mirror of https://github.com/MISP/misp-modules
support for md5 and sha1 hashes
parent
5ab8b605bb
commit
537f9132f5
|
@ -10,7 +10,7 @@ import re
|
||||||
|
|
||||||
misperrors = {"error": "Error"}
|
misperrors = {"error": "Error"}
|
||||||
|
|
||||||
types_to_use = ['sha1']
|
types_to_use = ['sha1', 'md5']
|
||||||
|
|
||||||
userConfig = {
|
userConfig = {
|
||||||
|
|
||||||
|
@ -29,16 +29,26 @@ moduleinfo = {'version': '1.0', 'author': 'Julien Bachmann, Hacknowledge',
|
||||||
|
|
||||||
|
|
||||||
def handle_sha1(value, period):
|
def handle_sha1(value, period):
|
||||||
return '''
|
query = '''select ((binary (executable_name version)) (user (name)) (device (name last_ip_address)) (execution (binary_path start_time)))
|
||||||
(select ((binary (executable_name version)) (user (name)) (device (name last_ip_address)) (execution (binary_path start_time)))
|
(from (binary user device execution)
|
||||||
(from (binary user device execution)
|
(where binary (eq sha1 (sha1 %s)))
|
||||||
(where binary (eq hash (sha1 %s))))
|
(between now-%s now))
|
||||||
(between now-%s now)
|
(limit 1000)
|
||||||
(limit 1000))
|
|
||||||
''' % (value, period)
|
''' % (value, period)
|
||||||
|
return query.replace('\n', ' ')
|
||||||
|
|
||||||
|
def handle_md5(value, period):
|
||||||
|
query = '''select ((binary (executable_name version)) (user (name)) (device (name last_ip_address)) (execution (binary_path start_time)))
|
||||||
|
(from (binary user device execution)
|
||||||
|
(where binary (eq hash (md5 %s)))
|
||||||
|
(between now-%s now))
|
||||||
|
(limit 1000)
|
||||||
|
''' % (value, period)
|
||||||
|
return query.replace('\n', ' ')
|
||||||
|
|
||||||
handlers = {
|
handlers = {
|
||||||
'sha1': handle_sha1
|
'sha1': handle_sha1,
|
||||||
|
'md5': handle_md5
|
||||||
}
|
}
|
||||||
|
|
||||||
def handler(q=False):
|
def handler(q=False):
|
||||||
|
@ -56,7 +66,6 @@ def handler(q=False):
|
||||||
r = {"response": [], "data": str(base64.b64encode(bytes(output, 'utf-8')), 'utf-8')}
|
r = {"response": [], "data": str(base64.b64encode(bytes(output, 'utf-8')), 'utf-8')}
|
||||||
return r
|
return r
|
||||||
|
|
||||||
|
|
||||||
def introspection():
|
def introspection():
|
||||||
modulesetup = {}
|
modulesetup = {}
|
||||||
try:
|
try:
|
||||||
|
|
Loading…
Reference in New Issue