#NEWLINE# def main( vulnerability , vulnObject , sourceIP , sourceHost ) : #NEWLINE# #INDENT# if ( not os . path . exists ( 'Results' ) ) : #NEWLINE# #INDENT# os . makedirs ( 'Results' ) #NEWLINE# #UNINDENT# if ( not os . path . exists ( 'Working' ) ) : #NEWLINE# #INDENT# os . makedirs ( 'Working' ) #NEWLINE# #UNINDENT# if ( vulnerability != '' ) : #NEWLINE# #INDENT# vulnCheck = 0 #NEWLINE# resultCount = 0 #NEWLINE# logsource = '' #NEWLINE# print ( ( ( 'Searching for evidence of "' + vulnerability ) + '"' ) ) #NEWLINE# print ( ( '  Host: ' + sourceIP ) ) #NEWLINE# try : #NEWLINE# #INDENT# configFile = 'config.xml' #NEWLINE# tree = ET . parse ( configFile ) #NEWLINE# root = tree . getroot ( ) #NEWLINE# #UNINDENT# except : #NEWLINE# #INDENT# sys . exit ( 'Not a valid config XML file' ) #NEWLINE# #UNINDENT# for settings in root . findall ( './log_source' ) : #NEWLINE# #INDENT# logsource = settings . text #NEWLINE# #UNINDENT# cnx = getDBConnector ( ) #NEWLINE# cursor = cnx . cursor ( ) #NEWLINE# query = ( ( ( ( "SELECT count(*) as count from assetVulnerabilities where victim_ip = '" + str ( ip2long ( sourceIP ) ) ) + "' and threat_id = '" ) + vulnerability ) + "'" ) #NEWLINE# cursor . execute ( query ) #NEWLINE# for row in cursor : #NEWLINE# #INDENT# vulnCheck = row [ 0 ] #NEWLINE# #UNINDENT# cursor . close ( ) #NEWLINE# if ( vulnCheck == 0 ) : #NEWLINE# #INDENT# cursor = cnx . cursor ( ) #NEWLINE# add_vulnInstance = 'INSERT INTO assetVulnerabilities (victim_ip, threat_id, active) VALUES (%s, %s, %s)' #NEWLINE# vulnData = ( ip2long ( sourceIP ) , vulnerability , '1' ) #NEWLINE# cursor . execute ( add_vulnInstance , vulnData ) #NEWLINE# cnx . commit ( ) #NEWLINE# cursor . close ( ) #NEWLINE# cnx . close ( ) #NEWLINE# #UNINDENT# searchStringResults = findStixObservables . run ( vulnerability ) #NEWLINE# isExploitFound = False #NEWLINE# searchStringCount = 0 #NEWLINE# operator = searchStringResults [ 0 ] #NEWLINE# numResults = 0 #NEWLINE# if ( searchStringResults [ 1 ] == 'No search file found' ) : #NEWLINE# #INDENT# searchResults = '0' #NEWLINE# print ( '  No search file found\n' ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# if ( searchStringResults [ 1 ] == 'No supported observables found' ) : #NEWLINE# #INDENT# searchResults = '0' #NEWLINE# print ( '  No supported observables found\n' ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# for entry in searchStringResults : #NEWLINE# #INDENT# if ( logsource == 'splunk' ) : #NEWLINE# #INDENT# if ( searchStringCount == 1 ) : #NEWLINE# #INDENT# searchString = ( ( ( ( ( ( ( entry + ' AND (host="' ) + sourceHost ) + '" OR s_ip="' ) + sourceIP ) + '" OR d_host="' ) + sourceHost ) + '")  | fields host, c_ip | fields - _bkt, _cd, _indextime, _kv, _serial, _si, _sourcetype | rename _raw as "Raw Log" | rename c_ip as clientip' ) #NEWLINE# numResults = splunk . searchVulnerability ( searchString , vulnerability , sourceIP , sourceHost ) #NEWLINE# if ( numResults != '0' ) : #NEWLINE# #INDENT# data = json . load ( numResults ) #NEWLINE# #UNINDENT# #UNINDENT# if ( operator == 'AND' ) : #NEWLINE# #INDENT# if ( searchStringCount > 1 ) : #NEWLINE# #INDENT# resultCount = 0 #NEWLINE# for result in data [ 'results' ] : #NEWLINE# #INDENT# startTime = ( dateutil . parser . parse ( data [ 'results' ] [ resultCount ] [ '_time' ] ) + datetime . timedelta ( days = ( - 300 ) ) ) #NEWLINE# endTime = ( dateutil . parser . parse ( data [ 'results' ] [ resultCount ] [ '_time' ] ) + datetime . timedelta ( days = 300 ) ) #NEWLINE# searchString = ( ( ( ( ( ( ( entry + ' AND (host="' ) + sourceHost ) + '" OR s_ip="' ) + sourceIP ) + '" OR d_host="' ) + sourceHost ) + '") | fields host, clientip | fields - _bkt, _cd, _indextime, _kv, _serial, _si, _sourcetype | rename _raw as "Raw Log"' ) #NEWLINE# newResults = splunk . searchVulnerabilityTimeRange ( searchString , vulnerability , sourceIP , sourceHost , startTime . isoformat ( ) , endTime . isoformat ( ) ) #NEWLINE# if ( newResults != '0' ) : #NEWLINE# #INDENT# newData = json . load ( newResults ) #NEWLINE# newResultCount = 0 #NEWLINE# for result in newData [ 'results' ] : #NEWLINE# #INDENT# try : #NEWLINE# #INDENT# clientip = newData [ 'results' ] [ newResultCount ] [ 'clientip' ] #NEWLINE# #UNINDENT# except : #NEWLINE# #INDENT# clientip = '0' #NEWLINE# #UNINDENT# isExploitFound = True #NEWLINE# cnx = getDBConnector ( ) #NEWLINE# cursor = cnx . cursor ( ) #NEWLINE# query = ( ( ( ( ( ( "SELECT count(*) as count from attackInventory where victim_ip = '" + str ( ip2long ( sourceIP ) ) ) + "' and threat_id = '" ) + vulnerability ) + "' and attack_time = '" ) + data [ 'results' ] [ resultCount ] [ '_time' ] ) + "'" ) #NEWLINE# cursor . execute ( query ) #NEWLINE# for row in cursor : #NEWLINE# #INDENT# logCheck = row [ 0 ] #NEWLINE# #UNINDENT# cursor . close ( ) #NEWLINE# if ( logCheck == 0 ) : #NEWLINE# #INDENT# cursor = cnx . cursor ( ) #NEWLINE# add_logInstance = 'INSERT INTO attackInventory (victim_ip, attacker_ip, attack_time, attack_log, threat_id) VALUES (%s, %s, %s, %s, %s)' #NEWLINE# logData = ( ip2long ( sourceIP ) , ip2long ( clientip ) , newData [ 'results' ] [ newResultCount ] [ '_time' ] , newData [ 'results' ] [ newResultCount ] [ 'Raw Log' ] , vulnerability ) #NEWLINE# cursor . execute ( add_logInstance , logData ) #NEWLINE# cnx . commit ( ) #NEWLINE# cursor . close ( ) #NEWLINE# #UNINDENT# cnx . close ( ) #NEWLINE# newResultCount = ( newResultCount + 1 ) #NEWLINE# #UNINDENT# #UNINDENT# else : #NEWLINE# #INDENT# newResultCount = 0 #NEWLINE# #UNINDENT# #UNINDENT# if ( isExploitFound == True ) : #NEWLINE# #INDENT# try : #NEWLINE# #INDENT# clientip = data [ 'results' ] [ resultCount ] [ 'clientip' ] #NEWLINE# #UNINDENT# except : #NEWLINE# #INDENT# clientip = '0' #NEWLINE# #UNINDENT# cnx = getDBConnector ( ) #NEWLINE# cursor = cnx . cursor ( ) #NEWLINE# query = ( ( ( ( ( ( "SELECT count(*) as count from attackInventory where victim_ip = '" + str ( ip2long ( sourceIP ) ) ) + "' and threat_id = '" ) + vulnerability ) + "' and attack_time = '" ) + data [ 'results' ] [ resultCount ] [ '_time' ] ) + "'" ) #NEWLINE# cursor . execute ( query ) #NEWLINE# for row in cursor : #NEWLINE# #INDENT# logCheck = row [ 0 ] #NEWLINE# #UNINDENT# cursor . close ( ) #NEWLINE# if ( logCheck == 0 ) : #NEWLINE# #INDENT# cursor = cnx . cursor ( ) #NEWLINE# add_logInstance = 'INSERT INTO attackInventory (victim_ip, attacker_ip, attack_time, attack_log, threat_id) VALUES (%s, %s, %s, %s, %s)' #NEWLINE# logData = ( ip2long ( sourceIP ) , ip2long ( clientip ) , data [ 'results' ] [ resultCount ] [ '_time' ] , data [ 'results' ] [ resultCount ] [ 'Raw Log' ] , vulnerability ) #NEWLINE# cursor . execute ( add_logInstance , logData ) #NEWLINE# cnx . commit ( ) #NEWLINE# cursor . close ( ) #NEWLINE# #UNINDENT# cnx . close ( ) #NEWLINE# resultCount = ( newResultCount + 1 ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# resultCount = newResultCount #NEWLINE# #UNINDENT# #UNINDENT# #UNINDENT# else : #NEWLINE# #INDENT# if ( operator == 'OR' ) : #NEWLINE# #INDENT# if ( searchStringCount > 0 ) : #NEWLINE# #INDENT# if ( len ( searchStringResults ) > 2 ) : #NEWLINE# #INDENT# searchString = ( ( ( ( ( ( ( entry + ' AND (host="' ) + sourceHost ) + '" OR s_ip="' ) + sourceIP ) + '" OR d_host="' ) + sourceHost ) + '")  | fields host, clientip | fields - _bkt, _cd, _indextime, _kv, _serial, _si, _sourcetype | rename _raw as "Raw Log"' ) #NEWLINE# numResults = splunk . searchVulnerability ( searchString , vulnerability , sourceIP , sourceHost ) #NEWLINE# if ( numResults != '0' ) : #NEWLINE# #INDENT# data = json . load ( numResults ) #NEWLINE# resultCount = 0 #NEWLINE# for result in data [ 'results' ] : #NEWLINE# #INDENT# isExploitFound = True #NEWLINE# cnx = getDBConnector ( ) #NEWLINE# cursor = cnx . cursor ( ) #NEWLINE# query = ( ( ( ( ( ( "SELECT count(*) as count from attackInventory where victim_ip = '" + str ( ip2long ( sourceIP ) ) ) + "' and threat_id = '" ) + vulnerability ) + "' and attack_time = '" ) + data [ 'results' ] [ resultCount ] [ '_time' ] ) + "'" ) #NEWLINE# cursor . execute ( query ) #NEWLINE# for row in cursor : #NEWLINE# #INDENT# logCheck = row [ 0 ] #NEWLINE# #UNINDENT# cursor . close ( ) #NEWLINE# if ( logCheck == 0 ) : #NEWLINE# #INDENT# cursor = cnx . cursor ( ) #NEWLINE# add_logInstance = 'INSERT INTO attackInventory (victim_ip, attacker_ip, attack_time, attack_log, threat_id) VALUES (%s, %s, %s, %s, %s)' #NEWLINE# logData = ( ip2long ( sourceIP ) , ip2long ( data [ 'results' ] [ resultCount ] [ 'clientip' ] ) , data [ 'results' ] [ resultCount ] [ '_time' ] , data [ 'results' ] [ resultCount ] [ 'Raw Log' ] , vulnerability ) #NEWLINE# cursor . execute ( add_logInstance , logData ) #NEWLINE# cnx . commit ( ) #NEWLINE# cursor . close ( ) #NEWLINE# #UNINDENT# cnx . close ( ) #NEWLINE# resultCount = ( resultCount + 1 ) #NEWLINE# #UNINDENT# #UNINDENT# #UNINDENT# else : #NEWLINE# #INDENT# if ( len ( searchStringResults ) == 2 ) : #NEWLINE# #INDENT# searchString = ( ( ( ( ( ( ( ( ( entry + ' AND (host="' ) + sourceHost ) + '" OR host="' ) + sourceIP ) + '" OR s_ip="' ) + sourceIP ) + '" OR d_host="' ) + sourceHost ) + '")  | fields host, clientip | fields - _bkt, _cd, _indextime, _kv, _serial, _si, _sourcetype | rename _raw as "Raw Log"' ) #NEWLINE# numResults = splunk . searchVulnerability ( searchString , vulnerability , sourceIP , sourceHost ) #NEWLINE# if ( numResults != '0' ) : #NEWLINE# #INDENT# data = json . load ( numResults ) #NEWLINE# resultCount = 0 #NEWLINE# for result in data [ 'results' ] : #NEWLINE# #INDENT# isExploitFound = True #NEWLINE# cnx = getDBConnector ( ) #NEWLINE# cursor = cnx . cursor ( ) #NEWLINE# query = ( ( ( ( ( ( "SELECT count(*) as count from attackInventory where victim_ip = '" + str ( ip2long ( sourceIP ) ) ) + "' and threat_id = '" ) + vulnerability ) + "' and attack_time = '" ) + data [ 'results' ] [ resultCount ] [ '_time' ] ) + "'" ) #NEWLINE# cursor . execute ( query ) #NEWLINE# for row in cursor : #NEWLINE# #INDENT# logCheck = row [ 0 ] #NEWLINE# #UNINDENT# cursor . close ( ) #NEWLINE# if ( logCheck == 0 ) : #NEWLINE# #INDENT# cursor = cnx . cursor ( ) #NEWLINE# add_logInstance = 'INSERT INTO attackInventory (victim_ip, attacker_ip, attack_time, attack_log, threat_id) VALUES (%s, %s, %s, %s, %s)' #NEWLINE# logData = ( ip2long ( sourceIP ) , ip2long ( data [ 'results' ] [ resultCount ] [ 'clientip' ] ) , data [ 'results' ] [ resultCount ] [ '_time' ] , data [ 'results' ] [ resultCount ] [ 'Raw Log' ] , vulnerability ) #NEWLINE# cursor . execute ( add_logInstance , logData ) #NEWLINE# cnx . commit ( ) #NEWLINE# cursor . close ( ) #NEWLINE# #UNINDENT# cnx . close ( ) #NEWLINE# resultCount = ( resultCount + 1 ) #NEWLINE# #UNINDENT# #UNINDENT# #UNINDENT# #UNINDENT# #UNINDENT# #UNINDENT# #UNINDENT# searchStringCount = ( searchStringCount + 1 ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# if ( logsource == 'elastic_search' ) : #NEWLINE# #INDENT# numResults = 0 #NEWLINE# startTime = '-90d' #NEWLINE# endTime = 'now' #NEWLINE# entry = re . sub ( '\\<source_host\\>' , sourceHost , entry ) #NEWLINE# entry = re . sub ( '\\<source_ip\\>' , sourceIP , entry ) #NEWLINE# if ( searchStringCount == 1 ) : #NEWLINE# #INDENT# entry = re . sub ( '\\<startTime\\>' , startTime , entry ) #NEWLINE# entry = re . sub ( '\\<endTime\\>' , endTime , entry ) #NEWLINE# if ( sourceIP == '*' ) : #NEWLINE# #INDENT# entry = re . sub ( '\\<min_count\\>' , '1' , entry ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# entry = re . sub ( '\\<min_count\\>' , '2' , entry ) #NEWLINE# #UNINDENT# searchResults = ElasticSearchQuery . searchVulnerability ( entry , vulnerability , sourceIP , sourceHost ) #NEWLINE# numResults = getElasticSearchResults ( searchResults ) #NEWLINE# #UNINDENT# if ( operator == 'AND' ) : #NEWLINE# #INDENT# if ( searchStringCount > 1 ) : #NEWLINE# #INDENT# resultCount = 0 #NEWLINE# for hit in searchResults [ 'hits' ] [ 'hits' ] : #NEWLINE# #INDENT# startTime = ( dateutil . parser . parse ( hit [ '_source' ] [ '@timestamp' ] ) + datetime . timedelta ( days = ( - 1 ) ) ) #NEWLINE# endTime = ( dateutil . parser . parse ( hit [ '_source' ] [ '@timestamp' ] ) + datetime . timedelta ( days = 1 ) ) #NEWLINE# entry = re . sub ( '\\<startTime\\>' , str ( startTime . isoformat ( ) ) , entry ) #NEWLINE# entry = re . sub ( '\\<endTime\\>' , str ( endTime . isoformat ( ) ) , entry ) #NEWLINE# newSearchResults = ElasticSearchQuery . searchVulnerability ( entry , vulnerability , sourceIP , sourceHost ) #NEWLINE# newResults = getElasticSearchResults ( newSearchResults ) #NEWLINE# if ( newResults != '0' ) : #NEWLINE# #INDENT# newResultCount = 0 #NEWLINE# isExploitFound = True #NEWLINE# for newhit in newSearchResults [ 'hits' ] [ 'hits' ] : #NEWLINE# #INDENT# try : #NEWLINE# #INDENT# attackerIP = newhit [ '_source' ] [ 'evt_srcip' ] #NEWLINE# #UNINDENT# except : #NEWLINE# #INDENT# attackerIP = '0.0.0.0' #NEWLINE# #UNINDENT# cnx = getDBConnector ( ) #NEWLINE# cursor = cnx . cursor ( ) #NEWLINE# query = ( ( ( ( ( ( "SELECT count(*) as count from attackInventory where victim_ip = '" + str ( ip2long ( sourceIP ) ) ) + "' and threat_id = '" ) + vulnerability ) + "' and attack_log = '" ) + newhit [ '_source' ] [ 'message' ] ) + "'" ) #NEWLINE# cursor . execute ( query ) #NEWLINE# for row in cursor : #NEWLINE# #INDENT# logCheck = row [ 0 ] #NEWLINE# #UNINDENT# cursor . close ( ) #NEWLINE# if ( logCheck == 0 ) : #NEWLINE# #INDENT# cursor = cnx . cursor ( ) #NEWLINE# add_logInstance = 'INSERT INTO attackInventory (victim_ip, attacker_ip, attack_time, attack_log, threat_id) VALUES (%s, %s, %s, %s, %s)' #NEWLINE# logData = ( ip2long ( sourceIP ) , ip2long ( attackerIP ) , hit [ '_source' ] [ '@timestamp' ] , hit [ '_source' ] [ 'message' ] , vulnerability ) #NEWLINE# cursor . execute ( add_logInstance , logData ) #NEWLINE# #UNINDENT# cursor = cnx . cursor ( ) #NEWLINE# query = ( ( ( ( ( ( "SELECT count(*) as count from attackInventory where victim_ip = '" + str ( ip2long ( sourceIP ) ) ) + "' and threat_id = '" ) + vulnerability ) + "' and attack_log = '" ) + newhit [ '_source' ] [ 'message' ] ) + "'" ) #NEWLINE# cursor . execute ( query ) #NEWLINE# for row in cursor : #NEWLINE# #INDENT# logCheck = row [ 0 ] #NEWLINE# #UNINDENT# cursor . close ( ) #NEWLINE# if ( logCheck == 0 ) : #NEWLINE# #INDENT# cursor = cnx . cursor ( ) #NEWLINE# add_logInstance = 'INSERT INTO attackInventory (victim_ip, attacker_ip, attack_time, attack_log, threat_id) VALUES (%s, %s, %s, %s, %s)' #NEWLINE# logData = ( ip2long ( sourceIP ) , ip2long ( attackerIP ) , newhit [ '_source' ] [ '@timestamp' ] , newhit [ '_source' ] [ 'message' ] , vulnerability ) #NEWLINE# cursor . execute ( add_logInstance , logData ) #NEWLINE# cnx . commit ( ) #NEWLINE# cursor . close ( ) #NEWLINE# #UNINDENT# cnx . close ( ) #NEWLINE# newResultCount = ( newResultCount + 1 ) #NEWLINE# #UNINDENT# #UNINDENT# else : #NEWLINE# #INDENT# newResultCount = 0 #NEWLINE# #UNINDENT# resultCount = ( newResultCount + 1 ) #NEWLINE# #UNINDENT# #UNINDENT# #UNINDENT# else : #NEWLINE# #INDENT# if ( operator == 'OR' ) : #NEWLINE# #INDENT# if ( searchStringCount == 1 ) : #NEWLINE# #INDENT# if ( int ( numResults ) > 0 ) : #NEWLINE# #INDENT# resultCount = int ( numResults ) #NEWLINE# writeElasticSearchResults ( searchResults , vulnObject , sourceIP , vulnerability ) #NEWLINE# isExploitFound = True #NEWLINE# #UNINDENT# #UNINDENT# if ( searchStringCount > 1 ) : #NEWLINE# #INDENT# entry = re . sub ( '\\<startTime\\>' , startTime , entry ) #NEWLINE# entry = re . sub ( '\\<endTime\\>' , endTime , entry ) #NEWLINE# if ( sourceIP == '*' ) : #NEWLINE# #INDENT# entry = re . sub ( '\\<min_count\\>' , '1' , entry ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# entry = re . sub ( '\\<min_count\\>' , '2' , entry ) #NEWLINE# #UNINDENT# if ( len ( searchStringResults ) > 1 ) : #NEWLINE# #INDENT# searchResults = ElasticSearchQuery . searchVulnerability ( entry , vulnerability , sourceIP , sourceHost ) #NEWLINE# numResults = getElasticSearchResults ( searchResults ) #NEWLINE# if ( int ( numResults ) > 0 ) : #NEWLINE# #INDENT# writeElasticSearchResults ( searchResults , vulnObject , sourceIP , vulnerability ) #NEWLINE# #UNINDENT# resultCount = ( resultCount + int ( numResults ) ) #NEWLINE# #UNINDENT# #UNINDENT# #UNINDENT# #UNINDENT# searchStringCount = ( searchStringCount + 1 ) #NEWLINE# #UNINDENT# #UNINDENT# #UNINDENT# if ( isExploitFound == True ) : #NEWLINE# #INDENT# print ( ( ( '  Found ' + str ( resultCount ) ) + ' instances of exploitation!' ) ) #NEWLINE# print ( '  Generating attack logs' ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# print ( '  No instances of exploitation found.\n' ) #NEWLINE# #UNINDENT# #UNINDENT# #UNINDENT# #UNINDENT# else : #NEWLINE# #INDENT# resultCount = 0 #NEWLINE# print ( 'Invalid vulnerability ID' ) #NEWLINE# #UNINDENT# return resultCount