added support for service-displayname, regkey|value

misp_modules/modules/export_mod/osqueryexport.py

@@ -1,5 +1,5 @@
 """
-Export module for coverting MISP events into OSQuery query pack.
+Export module for coverting MISP events into OSQuery queries.
 Source: https://github.com/0xmilkmix/misp-modules/blob/master/misp_modules/modules/export_mod/osqueryexport.py
 """
 
@@ -11,17 +11,13 @@ import re
 
 misperrors = {"error": "Error"}
 
-types_to_use = ['regkey', 'mutex']
-
+types_to_use = ['regkey', 'regkey|value', 'mutex', 'windows-service-displayname', 'yara']
 
 userConfig = {
 
 };
 
 moduleconfig = []
-
-# fixed for now, options in the future:
-# event, attribute, event-collection, attribute-collection
 inputSource = ['event']
 
 outputFileExtension = 'conf'
@@ -32,7 +28,6 @@ moduleinfo = {'version': '0.1', 'author': 'Julien Bachmann, Hacknowledge',
               'description': 'OSQuery query export module',
               'module-type': ['export']}
 
-# test : http://misp.vm/events/view/23
 def handle_regkey(value):
     rep = {'HKCU': 'HKEY_USERS\\%', 'HKLM': 'HKEY_LOCAL_MACHINE'}
     rep = dict((re.escape(k), v) for k, v in rep.items())
@@ -40,12 +35,29 @@ def handle_regkey(value):
     value = pattern.sub(lambda m: rep[re.escape(m.group(0))], value)
     return 'SELECT * FROM registry WHERE path LIKE \'%s\';' % value
 
+def handle_regkeyvalue(value):
+    key, value = value.split('|')
+    rep = {'HKCU': 'HKEY_USERS\\%', 'HKLM': 'HKEY_LOCAL_MACHINE'}
+    rep = dict((re.escape(k), v) for k, v in rep.items())
+    pattern = re.compile("|".join(rep.keys()))
+    key = pattern.sub(lambda m: rep[re.escape(m.group(0))], key)
+    return 'SELECT * FROM registry WHERE path LIKE \'%s\' AND data LIKE \'%s\';' % (key, value)
+
 def handle_mutex(value):
-    return '#waiting acceptance of Scott Lundgren PR that would allow to query Kernel Objects'
+    return 'not implemented yet'
+
+def handle_service(value):
+    return 'SELECT * FROM services WHERE display_name LIKE \'%s\' OR name like \'%s\';' % (value, value)
+
+def handle_yara(value):
+    return 'not implemented yet, not sure it\'s easily feasible w/o dropping the sig on the hosts first'
 
 handlers = {
     'regkey' : handle_regkey,
-    'mutex' : handle_mutex
+    'regkey|value' : handle_regkeyvalue,
+    'mutex' : handle_mutex,
+    'windows-service-displayname' : handle_service,
+    'yara' : handle_yara
 }
 
 def handler(q=False):