Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 13:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Intel: CERT_HASH indicator type was never checked

Browse source 
Hence, when people specify data of type CERT_HASH in their intel source
files, it will never trigger an alert.
This commit is contained in:
Johanna Amann 2016-04-11 15:50:02 +02:00
parent b5f1fb33fa
commit 00e759b44c
3 changed files with 19 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

11
scripts/policy/frameworks/intel/seen/x509.bro
View file

@ -26,3 +26,14 @@ event x509_certificate(f: fa_file, cert_ref: opaque of x509, cert: X509::Certifi
$where=X509::IN_CERT]);
}
}
event file_hash(f: fa_file, kind: string, hash: string)
{
if ( ! f?$info || ! f$info?$x509 || kind != "sha1" )
return;
Intel::seen([$indicator=hash,
$indicator_type=Intel::CERT_HASH,
$f=f,
$where=X509::IN_CERT]);
}