<gh_stars>1-10
#!/usr/bin/python3
"""
Part of RedELK

This check queries for UA\'s that are listed in any blacklist_useragents.conf and do talk to c2* paths on redirectors

Authors:
- <NAME>. / <NAME> (@xychix)
- <NAME> (@fastlorenzo)
"""
import logging
import traceback

from modules.helpers import get_initial_alarm_result, get_query

info = {
    'version': 0.1,
    'name': 'User-agent module',
    'alarmmsg': 'VISIT FROM BLACKLISTED USERAGENT TO C2_*',
    'description': 'This check queries for UA\'s that are listed in any blacklist_useragents.conf and do talk to c2* paths on redirectors',
    'type': 'redelk_alarm',   # Could also contain redelk_enrich if it was an enrichment module
    'submodule': 'alarm_useragent'
}


class Module():
    """ User-agent module """
    def __init__(self):
        self.logger = logging.getLogger(info['submodule'])

    def run(self):
        """ Run the alarm module """
        ret = get_initial_alarm_result()
        ret['info'] = info
        ret['fields'] = ['agent.hostname', '@timestamp', 'source.ip', 'http.headers.useragent', 'source.nat.ip', 'redir.frontend.name', 'redir.backend.name', 'infra.attack_scenario']
        ret['groupby'] = ['source.ip', 'http.headers.useragent']
        try:
            report = self.alarm_check()
            ret['hits']['hits'] = report['hits']
            ret['hits']['total'] = len(report['hits'])
        # pylint: disable=broad-except
        except Exception as error:
            stack_trace = traceback.format_exc()
            ret['error'] = stack_trace
            self.logger.exception(error)
        self.logger.info('finished running module. result: %s hits', ret['hits']['total'])
        return ret

    def alarm_check(self):
        """ This check queries for UA's that are listed in any blacklist_useragents.conf and do talk to c2* paths on redirectors
        We will dig trough ALL data finding specific IP related lines and tag them reading the useragents we trigger on. """
        file_name = "/etc/redelk/rogue_useragents.conf"
        with open(file_name) as file:
            content = file.readlines()
        ua_list = []
        for line in content:
            if not line.startswith('#'):
                ua_list.append(line.strip())
        keywords = ua_list
        es_subquery = ""
        # add keywords (UA's) to query
        for keyword in keywords:
            if es_subquery == "":
                es_subquery = "(http.headers.useragent:%s" % keyword
            else:
                es_subquery = es_subquery + " OR http.headers.useragent:%s" % keyword
        es_subquery = es_subquery + ") "
        # q = "%s AND redir.backendname:c2* AND tags:enrich_* AND NOT tags:alarm_* "%qSub
        es_query = "%s AND redir.backend.name:c2* AND NOT tags:alarm_useragent" % es_subquery

        es_results = get_query(es_query, 10000)
        report = {}
        report['hits'] = es_results
        return report

#!/usr/bin/python3
"""
Part of RedELK

This check queries for UA\'s that are listed in any blacklist_useragents.conf and do talk to c2* paths on redirectors

Authors:
- <NAME>. / <NAME> (@xychix)
- <NAME> (@fastlorenzo)
"""
import logging
import traceback

from modules.helpers import get_initial_alarm_result, get_query

info = {
    'version': 0.1,
    'name': 'User-agent module',
    'alarmmsg': 'VISIT FROM BLACKLISTED USERAGENT TO C2_*',
    'description': 'This check queries for UA\'s that are listed in any blacklist_useragents.conf and do talk to c2* paths on redirectors',
    'type': 'redelk_alarm',   # Could also contain redelk_enrich if it was an enrichment module
    'submodule': 'alarm_useragent'
}


class Module():
    """ User-agent module """
    def __init__(self):
        self.logger = logging.getLogger(info['submodule'])

    def run(self):
        """ Run the alarm module """
        ret = get_initial_alarm_result()
        ret['info'] = info
        ret['fields'] = ['agent.hostname', '@timestamp', 'source.ip', 'http.headers.useragent', 'source.nat.ip', 'redir.frontend.name', 'redir.backend.name', 'infra.attack_scenario']
        ret['groupby'] = ['source.ip', 'http.headers.useragent']
        try:
            report = self.alarm_check()
            ret['hits']['hits'] = report['hits']
            ret['hits']['total'] = len(report['hits'])
        # pylint: disable=broad-except
        except Exception as error:
            stack_trace = traceback.format_exc()
            ret['error'] = stack_trace
            self.logger.exception(error)
        self.logger.info('finished running module. result: %s hits', ret['hits']['total'])
        return ret

    def alarm_check(self):
        """ This check queries for UA's that are listed in any blacklist_useragents.conf and do talk to c2* paths on redirectors
        We will dig trough ALL data finding specific IP related lines and tag them reading the useragents we trigger on. """
        file_name = "/etc/redelk/rogue_useragents.conf"
        with open(file_name) as file:
            content = file.readlines()
        ua_list = []
        for line in content:
            if not line.startswith('#'):
                ua_list.append(line.strip())
        keywords = ua_list
        es_subquery = ""
        # add keywords (UA's) to query
        for keyword in keywords:
            if es_subquery == "":
                es_subquery = "(http.headers.useragent:%s" % keyword
            else:
                es_subquery = es_subquery + " OR http.headers.useragent:%s" % keyword
        es_subquery = es_subquery + ") "
        # q = "%s AND redir.backendname:c2* AND tags:enrich_* AND NOT tags:alarm_* "%qSub
        es_query = "%s AND redir.backend.name:c2* AND NOT tags:alarm_useragent" % es_subquery

        es_results = get_query(es_query, 10000)
        report = {}
        report['hits'] = es_results
        return report
#!/usr/bin/python3 Part of RedELK  This check queries for UA\'s that are listed in any blacklist_useragents.conf and do talk to c2* paths on redirectors  Authors: - <NAME>. / <NAME> (@xychix) - <NAME> (@fastlorenzo) # Could also contain redelk_enrich if it was an enrichment module User-agent module Run the alarm module # pylint: disable=broad-except This check queries for UA's that are listed in any blacklist_useragents.conf and do talk to c2* paths on redirectors         We will dig trough ALL data finding specific IP related lines and tag them reading the useragents we trigger on. # add keywords (UA's) to query # q = "%s AND redir.backendname:c2* AND tags:enrich_* AND NOT tags:alarm_* "%qSub