MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

support for md5 and sha1 hashes

pull/258/head
milkmix 2018-12-24 16:40:31 +01:00
parent 5ab8b605bb
commit 537f9132f5
1 changed files with 18 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
misp_modules/modules/export_mod/nexthinkexport.py
View File

@ -10,7 +10,7 @@ import re
misperrors = {"error": "Error"} misperrors = {"error": "Error"}
types_to_use = ['sha1'] types_to_use = ['sha1', 'md5']
userConfig = { userConfig = {
@ -29,16 +29,26 @@ moduleinfo = {'version': '1.0', 'author': 'Julien Bachmann, Hacknowledge',
def handle_sha1(value, period): def handle_sha1(value, period):
return ''' query = '''select ((binary (executable_name version)) (user (name)) (device (name last_ip_address)) (execution (binary_path start_time)))
(select ((binary (executable_name version)) (user (name)) (device (name last_ip_address)) (execution (binary_path start_time))) (from (binary user device execution)
(from (binary user device execution) (where binary (eq sha1 (sha1 %s)))
(where binary (eq hash (sha1 %s)))) (between now-%s now))
(between now-%s now) (limit 1000)
(limit 1000))
''' % (value, period) ''' % (value, period)
return query.replace('\n', ' ')
def handle_md5(value, period):
query = '''select ((binary (executable_name version)) (user (name)) (device (name last_ip_address)) (execution (binary_path start_time)))
(from (binary user device execution)
(where binary (eq hash (md5 %s)))
(between now-%s now))
(limit 1000)
''' % (value, period)
return query.replace('\n', ' ')
handlers = { handlers = {
'sha1': handle_sha1 'sha1': handle_sha1,
'md5': handle_md5
} }
def handler(q=False): def handler(q=False):
@ -56,7 +66,6 @@ def handler(q=False):
r = {"response": [], "data": str(base64.b64encode(bytes(output, 'utf-8')), 'utf-8')} r = {"response": [], "data": str(base64.b64encode(bytes(output, 'utf-8')), 'utf-8')}
return r return r
def introspection(): def introspection():
modulesetup = {} modulesetup = {}
try: try: