mirror of
https://github.com/mvt-project/mvt.git
synced 2026-04-21 11:16:20 +02:00
besendorf
6c537c624e
* Fix betterproto2 migration: update generated proto code and callers The dependency switch from betterproto to betterproto2 was incomplete. This updates all affected files to use the betterproto2 API: - tombstone.py: rewrite generated code to use betterproto2.field() with explicit TYPE_* constants, repeated/optional/group flags, and map_meta() for map fields - tombstone_crashes.py: update import and fix to_dict() call to use keyword-only casing= argument required by betterproto2 - pyproject.toml: replace betterproto[compiler] dev dep with betterproto2-compiler - Makefile: update protoc plugin flag to --python_betterproto2_out * Fix STIX2 hash key parsing to accept spec-compliant algorithm names The STIX2 specification requires single quotes around hash algorithm names that contain hyphens (e.g. file:hashes.'SHA-256'). MVT only accepted a non-standard lowercase form (file:hashes.sha256), silently dropping any indicators using the spec-correct spelling. Normalize hash algorithm keys in _process_indicator by stripping quotes and hyphens from the algorithm portion before matching, so all of the following are accepted for SHA-256, SHA-1 and MD5: file:hashes.'SHA-256' (STIX2 spec) file:hashes.SHA-256 file:hashes.SHA256 file:hashes.sha256 (previously the only accepted form) The same normalization is applied to app:cert.* keys. Update generate_stix.py to use the spec-compliant quoted forms, and add test_parse_stix2_hash_key_variants to cover all spelling variants.
117 lines
3.5 KiB
Python
117 lines
3.5 KiB
Python
# Mobile Verification Toolkit (MVT)
|
|
# Copyright (c) 2021-2023 The MVT Authors.
|
|
# Use of this software is governed by the MVT License 1.1 that can be found at
|
|
# https://license.mvt.re/1.1/
|
|
|
|
import os
|
|
|
|
from stix2.v21 import Bundle, Indicator, Malware, Relationship
|
|
|
|
|
|
def generate_test_stix_file(file_path):
|
|
if os.path.isfile(file_path):
|
|
os.remove(file_path)
|
|
|
|
domains = ["example.org"]
|
|
ip_addresses = ["198.51.100.1"]
|
|
processes = ["Launch"]
|
|
emails = ["foobar@example.org"]
|
|
filenames = ["/var/foobar/txt"]
|
|
android_property = ["sys.foobar"]
|
|
sha256 = ["570cd76bf49cf52e0cb347a68bdcf0590b2eaece134e1b1eba7e8d66261bdbe6"]
|
|
sha1 = ["da0611a300a9ce9aa7a09d1212f203fca5856794"]
|
|
urls = ["http://example.com/thisisbad"]
|
|
|
|
res = []
|
|
malware = Malware(name="TestMalware", is_family=False, description="")
|
|
res.append(malware)
|
|
for d in domains:
|
|
i = Indicator(
|
|
indicator_types=["malicious-activity"],
|
|
pattern="[domain-name:value='{}']".format(d),
|
|
pattern_type="stix",
|
|
)
|
|
res.append(i)
|
|
res.append(Relationship(i, "indicates", malware))
|
|
|
|
for a in ip_addresses:
|
|
i = Indicator(
|
|
indicator_types=["malicious-activity"],
|
|
pattern="[ipv4-addr:value='{}']".format(a),
|
|
pattern_type="stix",
|
|
)
|
|
res.append(i)
|
|
res.append(Relationship(i, "indicates", malware))
|
|
|
|
for p in processes:
|
|
i = Indicator(
|
|
indicator_types=["malicious-activity"],
|
|
pattern="[process:name='{}']".format(p),
|
|
pattern_type="stix",
|
|
)
|
|
res.append(i)
|
|
res.append(Relationship(i, "indicates", malware))
|
|
|
|
for f in filenames:
|
|
i = Indicator(
|
|
indicator_types=["malicious-activity"],
|
|
pattern="[file:name='{}']".format(f),
|
|
pattern_type="stix",
|
|
)
|
|
res.append(i)
|
|
res.append(Relationship(i, "indicates", malware))
|
|
|
|
for e in emails:
|
|
i = Indicator(
|
|
indicator_types=["malicious-activity"],
|
|
pattern="[email-addr:value='{}']".format(e),
|
|
pattern_type="stix",
|
|
)
|
|
res.append(i)
|
|
res.append(Relationship(i, "indicates", malware))
|
|
|
|
for p in android_property:
|
|
i = Indicator(
|
|
indicator_types=["malicious-activity"],
|
|
pattern="[android-property:name='{}']".format(p),
|
|
pattern_type="stix",
|
|
)
|
|
res.append(i)
|
|
res.append(Relationship(i, "indicates", malware))
|
|
|
|
for h in sha256:
|
|
i = Indicator(
|
|
indicator_types=["malicious-activity"],
|
|
pattern="[file:hashes.'SHA-256'='{}']".format(h),
|
|
pattern_type="stix",
|
|
)
|
|
res.append(i)
|
|
res.append(Relationship(i, "indicates", malware))
|
|
|
|
for h in sha1:
|
|
i = Indicator(
|
|
indicator_types=["malicious-activity"],
|
|
pattern="[file:hashes.'SHA-1'='{}']".format(h),
|
|
pattern_type="stix",
|
|
)
|
|
res.append(i)
|
|
res.append(Relationship(i, "indicates", malware))
|
|
|
|
for u in urls:
|
|
i = Indicator(
|
|
indicator_types=["malicious-activity"],
|
|
pattern="[url:value='{}']".format(u),
|
|
pattern_type="stix",
|
|
)
|
|
res.append(i)
|
|
res.append(Relationship(i, "indicates", malware))
|
|
|
|
bundle = Bundle(objects=res)
|
|
with open(file_path, "w+", encoding="utf-8") as f:
|
|
f.write(bundle.serialize(pretty=True))
|
|
|
|
|
|
if __name__ == "__main__":
|
|
generate_test_stix_file("test.stix2")
|
|
print("test.stix2 file created")
|