Merge pull request #161 from eCrimeLabs/ecrimelabs_dev

Added Yara syntax validation expansion module
pull/165/head
Alexandre Dulaunoy 2018-02-12 21:02:14 +01:00 committed by GitHub
commit ad112f9b87
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 40 additions and 1 deletions

View File

@ -21,3 +21,4 @@ domaintools_api
pygeoip pygeoip
bs4 bs4
oauth2 oauth2
yara

View File

@ -3,4 +3,4 @@ from . import _vmray
__all__ = ['vmray_submit', 'asn_history', 'circl_passivedns', 'circl_passivessl', __all__ = ['vmray_submit', 'asn_history', 'circl_passivedns', 'circl_passivessl',
'countrycode', 'cve', 'dns', 'domaintools', 'eupi', 'farsight_passivedns', 'ipasn', 'passivetotal', 'sourcecache', 'countrycode', 'cve', 'dns', 'domaintools', 'eupi', 'farsight_passivedns', 'ipasn', 'passivetotal', 'sourcecache',
'virustotal', 'whois', 'shodan', 'reversedns', 'geoip_country', 'wiki', 'iprep', 'threatminer', 'otx', 'virustotal', 'whois', 'shodan', 'reversedns', 'geoip_country', 'wiki', 'iprep', 'threatminer', 'otx',
'threatcrowd', 'vulndb', 'crowdstrike_falcon'] 'threatcrowd', 'vulndb', 'crowdstrike_falcon','yara_syntax_validator']

View File

@ -0,0 +1,38 @@
import json
import requests
try:
import yara
except:
print("yara is missing, use 'pip3 install yara' to install it.")
misperrors = {'error': 'Error'}
mispattributes = {'input': ['yara'], 'output': ['text']}
moduleinfo = {'version': '0.1', 'author': 'Dennis Rand', 'description': 'An expansion hover module to perform a syntax check on if yara rules are valid or not.', 'module-type': ['hover']}
moduleconfig = []
def handler(q=False):
if q is False:
return False
request = json.loads(q)
if not request.get('yara'):
misperrors['error'] = 'Yara rule missing'
return misperrors
try:
rules = yara.compile(source=request.get('yara'))
summary = ("Syntax valid")
except Exception as e:
summary = ("Syntax error: " + str(e))
r = {'results': [{'types': mispattributes['output'], 'values': summary}]}
return r
def introspection():
return mispattributes
def version():
moduleinfo['config'] = moduleconfig
return moduleinfo