Skip to content

Commit a547618

Browse files
0xThiebaut0xThiebaut
committed
Add support for MISP objects and split Sigma rules into single conditions
1 parent 8e0171c commit a547618

File tree

9 files changed

+827
-321
lines changed

9 files changed

+827
-321
lines changed

‎README.md

Lines changed: 137 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -84,67 +84,149 @@ As an example, this is how a generated multi-document Sigma rule would look like
8484

8585
```yaml
8686
action: global
87-
title: 'OSINT: Emissary Panda – A potential new malicious tool'
88-
id: 5b0562d3-8460-4482-93c4-05a3ac12042b
87+
title: 'Related IoCs to https://cert.gov.ua/article/39708 - Cyberattack on state organizations
88+
of Ukraine using the topic "Azovstal" and the malicious program Cobalt Strike Beacon
89+
(CERT-UA # 4490)'
90+
id: 1b2b6e15-3655-4648-afcb-c93214187736
8991
status: experimental
90-
description: See MISP event 60870
91-
author: dcso.de
92-
level: medium
92+
description: See MISP event 6803
93+
author: CIRCL
94+
level: high
9395
tags:
94-
- APT
95-
- tlp:white
96-
- iep:traffic-light-protocol="WHITE"
97-
- DCSO:tie="ALL"
98-
- DCSO:sharing="PUBLIC"
99-
- osint:source-type="blog-post"
96+
- type:OSINT
97+
- osint:lifetime="perpetual"
98+
- osint:certainty="50"
99+
- tlp:white
100+
- misp-galaxy:target-information="Ukraine"
101+
- misp-galaxy:tool="Cobalt Strike"
102+
- misp-galaxy:tool="Trick Bot"
100103
---
104+
action: global
101105
logsource:
102106
product: windows
107+
---
108+
detection:
109+
condition: all of event6803attr2265257mapping*
110+
event6803attr2265257mappingHostname:
111+
- - DestinationHostname: kitchenbath.mckillican.com
112+
- SourceHostname: kitchenbath.mckillican.com
113+
- Computer: kitchenbath.mckillican.com
114+
- ComputerName: kitchenbath.mckillican.com
115+
- Workstation: kitchenbath.mckillican.com
116+
- WorkstationName: kitchenbath.mckillican.com
117+
---
118+
detection:
119+
condition: all of event6803attr2265258mapping*
120+
event6803attr2265258mappingHostname:
121+
- - DestinationHostname: www.15ns84-fedex.us
122+
- SourceHostname: www.15ns84-fedex.us
123+
- Computer: www.15ns84-fedex.us
124+
- ComputerName: www.15ns84-fedex.us
125+
- Workstation: www.15ns84-fedex.us
126+
- WorkstationName: www.15ns84-fedex.us
127+
---
128+
// Some more domain-related detections
129+
---
130+
detection:
131+
condition: event6803object276948 and all of event6803object276948attr2265319mapping*
132+
event6803object276948:
133+
- Hashes|contains:
134+
- 877f834e8788d05b625ba639b9318512
135+
- 96bde83f4d3f29fb2801cd357c1abea827487e37
136+
- ea9dae45f81fe3527c62ad7b84b03d19629014b1a0e346b6aa933e52b0929d8a
137+
- cf72096dee679bce8cde6eacf922b5559dbac9b77367a7f2a3fba5022fd2b1303aa1c5805167c3cb8fb774e7390fab86eb3d16585fc72c31497a08bdf2b26518
138+
- 768:pdzHDjCxD6czZ8K1PjOoDl8SZbKsLRGKpb8rGYrMPelwhKmFV5xtezEs/48/dgAX:pVHDjCxD6czZ8K1PjOoDl8SZbKsLRGKM
139+
event6803object276948attr2265319mappingFilename:
140+
- - Image|endswith: ea9dae45f81fe3527c62ad7b84b03d19629014b1a0e346b6aa933e52b0929d8a
141+
- ProcessName|contains: ea9dae45f81fe3527c62ad7b84b03d19629014b1a0e346b6aa933e52b0929d8a
142+
---
143+
// Some more file-related detections
144+
---
145+
detection:
146+
condition: event6803
147+
event6803:
148+
- DestinationIp:
149+
- 84.32.188.29
150+
- 139.60.161.225
151+
- 139.60.161.74
152+
- 139.60.161.62
153+
- 139.60.161.99
154+
- 139.60.161.57
155+
- 139.60.161.75
156+
- 139.60.161.24
157+
- 139.60.161.89
158+
- 139.60.161.209
159+
- 139.60.161.85
160+
- 139.60.160.51
161+
- 139.60.161.226
162+
- 139.60.161.216
163+
- 139.60.161.163
164+
- 139.60.160.8
165+
- 139.60.161.32
166+
- 139.60.161.45
167+
- 139.60.161.60
168+
- 139.60.160.17
169+
- Hashes|contains:
170+
- 6f0ddfe6b68ea68b5e450e30b131137b6f01c60cc8383f3c48bea0c8acb6ef1c
171+
- 9990fe0d8aac0b4a6040d5979afd822c2212d9aec2b90e5d10c0b15dee8d61b1
172+
- df58100f881e2bfa694e00dd06bdb326b272a51ff9b75114819498a26bf6504c
173+
- ea9dae45f81fe3527c62ad7b84b03d19629014b1a0e346b6aa933e52b0929d8a
174+
---
175+
action: global
176+
logsource:
177+
category: proxy
178+
---
179+
detection:
180+
condition: all of event6803attr2265246mapping*
181+
event6803attr2265246mappingURI:
182+
- - c-uri: https://e5qo83-fedex.us/wzlco?VLakox?80934612
183+
- cs-referrer: https://e5qo83-fedex.us/wzlco?VLakox?80934612
184+
- r-dns: https://e5qo83-fedex.us/wzlco?VLakox?80934612
185+
---
186+
detection:
187+
condition: all of event6803attr2265247mapping*
188+
event6803attr2265247mappingURI:
189+
- - c-uri: http://138.68.229.0/pe.dll
190+
- cs-referrer: http://138.68.229.0/pe.dll
191+
- r-dns: http://138.68.229.0/pe.dll
192+
---
193+
// Some more proxy-related detections
194+
---
195+
detection:
196+
condition: event6803
197+
event6803:
198+
- dst_ip:
199+
- 84.32.188.29
200+
- 139.60.161.225
201+
- 139.60.161.74
202+
- 139.60.161.62
203+
- 139.60.161.99
204+
- 139.60.161.57
205+
- 139.60.161.75
206+
- 139.60.161.24
207+
- 139.60.161.89
208+
- 139.60.161.209
209+
- 139.60.161.85
210+
- 139.60.160.51
211+
- 139.60.161.226
212+
- 139.60.161.216
213+
- 139.60.161.163
214+
- 139.60.160.8
215+
- 139.60.161.32
216+
- 139.60.161.45
217+
- 139.60.161.60
218+
- 139.60.160.17
219+
---
220+
action: global
221+
logsource:
222+
category: webserver
223+
---
103224
detection:
104-
condition:
105-
- event60870
106-
- all of event60870attr2049468mapping*
107-
- event60870object33488
108-
- event60870object33489
109-
- event60870object33490 and all of event60870object33490attr2049523mapping*
110-
- event60870object33491 and all of event60870object33491attr2049526mapping*
111-
event60870:
112-
DestinationIp:
113-
- 159.65.80.157
114-
- 103.59.144.183
115-
event60870attr2049468mappingFilename:
116-
- Image|endswith: '%APPDATA%\systemconfig\sys.bin.url'
117-
- ParentImage|endswith: '%APPDATA%\systemconfig\sys.bin.url'
118-
- CommandLine|contains: '%APPDATA%\systemconfig\sys.bin.url'
119-
- ParentCommandLine|contains: '%APPDATA%\systemconfig\sys.bin.url'
120-
- ProcessName: '%APPDATA%\systemconfig\sys.bin.url'
121-
- ParentProcessName: '%APPDATA%\systemconfig\sys.bin.url'
122-
event60870object33488:
123-
Hashes|contains:
124-
- c69d60b82252b6e7eaaeb710d5e1ebe5
125-
- 4c0211c91b4b9f99e52f4d385e6e3960b321a3b0
126-
- 4d65d371a789aabe1beadcc10b38da1f998cd3ec87d4cc1cfbf0af014b783822
127-
- 768:NHO6X9W62QIPe1HhDIRmnTEDtcvyvfSl0zeM:NHOymWBDLYg0zB
128-
event60870object33489:
129-
Hashes|contains: 93b972951685b4ae284583dbc3959725
130-
event60870object33490:
131-
Hashes|contains: 2b2bb4c132d808572f180fe4db3a0a3143a37fdece667f8e78778ee1e9717606
132-
event60870object33490attr2049523mappingFilename:
133-
- Image|endswith: sys.bin.url
134-
- ParentImage|endswith: sys.bin.url
135-
- CommandLine|contains: sys.bin.url
136-
- ParentCommandLine|contains: sys.bin.url
137-
- ProcessName: sys.bin.url
138-
- ParentProcessName: sys.bin.url
139-
event60870object33491:
140-
Hashes|contains: 3e718f39dfb2f6b8fba366fefa8b7c127db1e6795f3caad2d4a9f3753eea0adc
141-
event60870object33491attr2049526mappingFilename:
142-
- Image|endswith: sys.bin.url
143-
- ParentImage|endswith: sys.bin.url
144-
- CommandLine|contains: sys.bin.url
145-
- ParentCommandLine|contains: sys.bin.url
146-
- ProcessName: sys.bin.url
147-
- ParentProcessName: sys.bin.url
225+
condition: all of event6803attr2265246mapping*
226+
event6803attr2265246mappingURI:
227+
- - c-uri: https://e5qo83-fedex.us/wzlco?VLakox?80934612
228+
- cs-referrer: https://e5qo83-fedex.us/wzlco?VLakox?80934612
229+
- r-dns: https://e5qo83-fedex.us/wzlco?VLakox?80934612
148230
---
149231
// Many more log-sources (firewall, proxy, webserver, ...) are trimmed for readability...
150232
```

‎lib/sigma/condition/and.go

Lines changed: 16 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -5,22 +5,17 @@ import (
55
)
66

77
func And(a Condition, b Condition) Condition {
8-
if ac, ok := a.(*andCondition); ok {
9-
return ac.And(b)
10-
} else if ac, ok = b.(*andCondition); ok {
11-
return ac.And(a)
12-
}
13-
return &andCondition{and: []Condition{a, b}}
8+
return (&andCondition{}).And(a).And(b)
149
}
1510

1611
type andCondition struct {
1712
and []Condition
1813
}
1914

2015
func (c *andCondition) And(cond Condition) Condition {
21-
if ac, ok := cond.(*andCondition); ok {
16+
if ac, ok := cond.(*andCondition); ok && ac != nil {
2217
c.and = append(c.and, ac.and...)
23-
} else {
18+
} else if cond != nil {
2419
c.and = append(c.and, cond)
2520
}
2621
return c
@@ -35,17 +30,20 @@ func (c *andCondition) MarshalYAML() (interface{}, error) {
3530
}
3631

3732
func (c *andCondition) String() string {
38-
x := len(c.and)
39-
if x == 1 {
33+
switch len(c.and) {
34+
case 0:
35+
return ""
36+
case 1:
4037
return c.and[0].String()
41-
}
42-
s := make([]string, len(c.and))
43-
for i, cond := range c.and {
44-
if sc, ok := cond.(singleCondition); ok {
45-
s[i] = sc.String()
46-
} else {
47-
s[i] = "(" + cond.String() + ")"
38+
default:
39+
s := make([]string, len(c.and))
40+
for i, cond := range c.and {
41+
if sc, ok := cond.(singleCondition); ok {
42+
s[i] = sc.String()
43+
} else {
44+
s[i] = "(" + cond.String() + ")"
45+
}
4846
}
47+
return strings.Join(s, " and ")
4948
}
50-
return strings.Join(s, " and ")
5149
}

‎lib/sigma/condition/or.go

Lines changed: 14 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,7 @@ package condition
33
import "strings"
44

55
func Or(a Condition, b Condition) Condition {
6-
if oc, ok := a.(*orCondition); ok {
7-
return oc.And(b)
8-
} else if oc, ok = b.(*orCondition); ok {
9-
return oc.And(a)
10-
}
11-
return &orCondition{or: []Condition{a, b}}
6+
return (&orCondition{}).Or(a).Or(b)
127
}
138

149
type orCondition struct {
@@ -33,17 +28,20 @@ func (c *orCondition) MarshalYAML() (interface{}, error) {
3328
}
3429

3530
func (c *orCondition) String() string {
36-
x := len(c.or)
37-
if x == 1 {
31+
switch len(c.or) {
32+
case 0:
33+
return ""
34+
case 1:
3835
return c.or[0].String()
39-
}
40-
s := make([]string, len(c.or))
41-
for i, cond := range c.or {
42-
if sc, ok := cond.(singleCondition); ok {
43-
s[i] = sc.String()
44-
} else {
45-
s[i] = "(" + cond.String() + ")"
36+
default:
37+
s := make([]string, len(c.or))
38+
for i, cond := range c.or {
39+
if sc, ok := cond.(singleCondition); ok {
40+
s[i] = sc.String()
41+
} else {
42+
s[i] = "(" + cond.String() + ")"
43+
}
4644
}
45+
return strings.Join(s, " or ")
4746
}
48-
return strings.Join(s, " or ")
4947
}

‎lib/sigma/detection.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ import (
66
)
77

88
type Detection struct {
9-
Searches map[string]search.Searches `yaml:",inline,omitempty"`
10-
TimeFrame string `yaml:",omitempty"`
11-
Condition condition.Condition `yaml:",omitempty"`
9+
Searches map[string][]search.Searches `yaml:",inline,omitempty"`
10+
TimeFrame string `yaml:",omitempty"`
11+
Condition condition.Condition `yaml:",omitempty"`
1212
}

‎lib/sigma/field/field.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ type Field string
55
const (
66
CommandLine Field = "CommandLine"
77
CSHost Field = "cs-host"
8+
CSMethod Field = "cs-method"
89
CSReferrer Field = "cs-referrer"
910
Computer Field = "Computer"
1011
ComputerName Field = "ComputerName"

‎lib/sources/misp/api/workers/worker.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import (
44
"bytes"
55
"crypto/tls"
66
"encoding/json"
7+
"errors"
78
"github.com/0xThiebaut/sigmai/lib/sources/misp/lib/attribute"
89
"github.com/0xThiebaut/sigmai/lib/sources/misp/lib/event"
910
"github.com/0xThiebaut/sigmai/lib/sources/misp/lib/object"
@@ -103,6 +104,9 @@ func (w *worker) Events() chan *event.Event {
103104
if err != nil {
104105
w.err = err
105106
return
107+
} else if resp.StatusCode != 200 {
108+
w.err = errors.New(resp.Status)
109+
return
106110
}
107111
// Create a new decoder
108112
dec := json.NewDecoder(resp.Body)
@@ -198,6 +202,8 @@ func (w *worker) enrichObjects(e *event.Event) error {
198202
resp, err := w.Client.Do(req)
199203
if err != nil {
200204
return err
205+
} else if resp.StatusCode != 200 {
206+
return errors.New(resp.Status)
201207
}
202208
// Create a new decoder
203209
dec := json.NewDecoder(resp.Body)
@@ -252,6 +258,8 @@ func (w *worker) enrichAttributes(e *event.Event) error {
252258
resp, err := w.Client.Do(req)
253259
if err != nil {
254260
return err
261+
} else if resp.StatusCode != 200 {
262+
return errors.New(resp.Status)
255263
}
256264
// Create a new decoder
257265
dec := json.NewDecoder(resp.Body)

0 commit comments

Comments
 (0)