"
|
|
58
|
+
],
|
|
59
|
+
"description": "The certificate(s) used to sign the (TSR), in PEM format.",
|
|
60
|
+
"misp-attribute": "attachment",
|
|
61
|
+
"multiple": false,
|
|
62
|
+
"to_ids": false,
|
|
63
|
+
"ui-priority": 1
|
|
64
|
+
}
|
|
65
|
+
},
|
|
66
|
+
"description": "A trusted timestamp.",
|
|
67
|
+
"meta-category": "file",
|
|
68
|
+
"name": "trusted-timestamp",
|
|
69
|
+
"required": [
|
|
70
|
+
"trusted-timestamp-response"
|
|
71
|
+
],
|
|
72
|
+
"uuid": "cb84ff28-a488-432e-8ba4-f0d54cc91172",
|
|
73
|
+
"version": 1
|
|
74
|
+
}
|
|
@@ -5,6 +5,7 @@ from __future__ import annotations
|
|
|
5
5
|
import logging
|
|
6
6
|
|
|
7
7
|
from io import BytesIO
|
|
8
|
+
from pathlib import Path
|
|
8
9
|
from typing import Any, TYPE_CHECKING
|
|
9
10
|
|
|
10
11
|
from ..exceptions import MISPObjectException
|
|
@@ -35,7 +36,7 @@ class FileTypeNotImplemented(MISPObjectException):
|
|
|
35
36
|
pass
|
|
36
37
|
|
|
37
38
|
|
|
38
|
-
def make_binary_objects(filepath: str | None = None,
|
|
39
|
+
def make_binary_objects(filepath: str | Path | None = None,
|
|
39
40
|
pseudofile: BytesIO | bytes | None = None,
|
|
40
41
|
filename: str | None = None,
|
|
41
42
|
standalone: bool = True,
|
|
@@ -43,13 +44,11 @@ def make_binary_objects(filepath: str | None = None,
|
|
|
43
44
|
misp_file = FileObject(filepath=filepath, pseudofile=pseudofile, filename=filename,
|
|
44
45
|
standalone=standalone, default_attributes_parameters=default_attributes_parameters)
|
|
45
46
|
if HAS_LIEF and (filepath or pseudofile):
|
|
47
|
+
# Since lief 0.17, the parse method figures out what do to with the parameter itself.
|
|
46
48
|
if filepath:
|
|
47
|
-
lief_parsed = lief.parse(filepath
|
|
49
|
+
lief_parsed = lief.parse(filepath)
|
|
48
50
|
elif pseudofile:
|
|
49
|
-
|
|
50
|
-
lief_parsed = lief.parse(raw=pseudofile)
|
|
51
|
-
else: # BytesIO
|
|
52
|
-
lief_parsed = lief.parse(obj=pseudofile)
|
|
51
|
+
lief_parsed = lief.parse(pseudofile)
|
|
53
52
|
else:
|
|
54
53
|
logger.critical('You need either a filepath, or a pseudofile and a filename.')
|
|
55
54
|
lief_parsed = None
|
pymisp/tools/elfobject.py
CHANGED
|
@@ -49,11 +49,11 @@ class ELFObject(AbstractMISPObjectGenerator):
|
|
|
49
49
|
logger.warning("pydeep is missing, please install pymisp this way: pip install pymisp[fileobjects]")
|
|
50
50
|
if pseudofile:
|
|
51
51
|
if isinstance(pseudofile, BytesIO):
|
|
52
|
-
e = lief.ELF.parse(
|
|
52
|
+
e = lief.ELF.parse(pseudofile)
|
|
53
53
|
elif isinstance(pseudofile, bytes):
|
|
54
|
-
e = lief.ELF.parse(
|
|
54
|
+
e = lief.ELF.parse(pseudofile)
|
|
55
55
|
elif isinstance(pseudofile, list):
|
|
56
|
-
e = lief.ELF.parse(
|
|
56
|
+
e = lief.ELF.parse(pseudofile)
|
|
57
57
|
else:
|
|
58
58
|
raise InvalidMISPObject(f'Pseudo file can be BytesIO or bytes got {type(pseudofile)}')
|
|
59
59
|
if not e:
|
pymisp/tools/machoobject.py
CHANGED
|
@@ -51,11 +51,11 @@ class MachOObject(AbstractMISPObjectGenerator):
|
|
|
51
51
|
logger.warning("pydeep is missing, please install pymisp this way: pip install pymisp[fileobjects]")
|
|
52
52
|
if pseudofile:
|
|
53
53
|
if isinstance(pseudofile, BytesIO):
|
|
54
|
-
m = lief.MachO.parse(
|
|
54
|
+
m = lief.MachO.parse(pseudofile)
|
|
55
55
|
elif isinstance(pseudofile, bytes):
|
|
56
|
-
m = lief.MachO.parse(
|
|
56
|
+
m = lief.MachO.parse(pseudofile)
|
|
57
57
|
elif isinstance(pseudofile, list):
|
|
58
|
-
m = lief.MachO.parse(
|
|
58
|
+
m = lief.MachO.parse(pseudofile)
|
|
59
59
|
else:
|
|
60
60
|
raise InvalidMISPObject(f'Pseudo file can be BytesIO or bytes got {type(pseudofile)}')
|
|
61
61
|
if not m:
|
pymisp/tools/peobject.py
CHANGED
|
@@ -53,11 +53,11 @@ class PEObject(AbstractMISPObjectGenerator):
|
|
|
53
53
|
logger.warning("pydeep is missing, please install pymisp this way: pip install pymisp[fileobjects]")
|
|
54
54
|
if pseudofile:
|
|
55
55
|
if isinstance(pseudofile, BytesIO):
|
|
56
|
-
p = lief.PE.parse(
|
|
56
|
+
p = lief.PE.parse(pseudofile)
|
|
57
57
|
elif isinstance(pseudofile, bytes):
|
|
58
|
-
p = lief.PE.parse(
|
|
58
|
+
p = lief.PE.parse(pseudofile)
|
|
59
59
|
elif isinstance(pseudofile, list):
|
|
60
|
-
p = lief.PE.parse(
|
|
60
|
+
p = lief.PE.parse(pseudofile)
|
|
61
61
|
else:
|
|
62
62
|
raise InvalidMISPObject(f'Pseudo file can be BytesIO or bytes got {type(pseudofile)}')
|
|
63
63
|
if not p:
|
|
@@ -1,8 +1,9 @@
|
|
|
1
|
-
Metadata-Version: 2.
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
2
|
Name: pymisp
|
|
3
|
-
Version: 2.5.17
|
|
3
|
+
Version: 2.5.17.2
|
|
4
4
|
Summary: Python API for MISP.
|
|
5
|
-
License: BSD-2-Clause
|
|
5
|
+
License-Expression: BSD-2-Clause
|
|
6
|
+
License-File: LICENSE
|
|
6
7
|
Author: Raphaël Vinot
|
|
7
8
|
Author-email: raphael.vinot@circl.lu
|
|
8
9
|
Requires-Python: >=3.9.2,<4.0
|
|
@@ -11,13 +12,13 @@ Classifier: Environment :: Console
|
|
|
11
12
|
Classifier: Intended Audience :: Information Technology
|
|
12
13
|
Classifier: Intended Audience :: Science/Research
|
|
13
14
|
Classifier: Intended Audience :: Telecommunications Industry
|
|
14
|
-
Classifier: License :: OSI Approved :: BSD License
|
|
15
15
|
Classifier: Operating System :: POSIX :: Linux
|
|
16
16
|
Classifier: Programming Language :: Python :: 3
|
|
17
17
|
Classifier: Programming Language :: Python :: 3.10
|
|
18
18
|
Classifier: Programming Language :: Python :: 3.11
|
|
19
19
|
Classifier: Programming Language :: Python :: 3.12
|
|
20
20
|
Classifier: Programming Language :: Python :: 3.13
|
|
21
|
+
Classifier: Programming Language :: Python :: 3.14
|
|
21
22
|
Classifier: Topic :: Internet
|
|
22
23
|
Classifier: Topic :: Security
|
|
23
24
|
Provides-Extra: brotli
|
|
@@ -29,19 +30,19 @@ Provides-Extra: pdfexport
|
|
|
29
30
|
Provides-Extra: url
|
|
30
31
|
Provides-Extra: virustotal
|
|
31
32
|
Requires-Dist: RTFDE (>=0.1.2.1) ; (python_version <= "3.9") and (extra == "email")
|
|
32
|
-
Requires-Dist: beautifulsoup4 (>=4.13.
|
|
33
|
+
Requires-Dist: beautifulsoup4 (>=4.13.5) ; extra == "openioc"
|
|
33
34
|
Requires-Dist: deprecated (>=1.2.18)
|
|
34
35
|
Requires-Dist: docutils (<0.22) ; (python_version >= "3.11") and (extra == "docs")
|
|
35
|
-
Requires-Dist: extract_msg (>=0.
|
|
36
|
-
Requires-Dist: lief (>=0.
|
|
36
|
+
Requires-Dist: extract_msg (>=0.55.0) ; extra == "email"
|
|
37
|
+
Requires-Dist: lief (>=0.17.0) ; extra == "fileobjects"
|
|
37
38
|
Requires-Dist: myst-parser (>=4.0.1) ; (python_version >= "3.11") and (extra == "docs")
|
|
38
39
|
Requires-Dist: oletools (>=0.60.2) ; extra == "email"
|
|
39
40
|
Requires-Dist: pydeep2 (>=0.5.1) ; extra == "fileobjects"
|
|
40
41
|
Requires-Dist: pyfaup (>=1.2) ; extra == "url"
|
|
41
42
|
Requires-Dist: python-dateutil (>=2.9.0.post0)
|
|
42
43
|
Requires-Dist: python-magic (>=0.4.27) ; extra == "fileobjects"
|
|
43
|
-
Requires-Dist: reportlab (>=4.4.
|
|
44
|
-
Requires-Dist: requests (>=2.32.
|
|
44
|
+
Requires-Dist: reportlab (>=4.4.4) ; extra == "pdfexport"
|
|
45
|
+
Requires-Dist: requests (>=2.32.5)
|
|
45
46
|
Requires-Dist: sphinx (>=8.2.3) ; (python_version >= "3.11") and (extra == "docs")
|
|
46
47
|
Requires-Dist: sphinx-autodoc-typehints (>=3.2.0) ; (python_version >= "3.11") and (extra == "docs")
|
|
47
48
|
Requires-Dist: urllib3 (>=2.5.0) ; extra == "brotli"
|
|
@@ -14,7 +14,7 @@ pymisp/data/misp-objects/objects/annotation/definition.json,sha256=rzISiChqHWyT6
|
|
|
14
14
|
pymisp/data/misp-objects/objects/anonymisation/definition.json,sha256=fY1lFoW0TvH0hYM65ww2r4RQYaqniLk5syTGf9pqSmc,5985
|
|
15
15
|
pymisp/data/misp-objects/objects/apivoid-email-verification/definition.json,sha256=OQEhXQNZcfYeOVVKz1xaYQ9his88oY7evgCxSrulmCw,6597
|
|
16
16
|
pymisp/data/misp-objects/objects/artifact/definition.json,sha256=VGDBEcAT_y59C62NS9lKMZ_s8y1916wFeMSjqwj6Wrk,3163
|
|
17
|
-
pymisp/data/misp-objects/objects/asn/definition.json,sha256=
|
|
17
|
+
pymisp/data/misp-objects/objects/asn/definition.json,sha256=QG7nG4YmWKfocqPQnNeE06S4GmhjiMbBAgFJL2QmVHQ,2778
|
|
18
18
|
pymisp/data/misp-objects/objects/attack-pattern/definition.json,sha256=NMh9X_xQnEI9vMQw0QiwOzcUix5QUo3qVyrderA5luo,1363
|
|
19
19
|
pymisp/data/misp-objects/objects/attack-step/definition.json,sha256=Zh_0xHUKc8sEKjz4u2wK38GQwJF8OHYtzm0P_XyX-8Y,2649
|
|
20
20
|
pymisp/data/misp-objects/objects/attacker-infra/definition.json,sha256=jvc-0GyaXKHkdVkhPIW1FVPKTQlVSQviE36Rp34ynZw,8222
|
|
@@ -291,6 +291,7 @@ pymisp/data/misp-objects/objects/scrippsco2-o18-daily/definition.json,sha256=29M
|
|
|
291
291
|
pymisp/data/misp-objects/objects/scrippsco2-o18-monthly/definition.json,sha256=w5kTSIRGDsZd4FzZJtNMOCpzZ7GYFyooDHoSe_ks46M,2104
|
|
292
292
|
pymisp/data/misp-objects/objects/script/definition.json,sha256=Gp0J3KV1MaDvlC6dqGi-B8Okj3w898raUIv9LLSeKhI,1811
|
|
293
293
|
pymisp/data/misp-objects/objects/security-playbook/definition.json,sha256=kX3FthTIbduWrCTKNljoTMfZOwE9v7RS4ts7o8y3sW0,6102
|
|
294
|
+
pymisp/data/misp-objects/objects/shadowserver-beacon-ttl-report/definition.json,sha256=8ez7gzZ27qUUWarSpfhQeKtw-wN2fFN8yd4gWkunL-Q,2540
|
|
294
295
|
pymisp/data/misp-objects/objects/shadowserver-malware-url-report/definition.json,sha256=p2n8qmQCKqD6YJxWg30VW9uQkHv5r5HhvHBCHinnZT0,4305
|
|
295
296
|
pymisp/data/misp-objects/objects/shadowserver-scan-http-proxy/definition.json,sha256=dA_Pxufgb8fjUCwL3a_67biHdgu3qODI6IBbr0TRGt0,5566
|
|
296
297
|
pymisp/data/misp-objects/objects/shell-commands/definition.json,sha256=qRZ6SJLpzBqVItIdDM_5mvXdulFgr3gQ3BG0iBeTWBE,1593
|
|
@@ -305,6 +306,7 @@ pymisp/data/misp-objects/objects/social-media-group/definition.json,sha256=RyUgI
|
|
|
305
306
|
pymisp/data/misp-objects/objects/software/definition.json,sha256=vx_qg2KBLCM6HJfhH_1WbfXFxpC755aWGVGBi7U6UuU,1930
|
|
306
307
|
pymisp/data/misp-objects/objects/spambee-report/definition.json,sha256=Ps73IJyEfUiOGR1uh_3Rs5v0ISHgAtW_2tXWg3cYVMQ,1437
|
|
307
308
|
pymisp/data/misp-objects/objects/spearphishing-attachment/definition.json,sha256=vtFQBw04jZp1vOWpjE8czGjc4jHr9t8bk08qRjLjahI,3849
|
|
309
|
+
pymisp/data/misp-objects/objects/spearphishing-campaign/definition.json,sha256=rskfYYkaJFKnGWF6G60VwbnpyEt1BGIv4CW8-RWTh70,2198
|
|
308
310
|
pymisp/data/misp-objects/objects/spearphishing-link/definition.json,sha256=Bj3tjqq9WDULRyJEPKBtBXQvmmWyUwx0rVB4jinSvAU,1681
|
|
309
311
|
pymisp/data/misp-objects/objects/splunk/definition.json,sha256=okI3cfABE4NYBNVskjroZqsbOgtrhuBx9PAfZ08a8Ys,1442
|
|
310
312
|
pymisp/data/misp-objects/objects/ss7-attack/definition.json,sha256=ktiPZxCoCLfvukYRW3CvrmRWWsMqVReCVod-g-pTtTY,12074
|
|
@@ -315,6 +317,8 @@ pymisp/data/misp-objects/objects/stock/definition.json,sha256=ZCV8X9VXRQPXt6_qpN
|
|
|
315
317
|
pymisp/data/misp-objects/objects/submarine/definition.json,sha256=1i33QhqVNkQeMbT0Glk7LyOSZkjnfBUrX23jflIX7FE,4223
|
|
316
318
|
pymisp/data/misp-objects/objects/summariser-output/definition.json,sha256=WDdiEKUxVM-dTy4AZO8R_4AxsT_WgRLfdXoMvG0SaHI,2639
|
|
317
319
|
pymisp/data/misp-objects/objects/suricata/definition.json,sha256=FQ5Is0dnVSr7ttDpBWnzI5Th9Sjx5nSh5WGYU9RZ9O0,952
|
|
320
|
+
pymisp/data/misp-objects/objects/taranis-news-item/definition.json,sha256=6zKRZe-NBhgEtGNTllq6lAJ4L63I3o7dsHZ-MJyvgeY,1772
|
|
321
|
+
pymisp/data/misp-objects/objects/taranis-story/definition.json,sha256=AkjnLfklfI08rrHhtxyAjpXO2XBOIj6EW6VecIBemeo,1360
|
|
318
322
|
pymisp/data/misp-objects/objects/target-system/definition.json,sha256=PaM41BdcjXCYzs1oY0N-ALabDJgzQVxHqnjj70zZ_S8,1000
|
|
319
323
|
pymisp/data/misp-objects/objects/task/definition.json,sha256=ugSxQkRnyMd8Jb6kMj5yJCveNyc-mJ-tCh3jiQKXXmA,3029
|
|
320
324
|
pymisp/data/misp-objects/objects/tattoo/definition.json,sha256=ELfj_gHXz6Vqv1ze2y7MOiDdhj3mA-XI7y34ybdKAOc,2301
|
|
@@ -335,6 +339,7 @@ pymisp/data/misp-objects/objects/transaction/definition.json,sha256=Dx98v2bDL1CU
|
|
|
335
339
|
pymisp/data/misp-objects/objects/translation/definition.json,sha256=IVue-4UTX_v6qzH3ZBR1pGN1VTvoGcg2G7aaXOtfxrs,5666
|
|
336
340
|
pymisp/data/misp-objects/objects/transport-ticket/definition.json,sha256=wE3VBZkNE18KaOfTCsqC07qyvsjqQ1oDTDku_fxDh4k,2567
|
|
337
341
|
pymisp/data/misp-objects/objects/trustar_report/definition.json,sha256=o9HV1gSYm5ABWK9h9ltmlpOUKxorQcecoD9SF-VsEyE,4281
|
|
342
|
+
pymisp/data/misp-objects/objects/trusted-timestamp/definition.json,sha256=12REyYSQn7Yl_aedWwjWZM1NvqXH6EddWvWW3UBgDCY,1771
|
|
338
343
|
pymisp/data/misp-objects/objects/tsk-chats/definition.json,sha256=N_0yBuNtp9j_IeWc91nmxqCqZwDnfQ2fQJiIe5dLPZQ,2320
|
|
339
344
|
pymisp/data/misp-objects/objects/tsk-web-bookmark/definition.json,sha256=PjifoI23HdRF7-jQndoliKCMkr0Quxb4_v5d-Fio3tI,1690
|
|
340
345
|
pymisp/data/misp-objects/objects/tsk-web-cookie/definition.json,sha256=tGyJS0i4GPnzY9OxwesfrMElW2pTdqU_2OxSCqpsJaM,1704
|
|
@@ -378,10 +383,10 @@ pymisp/tools/__init__.py,sha256=_KCihYo82e8G5cHV321ak2sgbao2GyFjf4sSTMiN_IM,2233
|
|
|
378
383
|
pymisp/tools/_psl_faup.py,sha256=JyK8RQm8DPWvNuoF4rQpiE0rBm-Az-sr38Kl46dmWcs,7034
|
|
379
384
|
pymisp/tools/abstractgenerator.py,sha256=x9dBMtAt8bcUGVqVAjVQ3Gf5hgnZScyyoMZ4wHSS09M,2745
|
|
380
385
|
pymisp/tools/asnobject.py,sha256=zWl29pdn7eu0g1YRAt609_aNSCp1R4BzLquVOlzkZ84,836
|
|
381
|
-
pymisp/tools/create_misp_object.py,sha256=
|
|
386
|
+
pymisp/tools/create_misp_object.py,sha256=yTACToGdy99Plumc4_HQtMCcRWyWSHkLDfC2RNGRmxs,2806
|
|
382
387
|
pymisp/tools/csvloader.py,sha256=d-Ox4KEehuXi9YxPE3hhf62etaj7D0pUHr5Qy4rPoqo,2588
|
|
383
388
|
pymisp/tools/domainipobject.py,sha256=2w1ckOWPZvp9EW6TOAguT1Kwov72K1jJuJLqgU1whoo,847
|
|
384
|
-
pymisp/tools/elfobject.py,sha256=
|
|
389
|
+
pymisp/tools/elfobject.py,sha256=JX080uLjbm4Oi1m4N9wD03C5HMrIQdeRMHniPzHtT2I,4948
|
|
385
390
|
pymisp/tools/emailobject.py,sha256=GjOj4MJ0IQsdStkfAk0pshxBe40OGn1_g0jTftym_0o,22500
|
|
386
391
|
pymisp/tools/ext_lookups.py,sha256=acRbOVQftw7XpbjDZDrrdYzDmLDU4HmhoW48Og3UfaY,1022
|
|
387
392
|
pymisp/tools/fail2banobject.py,sha256=VWxK8qWVL0AqO_YZSKmsOcaEnG_5j0jOok7OfEXWfMQ,740
|
|
@@ -391,11 +396,11 @@ pymisp/tools/genericgenerator.py,sha256=upQuQXlv8SF1juA3BHHWXF2bC0_g3-Vv6Q25K_ow
|
|
|
391
396
|
pymisp/tools/geolocationobject.py,sha256=069_d6kHKWeCiX9bGxVI7Ky3r26SVKRAFzJLmhmOc4A,852
|
|
392
397
|
pymisp/tools/git_vuln_finder_object.py,sha256=WTRUvUsXnG4hkmFMI3PBwQV8N7URkCPh8zPXnFexMhs,1278
|
|
393
398
|
pymisp/tools/load_warninglists.py,sha256=4ahczPmCDCbMS7Ab25NMOxeDBCj_3lVniJbH08PuAw8,1003
|
|
394
|
-
pymisp/tools/machoobject.py,sha256=
|
|
399
|
+
pymisp/tools/machoobject.py,sha256=q87LW3mm_WMpKe3r_Zw-3wwaYoIeNIgQkseDXguqwk8,4771
|
|
395
400
|
pymisp/tools/microblogobject.py,sha256=8_53_6M79VhfrJzR_itZ8HnPPclQwX9j0JdI9gMB2kg,6899
|
|
396
401
|
pymisp/tools/neo4j.py,sha256=3Jr2QlOTk8D-P5c1DefYDEP6IIgKNswlZA7F5FocHjU,2088
|
|
397
402
|
pymisp/tools/openioc.py,sha256=TwXcbUkWNzkZavmPoVXdZpjM_GcKB9bqLrw7o3xI24E,14458
|
|
398
|
-
pymisp/tools/peobject.py,sha256=
|
|
403
|
+
pymisp/tools/peobject.py,sha256=y7TAvv9CFS3ETDrVsXS7FTBxR3Izgrv3OUM9pcSxmgk,11773
|
|
399
404
|
pymisp/tools/reportlab_generator.py,sha256=njt0sP-WTWywQ2ieF7Qy5h-dk5FLA0P1i_HF9qhz_4I,76994
|
|
400
405
|
pymisp/tools/sbsignatureobject.py,sha256=aq5To8zcBJe7BHBRZzlqC9xG7N31Naem6yp6bGTOwrU,790
|
|
401
406
|
pymisp/tools/sshauthkeyobject.py,sha256=GEByZkdR7QN3KgE4GcDw3LYS_h-DrUw5cWAy6rMvA_Y,1284
|
|
@@ -403,7 +408,7 @@ pymisp/tools/update_objects.py,sha256=sp_XshzgtRjAU0Mqg8FgRTaokjVKLImyQ02xIcPSrH
|
|
|
403
408
|
pymisp/tools/urlobject.py,sha256=PIucy1356zaljUm1NbeKmEpHpAUK9yiK2lAugcMp2t8,2489
|
|
404
409
|
pymisp/tools/vehicleobject.py,sha256=bs7f4d47IBi2-VumssSM3HlqkH0viyHTLmIHQxe8Iz8,3687
|
|
405
410
|
pymisp/tools/vtreportobject.py,sha256=NsdYzgqm47dywYeW8UnWmEDeIsf07xZreD2iJzFm2wg,3217
|
|
406
|
-
pymisp-2.5.17.dist-info/
|
|
407
|
-
pymisp-2.5.17.dist-info/
|
|
408
|
-
pymisp-2.5.17.dist-info/
|
|
409
|
-
pymisp-2.5.17.dist-info/RECORD,,
|
|
411
|
+
pymisp-2.5.17.2.dist-info/METADATA,sha256=oNwg-yvJ5YgSGQFOnhmYbap2T8spzqy64DfDclg2d3w,8916
|
|
412
|
+
pymisp-2.5.17.2.dist-info/WHEEL,sha256=zp0Cn7JsFoX2ATtOhtaFYIiE2rmFAD4OcMhtUki8W3U,88
|
|
413
|
+
pymisp-2.5.17.2.dist-info/licenses/LICENSE,sha256=1oPSVvs96qLjbJVi3mPn0yvWs-6aoIF6BNXi6pVlFmY,1615
|
|
414
|
+
pymisp-2.5.17.2.dist-info/RECORD,,
|
|
File without changes
|