Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 20:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/johanna/intel-cert-hash'

Browse source 
BIT-1567 #merged

* origin/topic/johanna/intel-cert-hash:
  Intel: CERT_HASH indicator type was never checked
This commit is contained in:
Robin Sommer 2016-04-22 08:36:24 -07:00
commit efde4a74b0
5 changed files with 24 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
CHANGES
View file

@ -1,4 +1,8 @@
2.4-457 | 2016-04-22 08:36:27 -0700
* Fix Intel framework not checking the CERT_HASH indicator type. (Johanna Amann)
2.4-454 | 2016-04-14 10:06:58 -0400
* Additional mime types for file identification and a few fixes. (Seth Hall)

2
VERSION
View file

@ -1 +1 @@
2.4-454
2.4-457

11
scripts/policy/frameworks/intel/seen/x509.bro
View file

@ -26,3 +26,14 @@ event x509_certificate(f: fa_file, cert_ref: opaque of x509, cert: X509::Certifi
$where=X509::IN_CERT]);
}
}
event file_hash(f: fa_file, kind: string, hash: string)
{
if ( ! f?$info || ! f$info?$x509 || kind != "sha1" )
return;
Intel::seen([$indicator=hash,
$indicator_type=Intel::CERT_HASH,
$f=f,
$where=X509::IN_CERT]);
}

11
testing/btest/Baseline/scripts.policy.frameworks.intel.seen.certs/intel-all.log
View file

@ -3,20 +3,23 @@
#empty_field (empty)
#unset_field -
#path intel
#open 2015-03-14-01-47-46
#open 2016-04-11-13-48-49
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid file_mime_type file_desc seen.indicator seen.indicator_type seen.where seen.node sources
#types time string addr port addr port string string string string enum enum string set[string]
1416942644.593119 CXWv6p3arKYeMETxOg 192.168.4.149 49422 23.92.19.75 443 F0txuw2pvrkZOn04a8 application/pkix-cert 23.92.19.75:443/tcp www.pantz.org Intel::DOMAIN X509::IN_CERT bro source1
#close 2015-03-14-01-47-46
#close 2016-04-11-13-48-49
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path intel
#open 2015-03-14-01-47-46
#open 2016-04-11-13-48-49
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid file_mime_type file_desc seen.indicator seen.indicator_type seen.where seen.node sources
#types time string addr port addr port string string string string enum enum string set[string]
1170717505.735416 CXWv6p3arKYeMETxOg 192.150.187.164 58868 194.127.84.106 443 FeCwNK3rzqPnZ7eBQ5 application/pkix-cert 194.127.84.106:443/tcp 2c322ae2b7fe91391345e070b63668978bb1c9da Intel::CERT_HASH X509::IN_CERT bro source1
1170717505.934612 CXWv6p3arKYeMETxOg 192.150.187.164 58868 194.127.84.106 443 - - - www.dresdner-privat.de Intel::DOMAIN X509::IN_CERT bro source1
1170717508.883051 CjhGID4nQcgTWjvg4c 192.150.187.164 58869 194.127.84.106 443 FjkLnG4s34DVZlaBNc application/pkix-cert 194.127.84.106:443/tcp 2c322ae2b7fe91391345e070b63668978bb1c9da Intel::CERT_HASH X509::IN_CERT bro source1
1170717509.082241 CjhGID4nQcgTWjvg4c 192.150.187.164 58869 194.127.84.106 443 - - - www.dresdner-privat.de Intel::DOMAIN X509::IN_CERT bro source1
1170717511.909717 CCvvfg3TEfuqmmG4bh 192.150.187.164 58870 194.127.84.106 443 FQXAWgI2FB5STbrff application/pkix-cert 194.127.84.106:443/tcp 2c322ae2b7fe91391345e070b63668978bb1c9da Intel::CERT_HASH X509::IN_CERT bro source1
1170717512.108799 CCvvfg3TEfuqmmG4bh 192.150.187.164 58870 194.127.84.106 443 - - - www.dresdner-privat.de Intel::DOMAIN X509::IN_CERT bro source1
#close 2015-03-14-01-47-46
#close 2016-04-11-13-48-49

1
testing/btest/scripts/policy/frameworks/intel/seen/certs.bro
View file

@ -8,6 +8,7 @@
#fields indicator indicator_type meta.source meta.desc meta.url
www.pantz.org Intel::DOMAIN source1 test entry http://some-data-distributor.com/100000
www.dresdner-privat.de Intel::DOMAIN source1 test entry http://some-data-distributor.com/100000
2c322ae2b7fe91391345e070b63668978bb1c9da Intel::CERT_HASH source1 test entry http://some-data-distributor.com/100000
@TEST-END-FILE
@load base/frameworks/intel