Merge pull request #161 from eCrimeLabs/ecrimelabs_dev

Added Yara syntax validation expansion module

REQUIREMENTS

@@ -21,3 +21,4 @@ domaintools_api
 pygeoip
 bs4
 oauth2
+yara

misp_modules/modules/expansion/__init__.py

@@ -3,4 +3,4 @@ from . import _vmray
 __all__ = ['vmray_submit', 'asn_history', 'circl_passivedns', 'circl_passivessl',
            'countrycode', 'cve', 'dns', 'domaintools', 'eupi', 'farsight_passivedns', 'ipasn', 'passivetotal', 'sourcecache',
            'virustotal', 'whois', 'shodan', 'reversedns', 'geoip_country', 'wiki', 'iprep', 'threatminer', 'otx',
-           'threatcrowd', 'vulndb', 'crowdstrike_falcon']
+           'threatcrowd', 'vulndb', 'crowdstrike_falcon','yara_syntax_validator']

misp_modules/modules/expansion/yara_syntax_validator.py

@@ -0,0 +1,38 @@
+import json
+import requests
+try:
+    import yara
+except:
+    print("yara is missing, use 'pip3 install yara' to install it.")
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['yara'], 'output': ['text']}
+moduleinfo = {'version': '0.1', 'author': 'Dennis Rand', 'description': 'An expansion hover module to perform a syntax check on if yara rules are valid or not.', 'module-type': ['hover']}
+moduleconfig = []
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if not request.get('yara'):
+        misperrors['error'] = 'Yara rule missing'
+        return misperrors
+
+    try:
+        rules = yara.compile(source=request.get('yara'))
+        summary = ("Syntax valid")
+    except Exception as e:
+        summary = ("Syntax error: " + str(e))
+
+    r = {'results': [{'types': mispattributes['output'], 'values': summary}]}
+    return r
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo