2017-07-24 17:16:40 +02:00
|
|
|
#!/usr/bin/env python3
|
|
|
|
# -*- coding: utf-8 -*-
|
|
|
|
|
2021-01-19 15:44:58 +01:00
|
|
|
from pymisp import PyMISP
|
2017-07-24 17:16:40 +02:00
|
|
|
from pymisp.tools import make_binary_objects
|
|
|
|
import traceback
|
|
|
|
from keys import misp_url, misp_key, misp_verifycert
|
|
|
|
import glob
|
|
|
|
import argparse
|
|
|
|
|
|
|
|
if __name__ == '__main__':
|
|
|
|
parser = argparse.ArgumentParser(description='Extract indicators out of binaries and add MISP objects to a MISP instance.')
|
|
|
|
parser.add_argument("-e", "--event", required=True, help="Event ID to update.")
|
|
|
|
parser.add_argument("-p", "--path", required=True, help="Path to process (expanded using glob).")
|
|
|
|
args = parser.parse_args()
|
|
|
|
|
2021-01-19 15:44:58 +01:00
|
|
|
pymisp = PyMISP(misp_url, misp_key, misp_verifycert)
|
2017-07-24 17:16:40 +02:00
|
|
|
|
|
|
|
for f in glob.glob(args.path):
|
|
|
|
try:
|
|
|
|
fo, peo, seos = make_binary_objects(f)
|
2019-07-17 16:46:47 +02:00
|
|
|
except Exception:
|
2017-07-24 17:16:40 +02:00
|
|
|
traceback.print_exc()
|
2018-02-23 11:17:54 +01:00
|
|
|
continue
|
2017-08-23 15:36:13 +02:00
|
|
|
|
2017-07-24 17:16:40 +02:00
|
|
|
if seos:
|
|
|
|
for s in seos:
|
2019-07-17 16:46:47 +02:00
|
|
|
r = pymisp.add_object(args.event, s)
|
2017-08-23 15:36:13 +02:00
|
|
|
|
|
|
|
if peo:
|
2021-01-19 15:44:58 +01:00
|
|
|
if hasattr(peo, 'certificates') and hasattr(peo, 'signers'):
|
|
|
|
# special authenticode case for PE objects
|
|
|
|
for c in peo.certificates:
|
|
|
|
pymisp.add_object(args.event, c, pythonify=True)
|
|
|
|
for s in peo.signers:
|
|
|
|
pymisp.add_object(args.event, s, pythonify=True)
|
|
|
|
del peo.certificates
|
|
|
|
del peo.signers
|
|
|
|
del peo.sections
|
2019-07-22 12:41:27 +02:00
|
|
|
r = pymisp.add_object(args.event, peo, pythonify=True)
|
2017-08-28 19:01:53 +02:00
|
|
|
for ref in peo.ObjectReference:
|
2017-08-24 19:21:52 +02:00
|
|
|
r = pymisp.add_object_reference(ref)
|
2017-08-23 15:36:13 +02:00
|
|
|
|
|
|
|
if fo:
|
2019-07-22 12:41:27 +02:00
|
|
|
response = pymisp.add_object(args.event, fo, pythonify=True)
|
2017-08-28 19:01:53 +02:00
|
|
|
for ref in fo.ObjectReference:
|
2017-08-24 19:21:52 +02:00
|
|
|
r = pymisp.add_object_reference(ref)
|