infosecn1nja
/
HELK
mirror of https://github.com/infosecn1nja/HELK.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
HELK/docker/helk-jupyter/notebooks/sigma/proxy_ua_malware.ipynb

178 lines
7.2 KiB
Plaintext
Raw Blame History

{
"cells": [
{
"cell_type": "markdown",
"metadata": {},
"source": [
"# Malware User Agent\n",
"Detects suspicious user agent strings used by malware in proxy logs"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"## Rule Content\n",
"```\n",
"- title: Malware User Agent\n",
" id: 5c84856b-55a5-45f1-826f-13f37250cf4e\n",
" status: experimental\n",
" description: Detects suspicious user agent strings used by malware in proxy logs\n",
" references:\n",
" - http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules\n",
" - http://www.botopedia.org/search?searchword=scan&searchphrase=all\n",
" - https://networkraptor.blogspot.com/2015/01/user-agent-strings.html\n",
" - https://perishablepress.com/blacklist/ua-2013.txt\n",
" - https://www.bluecoat.com/en-gb/security-blog/2015-05-05/know-your-agents\n",
" author: Florian Roth\n",
" logsource:\n",
" category: proxy\n",
" product: null\n",
" service: null\n",
" detection:\n",
" selection:\n",
" c-useragent:\n",
" - Mozilla/5.0 (Windows NT 6.1; WOW64; rv:53.0) Gecko/20100101 Chrome /53.0\n",
" - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)\n",
" - Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)\n",
" - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)\n",
" - HttpBrowser/1.0\n",
" - '*<|>*'\n",
" - nsis_inetc (mozilla)\n",
" - Wget/1.9+cvs-stable (Red Hat modified)\n",
" - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322)\n",
" - '*zeroup*'\n",
" - Mozilla/5.0 (Windows NT 5.1 ; v.*\n",
" - '* adlib/*'\n",
" - '* tiny'\n",
" - '* BGroom *'\n",
" - '* changhuatong'\n",
" - '* CholTBAgent'\n",
" - Mozilla/5.0 WinInet\n",
" - RookIE/1.0\n",
" - M\n",
" - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)\n",
" - Mozilla/4.0 (compatible;MSIE 7.0;Windows NT 6.0)\n",
" - backdoorbot\n",
" - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401\n",
" Firefox/3.6.1 (.NET CLR 3.5.30731)\n",
" - Opera/8.81 (Windows NT 6.0; U; en)\n",
" - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401\n",
" Firefox/3.6.1 (.NET CLR 3.5.30729)\n",
" - Opera\n",
" - Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)\n",
" - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)\n",
" - MSIE\n",
" - '*(Charon; Inferno)'\n",
" - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0)\n",
" - Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)\n",
" - Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.1)\n",
" - Mozilla/5.0 (Windows NT 10.0; Win64; x64)\n",
" - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)\n",
" - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64)\n",
" - '* pxyscand*'\n",
" - '* asd'\n",
" - '* mdms'\n",
" - sample\n",
" - nocase\n",
" - Moxilla\n",
" - Win32 *\n",
" - '*Microsoft Internet Explorer*'\n",
" - agent *\n",
" - AutoIt\n",
" - IczelionDownLoad\n",
" condition: selection\n",
" fields:\n",
" - ClientIP\n",
" - c-uri\n",
" - c-useragent\n",
" falsepositives:\n",
" - Unknown\n",
" level: high\n",
"\n",
"```"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"## Querying Elasticsearch"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"### Import Libraries"
]
},
{
"cell_type": "code",
"execution_count": null,
"metadata": {},
"outputs": [],
"source": [
"from elasticsearch import Elasticsearch\n",
"from elasticsearch_dsl import Search\n",
"import pandas as pd"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"### Initialize Elasticsearch client"
]
},
{
"cell_type": "code",
"execution_count": null,
"metadata": {},
"outputs": [],
"source": [
"es = Elasticsearch(['http://helk-elasticsearch:9200'])\n",
"searchContext = Search(using=es, index='logs-*', doc_type='doc')"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"### Run Elasticsearch Query"
]
},
{
"cell_type": "code",
"execution_count": null,
"metadata": {},
"outputs": [],
"source": [
"s = searchContext.query('query_string', query='c-useragent.keyword:(Mozilla\\/5.0\\ \\(Windows\\ NT\\ 6.1;\\ WOW64;\\ rv\\:53.0\\)\\ Gecko\\/20100101\\ Chrome\\ \\/53.0 OR Mozilla\\/4.0\\ \\(compatible;\\ MSIE\\ 8.0;\\ Windows\\ NT\\ 5.1\\) OR Mozilla\\/4.0\\ \\(compatible;\\ MSIE\\ 7.0;\\ Windows\\ NT\\ 5.1;\\ Trident\\/4.0\\) OR Mozilla\\/4.0\\ \\(compatible;\\ MSIE\\ 6.0;\\ Windows\\ NT\\ 5.0;\\ .NET\\ CLR\\ \\ 1.1.4322\\) OR HttpBrowser\\/1.0 OR *|* OR nsis_inetc\\ \\(mozilla\\) OR Wget\\/1.9\\+cvs\\-stable\\ \\(Red\\ Hat\\ modified\\) OR Mozilla\\/4.0\\ \\(compatible;\\ MSIE\\ 8.0;\\ Windows\\ NT\\ 6.1;\\ Trident\\/4.0;\\ .NET\\ CLR\\ 1.1.4322\\) OR *zeroup* OR Mozilla\\/5.0\\ \\(Windows\\ NT\\ 5.1\\ ;\\ v.* OR *\\ adlib\\/* OR *\\ tiny OR *\\ BGroom\\ * OR *\\ changhuatong OR *\\ CholTBAgent OR Mozilla\\/5.0\\ WinInet OR RookIE\\/1.0 OR M OR Mozilla\\/4.0\\ \\(compatible;\\ MSIE\\ 8.0;\\ Windows\\ NT\\ 5.1;\\ Trident\\/4.0\\) OR Mozilla\\/4.0\\ \\(compatible;MSIE\\ 7.0;Windows\\ NT\\ 6.0\\) OR backdoorbot OR Mozilla\\/5.0\\ \\(Windows;\\ U;\\ Windows\\ NT\\ 5.1;\\ en\\-US;\\ rv\\:1.9.2.3\\)\\ Gecko\\/20100401\\ Firefox\\/3.6.1\\ \\(.NET\\ CLR\\ 3.5.30731\\) OR Opera\\/8.81\\ \\(Windows\\ NT\\ 6.0;\\ U;\\ en\\) OR Mozilla\\/5.0\\ \\(Windows;\\ U;\\ Windows\\ NT\\ 5.1;\\ en\\-US;\\ rv\\:1.9.2.3\\)\\ Gecko\\/20100401\\ Firefox\\/3.6.1\\ \\(.NET\\ CLR\\ 3.5.30729\\) OR Opera OR Mozilla\\/4.0\\ \\(compatible;\\ MSIE\\ 5.0;\\ Windows\\ 98\\) OR Mozilla\\/4.0\\ \\(compatible;\\ MSIE\\ 5.01;\\ Windows\\ NT\\ 5.0\\) OR MSIE OR *\\(Charon;\\ Inferno\\) OR Mozilla\\/4.0\\ \\(compatible;\\ MSIE\\ 8.0;\\ Windows\\ NT\\ 5.1;\\ Trident\\/5.0\\) OR Mozilla\\/4.0\\ \\(compatible;\\ MSIE\\ 6.1;\\ Windows\\ NT\\) OR Mozilla\\/4.0\\(compatible;\\ MSIE\\ 6.0;\\ Windows\\ NT\\ 5.1\\) OR Mozilla\\/5.0\\ \\(Windows\\ NT\\ 10.0;\\ Win64;\\ x64\\) OR Mozilla\\/4.0\\ \\(compatible;\\ MSIE\\ 8.0;\\ Windows\\ NT\\ 10.0;\\ Win64;\\ x64\\) OR Mozilla\\/4.0\\ \\(compatible;\\ MSIE\\ 8.0;\\ Windows\\ NT\\ 6.1;\\ Win64;\\ x64\\) OR *\\ pxyscand* OR *\\ asd OR *\\ mdms OR sample OR nocase OR Moxilla OR Win32\\ * OR *Microsoft\\ Internet\\ Explorer* OR agent\\ * OR AutoIt OR IczelionDownLoad)')\n",
"response = s.execute()\n",
"if response.success():\n",
" df = pd.DataFrame((d.to_dict() for d in s.scan()))"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"### Show Results"
]
},
{
"cell_type": "code",
"execution_count": null,
"metadata": {},
"outputs": [],
"source": [
"df.head()"
]
}
],
"metadata": {},
"nbformat": 4,
"nbformat_minor": 4
}
Reference in New Issue View Git Blame Copy Permalink