search

TheHive-Project / Cortex

Cortex: a Powerful Observable Analysis and Active Response Engine
https://strangebee.com/cortex/
GNU Affero General Public License v3.0
1.35k stars 232 forks source link

Malwareconfig Lookup and Yara Rule Additions #57

Closed darksheer closed 6 years ago

darksheer commented 6 years ago

Request Type

Feature Request

Problem Description

Cortex currently doesn't support lookups via http://mawareconfig.com. Having the ability to enrich data via Malware config would be a nice addition to the suite of Cortex analyzers.

Possible Solutions

Malwareconfig's API documentation is available here: https://malwareconfig.com/api/

Lookups to Malwareconfig.com are:

File submission is also possible.

Stat information, based on sample type ( https://malwareconfig.com/stats/ ) could also be used for weighting of results.

Screenshots, Geo locations, and other data is also available, which would be great to pass over to theHive for visual enrichment (I'll cut a separate issue to theHive referencing this request).

Malwareconfig also allows for downloading of Yara files, based on OS types, along with individual yara files. Having the Yara cortex analyzer auto-download those along with the Git repo would be an added value.

Complementary information

https://malwareconfig.com/yara/ https://malwareconfig.com/api/

darksheer commented 6 years ago

I'll happily take a look to see if this is something I could assist with, but didn't want to go down the path silently in case it's already being addressed.

nadouani commented 6 years ago

Hello @darksheer, thanks for the suggestion. I'll move this issue to https://github.com/TheHive-Project/Cortex-Analyzers repo since it's related to analyzers development.

If you are willing to help, you can contribute that analyzer, we can review it and make it public ;)

Thanks