From 349dd99d470bdad1c8d2a9ca758df3010a8fdd0d Mon Sep 17 00:00:00 2001 From: milkmix Date: Sun, 24 Jun 2018 21:13:56 +0200 Subject: [PATCH] added support for scheduledtasks --- misp_modules/modules/export_mod/osqueryexport.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/misp_modules/modules/export_mod/osqueryexport.py b/misp_modules/modules/export_mod/osqueryexport.py index 9c79d50..11c253d 100755 --- a/misp_modules/modules/export_mod/osqueryexport.py +++ b/misp_modules/modules/export_mod/osqueryexport.py @@ -11,7 +11,7 @@ import re misperrors = {"error": "Error"} -types_to_use = ['regkey', 'regkey|value', 'mutex', 'windows-service-displayname', 'yara'] +types_to_use = ['regkey', 'regkey|value', 'mutex', 'windows-service-displayname', 'windows-scheduled-task', 'yara'] userConfig = { @@ -52,11 +52,15 @@ def handle_service(value): def handle_yara(value): return 'not implemented yet, not sure it\'s easily feasible w/o dropping the sig on the hosts first' +def handle_scheduledtask(value): + return 'SELECT * FROM scheduled_tasks WHERE name LIKE \'%s\';' % value + handlers = { 'regkey' : handle_regkey, 'regkey|value' : handle_regkeyvalue, 'mutex' : handle_mutex, 'windows-service-displayname' : handle_service, + 'windows-scheduled-task' : handle_scheduledtask, 'yara' : handle_yara }