search

cisagov / CHIRP

A DFIR tool written in Python.
Creative Commons Zero v1.0 Universal
1.04k stars 90 forks source link

Add Malicious IP Addresses Associated with CISA Alert - AA21-062A #18

Closed greyl0cke closed 3 years ago

greyl0cke commented 3 years ago

🗣 Description

Added malicious IP addresses associated with CISA Alert - AA21-062A

https://us-cert.cisa.gov/ncas/alerts/aa21-062a

💭 Motivation and context

I've started to use this tool with clients to detect any network activity related to the recent Exchange vulnerabilities. Figured others might want to do the same.

DeemOnSecurity commented 3 years ago

I see you’re trying to pass the CI checks. Please check out the instructions in CONTRIBUTING.md to see how to run pre-commit checks on your local machine. This will let precommit actually modify the files to make the fix.

greyl0cke commented 3 years ago

I see you’re trying to pass the CI checks. Please check out the instructions in CONTRIBUTING.md to see how to run pre-commit checks on your local machine. This will let precondition actually modify the files to make the fix.

Thanks, I'll re-read the doc I'm sure I missed something.

This was actually my first pull request, apologies for the confusion.

greyl0cke commented 3 years ago

Once the previous change request has been fulfilled (a link to the volexity report in the description field of the indicator) and this is passing pre-commit checks I will merge with main

I changed the description and included the Alert from CISA (as well as the URL to the CISA alert) as that has the exact same info as the Volexity blog post. This is also passing pre-commit checks now but I'm not sure what to do with the first two commits that failed.