f3nris
d2742ec6fb
Three keyless sources for the questions an analyst asks first: - circl-hashlookup 1.0.0: is this hash known software (NSRL, distro packages, Windows updates)? `score` 0 for a known file, 100 when CIRCL flags it KnownMalicious, so an enrichment rule with benign 0 marks it benign; an unknown hash is an HTTP 404, read as "no record". Single and bulk lookups; base_url for a self-hosted instance. - rdap 1.0.0: who registered a domain, IP block or AS, and when — with age_days for the phishing question. Authoritative server from the IANA bootstrap, rdap.org as fallback; a host name walks up to its registered domain; GDPR placeholders are not reported as registrants; a TLD with no RDAP (.ch) is an error, not a fake "unregistered". - crtsh 1.0.0: Certificate Transparency — sub-domains with first/last seen, issuers, recent certificates, and a starts_with mode for look-alikes of a brand (crt.sh no longer searches with a leading wildcard). Retries the 502/503/504 its shared front throws under load. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmWT9wtWHGtZpMS64Hp4q5
74 lines
2.1 KiB
Python
74 lines
2.1 KiB
Python
import json, os, re, ssl, sys, urllib.error, urllib.request
|
|
|
|
DEFAULT_BASE = "https://hashlookup.circl.lu"
|
|
|
|
|
|
def _cfg():
|
|
return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
|
|
|
|
|
def _inputs():
|
|
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
|
|
|
|
|
def _base(cfg):
|
|
return (str(cfg.get("base_url") or "").strip() or DEFAULT_BASE).rstrip("/")
|
|
|
|
|
|
def _ctx(cfg):
|
|
if cfg.get("insecure") in (True, "true", "True", 1, "1"):
|
|
c = ssl.create_default_context()
|
|
c.check_hostname = False
|
|
c.verify_mode = ssl.CERT_NONE
|
|
return c
|
|
return None
|
|
|
|
|
|
def call(cfg, path, body=None):
|
|
data = json.dumps(body).encode("utf-8") if body is not None else None
|
|
headers = {"Accept": "application/json", "User-Agent": "riposte-soar"}
|
|
if data is not None:
|
|
headers["Content-Type"] = "application/json"
|
|
req = urllib.request.Request(_base(cfg) + path, data=data, headers=headers, method="POST" if data is not None else "GET")
|
|
with urllib.request.urlopen(req, timeout=60, context=_ctx(cfg)) as r:
|
|
raw = r.read()
|
|
return json.loads(raw) if raw else {}
|
|
|
|
|
|
def _run(fn):
|
|
try:
|
|
print(json.dumps(fn(_cfg(), _inputs())))
|
|
except urllib.error.HTTPError as e:
|
|
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
|
|
sys.exit(1)
|
|
except Exception as e:
|
|
print(json.dumps({"error": str(e)}))
|
|
sys.exit(1)
|
|
|
|
|
|
KINDS = {32: "md5", 40: "sha1", 64: "sha256"}
|
|
|
|
|
|
def kind_of(h):
|
|
h = h.strip().lower()
|
|
if not re.fullmatch(r"[0-9a-f]+", h) or len(h) not in KINDS:
|
|
raise Exception("not an MD5, SHA-1 or SHA-256 hash: " + h)
|
|
return KINDS[len(h)], h
|
|
|
|
|
|
def annotate(rec):
|
|
# score: 0 for a known file, 100 when CIRCL itself flags the record as
|
|
# malicious — what an enrichment rule maps with benign 0 / malicious 100.
|
|
rec = dict(rec)
|
|
rec["known"] = True
|
|
rec["score"] = 100 if rec.get("KnownMalicious") else 0
|
|
return rec
|
|
|
|
|
|
def main(cfg, inputs):
|
|
kind, h = kind_of(str(inputs.get("hash", "")))
|
|
return annotate(call(cfg, "/lookup/%s/%s" % (kind, h)))
|
|
|
|
|
|
_run(main)
|