f3nris
d2742ec6fb
Three keyless sources for the questions an analyst asks first: - circl-hashlookup 1.0.0: is this hash known software (NSRL, distro packages, Windows updates)? `score` 0 for a known file, 100 when CIRCL flags it KnownMalicious, so an enrichment rule with benign 0 marks it benign; an unknown hash is an HTTP 404, read as "no record". Single and bulk lookups; base_url for a self-hosted instance. - rdap 1.0.0: who registered a domain, IP block or AS, and when — with age_days for the phishing question. Authoritative server from the IANA bootstrap, rdap.org as fallback; a host name walks up to its registered domain; GDPR placeholders are not reported as registrants; a TLD with no RDAP (.ch) is an error, not a fake "unregistered". - crtsh 1.0.0: Certificate Transparency — sub-domains with first/last seen, issuers, recent certificates, and a starts_with mode for look-alikes of a brand (crt.sh no longer searches with a leading wildcard). Retries the 502/503/504 its shared front throws under load. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AmWT9wtWHGtZpMS64Hp4q5
49 lines
2.5 KiB
YAML
49 lines
2.5 KiB
YAML
id: circl_hashlookup
|
|
name: CIRCL hashlookup
|
|
version: 1.0.0
|
|
description: "CIRCL hashlookup — tells whether a file hash belongs to known software: NSRL, Linux distribution packages, Windows updates and other trusted sets (6.5 billion hashes). The fastest way to rule out a false positive on a file alert. Free public service, no API key; the server is open source and can be self-hosted (set base_url). Stdlib-only. As an enrichment rule: command lookup_hash, score field `score`, benign threshold 0 and malicious threshold 100 — a known file reads benign, a record CIRCL flags as KnownMalicious reads malicious, and an unknown hash is an answer (not found), never a failure."
|
|
changelog: "1.0.0 — Initial release: single lookup (MD5, SHA-1, SHA-256), bulk lookup (MD5, SHA-1), test connection."
|
|
category: enrichment
|
|
|
|
config_schema:
|
|
properties:
|
|
base_url:
|
|
type: string
|
|
description: "hashlookup server (default https://hashlookup.circl.lu — set it to a self-hosted instance to keep hashes in-house)"
|
|
default: https://hashlookup.circl.lu
|
|
insecure:
|
|
type: boolean
|
|
description: "Trust any TLS certificate (not secure — a self-hosted instance with a private CA only)"
|
|
default: false
|
|
required: []
|
|
|
|
commands:
|
|
- id: lookup_hash
|
|
name: hashlookup-lookup-hash
|
|
description: "Look up one MD5, SHA-1 or SHA-256 hash. Returns the CIRCL record (file name, product, source set, hashlookup:trust) plus `known: true` and `score` (0 = known file, 100 = flagged KnownMalicious). An unknown hash returns HTTP 404, which Riposte's enrichment reads as 'no record'."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
hash: { type: string, description: "MD5 (32 hex), SHA-1 (40 hex) or SHA-256 (64 hex)" }
|
|
required: [hash]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: bulk_lookup
|
|
name: hashlookup-bulk-lookup
|
|
description: "Look up many MD5 / SHA-1 hashes at once (the bulk API does not take SHA-256; those are looked up one by one). Returns `known` (records found) and `unknown` (hashes CIRCL has no record of)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
hashes: { type: string, description: "Hashes separated by commas, spaces or new lines (a JSON array also works)" }
|
|
required: [hashes]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: hashlookup-test-connection
|
|
description: "Reach the server's /info endpoint (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|