Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-10 18:48:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Add detection rate threshold for MHR.

Browse source
This commit is contained in:
Vlad Grigorescu 2012-11-03 12:09:11 -04:00
parent a1c0b853fe
commit 1aeb52ae46
1 changed files with 10 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

13
scripts/policy/protocols/http/detect-MHR.bro
View file

@ -15,6 +15,12 @@ export {
## malware hash registry. ## malware hash registry.
Malware_Hash_Registry_Match Malware_Hash_Registry_Match
}; };
## The malware hash registry runs each malware sample through several A/V engines.
## Team Cymru returns a percentage to indicate how many A/V engines flagged the
## sample as malicious. This threshold allows you to require a minimum detection
## rate (default: 50%).
const MHR_threshold = 50 &redef;
} }
event log_http(rec: HTTP::Info) event log_http(rec: HTTP::Info)
@ -22,10 +28,11 @@ event log_http(rec: HTTP::Info)
if ( rec?$md5 ) if ( rec?$md5 )
{ {
local hash_domain = fmt("%s.malware.hash.cymru.com", rec$md5); local hash_domain = fmt("%s.malware.hash.cymru.com", rec$md5);
when ( local addrs = lookup_hostname(hash_domain) ) when ( local MHR_result = lookup_hostname_txt(hash_domain) )
{ {
# 127.0.0.2 indicates that the md5 sum was found in the MHR. # Data is returned as "<dateFirstDetected> <detectionRate>"
if ( 127.0.0.2 in addrs ) local MHR_answer = split1(MHR_result, / /);
if ( length(MHR_answer) == 2 && to_count(MHR_answer[2]) >= MHR_threshold)
{ {
local url = HTTP::build_url_http(rec); local url = HTTP::build_url_http(rec);
local message = fmt("%s %s %s", rec$id$orig_h, rec$md5, url); local message = fmt("%s %s %s", rec$id$orig_h, rec$md5, url);