Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Excavate tries to de-duplicate yara matches based on description #1938

Closed
wants to merge 7 commits into from
+2 −1
Closed

Excavate tries to de-duplicate yara matches based on description #1938

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
4a9a6f7
Created a new module dom_excavate that will fully load a URL and sear…
aconite33 Nov 7, 2024
a32d759
Updated excavate to include the url_string in the description in orde…
aconite33 Nov 8, 2024
2db3334
Removed module not related to PR.
aconite33 Nov 8, 2024
3d7dee3
Fixed linting.
aconite33 Nov 8, 2024
c73af0e
refactor excavate finding description
liquidsec Nov 8, 2024
3aa3d96
spacing
liquidsec Nov 8, 2024
6b32b0b
Merge branch 'dev' into excavate_dedup
liquidsec Nov 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion bbot/modules/internal/excavate.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -274,8 +274,9 @@ async def process(self, yara_results, event, yara_rule_settings, discovery_conte
description_string = (
f" with description: [{yara_rule_settings.description}]" if yara_rule_settings.description else ""
)
url_string = event.data.get("url") or event.data.get("host", "Unknown Source")
event_data["description"] = (
f"Custom Yara Rule [{self.name}]{description_string} Matched via identifier [{identifier}]"
f"Custom Yara Rule [{self.name}]{description_string} Matched via identifier [{identifier}] on [{url_string}]"
)
if yara_rule_settings.emit_match:
event_data["description"] += f" and extracted [{result}]"
Expand Down
Loading