mirror of https://github.com/MISP/MISP
Added 2 new type of attributes
- sha256 / filename|sha256 - uploading a malware sample now automatically creates a filename|sha1 and a filename|sha256 in addition to the sample|md5pull/217/head
iglocska
parent
001151adc8
commit
d2fcda7cc6
|
|
@ -280,6 +280,9 @@ class AttributesController extends AppController {
|
|||
* @throws InternalErrorException
|
||||
*/
|
||||
public function add_attachment($eventId = null) {
|
||||
$sha256 = null;
|
||||
$sha1 = null;
|
||||
//$ssdeep = null;
|
||||
if ($this->request->is('post')) {
|
||||
$this->loadModel('Event');
|
||||
// Check if there were problems with the file upload
|
||||
|
|
@ -306,6 +309,8 @@ class AttributesController extends AppController {
|
|||
// Validate filename
|
||||
if (!preg_match('@^[\w-,\s]+\.[A-Za-z0-9_]{2,4}$@', $filename)) throw new Exception ('Filename not allowed');
|
||||
$this->request->data['Attribute']['value'] = $filename . '|' . $tmpfile->md5(); // TODO gives problems with bigger files
|
||||
$sha256 = (hash_file('sha256', $tmpfile->path));
|
||||
$sha1 = (hash_file('sha1', $tmpfile->path));
|
||||
$this->request->data['Attribute']['to_ids'] = 1; // LATER let user choose to send this to IDS
|
||||
} else {
|
||||
$this->request->data['Attribute']['type'] = "attachment";
|
||||
|
|
@ -375,6 +380,19 @@ class AttributesController extends AppController {
|
|||
$fileInZip->delete(); // delete the original not-zipped-file
|
||||
rename($zipfile->path, $file->path); // rename the .zip to .nothing
|
||||
}
|
||||
if ($this->request->data['Attribute']['malware']) {
|
||||
$temp = $this->request->data;
|
||||
$this->Attribute->create();
|
||||
$temp['Attribute']['type'] = 'filename|sha256';
|
||||
$temp['Attribute']['value'] = $filename . '|' .$sha256;
|
||||
$this->Attribute->save($temp, array('fieldlist' => array('value', 'type', 'category', 'event_id', 'distribution', 'to_ids')));
|
||||
$this->Attribute->create();
|
||||
$temp['Attribute']['type'] = 'filename|sha1';
|
||||
$temp['Attribute']['value'] = $filename . '|' .$sha1;
|
||||
$this->Attribute->save($temp, array('fieldlist' => array('value', 'type', 'category', 'event_id', 'distribution', 'to_ids')));
|
||||
}
|
||||
|
||||
|
||||
|
||||
// everything is done, now redirect to event view
|
||||
$this->Session->setFlash(__('The attachment has been uploaded'));
|
||||
|
|
|
|||
|
|
@ -72,7 +72,7 @@ class Attribute extends AppModel {
|
|||
2 => array('desc' => 'This field determines the current distribution of the event', 'formdesc' => "Users that are part of your MISP community will be able to see the event. This includes all organisations on this MISP server, all organisations on MISP servers synchronising with this server and the hosting organisations of servers that connect to those afore mentioned servers (so basically any server that is 2 hops away from this one). Any other organisations connected to linked servers that are 2 hops away from this will be restricted from seeing the event. Use this option if this server isn't the central MISP hub of the community but is connected to it."),
|
||||
3 => array('desc' => 'This field determines the current distribution of the event', 'formdesc' => "This will share the event with all MISP communities, allowing the event to be freely propagated from one server to the next."),
|
||||
);
|
||||
|
||||
|
||||
public $distributionLevels = array(
|
||||
0 => 'Your organisation only', 1 => 'This community only', 2 => 'Connected communities', 3 => 'All communities'
|
||||
);
|
||||
|
|
@ -93,15 +93,17 @@ class Attribute extends AppModel {
|
|||
);
|
||||
|
||||
public $typeDefinitions = array(
|
||||
'md5' => array('desc' => 'A checksum in md5 format', 'formdesc' => "You are encouraged to use filename|md5 instead. <br/>A checksum in md5 format, only use this if you don't know the correct filename"),
|
||||
'sha1' => array('desc' => 'A checksum in sha1 format', 'formdesc' => "You are encouraged to use filename|sha1 instead. <br/>A checksum in sha1 format, only use this if you don't know the correct filename"),
|
||||
'md5' => array('desc' => 'A checksum in md5 format', 'formdesc' => "You are encouraged to use filename|md5 instead. A checksum in md5 format, only use this if you don't know the correct filename"),
|
||||
'sha1' => array('desc' => 'A checksum in sha1 format', 'formdesc' => "You are encouraged to use filename|sha1 instead. A checksum in sha1 format, only use this if you don't know the correct filename"),
|
||||
'sha256' => array('desc' => 'A checksum in sha256 format', 'formdesc' => "You are encouraged to use filename|sha256 instead. A checksum in sha256 format, only use this if you don't know the correct filename"),
|
||||
'filename' => array('desc' => 'Filename'),
|
||||
'filename|md5' => array('desc' => 'A filename and an md5 hash separated by a |', 'formdesc' => "A filename and an md5 hash separated by a | (no spaces)"),
|
||||
'filename|sha1' => array('desc' => 'A filename and an sha1 hash separated by a |', 'formdesc' => "A filename and an sha1 hash separated by a | (no spaces)"),
|
||||
'filename|sha256' => array('desc' => 'A filename and an sha256 hash separated by a |', 'formdesc' => "A filename and an sha256 hash separated by a | (no spaces)"),
|
||||
'ip-src' => array('desc' => "A source IP address of the attacker"),
|
||||
'ip-dst' => array('desc' => 'A destination IP address of the attacker or C&C server', 'formdesc' => "A destination IP address of the attacker or C&C server. <br/>Also set the IDS flag on when this IP is hardcoded in malware"),
|
||||
'hostname' => array('desc' => 'A full host/dnsname of an attacker', 'formdesc' => "A full host/dnsname of an attacker. <br/>Also set the IDS flag on when this hostname is hardcoded in malware"),
|
||||
'domain' => array('desc' => 'A domain name used in the malware', 'formdesc' => "A domain name used in the malware. <br/>Use this instead of hostname when the upper domain is <br/>important or can be used to create links between events."),
|
||||
'ip-dst' => array('desc' => 'A destination IP address of the attacker or C&C server', 'formdesc' => "A destination IP address of the attacker or C&C server. Also set the IDS flag on when this IP is hardcoded in malware"),
|
||||
'hostname' => array('desc' => 'A full host/dnsname of an attacker', 'formdesc' => "A full host/dnsname of an attacker. Also set the IDS flag on when this hostname is hardcoded in malware"),
|
||||
'domain' => array('desc' => 'A domain name used in the malware', 'formdesc' => "A domain name used in the malware. Use this instead of hostname when the upper domain is important or can be used to create links between events."),
|
||||
'email-src' => array('desc' => "The email address (or domainname) used to send the malware."),
|
||||
'email-dst' => array('desc' => "A recipient email address", 'formdesc' => "A recipient email address that is not related to your constituency."),
|
||||
'email-subject' => array('desc' => "The subject of the email"),
|
||||
|
|
@ -111,7 +113,7 @@ class Attribute extends AppModel {
|
|||
'regkey' => array('desc' => "Registry key or value"),
|
||||
'regkey|value' => array('desc' => "Registry value + data separated by |"),
|
||||
'AS' => array('desc' => 'Autonomous system'),
|
||||
'snort' => array('desc' => 'An IDS rule in Snort rule-format', 'formdesc' => "An IDS rule in Snort rule-format. <br/>This rule will be automatically rewritten in the NIDS exports."),
|
||||
'snort' => array('desc' => 'An IDS rule in Snort rule-format', 'formdesc' => "An IDS rule in Snort rule-format. This rule will be automatically rewritten in the NIDS exports."),
|
||||
'pattern-in-file' => array('desc' => 'Pattern in file that identifies the malware'),
|
||||
'pattern-in-traffic' => array('desc' => 'Pattern in network traffic that identifies the malware'),
|
||||
'pattern-in-memory' => array('desc' => 'Pattern in memory dump that identifies the malware'),
|
||||
|
|
@ -120,7 +122,7 @@ class Attribute extends AppModel {
|
|||
'attachment' => array('desc' => 'Attachment with external information', 'formdesc' => "Please upload files using the <em>Upload Attachment</em> button."),
|
||||
'malware-sample' => array('desc' => 'Attachment containing encrypted malware sample', 'formdesc' => "Please upload files using the <em>Upload Attachment</em> button."),
|
||||
'link' => array('desc' => 'Link to an external information'),
|
||||
'comment' => array('desc' => 'Comment or description in a human language', 'formdesc' => 'Comment or description in a human language. <br/> This will not be correlated with other attributes (NOT IMPLEMENTED YET)'),
|
||||
'comment' => array('desc' => 'Comment or description in a human language', 'formdesc' => 'Comment or description in a human language. This will not be correlated with other attributes (NOT IMPLEMENTED YET)'),
|
||||
'text' => array('desc' => 'Name, ID or a reference'),
|
||||
'other' => array('desc' => 'Other attribute'),
|
||||
'named pipe' => array('desc' => 'Named pipe, use the format \\.\pipe\<PipeName>'),
|
||||
|
|
@ -140,17 +142,17 @@ class Attribute extends AppModel {
|
|||
),
|
||||
'Payload delivery' => array(
|
||||
'desc' => 'Information about how the malware is delivered',
|
||||
'formdesc' => 'Information about the way the malware payload is initially delivered, <br/>for example information about the email or web-site, vulnerability used, originating IP etc. <br/>Malware sample itself should be attached here.',
|
||||
'types' => array('md5', 'sha1', 'filename', 'filename|md5', 'filename|sha1', 'ip-src', 'ip-dst', 'hostname', 'domain', 'email-src', 'email-dst', 'email-subject', 'email-attachment', 'url', 'ip-dst', 'user-agent', 'AS', 'pattern-in-file', 'pattern-in-traffic', 'yara', 'attachment', 'malware-sample', 'link', 'comment', 'text', 'vulnerability', 'other')
|
||||
'formdesc' => 'Information about the way the malware payload is initially delivered, for example information about the email or web-site, vulnerability used, originating IP etc. Malware sample itself should be attached here.',
|
||||
'types' => array('md5', 'sha1', 'sha256','filename', 'filename|md5', 'filename|sha1', 'filename|sha256', 'ip-src', 'ip-dst', 'hostname', 'domain', 'email-src', 'email-dst', 'email-subject', 'email-attachment', 'url', 'ip-dst', 'user-agent', 'AS', 'pattern-in-file', 'pattern-in-traffic', 'yara', 'attachment', 'malware-sample', 'link', 'comment', 'text', 'vulnerability', 'other')
|
||||
),
|
||||
'Artifacts dropped' => array(
|
||||
'desc' => 'Any artifact (files, registry keys etc.) dropped by the malware or other modifications to the system',
|
||||
'types' => array('md5', 'sha1', 'filename', 'filename|md5', 'filename|sha1', 'regkey', 'regkey|value', 'pattern-in-file', 'pattern-in-memory', 'yara', 'attachment', 'malware-sample', 'comment', 'text', 'other', 'named pipe', 'mutex')
|
||||
'types' => array('md5', 'sha1', 'sha256', 'filename', 'filename|md5', 'filename|sha1', 'filename|sha256', 'regkey', 'regkey|value', 'pattern-in-file', 'pattern-in-memory', 'yara', 'attachment', 'malware-sample', 'comment', 'text', 'other', 'named pipe', 'mutex')
|
||||
),
|
||||
'Payload installation' => array(
|
||||
'desc' => 'Info on where the malware gets installed in the system',
|
||||
'formdesc' => 'Location where the payload was placed in the system and the way it was installed.<br/>For example, a filename|md5 type attribute can be added here like this:<br/>c:\\windows\\system32\\malicious.exe|41d8cd98f00b204e9800998ecf8427e.',
|
||||
'types' => array('md5', 'sha1', 'filename', 'filename|md5', 'filename|sha1', 'pattern-in-file', 'pattern-in-traffic', 'pattern-in-memory', 'yara', 'vulnerability', 'attachment', 'malware-sample', 'comment', 'text', 'other')
|
||||
'types' => array('md5', 'sha1', 'sha256', 'filename', 'filename|md5', 'filename|sha1', 'filename|sha256', 'pattern-in-file', 'pattern-in-traffic', 'pattern-in-memory', 'yara', 'vulnerability', 'attachment', 'malware-sample', 'comment', 'text', 'other')
|
||||
),
|
||||
'Persistence mechanism' => array(
|
||||
'desc' => 'Mechanisms used by the malware to start at boot',
|
||||
|
|
@ -173,7 +175,7 @@ class Attribute extends AppModel {
|
|||
'External analysis' => array(
|
||||
'desc' => 'Any other result from additional analysis of the malware like tools output',
|
||||
'formdesc' => 'Any other result from additional analysis of the malware like tools output<br/>Examples: pdf-parser output, automated sandbox analysis, reverse engineering report.',
|
||||
'types' => array('md5', 'sha1', 'filename', 'filename|md5', 'filename|sha1', 'ip-src', 'ip-dst', 'hostname', 'domain', 'url', 'user-agent', 'regkey', 'regkey|value', 'AS', 'snort', 'pattern-in-file', 'pattern-in-traffic', 'pattern-in-memory', 'vulnerability', 'attachment', 'malware-sample', 'link', 'comment', 'text', 'other')
|
||||
'types' => array('md5', 'sha1', 'sha256','filename', 'filename|md5', 'filename|sha1', 'filename|sha256', 'ip-src', 'ip-dst', 'hostname', 'domain', 'url', 'user-agent', 'regkey', 'regkey|value', 'AS', 'snort', 'pattern-in-file', 'pattern-in-traffic', 'pattern-in-memory', 'vulnerability', 'attachment', 'malware-sample', 'link', 'comment', 'text', 'other')
|
||||
),
|
||||
'Other' => array(
|
||||
'desc' => 'Attributes that are not part of any other category',
|
||||
|
|
@ -396,12 +398,14 @@ class Attribute extends AppModel {
|
|||
// lowercase these things
|
||||
case 'md5':
|
||||
case 'sha1':
|
||||
case 'sha256':
|
||||
case 'domain':
|
||||
case 'hostname':
|
||||
$this->data['Attribute']['value'] = strtolower($this->data['Attribute']['value']);
|
||||
break;
|
||||
case 'filename|md5':
|
||||
case 'filename|sha1':
|
||||
case 'filename|sha256':
|
||||
$pieces = explode('|', $this->data['Attribute']['value']);
|
||||
$this->data['Attribute']['value'] = $pieces[0] . '|' . strtolower($pieces[1]);
|
||||
break;
|
||||
|
|
@ -479,6 +483,13 @@ class Attribute extends AppModel {
|
|||
$returnValue = 'Checksum has invalid length or format. Please double check the value or select "other" for a type.';
|
||||
}
|
||||
break;
|
||||
case 'sha256':
|
||||
if (preg_match("#^[0-9a-f]{64}$#", $value)) {
|
||||
$returnValue = true;
|
||||
} else {
|
||||
$returnValue = 'Checksum has invalid length or format. Please double check the value or select "other" for a type.';
|
||||
}
|
||||
break;
|
||||
case 'filename':
|
||||
// no newline
|
||||
if (!preg_match("#\n#", $value)) {
|
||||
|
|
@ -501,6 +512,14 @@ class Attribute extends AppModel {
|
|||
$returnValue = 'Checksum has invalid length or format. Please double check the value or select "other" for a type.';
|
||||
}
|
||||
break;
|
||||
case 'filename|sha256':
|
||||
// no newline
|
||||
if (preg_match("#^.+\|[0-9a-f]{64}$#", $value)) {
|
||||
$returnValue = true;
|
||||
} else {
|
||||
$returnValue = 'Checksum has invalid length or format. Please double check the value or select "other" for a type.';
|
||||
}
|
||||
break;
|
||||
case 'ip-src':
|
||||
$parts = explode("/", $value);
|
||||
// [0] = the ip
|
||||
|
|
|
|||
Loading…
Reference in New Issue