From 946f19fb9da0f64c4e71c20e458e7dae4d2b75da Mon Sep 17 00:00:00 2001 From: Johanna Amann Date: Tue, 3 Mar 2015 17:13:55 -0800 Subject: [PATCH] Use our new features to send the CN and SAN fields of certificates to the intel framework. --- scripts/policy/frameworks/intel/seen/ssl.bro | 13 +++++++++++ scripts/policy/frameworks/intel/seen/x509.bro | 10 +++++++++ .../intel-all.log | 22 +++++++++++++++++++ .../policy/frameworks/intel/seen/certs.bro | 18 +++++++++++++++ 4 files changed, 63 insertions(+) create mode 100644 testing/btest/Baseline/scripts.policy.frameworks.intel.seen.certs/intel-all.log create mode 100644 testing/btest/scripts/policy/frameworks/intel/seen/certs.bro diff --git a/scripts/policy/frameworks/intel/seen/ssl.bro b/scripts/policy/frameworks/intel/seen/ssl.bro index 70c70f5b71..7bfbef4e9b 100644 --- a/scripts/policy/frameworks/intel/seen/ssl.bro +++ b/scripts/policy/frameworks/intel/seen/ssl.bro @@ -10,3 +10,16 @@ event ssl_extension_server_name(c: connection, is_orig: bool, names: string_vec) $conn=c, $where=SSL::IN_SERVER_NAME]); } + +event ssl_established(c: connection) + { + if ( ! c$ssl?$cert_chain || |c$ssl$cert_chain| == 0 || + ! c$ssl$cert_chain[0]?$x509 ) + return; + + if ( c$ssl$cert_chain[0]$x509?$certificate && c$ssl$cert_chain[0]$x509$certificate?$cn ) + Intel::seen([$indicator=c$ssl$cert_chain[0]$x509$certificate$cn, + $indicator_type=Intel::DOMAIN, + $conn=c, + $where=X509::IN_CERT]); + } diff --git a/scripts/policy/frameworks/intel/seen/x509.bro b/scripts/policy/frameworks/intel/seen/x509.bro index 11e4d57f90..3e235e085f 100644 --- a/scripts/policy/frameworks/intel/seen/x509.bro +++ b/scripts/policy/frameworks/intel/seen/x509.bro @@ -2,6 +2,16 @@ @load base/files/x509 @load ./where-locations +event x509_ext_subject_alternative_name(f: fa_file, ext: X509::SubjectAlternativeName) + { + if ( ext?$dns ) + for ( i in ext$dns ) + Intel::seen([$indicator=ext$dns[i], + $indicator_type=Intel::DOMAIN, + $f=f, + $where=X509::IN_CERT]); + } + event x509_certificate(f: fa_file, cert_ref: opaque of x509, cert: X509::Certificate) { if ( /emailAddress=/ in cert$subject ) diff --git a/testing/btest/Baseline/scripts.policy.frameworks.intel.seen.certs/intel-all.log b/testing/btest/Baseline/scripts.policy.frameworks.intel.seen.certs/intel-all.log new file mode 100644 index 0000000000..8782898d33 --- /dev/null +++ b/testing/btest/Baseline/scripts.policy.frameworks.intel.seen.certs/intel-all.log @@ -0,0 +1,22 @@ +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path intel +#open 2015-03-04-01-12-47 +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid file_mime_type file_desc seen.indicator seen.indicator_type seen.where seen.node sources +#types time string addr port addr port string string string string enum enum string set[string] +1416942644.593119 CXWv6p3arKYeMETxOg 192.168.4.149 49422 23.92.19.75 443 F0txuw2pvrkZOn04a8 - 23.92.19.75:443/tcp www.pantz.org Intel::DOMAIN X509::IN_CERT bro source1 +#close 2015-03-04-01-12-47 +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path intel +#open 2015-03-04-01-12-47 +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid file_mime_type file_desc seen.indicator seen.indicator_type seen.where seen.node sources +#types time string addr port addr port string string string string enum enum string set[string] +1170717505.934612 CXWv6p3arKYeMETxOg 192.150.187.164 58868 194.127.84.106 443 - - - www.dresdner-privat.de Intel::DOMAIN X509::IN_CERT bro source1 +1170717509.082241 CjhGID4nQcgTWjvg4c 192.150.187.164 58869 194.127.84.106 443 - - - www.dresdner-privat.de Intel::DOMAIN X509::IN_CERT bro source1 +1170717512.108799 CCvvfg3TEfuqmmG4bh 192.150.187.164 58870 194.127.84.106 443 - - - www.dresdner-privat.de Intel::DOMAIN X509::IN_CERT bro source1 +#close 2015-03-04-01-12-47 diff --git a/testing/btest/scripts/policy/frameworks/intel/seen/certs.bro b/testing/btest/scripts/policy/frameworks/intel/seen/certs.bro new file mode 100644 index 0000000000..afddc6b2d9 --- /dev/null +++ b/testing/btest/scripts/policy/frameworks/intel/seen/certs.bro @@ -0,0 +1,18 @@ +# @TEST-EXEC: bro -r $TRACES/tls/ecdsa-cert.pcap %INPUT +# @TEST-EXEC: cat intel.log > intel-all.log +# @TEST-EXEC: bro -r $TRACES/tls/ssl.v3.trace %INPUT +# @TEST-EXEC: cat intel.log >> intel-all.log +# @TEST-EXEC: btest-diff intel-all.log + +@TEST-START-FILE intel.dat +#fields indicator indicator_type meta.source meta.desc meta.url +www.pantz.org Intel::DOMAIN source1 test entry http://some-data-distributor.com/100000 +www.dresdner-privat.de Intel::DOMAIN source1 test entry http://some-data-distributor.com/100000 +@TEST-END-FILE + +@load base/frameworks/intel +@load base/protocols/ssl +@load frameworks/intel/seen + +redef Intel::read_files += { "intel.dat" }; +