mirror of
https://github.com/zeek/zeek.git
synced 2025-10-09 18:18:19 +00:00
d89ee3cee0
We now extract email addresses in the fields that one would expect to contain addresses. This makes further downstream processing of these fields easier like log analysis or using these fields in the Intel framework. The primary downside is that any other content in these fields is no longer available such as full name and any group information. I believe the simplification of the content in these fields is worth the change. Added "cc" to the script that feeds information from SMTP into the Intel framework. A new script for email handling utility functions has been created as a side effect of these changes.
97 lines
2.1 KiB
Text
97 lines
2.1 KiB
Text
@load base/frameworks/intel
|
|
@load base/protocols/smtp
|
|
@load ./where-locations
|
|
|
|
event mime_end_entity(c: connection)
|
|
{
|
|
if ( c?$smtp )
|
|
{
|
|
if ( c$smtp?$path )
|
|
{
|
|
local path = c$smtp$path;
|
|
for ( i in path )
|
|
{
|
|
Intel::seen([$host=path[i],
|
|
$conn=c,
|
|
$where=SMTP::IN_RECEIVED_HEADER]);
|
|
}
|
|
}
|
|
|
|
if ( c$smtp?$user_agent )
|
|
Intel::seen([$indicator=c$smtp$user_agent,
|
|
$indicator_type=Intel::SOFTWARE,
|
|
$conn=c,
|
|
$where=SMTP::IN_HEADER]);
|
|
|
|
if ( c$smtp?$x_originating_ip )
|
|
Intel::seen([$host=c$smtp$x_originating_ip,
|
|
$conn=c,
|
|
$where=SMTP::IN_X_ORIGINATING_IP_HEADER]);
|
|
|
|
if ( c$smtp?$mailfrom )
|
|
{
|
|
for ( mailfrom_addr in c$smtp$mailfrom )
|
|
{
|
|
Intel::seen([$indicator=mailfrom_addr,
|
|
$indicator_type=Intel::EMAIL,
|
|
$conn=c,
|
|
$where=SMTP::IN_MAIL_FROM]);
|
|
}
|
|
}
|
|
|
|
if ( c$smtp?$rcptto )
|
|
{
|
|
for ( rcptto_addr in c$smtp$rcptto )
|
|
{
|
|
Intel::seen([$indicator=rcptto_addr,
|
|
$indicator_type=Intel::EMAIL,
|
|
$conn=c,
|
|
$where=SMTP::IN_RCPT_TO]);
|
|
}
|
|
}
|
|
|
|
if ( c$smtp?$from )
|
|
{
|
|
for ( from_addr in c$smtp$from )
|
|
{
|
|
Intel::seen([$indicator=from_addr,
|
|
$indicator_type=Intel::EMAIL,
|
|
$conn=c,
|
|
$where=SMTP::IN_FROM]);
|
|
}
|
|
}
|
|
|
|
if ( c$smtp?$to )
|
|
{
|
|
for ( email_to_addr in c$smtp$to )
|
|
{
|
|
Intel::seen([$indicator=email_to_addr,
|
|
$indicator_type=Intel::EMAIL,
|
|
$conn=c,
|
|
$where=SMTP::IN_TO]);
|
|
}
|
|
}
|
|
|
|
if ( c$smtp?$cc )
|
|
{
|
|
for ( cc_addr in c$smtp$cc )
|
|
{
|
|
Intel::seen([$indicator=cc_addr,
|
|
$indicator_type=Intel::EMAIL,
|
|
$conn=c,
|
|
$where=SMTP::IN_CC]);
|
|
}
|
|
}
|
|
|
|
if ( c$smtp?$reply_to )
|
|
{
|
|
for ( replyto_addr in c$smtp$reply_to )
|
|
{
|
|
Intel::seen([$indicator=replyto_addr,
|
|
$indicator_type=Intel::EMAIL,
|
|
$conn=c,
|
|
$where=SMTP::IN_REPLY_TO]);
|
|
}
|
|
}
|
|
}
|
|
}
|