mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 15:18:20 +00:00
23f04835c6
These functions are now deprecated in favor of alternative versions that return a vector of strings rather than a table of strings. Deprecated functions: - split: use split_string instead. - split1: use split_string1 instead. - split_all: use split_string_all instead. - split_n: use split_string_n instead. - cat_string_array: see join_string_vec instead. - cat_string_array_n: see join_string_vec instead. - join_string_array: see join_string_vec instead. - sort_string_array: use sort instead instead. - find_ip_addresses: use extract_ip_addresses instead. Changed functions: - has_valid_octets: uses a string_vec parameter instead of string_array. Addresses BIT-924, BIT-757.
97 lines
2.3 KiB
Text
97 lines
2.3 KiB
Text
@load base/frameworks/intel
|
|
@load base/protocols/smtp
|
|
@load ./where-locations
|
|
|
|
event mime_end_entity(c: connection)
|
|
{
|
|
if ( c?$smtp )
|
|
{
|
|
if ( c$smtp?$path )
|
|
{
|
|
local path = c$smtp$path;
|
|
for ( i in path )
|
|
{
|
|
Intel::seen([$host=path[i],
|
|
$conn=c,
|
|
$where=SMTP::IN_RECEIVED_HEADER]);
|
|
}
|
|
}
|
|
|
|
if ( c$smtp?$user_agent )
|
|
Intel::seen([$indicator=c$smtp$user_agent,
|
|
$indicator_type=Intel::SOFTWARE,
|
|
$conn=c,
|
|
$where=SMTP::IN_HEADER]);
|
|
|
|
if ( c$smtp?$x_originating_ip )
|
|
Intel::seen([$host=c$smtp$x_originating_ip,
|
|
$conn=c,
|
|
$where=SMTP::IN_X_ORIGINATING_IP_HEADER]);
|
|
|
|
if ( c$smtp?$mailfrom )
|
|
{
|
|
local mailfromparts = split_string_n(c$smtp$mailfrom, /<.+>/, T, 1);
|
|
if ( |mailfromparts| > 2 )
|
|
{
|
|
Intel::seen([$indicator=mailfromparts[1][1:-2],
|
|
$indicator_type=Intel::EMAIL,
|
|
$conn=c,
|
|
$where=SMTP::IN_MAIL_FROM]);
|
|
}
|
|
}
|
|
|
|
if ( c$smtp?$rcptto )
|
|
{
|
|
for ( rcptto in c$smtp$rcptto )
|
|
{
|
|
local rcpttoparts = split_string_n(rcptto, /<.+>/, T, 1);
|
|
if ( |rcpttoparts| > 2 )
|
|
{
|
|
Intel::seen([$indicator=rcpttoparts[1][1:-2],
|
|
$indicator_type=Intel::EMAIL,
|
|
$conn=c,
|
|
$where=SMTP::IN_RCPT_TO]);
|
|
}
|
|
}
|
|
}
|
|
|
|
if ( c$smtp?$from )
|
|
{
|
|
local fromparts = split_string_n(c$smtp$from, /<.+>/, T, 1);
|
|
if ( |fromparts| > 2 )
|
|
{
|
|
Intel::seen([$indicator=fromparts[1][1:-2],
|
|
$indicator_type=Intel::EMAIL,
|
|
$conn=c,
|
|
$where=SMTP::IN_FROM]);
|
|
}
|
|
}
|
|
|
|
if ( c$smtp?$to )
|
|
{
|
|
for ( email_to in c$smtp$to )
|
|
{
|
|
local toparts = split_string_n(email_to, /<.+>/, T, 1);
|
|
if ( |toparts| > 2 )
|
|
{
|
|
Intel::seen([$indicator=toparts[1][1:-2],
|
|
$indicator_type=Intel::EMAIL,
|
|
$conn=c,
|
|
$where=SMTP::IN_TO]);
|
|
}
|
|
}
|
|
}
|
|
|
|
if ( c$smtp?$reply_to )
|
|
{
|
|
local replytoparts = split_string_n(c$smtp$reply_to, /<.+>/, T, 1);
|
|
if ( |replytoparts| > 2 )
|
|
{
|
|
Intel::seen([$indicator=replytoparts[1][1:-2],
|
|
$indicator_type=Intel::EMAIL,
|
|
$conn=c,
|
|
$where=SMTP::IN_REPLY_TO]);
|
|
}
|
|
}
|
|
}
|
|
}
|