-
Notifications
You must be signed in to change notification settings - Fork 10
/
misp.py
275 lines (251 loc) · 13.8 KB
/
misp.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
#!/usr/bin/env python3
""" MISP custom connector and general handler """
import sys
import traceback
import logging
import re
from urllib.parse import urlparse
from pymisp import MISPEvent, PyMISP, MISPObject
from defang import refang
class MispCustomConnector:
""" custom MISP connector """
def __init__(self, misp_url:str, misp_key: str, misp_ssl: bool):
try:
# https://pymisp.readthedocs.io/en/latest/modules.html#pymisp
self.misp = PyMISP(misp_url, misp_key, misp_ssl)
except Exception as err:
sys.exit('Batch Job Terminated: MISP connection error - \n'+repr(err))
self.misp_logger = logging.getLogger('mispattruploader')
def submit_to_misp(self, misp: PyMISP, misp_event: MISPEvent, original_misp_objects: list):
'''
Submit a list of MISP objects to a MISP event
:misp: PyMISP API object for interfacing with MISP
:misp_event: MISPEvent object
:misp_objects: List of MISPObject objects. Must be a list
'''
# go through round one and only add MISP objects
misp_objects = []
for misp_object in original_misp_objects:
self.misp_logger.info(misp_object)
if len(misp_object.attributes) > 0:
if misp_object.name == 'network-connection':
template_id = 'af16764b-f8e5-4603-9de1-de34d272f80b'
else:
# self.misp_logger.debug(dir(pymisp.api))
# self.misp_logger.debug(dir(self.misp))
# exit()
self.misp_logger.info(misp_object)
self.misp_logger.info(misp_object.template_uuid)
object_template = self.misp.get_object_template(misp_object.template_uuid)
self.misp_logger.info("MISP Object Template: " + str(object_template))
template_id = object_template['ObjectTemplate']['id']
self.misp_logger.info(template_id)
# self.misp_logger.info(dir(misp_event))
self.misp_logger.info(misp_event)
# add the object and get the result
result = misp.add_object(event=misp_event, misp_object=misp_object)
self.misp_logger.info("MISP Add Object Result" + str(result))
misp_objects.append(result)
# go through round two and add all the object references for each object
misp_object_references = []
for misp_object in misp_objects:
self.misp_logger.info("MISP Object Result" + str(misp_object))
if 'ObjectReference' in misp_object: ## this doesnt seem to happen
# TODO - Fix this.
for reference in misp_object.ObjectReference:
# add the reference and get the result
result = misp.add_object_reference(reference)
misp_object_references.append(result)
return misp_objects, misp_object_references
def check_object_length(self, misp_objects: list):
""" check object has some attributes """
self.misp_logger.info("check_object_length called")
for misp_object in misp_objects:
self.misp_logger.info("got object: %s", misp_object.name)
if len(misp_object.attributes) == 0:
self.misp_logger.error('failed to put in correct tags')
return False
return True
def get_comm_and_tags(self, strInput: str):
""" pull comments and tags from input """
comment = None
str_comment = ""
tags = ["tlp:green"]
tag_type = None
for line in strInput.splitlines():
if "comment:" in line.lower():
vals = line.split(":", 1)
comment = vals[1:]
elif "tag:" in line.lower():
vals = line.split(":", 1)
value = vals[1].strip().lower()
if "tlp" in value:
tags.remove("tlp:green")
vals_str = "tlp:"
vals_split = vals[1].split(":")
vals_str += vals_split[1]
tags.append(vals_str)
elif "type:" in line.lower():
vals = line.split(":", 1)
value = vals[1].strip().lower()
if value in ('phish', 'malware', 'bec/spam', 'dump', 'apt', 'APT'):
tag_type = value.lower()
if tag_type:
self.misp_logger.info('Setting tag to ir8: %s', tag_type)
tag = "ir8:" + tag_type
tags.append(tag)
else:
tags = None
if comment != None:
for c in comment:
str_comment += c
else:
str_comment = comment
return str_comment, tags
####### SLACK ENTRY POINT! ######
def misp_send(self, strMISPEventID, strInput, strInfo, strUsername):
""" send an event to MISP """
try:
objects=[]
#get comments and tags from string input
str_comment, tags = self.get_comm_and_tags(strInput)
print(tags)
if tags is None:
self.misp_logger.info('Irate not in Tags: %s equals None', tags)
response = None
return response
#setup misp objects
mispobj_email = MISPObject(name="email")
mispobj_file = MISPObject(name="file")
mispobj_files = {}
mispobj_domainip = MISPObject(name="domain-ip")
url_no = 0
file_no = 0
mispobj_urls = {}
#process input
for line in strInput.splitlines():
if "domain:" in line.lower(): #Catch domain and add to domain/IP object
mispobj_domainip = MISPObject(name="domain-ip")
vals = line.split(":", 1)
mispobj_domainip.add_attribute("domain", value=vals[1].strip(), comment=str_comment)
objects.append(mispobj_domainip)
elif "ip:" in line.lower() or "ip-dst:" in line.lower() or "ip-src:" in line.lower(): #Catch IP and add to domain/IP object
if "domain:" in strInput.splitlines():
mispobj_domainip = MISPObject(name="domain-ip")
vals = line.split(":", 1)
mispobj_domainip.add_attribute("ip", value=vals[1].strip(), comment=str_comment)
objects.append(mispobj_domainip)
else:
mispobj_network_connection = MISPObject(name="network-connection")
vals = line.split(":", 1)
if ("ip:" in line.lower()) or ("ip-dst:" in line.lower()):
mispobj_network_connection.add_attribute("ip-dst", type="ip-dst", value=vals[1].strip(), comment=str_comment)
else:
mispobj_network_connection.add_attribute("ip-src", type="ip-src", value=vals[1].strip(), comment=str_comment)
objects.append(mispobj_network_connection)
elif "source-email:" in line.lower() or "email-source" in line.lower() or "from:" in line.lower(): #Catch email and add to email object
vals = line.split(":", 1)
mispobj_email.add_attribute("from", value = vals[1].strip(), comment=str_comment)
elif "url:" in line.lower() or (('kit:' in line.lower() or ('creds:' in line.lower())) and (('hxxp' in line.lower()) or ('http' in line.lower()))): #Catch URL and add to URL object
vals = line.split(":", 1)
url = vals[1].strip()
url = refang(url)
parsed = urlparse(url)
mispobj_url = MISPObject(name="url")
mispobj_url.add_attribute("url", value=parsed.geturl(), category="Payload delivery", comment=str_comment)
if parsed.hostname:
mispobj_url.add_attribute("host", value=parsed.hostname, comment=str_comment)
if parsed.scheme:
mispobj_url.add_attribute("scheme", value=parsed.scheme, comment=str_comment)
if parsed.port:
mispobj_url.add_attribute("port", value=parsed.port, comment=str_comment)
mispobj_urls[url_no] = mispobj_url
url_no += 1
#Catch different hashes and add to file object
elif "sha1:" in line.lower():
vals = line.split(":", 1)
mispobj_file.add_attribute("sha1", value=vals[1].strip(),comment=str_comment)
elif "sha256:" in line.lower():
vals = line.split(":", 1)
mispobj_file.add_attribute("sha256", value=vals[1].strip(), comment=str_comment)
elif "md5:" in line.lower():
vals = line.split(":", 1)
mispobj_file.add_attribute("md5", value=vals[1].strip(), comment=str_comment)
elif "subject:" in line.lower(): #or ("subject:" in line): #Catch subject and add to email object
vals = line.split(":", 1)
self.misp_logger.info(f"adding subject: {vals[1].strip()}")
mispobj_email.add_attribute("subject", value = vals[1].strip(), comment=str_comment)
elif "hash|filename:" in line.lower(): #catch hash|filename pair and add to file object
vals = line.split(":", 1)
val = vals[1].split("|")
l_hash = val[0]
l_filename = val[1]
l_mispobj_file = MISPObject(name="file")
if len(re.findall(r"\b[a-fA-F\d]{32}\b", l_hash)) > 0:
l_mispobj_file.add_attribute("md5", value=l_hash.strip(), comment=str_comment)
l_mispobj_file.add_attribute("filename", value=l_filename.strip(), comment=str_comment)
mispobj_files[file_no] = l_mispobj_file
elif len(re.findall(r'\b[0-9a-f]{40}\b', l_hash)) > 0:
l_mispobj_file.add_attribute("sha1", value=l_hash.strip(), comment=str_comment)
l_mispobj_file.add_attribute("filename", value=l_filename.strip(), comment=str_comment)
mispobj_files[file_no] = l_mispobj_file
elif len(re.findall(r'\b[A-Fa-f0-9]{64}\b', l_hash)) > 0:
l_mispobj_file.add_attribute("sha256", value=l_hash.strip(), comment=str_comment)
l_mispobj_file.add_attribute("filename", value=l_filename.strip(), comment=str_comment)
mispobj_files[file_no] = l_mispobj_file
file_no +=1
#add all misp objects to List to be processed and submitted to MISP server as one.
if len(mispobj_file.attributes) > 0:
objects.append(mispobj_file)
if len(mispobj_email.attributes) > 0:
objects.append(mispobj_email)
for u_key, u_value in mispobj_urls.items():
if len(u_value.attributes) > 0:
objects.append(u_value)
for f_key, f_value in mispobj_files.items():
if len(f_value.attributes) > 0:
objects.append(f_value)
# Update timestamp and event
except Exception as e:
error = traceback.format_exc()
response = f"Error occured when converting string to misp objects:\n{error}"
self.misp_logger.error(response)
return response
if not self.check_object_length(objects):
self.misp_logger.error('Input from %s did not contain accepted tags.\n Input: \n%s', (strUsername, strInput))
return "Error in the tags you entered. Please see the guide for accepted tags: (https://github.com/IRATEAU/sam-bot/blob/master/README.md)"
try:
misp_event = MISPEvent()
misp_event.info = strInfo
misp_event.distribution = 0
misp_event.analysis = 2
misp_event.threat_level_id = 3
add = self.misp.add_event(misp_event)
self.misp_logger.info("Added event %s", add)
if objects:
self.misp_logger.info("Adding objects to event...")
objects, references = self.submit_to_misp(self.misp, misp_event, objects)
self.misp_logger.info("References: %s", references)
for tag in tags:
self.misp_logger.info("Adding tag %s", tag)
self.misp.tag(misp_event.uuid, tag)
#self.misp.add_internal_comment(misp_event.id, reference="Author: " + strUsername, comment=str_comment)
self.misp_logger.info("Publishing event...")
publish_result = self.misp.publish(misp_event, alert=False)
self.misp_logger.info("Publish result: %s", publish_result)
if 'errors' in publish_result and publish_result.get('errors'):
return_value = ("Submission error: "+repr(publish_result.get('errors')))
else:
if misp_event.get('Event',{}).get('RelatedEvent'):
e_related = ""
for each in misp_event['Event']['RelatedEvent']:
e_related = e_related + each['Event']['id'] + ", "
return_value = "Created ID: " + publish_result.get('id') + "\nRelated Events: " + ''.join(e_related)
else:
return_value = "Created ID: " + publish_result.get('id')
return return_value
except Exception as e:
error = traceback.format_exc()
response = "Error occured when submitting to MISP:\n %s" %error
self.misp_logger.error(response)
return response