MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

added support for scheduledtasks

pull/237/head
milkmix 2018-06-24 21:13:56 +02:00
parent 7c037ed090
commit 349dd99d47
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
misp_modules/modules/export_mod/osqueryexport.py
View File

@ -11,7 +11,7 @@ import re
misperrors = {"error": "Error"} misperrors = {"error": "Error"}
types_to_use = ['regkey', 'regkey|value', 'mutex', 'windows-service-displayname', 'yara'] types_to_use = ['regkey', 'regkey|value', 'mutex', 'windows-service-displayname', 'windows-scheduled-task', 'yara']
userConfig = { userConfig = {
@ -52,11 +52,15 @@ def handle_service(value):
def handle_yara(value): def handle_yara(value):
return 'not implemented yet, not sure it\'s easily feasible w/o dropping the sig on the hosts first' return 'not implemented yet, not sure it\'s easily feasible w/o dropping the sig on the hosts first'
def handle_scheduledtask(value):
return 'SELECT * FROM scheduled_tasks WHERE name LIKE \'%s\';' % value
handlers = { handlers = {
'regkey' : handle_regkey, 'regkey' : handle_regkey,
'regkey|value' : handle_regkeyvalue, 'regkey|value' : handle_regkeyvalue,
'mutex' : handle_mutex, 'mutex' : handle_mutex,
'windows-service-displayname' : handle_service, 'windows-service-displayname' : handle_service,
'windows-scheduled-task' : handle_scheduledtask,
'yara' : handle_yara 'yara' : handle_yara
} }