f3nris
d2742ec6fb
Three keyless sources for the questions an analyst asks first: - circl-hashlookup 1.0.0: is this hash known software (NSRL, distro packages, Windows updates)? `score` 0 for a known file, 100 when CIRCL flags it KnownMalicious, so an enrichment rule with benign 0 marks it benign; an unknown hash is an HTTP 404, read as "no record". Single and bulk lookups; base_url for a self-hosted instance. - rdap 1.0.0: who registered a domain, IP block or AS, and when — with age_days for the phishing question. Authoritative server from the IANA bootstrap, rdap.org as fallback; a host name walks up to its registered domain; GDPR placeholders are not reported as registrants; a TLD with no RDAP (.ch) is an error, not a fake "unregistered". - crtsh 1.0.0: Certificate Transparency — sub-domains with first/last seen, issuers, recent certificates, and a starts_with mode for look-alikes of a brand (crt.sh no longer searches with a leading wildcard). Retries the 502/503/504 its shared front throws under load. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmWT9wtWHGtZpMS64Hp4q5
107 lines
3.3 KiB
Python
107 lines
3.3 KiB
Python
import json, os, re, ssl, sys, urllib.error, urllib.request
|
|
|
|
DEFAULT_BASE = "https://hashlookup.circl.lu"
|
|
|
|
|
|
def _cfg():
|
|
return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
|
|
|
|
|
def _inputs():
|
|
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
|
|
|
|
|
def _base(cfg):
|
|
return (str(cfg.get("base_url") or "").strip() or DEFAULT_BASE).rstrip("/")
|
|
|
|
|
|
def _ctx(cfg):
|
|
if cfg.get("insecure") in (True, "true", "True", 1, "1"):
|
|
c = ssl.create_default_context()
|
|
c.check_hostname = False
|
|
c.verify_mode = ssl.CERT_NONE
|
|
return c
|
|
return None
|
|
|
|
|
|
def call(cfg, path, body=None):
|
|
data = json.dumps(body).encode("utf-8") if body is not None else None
|
|
headers = {"Accept": "application/json", "User-Agent": "riposte-soar"}
|
|
if data is not None:
|
|
headers["Content-Type"] = "application/json"
|
|
req = urllib.request.Request(_base(cfg) + path, data=data, headers=headers, method="POST" if data is not None else "GET")
|
|
with urllib.request.urlopen(req, timeout=60, context=_ctx(cfg)) as r:
|
|
raw = r.read()
|
|
return json.loads(raw) if raw else {}
|
|
|
|
|
|
def _run(fn):
|
|
try:
|
|
print(json.dumps(fn(_cfg(), _inputs())))
|
|
except urllib.error.HTTPError as e:
|
|
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
|
|
sys.exit(1)
|
|
except Exception as e:
|
|
print(json.dumps({"error": str(e)}))
|
|
sys.exit(1)
|
|
|
|
|
|
KINDS = {32: "md5", 40: "sha1", 64: "sha256"}
|
|
|
|
|
|
def kind_of(h):
|
|
h = h.strip().lower()
|
|
if not re.fullmatch(r"[0-9a-f]+", h) or len(h) not in KINDS:
|
|
raise Exception("not an MD5, SHA-1 or SHA-256 hash: " + h)
|
|
return KINDS[len(h)], h
|
|
|
|
|
|
def annotate(rec):
|
|
# score: 0 for a known file, 100 when CIRCL itself flags the record as
|
|
# malicious — what an enrichment rule maps with benign 0 / malicious 100.
|
|
rec = dict(rec)
|
|
rec["known"] = True
|
|
rec["score"] = 100 if rec.get("KnownMalicious") else 0
|
|
return rec
|
|
|
|
|
|
def parse_list(v):
|
|
if isinstance(v, list):
|
|
return [str(x) for x in v]
|
|
s = str(v or "").strip()
|
|
if s.startswith("["):
|
|
return [str(x) for x in json.loads(s)]
|
|
return [x for x in re.split(r"[\s,;]+", s) if x]
|
|
|
|
|
|
def main(cfg, inputs):
|
|
groups = {"md5": [], "sha1": [], "sha256": []}
|
|
for raw in parse_list(inputs.get("hashes")):
|
|
kind, h = kind_of(raw)
|
|
if h not in groups[kind]:
|
|
groups[kind].append(h)
|
|
known, unknown = [], []
|
|
for kind in ("md5", "sha1"):
|
|
hs = groups[kind]
|
|
for i in range(0, len(hs), 500):
|
|
chunk = hs[i:i + 500]
|
|
res = call(cfg, "/bulk/" + kind, {"hashes": chunk})
|
|
found = set()
|
|
for rec in res if isinstance(res, list) else []:
|
|
key = str(rec.get("MD5" if kind == "md5" else "SHA-1", "")).lower()
|
|
if key and "message" not in rec:
|
|
found.add(key)
|
|
known.append(annotate(rec))
|
|
unknown.extend(h for h in chunk if h not in found)
|
|
for h in groups["sha256"]:
|
|
try:
|
|
known.append(annotate(call(cfg, "/lookup/sha256/" + h)))
|
|
except urllib.error.HTTPError as e:
|
|
if e.code != 404:
|
|
raise
|
|
unknown.append(h)
|
|
return {"known": known, "unknown": unknown, "known_count": len(known), "unknown_count": len(unknown)}
|
|
|
|
|
|
_run(main)
|