mirror of https://github.com/MISP/misp-modules
Raphaël Vinot
6 years ago
parent
8bd9b46713
commit
c508e60f65
5 changed files with 200 additions and 38 deletions
@ -1,3 +1,4 @@ |
||||
from . import _vmray |
||||
|
||||
__all__ = ['vmray_import', 'testimport', 'ocr', 'stiximport', 'cuckooimport', 'email_import', 'mispjson'] |
||||
__all__ = ['vmray_import', 'testimport', 'ocr', 'stiximport', 'cuckooimport', |
||||
'email_import', 'mispjson', 'openiocimport'] |
||||
|
||||
@ -0,0 +1,58 @@ |
||||
import json |
||||
import base64 |
||||
|
||||
from pymisp.tools import openioc |
||||
|
||||
misperrors = {'error': 'Error'} |
||||
userConfig = {} |
||||
inputSource = ['file'] |
||||
|
||||
moduleinfo = {'version': '0.1', 'author': 'Raphaël Vinot', |
||||
'description': 'Import OpenIOC package', |
||||
'module-type': ['import']} |
||||
|
||||
moduleconfig = [] |
||||
|
||||
|
||||
def handler(q=False): |
||||
# Just in case we have no data |
||||
if q is False: |
||||
return False |
||||
|
||||
# The return value |
||||
r = {'results': []} |
||||
|
||||
# Load up that JSON |
||||
q = json.loads(q) |
||||
|
||||
# It's b64 encoded, so decode that stuff |
||||
package = base64.b64decode(q.get("data")).decode('utf-8') |
||||
|
||||
# If something really weird happened |
||||
if not package: |
||||
return json.dumps({"success": 0}) |
||||
|
||||
pkg = openioc.load_openioc(package) |
||||
for attrib in pkg.attributes: |
||||
r["results"].append({"values": [attrib.value], "types": [attrib.type], "categories": [attrib.category]}) |
||||
return r |
||||
|
||||
|
||||
def introspection(): |
||||
modulesetup = {} |
||||
try: |
||||
userConfig |
||||
modulesetup['userConfig'] = userConfig |
||||
except NameError: |
||||
pass |
||||
try: |
||||
inputSource |
||||
modulesetup['inputSource'] = inputSource |
||||
except NameError: |
||||
pass |
||||
return modulesetup |
||||
|
||||
|
||||
def version(): |
||||
moduleinfo['config'] = moduleconfig |
||||
return moduleinfo |
||||
@ -0,0 +1,91 @@ |
||||
<?xml version="1.0" encoding="us-ascii"?> |
||||
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="ea3cab0c-72ad-40cc-abbf-90846fa4afec" last-modified="2011-11-04T19:35:05" xmlns="http://schemas.mandiant.com/2010/ioc"> |
||||
<short_description>STUXNET VIRUS (METHODOLOGY)</short_description> |
||||
<description>Generic indicator for the stuxnet virus. When loaded, stuxnet spawns lsass.exe in a suspended state. The malware then maps in its own executable section and fixes up the CONTEXT to point to the newly mapped in section. This is a common task performed by malware and allows the malware to execute under the pretense of a known and trusted process.</description> |
||||
<keywords>methodology</keywords> |
||||
<authored_by>Mandiant</authored_by> |
||||
<authored_date>0001-01-01T00:00:00</authored_date> |
||||
<links /> |
||||
<definition> |
||||
<Indicator operator="OR" id="73bc8d65-826b-48d2-b4a8-48918e29e323"> |
||||
<IndicatorItem id="b9ef2559-cc59-4463-81d9-52800545e16e" condition="contains"> |
||||
<Context document="FileItem" search="FileItem/PEInfo/Sections/Section/Name" type="mir" /> |
||||
<Content type="string">.stub</Content> |
||||
</IndicatorItem> |
||||
<IndicatorItem id="156bc4b6-a2a1-4735-bfe8-6c8d1f7eae38" condition="contains"> |
||||
<Context document="FileItem" search="FileItem/FileName" type="mir" /> |
||||
<Content type="string">mdmcpq3.PNF</Content> |
||||
</IndicatorItem> |
||||
<IndicatorItem id="e57d9a5b-5e6a-41ec-87c8-ee67f3ed2e20" condition="contains"> |
||||
<Context document="FileItem" search="FileItem/FileName" type="mir" /> |
||||
<Content type="string">mdmeric3.PNF</Content> |
||||
</IndicatorItem> |
||||
<IndicatorItem id="63d7bee6-b575-4d56-8d43-1c5eac57658f" condition="contains"> |
||||
<Context document="FileItem" search="FileItem/FileName" type="mir" /> |
||||
<Content type="string">oem6C.PNF</Content> |
||||
</IndicatorItem> |
||||
<IndicatorItem id="e6bff12a-e23d-45ea-94bd-8289f806bea7" condition="contains"> |
||||
<Context document="FileItem" search="FileItem/FileName" type="mir" /> |
||||
<Content type="string">oem7A.PNF</Content> |
||||
</IndicatorItem> |
||||
<Indicator operator="AND" id="422ae9bf-a1ae-41f2-8e54-5b4c6f3e1598"> |
||||
<IndicatorItem id="e93f1610-daaf-4311-bcf3-3aecef8271c0" condition="contains"> |
||||
<Context document="DriverItem" search="DriverItem/DeviceItem/AttachedToDriverName" type="mir" /> |
||||
<Content type="string">fs_rec.sys</Content> |
||||
</IndicatorItem> |
||||
<IndicatorItem id="72476f35-8dea-4bae-8239-7c22d05d664f" condition="contains"> |
||||
<Context document="DriverItem" search="DriverItem/DeviceItem/AttachedToDriverName" type="mir" /> |
||||
<Content type="string">mrxsmb.sys</Content> |
||||
</IndicatorItem> |
||||
<IndicatorItem id="f98ea5aa-9e23-4f18-b871-b3cf5ba153fe" condition="contains"> |
||||
<Context document="DriverItem" search="DriverItem/DeviceItem/AttachedToDriverName" type="mir" /> |
||||
<Content type="string">sr.sys</Content> |
||||
</IndicatorItem> |
||||
<IndicatorItem id="32f61140-0f58-43bc-8cdd-a25db75ca6c4" condition="contains"> |
||||
<Context document="DriverItem" search="DriverItem/DeviceItem/AttachedToDriverName" type="mir" /> |
||||
<Content type="string">fastfat.sys</Content> |
||||
</IndicatorItem> |
||||
</Indicator> |
||||
<Indicator operator="AND" id="eb585bf5-18d8-4837-baf0-80ac74104ca3"> |
||||
<IndicatorItem id="8d85b559-4d18-4e15-b0c9-da5a9b32f53c" condition="contains"> |
||||
<Context document="FileItem" search="FileItem/FileName" type="mir" /> |
||||
<Content type="string">mrxcls.sys</Content> |
||||
</IndicatorItem> |
||||
<IndicatorItem id="8a3e425d-fa87-4a31-b20d-8f8630d77933" condition="contains"> |
||||
<Context document="FileItem" search="FileItem/PEInfo/DigitalSignature/CertificateSubject" type="mir" /> |
||||
<Content type="string">Realtek Semiconductor Corp</Content> |
||||
</IndicatorItem> |
||||
</Indicator> |
||||
<Indicator operator="AND" id="bc8d06dd-f879-4609-bb1c-eccded0222ce"> |
||||
<IndicatorItem id="89f194d3-3ee6-4218-93f8-055ea92a9f00" condition="contains"> |
||||
<Context document="FileItem" search="FileItem/FileName" type="mir" /> |
||||
<Content type="string">mrxnet.sys</Content> |
||||
</IndicatorItem> |
||||
<IndicatorItem id="c2dae8bf-81b1-49fb-8654-396830d75ade" condition="contains"> |
||||
<Context document="FileItem" search="FileItem/PEInfo/DigitalSignature/CertificateSubject" type="mir" /> |
||||
<Content type="string">Realtek Semiconductor Corp</Content> |
||||
</IndicatorItem> |
||||
</Indicator> |
||||
<Indicator operator="AND" id="00538c36-88fe-42ea-a70f-136a2fb53834"> |
||||
<IndicatorItem id="a779b811-345f-4164-897e-0752837d0c1e" condition="contains"> |
||||
<Context document="RegistryItem" search="RegistryItem/Path" type="mir" /> |
||||
<Content type="string">HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MRxCls\ImagePath</Content> |
||||
</IndicatorItem> |
||||
<IndicatorItem id="ee981f06-b713-40aa-ac98-c6f4fd82b78d" condition="contains"> |
||||
<Context document="RegistryItem" search="RegistryItem/Text" type="mir" /> |
||||
<Content type="string">mrxcls.sys</Content> |
||||
</IndicatorItem> |
||||
</Indicator> |
||||
<Indicator operator="AND" id="d8d9b32c-f648-4552-9805-93c05ed48219"> |
||||
<IndicatorItem id="c08044e7-e88c-433c-b463-763bdddeff82" condition="contains"> |
||||
<Context document="RegistryItem" search="RegistryItem/Path" type="mir" /> |
||||
<Content type="string">HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MRxNet\ImagePath</Content> |
||||
</IndicatorItem> |
||||
<IndicatorItem id="38dfb382-ebbe-4685-bbb7-60675b91bd15" condition="contains"> |
||||
<Context document="RegistryItem" search="RegistryItem/Text" type="mir" /> |
||||
<Content type="string">mrxnet.sys</Content> |
||||
</IndicatorItem> |
||||
</Indicator> |
||||
</Indicator> |
||||
</definition> |
||||
</ioc> |
||||
Loading…
Reference in new issue