Add OpenIOC import module

2017-02-27 13:32:31 +01:00 · 2017-02-27 13:32:31 +01:00 · c508e60f65
parent 8bd9b46713
commit c508e60f65
5 changed files with 200 additions and 38 deletions
--- a/1
+++ b/1
@ -19,3 +19,4 @@ pytesseract
 SPARQLWrapper
 domaintools_api
 pygeoip
+bs4
--- a/misp_modules/modules/import_mod/init.py
+++ b/misp_modules/modules/import_mod/init.py
@ -1,3 +1,4 @@
 from . import _vmray

-__all__ = ['vmray_import', 'testimport', 'ocr', 'stiximport', 'cuckooimport', 'email_import', 'mispjson']
+__all__ = ['vmray_import', 'testimport', 'ocr', 'stiximport', 'cuckooimport',
+           'email_import', 'mispjson', 'openiocimport']
--- a/misp_modules/modules/import_mod/openiocimport.py
+++ b/misp_modules/modules/import_mod/openiocimport.py
@ -0,0 +1,58 @@
+import json
+import base64
+
+from pymisp.tools import openioc
+
+misperrors = {'error': 'Error'}
+userConfig = {}
+inputSource = ['file']
+
+moduleinfo = {'version': '0.1', 'author': 'Raphaël Vinot',
+              'description': 'Import OpenIOC package',
+              'module-type': ['import']}
+
+moduleconfig = []
+
+
+def handler(q=False):
+    # Just in case we have no data
+    if q is False:
+        return False
+
+    # The return value
+    r = {'results': []}
+
+    # Load up that JSON
+    q = json.loads(q)
+
+    # It's b64 encoded, so decode that stuff
+    package = base64.b64decode(q.get("data")).decode('utf-8')
+
+    # If something really weird happened
+    if not package:
+        return json.dumps({"success": 0})
+
+    pkg = openioc.load_openioc(package)
+    for attrib in pkg.attributes:
+        r["results"].append({"values": [attrib.value], "types": [attrib.type], "categories": [attrib.category]})
+    return r
+
+
+def introspection():
+    modulesetup = {}
+    try:
+        userConfig
+        modulesetup['userConfig'] = userConfig
+    except NameError:
+        pass
+    try:
+        inputSource
+        modulesetup['inputSource'] = inputSource
+    except NameError:
+        pass
+    return modulesetup
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo
--- a/tests/openioc.xml
+++ b/tests/openioc.xml
@ -0,0 +1,91 @@
+<?xml version="1.0" encoding="us-ascii"?>
+<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="ea3cab0c-72ad-40cc-abbf-90846fa4afec" last-modified="2011-11-04T19:35:05" xmlns="http://schemas.mandiant.com/2010/ioc">
+  <short_description>STUXNET VIRUS (METHODOLOGY)</short_description>
+  <description>Generic indicator for the stuxnet virus.  When loaded, stuxnet spawns lsass.exe in a suspended state. The malware then maps in its own executable section and fixes up the CONTEXT to point to the newly mapped in section. This is a common task performed by malware and allows the malware to execute under the pretense of a known and trusted process.</description>
+  <keywords>methodology</keywords>
+  <authored_by>Mandiant</authored_by>
+  <authored_date>0001-01-01T00:00:00</authored_date>
+  <links />
+  <definition>
+    <Indicator operator="OR" id="73bc8d65-826b-48d2-b4a8-48918e29e323">
+      <IndicatorItem id="b9ef2559-cc59-4463-81d9-52800545e16e" condition="contains">
+        <Context document="FileItem" search="FileItem/PEInfo/Sections/Section/Name" type="mir" />
+        <Content type="string">.stub</Content>
+      </IndicatorItem>
+      <IndicatorItem id="156bc4b6-a2a1-4735-bfe8-6c8d1f7eae38" condition="contains">
+        <Context document="FileItem" search="FileItem/FileName" type="mir" />
+        <Content type="string">mdmcpq3.PNF</Content>
+      </IndicatorItem>
+      <IndicatorItem id="e57d9a5b-5e6a-41ec-87c8-ee67f3ed2e20" condition="contains">
+        <Context document="FileItem" search="FileItem/FileName" type="mir" />
+        <Content type="string">mdmeric3.PNF</Content>
+      </IndicatorItem>
+      <IndicatorItem id="63d7bee6-b575-4d56-8d43-1c5eac57658f" condition="contains">
+        <Context document="FileItem" search="FileItem/FileName" type="mir" />
+        <Content type="string">oem6C.PNF</Content>
+      </IndicatorItem>
+      <IndicatorItem id="e6bff12a-e23d-45ea-94bd-8289f806bea7" condition="contains">
+        <Context document="FileItem" search="FileItem/FileName" type="mir" />
+        <Content type="string">oem7A.PNF</Content>
+      </IndicatorItem>
+      <Indicator operator="AND" id="422ae9bf-a1ae-41f2-8e54-5b4c6f3e1598">
+        <IndicatorItem id="e93f1610-daaf-4311-bcf3-3aecef8271c0" condition="contains">
+          <Context document="DriverItem" search="DriverItem/DeviceItem/AttachedToDriverName" type="mir" />
+          <Content type="string">fs_rec.sys</Content>
+        </IndicatorItem>
+        <IndicatorItem id="72476f35-8dea-4bae-8239-7c22d05d664f" condition="contains">
+          <Context document="DriverItem" search="DriverItem/DeviceItem/AttachedToDriverName" type="mir" />
+          <Content type="string">mrxsmb.sys</Content>
+        </IndicatorItem>
+        <IndicatorItem id="f98ea5aa-9e23-4f18-b871-b3cf5ba153fe" condition="contains">
+          <Context document="DriverItem" search="DriverItem/DeviceItem/AttachedToDriverName" type="mir" />
+          <Content type="string">sr.sys</Content>
+        </IndicatorItem>
+        <IndicatorItem id="32f61140-0f58-43bc-8cdd-a25db75ca6c4" condition="contains">
+          <Context document="DriverItem" search="DriverItem/DeviceItem/AttachedToDriverName" type="mir" />
+          <Content type="string">fastfat.sys</Content>
+        </IndicatorItem>
+      </Indicator>
+      <Indicator operator="AND" id="eb585bf5-18d8-4837-baf0-80ac74104ca3">
+        <IndicatorItem id="8d85b559-4d18-4e15-b0c9-da5a9b32f53c" condition="contains">
+          <Context document="FileItem" search="FileItem/FileName" type="mir" />
+          <Content type="string">mrxcls.sys</Content>
+        </IndicatorItem>
+        <IndicatorItem id="8a3e425d-fa87-4a31-b20d-8f8630d77933" condition="contains">
+          <Context document="FileItem" search="FileItem/PEInfo/DigitalSignature/CertificateSubject" type="mir" />
+          <Content type="string">Realtek Semiconductor Corp</Content>
+        </IndicatorItem>
+      </Indicator>
+      <Indicator operator="AND" id="bc8d06dd-f879-4609-bb1c-eccded0222ce">
+        <IndicatorItem id="89f194d3-3ee6-4218-93f8-055ea92a9f00" condition="contains">
+          <Context document="FileItem" search="FileItem/FileName" type="mir" />
+          <Content type="string">mrxnet.sys</Content>
+        </IndicatorItem>
+        <IndicatorItem id="c2dae8bf-81b1-49fb-8654-396830d75ade" condition="contains">
+          <Context document="FileItem" search="FileItem/PEInfo/DigitalSignature/CertificateSubject" type="mir" />
+          <Content type="string">Realtek Semiconductor Corp</Content>
+        </IndicatorItem>
+      </Indicator>
+      <Indicator operator="AND" id="00538c36-88fe-42ea-a70f-136a2fb53834">
+        <IndicatorItem id="a779b811-345f-4164-897e-0752837d0c1e" condition="contains">
+          <Context document="RegistryItem" search="RegistryItem/Path" type="mir" />
+          <Content type="string">HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MRxCls\ImagePath</Content>
+        </IndicatorItem>
+        <IndicatorItem id="ee981f06-b713-40aa-ac98-c6f4fd82b78d" condition="contains">
+          <Context document="RegistryItem" search="RegistryItem/Text" type="mir" />
+          <Content type="string">mrxcls.sys</Content>
+        </IndicatorItem>
+      </Indicator>
+      <Indicator operator="AND" id="d8d9b32c-f648-4552-9805-93c05ed48219">
+        <IndicatorItem id="c08044e7-e88c-433c-b463-763bdddeff82" condition="contains">
+          <Context document="RegistryItem" search="RegistryItem/Path" type="mir" />
+          <Content type="string">HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MRxNet\ImagePath</Content>
+        </IndicatorItem>
+        <IndicatorItem id="38dfb382-ebbe-4685-bbb7-60675b91bd15" condition="contains">
+          <Context document="RegistryItem" search="RegistryItem/Text" type="mir" />
+          <Content type="string">mrxnet.sys</Content>
+        </IndicatorItem>
+      </Indicator>
+    </Indicator>
+  </definition>
+</ioc>
--- a/tests/test.py
+++ b/tests/test.py
@ -41,6 +41,20 @@ class TestModules(unittest.TestCase):
            print(response.json())
            response.connection.close()

+    def test_openioc(self):
+        with open("tests/openioc.xml", "rb") as f:
+            content = base64.b64encode(f.read())
+            data = json.dumps({"module": "openiocimport",
+                               "data": content.decode(),
+                               })
+            response = requests.post(self.url + "query", data=data).json()
+            print(response)
+
+            print("OpenIOC :: {}".format(response))
+            values = [x["values"][0] for x in response["results"]]
+            assert("mrxcls.sys" in values)
+            assert("mdmcpq3.PNF" in values)
+
    def test_stix(self):
        with open("tests/stix.xml", "rb") as f:
            content = base64.b64encode(f.read())
@ -128,7 +142,6 @@ class TestModules(unittest.TestCase):
                attch_data = base64.b64decode(i["data"])
                self.assertEqual(attch_data, b'X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-')

-
    def test_email_attachment_unpack(self):
        query = {"module": "email_import"}
        query["config"] = {"unzip_attachments": "true",
@ -192,7 +205,6 @@ class TestModules(unittest.TestCase):
                self.assertEqual(filesum.hexdigest(),
                                 '098da5381a90d4a51e6b844c18a0fecf2e364813c2f8b317cfdc51c21f2506a5')

-
    def test_email_attachment_unpack_with_password(self):
        query = {"module": "email_import"}
        query["config"] = {"unzip_attachments": "true",
@ -221,7 +233,6 @@ class TestModules(unittest.TestCase):
                self.assertEqual(attch_data,
                                 b'X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-')

-
    def test_email_attachment_password_in_body(self):
        query = {"module": "email_import"}
        query["config"] = {"unzip_attachments": "true",
@ -344,7 +355,6 @@ class TestModules(unittest.TestCase):
                self.assertEqual(attch_data,
                                 'X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-')

-
    def test_email_extract_html_body_urls(self):
        query = {"module": "email_import"}
        query["config"] = {"unzip_attachments": None,
@ -388,6 +398,7 @@ without modifying core components. The API is available via a simple REST API wh
    #    response = requests.post(self.url + "query", data=json.dumps(query)).json()
    #    print(response)

+
 def decode_email(message):
    message64 = base64.b64encode(message.as_bytes()).decode()
    return message64