Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

intel/seen/file-names: Use file_over_new_connection()

Browse source 
The seen/file-names script relies on f$info$filename to be populated.
For HTTP and other network protocols, however, this field is only
populated during file_over_new_connection() that's running after
file_new().

Use the file_new() event only for files without connections and
file_over_new_connection() implies that f$conns is populated, anyway.

Special case SMB to avoid finding files twice, because there's a
custom implementation in seen/smb-filenames.zeek.

Fixes #2647
This commit is contained in:
Arne Welzel 2022-12-14 16:30:21 +01:00
parent 92e4c11914
commit 6d19c49efe
6 changed files with 91 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

21
scripts/policy/frameworks/intel/seen/file-names.zeek
View file

@ -3,9 +3,28 @@
event file_new(f: fa_file)
{
# If there are connections attached, we'll be using
# file_over_new_connection() for reporting the
# filename instead as it's more likely to be populated.
if ( f?$conns && |f$conns| > 0 )
return;
if ( f?$info && f$info?$filename )
Intel::seen([$indicator=f$info$filename,
$indicator_type=Intel::FILE_NAME,
$f=f,
$where=Files::IN_NAME]);
}
}
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=-5
{
# Skip SMB, there's a custom implementation in smb-filenames.zeek
if ( f$source == "SMB" )
return;
if ( f?$info && f$info?$filename )
Intel::seen([$indicator=f$info$filename,
$indicator_type=Intel::FILE_NAME,
$f=f,
$where=Files::IN_NAME]);
}