Skip to content

Commit

Permalink
Updated excavate to include the url_string in the description in orde…
Browse files Browse the repository at this point in the history
…r to unique identify when a yara rule hits a URL.
  • Loading branch information
aconite33 committed Nov 8, 2024
1 parent 4a9a6f7 commit a32d759
Showing 1 changed file with 5 additions and 1 deletion.
6 changes: 5 additions & 1 deletion bbot/modules/internal/excavate.py
Original file line number Diff line number Diff line change
Expand Up @@ -274,8 +274,12 @@ async def process(self, yara_results, event, yara_rule_settings, discovery_conte
description_string = (
f" with description: [{yara_rule_settings.description}]" if yara_rule_settings.description else ""
)
# Get URL from event if available
url = event.data.get("url", "") if hasattr(event, "data") else ""
url_string = f" on @{url}" if url else ""

event_data["description"] = (
f"Custom Yara Rule [{self.name}]{description_string} Matched via identifier [{identifier}]"
f"Custom Yara Rule [{self.name}]{description_string} Matched via identifier [{identifier}]{url_string}"
)
if yara_rule_settings.emit_match:
event_data["description"] += f" and extracted [{result}]"
Expand Down

0 comments on commit a32d759

Please sign in to comment.