Untitled
unknown
zeek
2 years ago
2.5 kB
9
Indexable
@load base/frameworks/files @load base/frameworks/notice @load frameworks/files/hash-all-files module VirusDetect; export { redef enum Notice::Type += { Match }; option match_file_types = /application\/x-dosexec/ | /application\/vnd\.ms-cab-compressed/ | /application\/pdf/ | /application\/x-shockwave-flash/ | /application\/x-java-applet/ | /application\/jar/ |/application\/raj/| /application\/zip/ |/application\/rar/ | /video\/mp4/ | /application\/com/; option match_sub_url = "https://www.virustotal.com/gui/search/%s"; option notice_threshold = 10; } type Idx: record { hash: string; }; type Val: record { typehash: string; }; global malist: table[string] of Val = table(); event zeek_init() { Input::add_table([$source="malist.file", $name="malist",$idx=Idx,$val=Val,$destination=malist]); Input::remove("malist"); } event Input::end_of_data(name: string, source: string) { print malist; } function do_mhr_lookup(hash: string, fi: Notice::FileInfo) { local hash_domain = fmt("%s.malware.hash.cymru.com", hash); when [hash, fi, hash_domain] ( local MHR_result = lookup_hostname_txt(hash_domain) ) { # Data is returned as "<dateFirstDetected> <detectionRate>" local MHR_answer = split_string1(MHR_result, / /); if ( |MHR_answer| == 2 ) { local mhr_detect_rate = to_count(MHR_answer[1]); if ( mhr_detect_rate >= notice_threshold ) { local mhr_first_detected = double_to_time(to_double(MHR_answer[0])); local readable_first_detected = strftime("%Y-%m-%d %H:%M:%S", mhr_first_detected); local message = fmt("Malware Hash Registry Detection rate: %d%% Last seen: %s", mhr_detect_rate, readable_first_detected); local virustotal_url = fmt(match_sub_url, hash); # We don't have the full fa_file record here in order to # avoid the "when" statement cloning it (expensive!). local n: Notice::Info = Notice::Info($note=Match, $msg=message, $sub=virustotal_url); Notice::populate_file_info2(fi, n); NOTICE(n); } } } } event file_hash(f: fa_file, kind: string, hash: string) { if ( kind == "sha1" && f?$info && f$info?$mime_type && match_file_types in f$info$mime_type && hash in malist) print fmt("Malware detection with the hash: %s type: Malware \n More information: %s",hash,match_sub_url); do_mhr_lookup(hash, Notice::create_file_info(f)); }
Editor is loading...