search

outflanknl / RedELK

Red Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.
BSD 3-Clause "New" or "Revised" License
2.35k stars 371 forks source link

New alarm: alarm_baddomain: domain has a 'bad' classification. #131

Open xychix opened 3 years ago

xychix commented 3 years ago

alarm when a domain has a 'bad' classification. Bad is defined in the list that is already added as comment to alarm_check4 in alarm.py.

This list of bad words comes from a review of classes defined by the domain checkers as currently supported by chameleon.py

xychix commented 3 years ago

is this a duplicate of issue #127 ?

MarcOverIP commented 3 years ago

Not sure if duplicate.

MarcOverIP commented 3 years ago

Below the full list of bad words that should be checked against. I created this by carving the documentation by the domain classifiers. Some words are cut short for easier checking.

abortion, adult, adware, alcohol, anonym, botnet, c2, command and control, compromised, controlled, copyright, crime, criminal, cryptocurrency, discrimination, early warning, extreme, file sharing, freeware, gambling, gore, gruesome, hacking, hate, illegal, intolerance, keyloggers, lottery, malicious, malnets, malware, marijuana, mature, military, moderated, nudity, p2p, phishing, piracy, placeholders, political, pornography, proxy, questionable, scam, sects, sex, shareware, spam, spyware, suspicious, tabacco, unwanted, usenet, violence, warez, weapons

fastlorenzo commented 2 years ago

pending on #270

MarcOverIP commented 2 years ago

After discussion with @fastlorenzo, decided that this first needs restructuring of how we handle domain info. So this is pending on #270