cuckoosandbox/cuckoo
1
0
Fork 0
mirror of https://github.com/cuckoosandbox/cuckoo.git synced 2026-10-11 21:59:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

Using safelist/blocklist

Browse Source
This commit is contained in:
Nex
2020-06-02 09:30:18 +02:00
parent 6d7df64bc8
commit 1962aa3fa8
32 changed files with 166 additions and 166 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cuckoo/apps/apps.py
+5 -5
View File
@@ -504,15 +504,15 @@ def migrate_cwd():
mkdir(cwd("stuff"))
mkdir(cwd("yara", "office"))
# Create the new $CWD/whitelist/ directory.
if not os.path.exists(cwd("whitelist")):
# Create the new $CWD/safelist/ directory.
if not os.path.exists(cwd("safelist")):
shutil.copytree(
cwd("..", "data", "whitelist", private=True), cwd("whitelist")
cwd("..", "data", "safelist", private=True), cwd("safelist")
)
else:
data_wl = cwd("..", "data", "whitelist", private=True)
data_wl = cwd("..", "data", "safelist", private=True)
for wl_file in os.listdir(data_wl):
cwd_wl = cwd("whitelist", wl_file)
cwd_wl = cwd("safelist", wl_file)
if not os.path.isfile(cwd_wl):
shutil.copy(os.path.join(data_wl, wl_file), cwd_wl)
cuckoo/auxiliary/sniffer.py
+4 -4
View File
@@ -107,11 +107,11 @@ class Sniffer(Auxiliary):
"standard output, got: %r." % out
)
err_whitelist_start = (
err_safelist_start = (
"tcpdump: listening on ",
)
err_whitelist_ends = (
err_safelist_ends = (
"packet captured",
"packets captured",
"packet received by filter",
@@ -124,10 +124,10 @@ class Sniffer(Auxiliary):
)
for line in err.split("\n"):
if not line or line.startswith(err_whitelist_start):
if not line or line.startswith(err_safelist_start):
continue
if line.endswith(err_whitelist_ends):
if line.endswith(err_safelist_ends):
continue
raise CuckooOperationalError(
cuckoo/common/config.py
+1 -1
View File
@@ -579,7 +579,7 @@ class Config(object):
},
"network": {
"enabled": Boolean(True),
"whitelist_dns": Boolean(False),
"safelist_dns": Boolean(False),
"allowed_dns": String(),
},
"procmemory": {
cuckoo/common/objects.py
+2 -2
View File
@@ -16,7 +16,7 @@ import shutil
import tempfile
import zipfile
from cuckoo.common.whitelist import is_whitelisted_domain
from cuckoo.common.safelist import is_safelisted_domain
try:
import pydeep
@@ -383,7 +383,7 @@ class File(object):
# http://stackoverflow.com/a/454589
urls, f = set(), open(self.file_path, "rb")
for url in re.findall(URL_REGEX, self.mmap(f.fileno())):
if not is_whitelisted_domain(url[1]):
if not is_safelisted_domain(url[1]):
urls.add("".join(url))
return list(urls)
cuckoo/common/safelist.py
+70
View File
@@ -0,0 +1,70 @@
# Copyright (C) 2015-2019 Cuckoo Foundation.
# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
# See the file 'docs/LICENSE' for copying permission.
import os.path
from cuckoo.misc import cwd
domains = set()
ips = set()
mispdomains = set()
mispips = set()
mispurls = set()
misphashes = set()
def _load_safelist(wlset, wl_file):
wl_path = cwd("safelist", wl_file)
if not os.path.isfile(wl_path):
wl_path = cwd("..", "data", "safelist", wl_file, private=True)
with open(wl_path, "rb") as fp:
safelist = fp.read()
for entry in safelist.split("\n"):
entry = entry.strip()
if entry and not entry.startswith("#"):
wlset.add(entry)
def is_safelisted_domain(domain):
if not domains:
# Initialize the domain safelist.
_load_safelist(domains, "domain.txt")
return domain in domains
def is_safelisted_ip(ip):
if not ips:
# Initialize the ip safelist.
_load_safelist(ips, "ip.txt")
return ip in ips
def is_safelisted_mispdomain(domain):
if not mispdomains:
# Initialize the misp domain safelist.
_load_safelist(mispdomains, "mispdomain.txt")
return domain in mispdomains
def is_safelisted_mispip(ip):
if not mispips:
# Initialize the misp ip safelist.
_load_safelist(mispips, "mispip.txt")
return ip in mispips
def is_safelisted_mispurl(url):
if not mispurls:
# Initialize the misp url safelist.
_load_safelist(mispurls, "mispurl.txt")
return url in mispurls
def is_safelisted_misphash(hash):
if not misphashes:
# Initialize the misp hash safelist.
_load_safelist(misphashes, "misphash.txt")
return hash in misphashes
cuckoo/common/utils.py
+2 -2
View File
@@ -263,7 +263,7 @@ def exception_message():
))
return msg
_jsbeautify_blacklist = [
_jsbeautify_blocklist = [
"",
"error: Unknown p.a.c.k.e.r. encoding.\n",
]
@@ -280,7 +280,7 @@ def jsbeautify(javascript):
except Exception as e:
log.exception("Unable to beautify javascript: %s", e)
if sys.stdout.getvalue() not in _jsbeautify_blacklist:
if sys.stdout.getvalue() not in _jsbeautify_blocklist:
log.warning(
"jsbeautifier returned error: %s", sys.stdout.getvalue()
)
cuckoo/common/virustotal.py
+2 -2
View File
@@ -29,7 +29,7 @@ class VirusTotalAPI(object):
URL_SCAN = "https://www.virustotal.com/vtapi/v2/url/scan"
HASH_DOWNLOAD = "https://www.virustotal.com/vtapi/v2/file/download"
VARIANT_BLACKLIST = [
VARIANT_BLOCKLIST = [
"generic", "malware", "trojan", "agent", "win32", "multi", "w32",
"trojanclicker", "trojware", "win", "a variant of win32", "trj",
"susp", "dangerousobject", "backdoor", "clicker", "variant", "heur",
@@ -198,7 +198,7 @@ class VirusTotalAPI(object):
if len(word) < 4:
continue
if word.lower() in self.VARIANT_BLACKLIST:
if word.lower() in self.VARIANT_BLOCKLIST:
continue
# Random hashes that are specific to this file.
cuckoo/common/whitelist.py
-70
View File
@@ -1,70 +0,0 @@
# Copyright (C) 2015-2019 Cuckoo Foundation.
# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
# See the file 'docs/LICENSE' for copying permission.
import os.path
from cuckoo.misc import cwd
domains = set()
ips = set()
mispdomains = set()
mispips = set()
mispurls = set()
misphashes = set()
def _load_whitelist(wlset, wl_file):
wl_path = cwd("whitelist", wl_file)
if not os.path.isfile(wl_path):
wl_path = cwd("..", "data", "whitelist", wl_file, private=True)
with open(wl_path, "rb") as fp:
whitelist = fp.read()
for entry in whitelist.split("\n"):
entry = entry.strip()
if entry and not entry.startswith("#"):
wlset.add(entry)
def is_whitelisted_domain(domain):
if not domains:
# Initialize the domain whitelist.
_load_whitelist(domains, "domain.txt")
return domain in domains
def is_whitelisted_ip(ip):
if not ips:
# Initialize the ip whitelist.
_load_whitelist(ips, "ip.txt")
return ip in ips
def is_whitelisted_mispdomain(domain):
if not mispdomains:
# Initialize the misp domain whitelist.
_load_whitelist(mispdomains, "mispdomain.txt")
return domain in mispdomains
def is_whitelisted_mispip(ip):
if not mispips:
# Initialize the misp ip whitelist.
_load_whitelist(mispips, "mispip.txt")
return ip in mispips
def is_whitelisted_mispurl(url):
if not mispurls:
# Initialize the misp url whitelist.
_load_whitelist(mispurls, "mispurl.txt")
return url in mispurls
def is_whitelisted_misphash(hash):
if not misphashes:
# Initialize the misp hash whitelist.
_load_whitelist(misphashes, "misphash.txt")
return hash in misphashes
cuckoo/compat/config.py
+4 -4
View File
@@ -489,7 +489,7 @@ def _20c1_20c2(c):
"apikey": None,
"maxioc": 100,
}
c["processing"]["network"]["whitelist-dns"] = False
c["processing"]["network"]["safelist-dns"] = False
c["processing"]["network"]["allowed-dns"] = None
c["processing"]["procmemory"]["extract_img"] = True
c["processing"]["procmemory"]["dump_delete"] = False
@@ -554,9 +554,9 @@ def _20c2_200(c):
"company": None,
"email": None,
}
c["processing"]["network"]["whitelist_dns"] = cast(
"processing:network:whitelist_dns",
c["processing"]["network"].pop("whitelist-dns", None)
c["processing"]["network"]["safelist_dns"] = cast(
"processing:network:safelist_dns",
c["processing"]["network"].pop("safelist-dns", None)
)
c["processing"]["network"]["allowed_dns"] = cast(
"processing:network:allowed_dns",
cuckoo/core/feedback.py
+3 -3
View File
@@ -20,7 +20,7 @@ log = logging.getLogger(__name__)
class CuckooFeedback(object):
"""Contact Cuckoo HQ with feedback & optional analysis dump."""
endpoint = "https://feedback.cuckoosandbox.org/api/submit/"
exc_whitelist = (
exc_safelist = (
CuckooFeedbackError,
)
@@ -41,8 +41,8 @@ class CuckooFeedback(object):
automated=True, message="Exception encountered: %s" % exception
)
if isinstance(exception, self.exc_whitelist):
log.debug("A whitelisted exception occurred: %s", exception)
if isinstance(exception, self.exc_safelist):
log.debug("A safelisted exception occurred: %s", exception)
return
# Ignore 404 exceptions regarding ".map" development files.
cuckoo/core/resultserver.py
+1 -1
View File
@@ -33,7 +33,7 @@ MAX_NETLOG_LINE = 4 * 1024
BUFSIZE = 16 * 1024
# Directories in which analysis-related files will be stored; also acts as
# whitelist
# safelist
RESULT_UPLOADABLE = ("files", "shots", "buffer", "extracted", "memory")
RESULT_DIRECTORIES = RESULT_UPLOADABLE + ("reports", "logs")
cuckoo/data/whitelist/domain.txt → cuckoo/data/safelist/domain.txt
+1 -1
View File
@@ -1,4 +1,4 @@
# You can add whitelisted domains here.
# You can add safelisted domains here.
java.com
www.msn.com
www.bing.com
cuckoo/data/safelist/ip.txt
+1
View File
@@ -0,0 +1 @@
# You can add safelisted IPs here.
cuckoo/data/whitelist/mispdomain.txt → cuckoo/data/safelist/mispdomain.txt
View File
cuckoo/data/whitelist/misphash.txt → cuckoo/data/safelist/misphash.txt
View File
cuckoo/data/whitelist/mispip.txt → cuckoo/data/safelist/mispip.txt
View File
cuckoo/data/whitelist/mispurl.txt → cuckoo/data/safelist/mispurl.txt
View File
cuckoo/data/stuff/ttp_descriptions.json
+7 -7
View File
@@ -32,7 +32,7 @@
"short": "Fallback Channels"
},
"T1009": {
"long": "Some security tools inspect files with static signatures to determine if they are known malicious. Adversaries may add data to files to increase the size beyond what security tools are capable of handling or to change the file hash to avoid hash-based blacklists.",
"long": "Some security tools inspect files with static signatures to determine if they are known malicious. Adversaries may add data to files to increase the size beyond what security tools are capable of handling or to change the file hash to avoid hash-based blocklists.",
"short": "Binary Padding"
},
"T1010": {
@@ -336,7 +336,7 @@
"short": "Windows Management Instrumentation Event Subscription"
},
"T1085": {
"long": "The rundll32.exe program can be called to execute an arbitrary binary. Adversaries may take advantage of this functionality to proxy execution of code to avoid triggering security tools that may not monitor execution of the rundll32.exe process because of whitelists or false positives from Windows using rundll32.exe for normal operations.",
"long": "The rundll32.exe program can be called to execute an arbitrary binary. Adversaries may take advantage of this functionality to proxy execution of code to avoid triggering security tools that may not monitor execution of the rundll32.exe process because of safelists or false positives from Windows using rundll32.exe for normal operations.",
"short": "Rundll32"
},
"T1086": {
@@ -504,7 +504,7 @@
"short": "Network Share Connection Removal"
},
"T1127": {
"long": "There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering. These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application whitelisting defensive solutions.",
"long": "There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering. These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application safelisting defensive solutions.",
"short": "Trusted Developer Utilities"
},
"T1128": {
@@ -592,7 +592,7 @@
"short": "HISTCONTROL"
},
"T1149": {
"long": "As of OS X 10.8, mach-O binaries introduced a new header called LC_MAIN that points to the binary\u2019s entry point for execution. Previously, there were two headers to achieve this same effect: LC_THREAD and LC_UNIXTHREAD . The entry point for a binary can be hijacked so that initial execution flows to a malicious addition (either another section or a code cave) and then goes back to the initial entry point so that the victim doesn\u2019t know anything was different . By modifying a binary in this way, application whitelisting can be bypassed because the file name or application path is still the same.",
"long": "As of OS X 10.8, mach-O binaries introduced a new header called LC_MAIN that points to the binary\u2019s entry point for execution. Previously, there were two headers to achieve this same effect: LC_THREAD and LC_UNIXTHREAD . The entry point for a binary can be hijacked so that initial execution flows to a malicious addition (either another section or a code cave) and then goes back to the initial entry point so that the victim doesn\u2019t know anything was different . By modifying a binary in this way, application safelisting can be bypassed because the file name or application path is still the same.",
"short": "LC_MAIN Hijacking"
},
"T1150": {
@@ -860,7 +860,7 @@
"short": "Kernel Modules and Extensions"
},
"T1216": {
"long": "Scripts signed with trusted certificates can be used to proxy execution of malicious files. This behavior may bypass signature validation restrictions and application whitelisting solutions that do not account for use of these scripts.",
"long": "Scripts signed with trusted certificates can be used to proxy execution of malicious files. This behavior may bypass signature validation restrictions and application safelisting solutions that do not account for use of these scripts.",
"short": "Signed Script Proxy Execution"
},
"T1217": {
@@ -868,11 +868,11 @@
"short": "Browser Bookmark Discovery"
},
"T1218": {
"long": "Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files. This behavior may be abused by adversaries to execute malicious files that could bypass application whitelisting and signature validation on systems. This technique accounts for proxy execution methods that are not already accounted for within the existing techniques.",
"long": "Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files. This behavior may be abused by adversaries to execute malicious files that could bypass application safelisting and signature validation on systems. This technique accounts for proxy execution methods that are not already accounted for within the existing techniques.",
"short": "Signed Binary Proxy Execution"
},
"T1219": {
"long": "An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be whitelisted within a target environment. Remote access tools like VNC, Ammy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.",
"long": "An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be safelisted within a target environment. Remote access tools like VNC, Ammy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.",
"short": "Remote Access Tools"
},
"T1220": {
cuckoo/data/whitelist/ip.txt
-1
View File
@@ -1 +0,0 @@
# You can add whitelisted IPs here.
cuckoo/private/cwd/conf/processing.conf
+3 -3
View File
@@ -61,10 +61,10 @@ maxioc = {{ processing.misp.maxioc }}
[network]
enabled = {{ processing.network.enabled }}
# Allow domain whitelisting
whitelist_dns = {{ processing.network.whitelist_dns }}
# Allow domain safelisting
safelist_dns = {{ processing.network.safelist_dns }}
# Allow DNS responses from your configured DNS server for whitelisting to
# Allow DNS responses from your configured DNS server for safelisting to
# deactivate when responses come from some other DNS
# Can be also multiple like : 8.8.8.8,8.8.4.4
allowed_dns = {{ processing.network.allowed_dns }}
cuckoo/private/cwd/hashes.txt
+5 -5
View File
@@ -324,8 +324,8 @@ b0ceb903d39fe7778e0ad173ef0e02ad0bc7440b monitor/2deb9ccd75d5a7a3fe05b2625b03a86
c278d582c26003467794ee4d0ab7ae337034c2ea monitor/latest
4575c7d09b316cad3a71059a27b78cbcb9c1f6b4 stuff/ttp_descriptions.json
9870109fa8a09c2f1b871ea178bdd3d40390baab web/local_settings.py
f81e71f788149039f31c9b0b5e2891733e51b5d7 whitelist/ip.txt
cc78a9c7ecdd5a3862b39ad7e6676723e72eb2ba whitelist/mispdomain.txt
8f6442b91064e46ab3454d6bc15a4cf1f3949a0f whitelist/misphash.txt
1f0ec663731206a9bf9363293421c68855aed772 whitelist/mispip.txt
e57ba6930af466d1a56aa22f791048020fadef88 whitelist/mispurl.txt
f81e71f788149039f31c9b0b5e2891733e51b5d7 safelist/ip.txt
cc78a9c7ecdd5a3862b39ad7e6676723e72eb2ba safelist/mispdomain.txt
8f6442b91064e46ab3454d6bc15a4cf1f3949a0f safelist/misphash.txt
1f0ec663731206a9bf9363293421c68855aed772 safelist/mispip.txt
e57ba6930af466d1a56aa22f791048020fadef88 safelist/mispurl.txt
cuckoo/processing/memory.py
+1 -1
View File
@@ -619,7 +619,7 @@ class VolatilityAPI(object):
command = self.plugins["apihooks"](self.config)
for process, module, hook in command.calculate():
proc_name = str(process.ImageFileName) if process else ''
if command.whitelist(hook.hook_mode | hook.hook_type,
if command.safelist(hook.hook_mode | hook.hook_type,
proc_name, hook.VictimModule,
hook.HookModule, hook.Function):
continue
cuckoo/processing/network.py
+17 -17
View File
@@ -26,7 +26,7 @@ from cuckoo.common.exceptions import CuckooProcessingError
from cuckoo.common.irc import ircMessage
from cuckoo.common.objects import File
from cuckoo.common.utils import convert_to_printable
from cuckoo.common.whitelist import is_whitelisted_domain, is_whitelisted_ip
from cuckoo.common.safelist import is_safelisted_domain, is_safelisted_ip
from cuckoo.misc import mkdir
# Be less verbose about httpreplay logging messages.
@@ -83,19 +83,19 @@ class Pcap(object):
self.irc_requests = []
# Dictionary containing all the results of this processing.
self.results = {}
# List for holding whitelisted IP-s according to DNS responses
self.whitelist_ips = []
# state of whitelisting
self.whitelist_enabled = self.options.get("whitelist_dns")
# List for holding safelisted IP-s according to DNS responses
self.safelist_ips = []
# state of safelisting
self.safelist_enabled = self.options.get("safelist_dns")
# List of known good DNS servers
self.known_dns = self._build_known_dns()
# List of all used DNS servers
self.dns_servers = []
def _is_whitelisted(self, conn, hostname):
"""Check if whitelisting conditions are met"""
# Is whitelistng enabled?
if not self.whitelist_enabled:
def _is_safelisted(self, conn, hostname):
"""Check if safelisting conditions are met"""
# Is safelistng enabled?
if not self.safelist_enabled:
return False
# Is DNS recording coming from allowed NS server.
@@ -107,8 +107,8 @@ class Pcap(object):
else:
return False
# Is hostname whitelisted.
if not is_whitelisted_domain(hostname):
# Is hostname safelisted.
if not is_safelisted_domain(hostname):
return False
return True
@@ -211,7 +211,7 @@ class Pcap(object):
# We add external IPs to the list, only the first time
# we see them and if they're the destination of the
# first packet they appear in.
if not self._is_private_ip(ip) and ip not in self.whitelist_ips:
if not self._is_private_ip(ip) and ip not in self.safelist_ips:
self.unique_hosts.append(ip)
except:
pass
@@ -397,9 +397,9 @@ class Pcap(object):
# TODO: add srv handling
query["answers"].append(ans)
if self._is_whitelisted(conn, q_name):
log.debug("DNS target {0} whitelisted. Skipping ...".format(q_name))
self.whitelist_ips = self.whitelist_ips + _ip
if self._is_safelisted(conn, q_name):
log.debug("DNS target {0} safelisted. Skipping ...".format(q_name))
self.safelist_ips = self.safelist_ips + _ip
return True
self._add_domain(query["request"])
@@ -635,7 +635,7 @@ class Pcap(object):
offset = file.tell()
continue
if is_whitelisted_ip(connection["dst"]):
if is_safelisted_ip(connection["dst"]):
continue
self._add_hosts(connection)
@@ -768,7 +768,7 @@ class Pcap2(object):
for s, ts, protocol, sent, recv in l:
srcip, srcport, dstip, dstport = s
if is_whitelisted_ip(dstip):
if is_safelisted_ip(dstip):
continue
if protocol == "smtp":
cuckoo/processing/suricata.py
+2 -2
View File
@@ -25,7 +25,7 @@ class Suricata(Processing):
"""Suricata processing module."""
# List of Suricata Signatures IDs that should be ignored.
sid_blacklist = [
sid_blocklist = [
# SURICATA FRAG IPv6 Fragmentation overlap
2200074,
@@ -127,7 +127,7 @@ class Suricata(Processing):
if event["event_type"] == "alert":
alert = event["alert"]
if alert["signature_id"] in self.sid_blacklist:
if alert["signature_id"] in self.sid_blocklist:
log.debug(
"Ignoring alert with sid=%d, signature=%s",
alert["signature_id"], alert["signature"]
cuckoo/reporting/misp.py
+13 -13
View File
@@ -9,9 +9,9 @@ import warnings
from cuckoo.common.abstracts import Report
from cuckoo.common.exceptions import CuckooProcessingError
from cuckoo.common.whitelist import (
is_whitelisted_mispdomain, is_whitelisted_mispip, is_whitelisted_mispurl,
is_whitelisted_misphash
from cuckoo.common.safelist import (
is_safelisted_mispdomain, is_safelisted_mispip, is_safelisted_mispurl,
is_safelisted_misphash
)
log = logging.getLogger(__name__)
@@ -37,15 +37,15 @@ class MISP(Report):
urls = set()
for protocol in ("http_ex", "https_ex"):
for entry in results.get("network", {}).get(protocol, []):
if is_whitelisted_mispdomain(entry["host"]):
if is_safelisted_mispdomain(entry["host"]):
continue
if is_whitelisted_mispdomain(entry["host"]):
if is_safelisted_mispdomain(entry["host"]):
continue
url = "%s://%s%s" % (
entry["protocol"], entry["host"], entry["uri"])
if not is_whitelisted_mispurl(url):
if not is_safelisted_mispurl(url):
urls.add(url)
self.misp.add_url(event, sorted(list(urls)))
@@ -53,10 +53,10 @@ class MISP(Report):
def domain_ipaddr(self, results, event):
domains, ips = {}, set()
for domain in results.get("network", {}).get("domains", []):
if is_whitelisted_mispip(domain["ip"]):
if is_safelisted_mispip(domain["ip"]):
continue
if is_whitelisted_mispdomain(domain["domain"]):
if is_safelisted_mispdomain(domain["domain"]):
continue
domains[domain["domain"]] = domain["ip"]
@@ -64,7 +64,7 @@ class MISP(Report):
ipaddrs = set()
for ipaddr in results.get("network", {}).get("hosts", []):
if ipaddr not in ips and not is_whitelisted_mispip(ipaddr):
if ipaddr not in ips and not is_safelisted_mispip(ipaddr):
ipaddrs.add(ipaddr)
self.misp.add_domains_ips(event, domains)
@@ -145,11 +145,11 @@ class MISP(Report):
if results.get("target", {}).get("category") == "file":
f = results.get("target", {}).get("file", {})
hash_whitelisted = is_whitelisted_misphash(f["md5"]) or \
is_whitelisted_misphash(f["sha1"]) or \
is_whitelisted_misphash(f["sha256"])
hash_safelisted = is_safelisted_misphash(f["md5"]) or \
is_safelisted_misphash(f["sha1"]) or \
is_safelisted_misphash(f["sha256"])
if hash_whitelisted:
if hash_safelisted:
return
if score < self.options.get("min_malscore", 0):
docs/CHANGELOG
+1 -1
View File
@@ -78,7 +78,7 @@ Cuckoo Sandbox 2.0-rc1 (2016-01-21)
* Added option to skip calls from JSON report
* Added option to load the entire process memory dump into IDA Pro
* Added some process memory dump analysis improvements
* Added URLs parsing from memory dump and URLs whitelist
* Added URLs parsing from memory dump and URLs safelist
* Added tracking and reporting dead IP address/port combinations
* Added maliciousness scoring system
* Added option to web interface to submit dropped files for analysis
docs/book/_files/conf/processing.conf
+3 -3
View File
@@ -61,10 +61,10 @@ maxioc = 100
[network]
enabled = yes
# Allow domain whitelisting
whitelist_dns = no
# Allow domain safelisting
safelist_dns = no
# Allow DNS responses from your configured DNS server for whitelisting to
# Allow DNS responses from your configured DNS server for safelisting to
# deactivate when responses come from some other DNS
# Can be also multiple like : 8.8.8.8,8.8.4.4
allowed_dns =
setup.py
+1 -1
View File
@@ -65,7 +65,7 @@ cwd_public = os.path.join("cuckoo", "data")
cwd_private = os.path.join("cuckoo", "private")
hashes_ignore = (
"whitelist/domain.txt",
"safelist/domain.txt",
)
def update_hashes():
tests/files/conf/20c2_plain/processing.conf
+3 -3
View File
@@ -58,10 +58,10 @@ maxioc = 100
[network]
enabled = yes
# Allow domain whitelisting
whitelist-dns = no
# Allow domain safelisting
safelist-dns = no
# Allow DNS responses from your configured DNS server for whitelisting to
# Allow DNS responses from your configured DNS server for safelisting to
# deactivate when responses come from some other DNS
# Can be also multiple like : 8.8.8.8,8.8.4.4
allowed-dns =
tests/test_apps.py
+4 -4
View File
@@ -714,7 +714,7 @@ class TestMigrateCWD(object):
shutil.rmtree(cwd("yara", "scripts"))
shutil.rmtree(cwd("yara", "shellcode"))
shutil.rmtree(cwd("stuff"))
shutil.rmtree(cwd("whitelist"))
shutil.rmtree(cwd("safelist"))
open(cwd("yara", "index_binaries.yar"), "wb").write("hello")
migrate_cwd()
# TODO Move this to its own 2.0.2 -> 2.0.3 migration handler.
@@ -722,10 +722,10 @@ class TestMigrateCWD(object):
assert os.path.exists(cwd("yara", "shellcode", ".gitignore"))
# TODO Move this to its own 2.0.3 -> 2.0.4 migration handler.
assert os.path.exists(cwd("stuff"))
assert os.path.exists(cwd("whitelist"))
assert os.path.exists(cwd("safelist"))
wl = open(cwd("whitelist", "domain.txt"), "rb").read().split("\n")
assert wl[0] == "# You can add whitelisted domains here."
wl = open(cwd("safelist", "domain.txt"), "rb").read().split("\n")
assert wl[0] == "# You can add safelisted domains here."
assert os.path.exists(cwd("yara", "dumpmem"))
assert not os.path.exists(cwd("yara", "index_binaries.yar"))
tests/test_config.py
+5 -5
View File
@@ -882,7 +882,7 @@ interface = hehe
assert cfg["processing"]["misp"]["url"] is None
assert cfg["processing"]["misp"]["apikey"] is None
assert cfg["processing"]["misp"]["maxioc"] == 100
assert cfg["processing"]["network"]["whitelist-dns"] is False
assert cfg["processing"]["network"]["safelist-dns"] is False
assert cfg["processing"]["network"]["allowed-dns"] is None
assert cfg["processing"]["procmemory"]["extract_img"] is True
assert cfg["processing"]["procmemory"]["dump_delete"] is False
@@ -927,7 +927,7 @@ analysis_size_limit = 104857600
""")
Files.create(cwd("conf"), "processing.conf", """
[network]
whitelist-dns = yes
safelist-dns = yes
allowed-dns = 8.8.8.8
[procmemory]
enabled = yes
@@ -988,7 +988,7 @@ interface = eth0
""")
cfg = Config.from_confdir(cwd("conf"), loose=True)
assert "vpn" in cfg
assert "whitelist-dns" in cfg["processing"]["network"]
assert "safelist-dns" in cfg["processing"]["network"]
assert "allowed-dns" in cfg["processing"]["network"]
cfg = migrate(cfg, "2.0-rc2", "2.0.0")
assert cfg["auxiliary"]["mitm"]["script"] == "mitm.py"
@@ -1000,9 +1000,9 @@ interface = eth0
assert cfg["cuckoo"]["feedback"]["email"] is None
assert cfg["cuckoo"]["processing"]["analysis_size_limit"] == 128*1024*1024
assert cfg["cuckoo"]["resultserver"]["upload_max_size"] == 128*1024*1024
assert "whitelist-dns" not in cfg["processing"]["network"]
assert "safelist-dns" not in cfg["processing"]["network"]
assert "allowed-dns" not in cfg["processing"]["network"]
assert cfg["processing"]["network"]["whitelist_dns"] is True
assert cfg["processing"]["network"]["safelist_dns"] is True
assert cfg["processing"]["procmemory"]["extract_dll"] is False
assert cfg["processing"]["network"]["allowed_dns"] == "8.8.8.8"
assert cfg["processing"]["virustotal"]["enabled"] is False
tests/test_utils.py
+5 -5
View File
@@ -18,7 +18,7 @@ from cuckoo.common.exceptions import CuckooOperationalError
from cuckoo.common.files import (
Folders, Files, Storage, temppath, open_exclusive
)
from cuckoo.common.whitelist import is_whitelisted_domain
from cuckoo.common.safelist import is_safelisted_domain
from cuckoo.common import utils
from cuckoo.main import cuckoo_create
from cuckoo.misc import set_cwd, getuser
@@ -435,10 +435,10 @@ def test_list_of():
assert utils.list_of_ints([1, 2]) is True
assert utils.list_of_ints([lambda x: x]) is False
def test_is_whitelisted_domain():
assert is_whitelisted_domain("java.com") is True
assert is_whitelisted_domain("java2.com") is False
assert is_whitelisted_domain("crl.microsoft.com") is True
def test_is_safelisted_domain():
assert is_safelisted_domain("java.com") is True
assert is_safelisted_domain("java2.com") is False
assert is_safelisted_domain("crl.microsoft.com") is True
def test_open_exclusive():
fpath = os.path.join(tempfile.mkdtemp(), "yeet.exclusive")