From eb6d6d75eac6fb6fbaf24c20351d8895200951ea Mon Sep 17 00:00:00 2001 From: Ants Madisson Date: Fri, 24 May 2019 12:47:53 +0300 Subject: [PATCH] signatures marks as misp comment --- cuckoo/reporting/misp.py | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/cuckoo/reporting/misp.py b/cuckoo/reporting/misp.py index a1cff8e85..5feccf991 100644 --- a/cuckoo/reporting/misp.py +++ b/cuckoo/reporting/misp.py @@ -73,8 +73,29 @@ class MISP(Report): self.misp.add_useragent(event, user_agent) def signature(self, results, event): - for sig in results["signatures"]: - data = "%s - (%s)" % (sig["description"], ",".join(sig["ttp"])) + for sig in results.get("signatures", []): + try: + temp = [] + for mark in sig.get("marks", []): + if mark["type"] == "generic": + temp.append("%s %s" % (mark.get("parent_process", ""), mark.get("martian_process", ""))) + temp.append("%s %s" % (mark.get("reg_key", ""), mark.get("reg_value", ""))) + temp.append("%s %s" % (mark.get("option", ""), mark.get("value", ""))) + temp.append("%s" % mark.get("domain", "")) + temp.append("%s" % mark.get("description", "")) + temp.append("%s" % mark.get("host", "")) + elif mark["type"] == "call": + if not mark["call"]["api"] in temp: + temp.append(mark["call"]["api"]) + elif mark["type"] == "config": + temp.append(mark["config"]["url"]) + else: + temp.append(mark[mark["type"]]) + datainfo = ",".join([x for x in temp if x not in ["", " "]]) + except: + datainfo = ",".join(sig["ttp"]) + pass + data = "%s - (%s)" % (sig["description"], datainfo) self.misp.add_internal_comment(event, data) for att, description in sig["ttp"].items(): if description is None: