lib/tasks/threat/search_blcheck_list.rb
# Check the BlackLists database for suspicious or malicious IP addresses or domains
Check the BlackLists database for suspicious or malicious IP addresses or domains
Check the BlackLists database for suspicious or malicious IP addresses or domains
def check_blcheck inves, dns_obj, blacklists
    revip = inves.to_s.split(/\./).reverse.join(".")
    i = 1
    f = []
    blacklists.each do |data|
      query = revip +"."+ data["dnsbl"]
      f = dns_obj.getaddresses(query)
      _log "#{i}/ 122  checks vs #{data["dnsbl"]} ... "
      f.each do |j|
        if j.to_s.include? "127."
          if data["query"] == true
            source = "#{data["reference"]}#{inves}"
          else
            source = data["reference"]
          end
          _create_linked_issue("suspicious_activity_detected", {
            status: "confirmed",
            description: "Suspicious activity was detcted on this entity.",
            proof: "This IP was found in the #{data["dnsbl"]} list",
            source: source,
            confidence: data["confidence"]
          })
          blocked_list = @entity.get_detail("suspicious_activity_detected") || []
          @entity.set_detail("suspicious_activity_detected", blocked_list.concat([{source: source}]))
        end
      end
      i += 1
    end
  end
def check_blcheck inves , dns_obj , blacklists revip = inves . to_s . split ( / \. / ) . reverse . join ( "." ) i = 1 f = [ ] blacklists . each do | data | query = revip + "." + data [ "dnsbl" ] f = dns_obj . getaddresses ( query ) _log "#{i}/ 122  checks vs #{data["dnsbl"]} ... " f . each do | j | if j . to_s . include? "127." if data [ "query" ] == true source = "#{data["reference"]}#{inves}" else source = data [ "reference" ] end _create_linked_issue ( "suspicious_activity_detected" , { status : "confirmed" , description : "Suspicious activity was detcted on this entity." , proof : "This IP was found in the #{data["dnsbl"]} list" , source : source , confidence : data [ "confidence" ] } ) blocked_list = @entity . get_detail ( "suspicious_activity_detected" ) || [ ] @entity . set_detail ( "suspicious_activity_detected" , blocked_list . concat ( [ { source : source } ] ) ) end end i += 1 end end
Check the BlackLists database for suspicious or malicious IP addresses or domains
Check the BlackLists database for suspicious or malicious IP addresses or domains
# Reverse the IP to match the Dbl rules for checks # Perform nslookup vs every bl in the list #puts data["dnsbl"] # Get the source of the blocker # Getting multiple addresses results from the nslookup # Investigate if the response is similar to 127.0.0. # for confirming the listing # Create an issue if the IP is blacklisted #_log "creating issue ... #{source}" # Also store it on the entity
inves
dns_obj
blacklists