зеркало из https://github.com/mozilla/MozDef.git
Update regex strings
This commit is contained in:
Brandon Myers
Родитель
cb723a114c
Коммит
211ab423e7
|
|
@ -20,8 +20,8 @@ CONFIG_FILE = os.path.join(
|
|||
def _find_ip_addresses(string):
|
||||
'''List all of the IPv4 and IPv6 addresses found in a string.'''
|
||||
|
||||
ipv4_rx = '(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)'
|
||||
ipv6_rx = '(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))'
|
||||
ipv4_rx = r'(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)'
|
||||
ipv6_rx = r'(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))'
|
||||
|
||||
ipv4 = re.findall(ipv4_rx, string)
|
||||
ipv6_map = map(
|
||||
|
|
|
|||
|
|
@ -24,7 +24,7 @@ class AlertProxyDropExecutable(AlertTask):
|
|||
)
|
||||
|
||||
# Only notify on certain file extensions from config
|
||||
filename_regex = "/.*\.({0})/".format(self.config.extensions.replace(",", "|"))
|
||||
filename_regex = r"/.*\.({0})/".format(self.config.extensions.replace(",", "|"))
|
||||
search_query.add_must(
|
||||
[QueryStringMatch("details.destination: {}".format(filename_regex))]
|
||||
)
|
||||
|
|
|
|||
|
|
@ -57,7 +57,7 @@ class AlertAuthSignRelengSSH(AlertTask):
|
|||
sourceipaddress = x['details']['sourceipaddress']
|
||||
|
||||
targetuser = 'unknown'
|
||||
expr = re.compile('Accepted publickey for ([A-Za-z0-9]+) from')
|
||||
expr = re.compile(r'Accepted publickey for ([A-Za-z0-9]+) from')
|
||||
m = expr.match(event['_source']['summary'])
|
||||
groups = m.groups()
|
||||
if len(groups) > 0:
|
||||
|
|
|
|||
|
|
@ -124,7 +124,7 @@ class SshLateral(AlertTask):
|
|||
source_ips = []
|
||||
users = []
|
||||
for x in aggreg['events']:
|
||||
m = re.match('Accepted publickey for (\S+) from (\S+).*', x['_source']['summary'])
|
||||
m = re.match(r'Accepted publickey for (\S+) from (\S+).*', x['_source']['summary'])
|
||||
if m is not None and len(m.groups()) == 2:
|
||||
ipaddr = netaddr.IPAddress(m.group(2))
|
||||
for y in self._config['alertifsource']:
|
||||
|
|
|
|||
|
|
@ -65,7 +65,7 @@ class AlertUnauthSSH(AlertTask):
|
|||
sourceipaddress = x['details']['sourceipaddress']
|
||||
|
||||
targetuser = 'unknown'
|
||||
expr = re.compile('Accepted publickey for ([A-Za-z0-9@.\-]+) from')
|
||||
expr = re.compile(r'Accepted publickey for ([A-Za-z0-9@.\-]+) from')
|
||||
m = expr.match(event['_source']['summary'])
|
||||
groups = m.groups()
|
||||
if len(groups) > 0:
|
||||
|
|
|
|||
|
|
@ -49,7 +49,7 @@ def isFQDN(fqdn):
|
|||
# We could resolve FQDNs here, but that could tip our hand and it's
|
||||
# possible us investigating could trigger other alerts.
|
||||
# validate using the regex from https://github.com/yolothreat/utilitybelt
|
||||
fqdn_re = re.compile('(?=^.{4,255}$)(^((?!-)[a-zA-Z0-9-]{1,63}(?<!-)\.)+[a-zA-Z]{2,63}$)', re.I | re.S | re.M)
|
||||
fqdn_re = re.compile(r'(?=^.{4,255}$)(^((?!-)[a-zA-Z0-9-]{1,63}(?<!-)\.)+[a-zA-Z]{2,63}$)', re.I | re.S | re.M)
|
||||
return bool(re.match(fqdn_re,fqdn))
|
||||
except:
|
||||
return False
|
||||
|
|
|
|||
|
|
@ -19,13 +19,13 @@ class message(object):
|
|||
|
||||
def onMessage(self, message, metadata):
|
||||
|
||||
self.accepted_regex = re.compile('^(?P<authstatus>\w+) (?P<authmethod>\w+) for (?P<username>[a-zA-Z0-9\@._-]+) from (?P<sourceipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) port (?P<sourceport>\d{1,5}) ssh2(\:\sRSA\s)?(?:(?P<rsakeyfingerprint>(\S+)))?$')
|
||||
self.session_opened_regex = re.compile('^pam_unix\(sshd\:session\)\: session (opened|closed) for user (?P<username>[a-zA-Z0-9\@._-]+)(?: by \(uid\=\d*\))?$')
|
||||
self.postponed_regex = re.compile('^Postponed (?P<authmethod>\w+) for (?P<username>[a-zA-Z0-9\@._-]+) from (?P<sourceipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) port (?P<sourceport>\d{1,5}) ssh2(?: \[preauth\])?$')
|
||||
self.starting_session_regex = re.compile('^Starting session: (?P<sessiontype>\w+)(?: on )?(?P<device>pts/0)? for (?P<username>[a-zA-Z0-9\@._-]+) from (?P<sourceipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) port (?P<sourceport>\d{1,5})$')
|
||||
self.unauthorized_user_regex = re.compile('^Invalid user (?P<username>[a-zA-Z0-9\@._-]+) from (?P<sourceipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})?$')
|
||||
self.userauth_request_regex = re.compile('^input_userauth_request: invalid user (?P<username>[a-zA-Z0-9\@._-]+) \[preauth\]')
|
||||
self.disconnect_regex = re.compile('^Received disconnect from (?P<sourceipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}): (?P<sourceport>\d{1,5}): (|Bye Bye|Normal Shutdown, Thank you for playing) \[preauth\]')
|
||||
self.accepted_regex = re.compile(r'^(?P<authstatus>\w+) (?P<authmethod>\w+) for (?P<username>[a-zA-Z0-9\@._-]+) from (?P<sourceipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) port (?P<sourceport>\d{1,5}) ssh2(\:\sRSA\s)?(?:(?P<rsakeyfingerprint>(\S+)))?$')
|
||||
self.session_opened_regex = re.compile(r'^pam_unix\(sshd\:session\)\: session (opened|closed) for user (?P<username>[a-zA-Z0-9\@._-]+)(?: by \(uid\=\d*\))?$')
|
||||
self.postponed_regex = re.compile(r'^Postponed (?P<authmethod>\w+) for (?P<username>[a-zA-Z0-9\@._-]+) from (?P<sourceipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) port (?P<sourceport>\d{1,5}) ssh2(?: \[preauth\])?$')
|
||||
self.starting_session_regex = re.compile(r'^Starting session: (?P<sessiontype>\w+)(?: on )?(?P<device>pts/0)? for (?P<username>[a-zA-Z0-9\@._-]+) from (?P<sourceipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) port (?P<sourceport>\d{1,5})$')
|
||||
self.unauthorized_user_regex = re.compile(r'^Invalid user (?P<username>[a-zA-Z0-9\@._-]+) from (?P<sourceipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})?$')
|
||||
self.userauth_request_regex = re.compile(r'^input_userauth_request: invalid user (?P<username>[a-zA-Z0-9\@._-]+) \[preauth\]')
|
||||
self.disconnect_regex = re.compile(r'^Received disconnect from (?P<sourceipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}): (?P<sourceport>\d{1,5}): (|Bye Bye|Normal Shutdown, Thank you for playing) \[preauth\]')
|
||||
|
||||
if 'processname' in message and message['processname'] == 'sshd':
|
||||
msg_unparsed = message['summary']
|
||||
|
|
|
|||
|
|
@ -22,7 +22,7 @@ class message(object):
|
|||
|
||||
def onMessage(self, message, metadata):
|
||||
|
||||
self.session_regexp = re.compile('^pam_unix\(su(?:-l)?\:session\)\: session (?P<status>\w+) for user (?P<username>\w+)(?: (?:by (?:(?P<originuser>\w+))?\(uid\=(?P<uid>[0-9]+)\)?)?)?$')
|
||||
self.session_regexp = re.compile(r'^pam_unix\(su(?:-l)?\:session\)\: session (?P<status>\w+) for user (?P<username>\w+)(?: (?:by (?:(?P<originuser>\w+))?\(uid\=(?P<uid>[0-9]+)\)?)?)?$')
|
||||
|
||||
if 'details' in message:
|
||||
if 'program' in message['details']:
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@ def isFQDN(fqdn):
|
|||
# We could resolve FQDNs here, but that could tip our hand and it's
|
||||
# possible us investigating could trigger other alerts.
|
||||
# validate using the regex from https://github.com/yolothreat/utilitybelt
|
||||
fqdn_re = re.compile('(?=^.{4,255}$)(^((?!-)[a-zA-Z0-9-]{1,63}(?<!-)\.)+[a-zA-Z]{2,63}$)', re.I | re.S | re.M)
|
||||
fqdn_re = re.compile(r'(?=^.{4,255}$)(^((?!-)[a-zA-Z0-9-]{1,63}(?<!-)\.)+[a-zA-Z]{2,63}$)', re.I | re.S | re.M)
|
||||
return bool(re.match(fqdn_re,fqdn))
|
||||
except:
|
||||
return False
|
||||
|
|
|
|||
|
|
@ -4,11 +4,11 @@ from .negative_test_suite import NegativeTestSuite
|
|||
from mozdef_util.query_models import QueryStringMatch
|
||||
|
||||
|
||||
hostname_test_regex = 'hostname: /(.*\.)*(groupa|groupb)\.(.*\.)*subdomain\.(.*\.)*.*/'
|
||||
filename_matcher = 'summary: /.*\.(exe|sh)/'
|
||||
hostname_test_regex = r'hostname: /(.*\.)*(groupa|groupb)\.(.*\.)*subdomain\.(.*\.)*.*/'
|
||||
filename_matcher = r'summary: /.*\.(exe|sh)/'
|
||||
|
||||
# Note that this has potential for over-matching on foo.bar.baz.com, which needs further validation in alerts
|
||||
ip_matcher = 'destination: /.*\..{1,3}\..{1,3}\..{1,3}(:.*|\/.*)/'
|
||||
ip_matcher = r'destination: /.*\..{1,3}\..{1,3}\..{1,3}(:.*|\/.*)/'
|
||||
|
||||
|
||||
class TestQueryStringMatchPositiveTestSuite(PositiveTestSuite):
|
||||
|
|
|
|||
Загрузка…
Ссылка в новой задаче