Skip to content

Commit f78e752

Browse files
dcodedcode
committed
catch up and sample documents of working ideas
1 parent b8b1e72 commit f78e752

9 files changed

Lines changed: 10068 additions & 16 deletions

File tree

‎x-pack/filebeat/module/virustotal/fields.go‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎x-pack/filebeat/module/virustotal/livehunt/config/livehunt.yml‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,20 @@
11
#spellchecker: disable
22
{{ if eq .input "httpjson" }}
33
type: httpjson
4-
config_version: 2
5-
interval: 1m
4+
config_version: "2"
5+
interval: {{ .interval }}
66
request:
77
url: https://www.virustotal.com/api/v3/intelligence/hunting_notification_files?limit={{ .limit }}
88
method: GET
99
transforms:
1010
- set:
1111
target: header.x-apikey
1212
value: {{ .api_key }}
13+
- set:
14+
target: url.params.filter
15+
value: 'date:[[.cursor.timefilter]]+'
16+
default: ''
17+
1318
response:
1419
split:
1520
target: body.data
@@ -18,6 +23,10 @@ response:
1823
- set:
1924
target: url.params.cursor
2025
value: '[[.last_response.body.meta.cursor]]'
26+
27+
cursor:
28+
timefilter:
29+
value: '[[ .last_event.context_attributes.notification_date ]]'
2130
{{ end }}
2231

2332
{{ if eq .input "file" }}

‎x-pack/filebeat/module/virustotal/livehunt/config/virustotal-elf.js‎

Lines changed: 20 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,11 @@ var elf_symbol_type_lookup = {
77
"OBJECT": "object"
88
};
99

10+
function isLetter(c) {
11+
return c.toLowerCase() != c.toUpperCase();
12+
}
13+
14+
1015
var vtELF = (function () {
1116
var processor = require("processor");
1217
var console = require("console");
@@ -94,11 +99,10 @@ var vtELF = (function () {
9499
var new_sect = {
95100
"name": old_sect.name,
96101
// VT returns this field with a misspelling
97-
"physical_offset": old_sect.phisical_offset,
102+
"physical_offset": "0x" + old_sect.phisical_offset.toString(16).toUpperCase(),
98103
"physical_size": old_sect.size,
99-
"virtual_address": old_sect.virtual_address,
100-
"type": old_sect.section_type,
101-
"flags": Array()
104+
"virtual_address": "0x" + old_sect.virtual_address.toString(16).toUpperCase(),
105+
"type": old_sect.section_type
102106
}
103107

104108
// Section flags: https://en.wikipedia.org/wiki/Executable_and_Linkable_Format#Section_header
@@ -126,18 +130,24 @@ var vtELF = (function () {
126130
"T": "TLS"
127131
}
128132

133+
console.debug("section flags[" + old_sect.flags.length + "]: \n" + old_sect.flags);
134+
135+
var new_flags = [];
129136
for (var j = 0; j < old_sect.flags.length; j++) {
130-
var flag = old_sect.flags[i];
131-
new_sect.flags.push(flag);
132-
continue;
133137

134-
if (flag_lookup[flag] != null) {
135-
new_sect.flags.push(flag_lookup[flag]);
138+
var flag = old_sect.flags[j];
139+
console.debug("flag[" + j + "]: " + flag[j]);
140+
if (flag_lookup.hasOwnProperty(flag)) {
141+
new_flags.push(flag_lookup[flag]);
136142
} else {
137-
new_sect.flags.push(flag);
143+
new_flags.push(flag);
138144
}
145+
}
139146

147+
if (new_flags.length > 0) {
148+
new_sect["flags"] = new_flags;
140149
}
150+
141151
// Replace existing section
142152
sections[i] = new_sect;
143153
}

‎x-pack/filebeat/module/virustotal/livehunt/config/virustotal-pe.js‎

Lines changed: 61 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,10 +44,9 @@ var vtPE = (function () {
4444
console.debug("vtPE.normalizeExports");
4545

4646
var exports = evt.Get("file.pe.exports");
47-
var normal_exports = Array();
48-
4947
if (exports != null) {
50-
console.debug("exports[" + exports.length + "]: \n" + JSON.stringify(exports, undefined, 2));
48+
console.debug("exports[" + exports.length + "]: \n" +
49+
JSON.stringify(exports, undefined, 2));
5150

5251
/* The goal is to normalize export list to the following
5352
* structure:
@@ -72,6 +71,65 @@ var vtPE = (function () {
7271
}
7372
};
7473

74+
var normalizeSections = function (evt) {
75+
console.debug("vtPE.normalizeSections");
76+
77+
var sections = evt.Get("file.pe.sections");
78+
79+
// original sections entry: [{
80+
// "chi2": 144106.34,
81+
// "virtual_address": 8192,
82+
// "entropy": 5.29,
83+
// "name": ".text",
84+
// "flags": "rx",
85+
// "raw_size": 5632,
86+
// "virtual_size": 5316,
87+
// "md5": "9002a963c87901397a986c3333d09627"
88+
// },...]
89+
if (sections != null) {
90+
console.debug("sections[" + sections.length + "]: \n" +
91+
JSON.stringify(sections, undefined, 2));
92+
93+
// {
94+
// name: "Name of code section",
95+
// physical_offset: "[keyword] Offset of the section from the beginning of the segment, in hex",
96+
// physical_size: "[long] Size of the code section in the file in bytes",
97+
// virtual_address: "[keyword] relative virtual memory address when loaded",
98+
// virtual_size: "[long] Size of the section in bytes when loaded into memory",
99+
// flags: "[keyword] List of flag values as strings for this section",
100+
// type: "[keyword] Section type as string, if applicable",
101+
// segment_name: "[keyword] Name of segment for this section, if applicable",
102+
// entropy: "[float] shannon entropy calculated from section content in bits per byte of information",
103+
// chi2: "[float]"
104+
// }
105+
var normal_sections = Array();
106+
for (var i = 0; i < sections.length; i++) {
107+
var norm_sect = {
108+
"name": sections[i].name,
109+
"physical_size": sections[i].raw_size,
110+
"virtual_address": "0x" + sections[i].virtual_address.toString(16).toUpperCase(),
111+
"virtual_size": sections[i].virtual_size,
112+
"flags": sections[i].flags,
113+
"entropy": sections[i].entropy,
114+
"chi2": sections[i].chi2
115+
};
116+
117+
// Allow for different hashes in the future
118+
var hashes = {};
119+
if (sections[i].hasOwnProperty("md5")) {
120+
hashes["md5"] = sections[i].md5;
121+
}
122+
123+
if (hashes != {}) {
124+
norm_sect["hash"] = hashes;
125+
}
126+
127+
normal_sections.push(norm_sect);
128+
}
129+
}
130+
131+
};
132+
75133
var processMessage = new processor.Chain()
76134
.Add(function (evt) {
77135
normalizeImports(evt);

0 commit comments

Comments
 (0)