example.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "from snortparser import Parser"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{'header': OrderedDict([('action', 'alert'),\n",
       "              ('proto', 'tcp'),\n",
       "              ('source', (True, 'any')),\n",
       "              ('src_port', (True, 'any')),\n",
       "              ('arrow', '->'),\n",
       "              ('destination', (True, 'any')),\n",
       "              ('dst_port', (True, 'any'))]),\n",
       " 'options': OrderedDict([(0,\n",
       "               ('msg',\n",
       "                ['\"Non-Std TCP Client Traffic contains \"HX1|3a|\" \"HX2|3a|\" \"HX3|3a|\" \"HX4|3a|\" (PLUGX Variant)\"'])),\n",
       "              (1, ('sid', ['7238331'])),\n",
       "              (2, ('rev', ['20170428'])),\n",
       "              (3, ('flow', ['established', 'to_server'])),\n",
       "              (4, ('content', ['\"Accept|3a 20 2a 2f 2a|\"'])),\n",
       "              (5, ('nocase', '')),\n",
       "              (6, ('content', ['\"HX1|3a|\"'])),\n",
       "              (7, ('distance', ['0'])),\n",
       "              (8, ('within', ['6'])),\n",
       "              (9, ('fast_pattern', '')),\n",
       "              (10, ('content', ['\"HX2|3a|\"'])),\n",
       "              (11, ('nocase', '')),\n",
       "              (12, ('distance', ['0'])),\n",
       "              (13, ('content', ['\"HX3|3a|\"'])),\n",
       "              (14, ('nocase', '')),\n",
       "              (15, ('distance', ['0'])),\n",
       "              (16, ('content', ['\"HX4|3a|\"'])),\n",
       "              (17, ('nocase', '')),\n",
       "              (18, ('distance', ['0'])),\n",
       "              (19, ('classtype', ['nonstd-tcp'])),\n",
       "              (20,\n",
       "               ('threshold',\n",
       "                ['type limit', ' track by_src', ' count 1 ', ' seconds 60'])),\n",
       "              (21, ('priority', ['X'])),\n",
       "              (22,\n",
       "               ('reference',\n",
       "                ['url',\n",
       "                 'cti.cert.europa.eu/index.php/mnuthreatobject/indicatorslist/details/83/12844'])),\n",
       "              (23, ('gid', ['1']))])}"
      ]
     },
     "execution_count": 2,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "rules = [\n",
    "    'alert tcp any any -> any any (msg:\"Non-Std TCP Client Traffic contains \"HX1|3a|\" \"HX2|3a|\" \"HX3|3a|\" \"HX4|3a|\" (PLUGX Variant)\"; sid:7238331; rev:20170428; flow:established,to_server; content:\"Accept|3a 20 2a 2f 2a|\"; nocase; content:\"HX1|3a|\"; distance:0; within:6; fast_pattern; content:\"HX2|3a|\"; nocase; distance:0; content:\"HX3|3a|\"; nocase; distance:0; content:\"HX4|3a|\"; nocase; distance:0; classtype:nonstd-tcp; threshold:type limit, track by_src, count 1 , seconds 60;priority:X; reference:url,cti.cert.europa.eu/index.php/mnuthreatobject/indicatorslist/details/83/12844; gid:1;)',\n",
    "    'alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg: \"CrowdStrike Possible Empire Powershell C2 Request\"; flow: to_server,established; content: \"GET /login/process.php HTTP/1.1|0d 0a|Cookie: session=\"; depth:49; content: \"=|0d 0a|User-Agent: Mozilla/5.0 (Windows NT 6.1\\\\; WOW64\\\\; Trident/7.0\\\\; rv:11.0) like Gecko|0d 0a|Host: \"; offset:76; depth:91; content: \"Connection: Keep-Alive|0d 0a 0d 0a|\"; classtype: trojan-activity; sid:8001380; rev:20190308;)',\n",
    "    'alert tcp $HOME_NET ANY -> $EXTERNAL_NET $HTTP_PORTS (msg: \"CrowdStrike VOODOO BEAR VBS Backdoor [CSIT-18082]\"; flow: established, to_server; content: \"POST\"; http_method; content: \"Content-Type:|20|application/x-www-form-urlencoded\"; http_header; content: \"ui=en-US&\"; http_client_body; depth: 9; content: \"_LinkId=\"; http_client_body; within: 13; classtype: trojan-activity; metadata: service http; sid:8001209; rev:20180523; reference:url,falcon.crowdstrike.com/intelligence/reports/CSIT-18082;)',\n",
    "]\n",
    "\n",
    "Parser(rules[0]).all"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{'header': OrderedDict([('action', 'alert'),\n",
       "              ('proto', 'tcp'),\n",
       "              ('source', (True, '$HOME_NET')),\n",
       "              ('src_port', (True, 'any')),\n",
       "              ('arrow', '->'),\n",
       "              ('destination', (True, '$EXTERNAL_NET')),\n",
       "              ('dst_port', (True, 'any'))]),\n",
       " 'options': OrderedDict([(0,\n",
       "               ('msg',\n",
       "                [' \"CrowdStrike Possible Empire Powershell C2 Request\"'])),\n",
       "              (1, ('flow', [' to_server', 'established'])),\n",
       "              (2,\n",
       "               ('content',\n",
       "                [' \"GET /login/process.php HTTP/1.1|0d 0a|Cookie: session=\"'])),\n",
       "              (3, ('depth', ['49'])),\n",
       "              (4,\n",
       "               ('content',\n",
       "                [' \"=|0d 0a|User-Agent: Mozilla/5.0 (Windows NT 6.1\\\\ WOW64\\\\ Trident/7.0\\\\ rv:11.0) like Gecko|0d 0a|Host: \"'])),\n",
       "              (5, ('offset', ['76'])),\n",
       "              (6, ('depth', ['91'])),\n",
       "              (7, ('content', [' \"Connection: Keep-Alive|0d 0a 0d 0a|\"'])),\n",
       "              (8, ('classtype', [' trojan-activity'])),\n",
       "              (9, ('sid', ['8001380'])),\n",
       "              (10, ('rev', ['20190308']))])}"
      ]
     },
     "execution_count": 3,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "Parser(rules[1]).all"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{'header': OrderedDict([('action', 'alert'),\n",
       "              ('proto', 'tcp'),\n",
       "              ('source', (True, '$HOME_NET')),\n",
       "              ('src_port', (True, 'ANY')),\n",
       "              ('arrow', '->'),\n",
       "              ('destination', (True, '$EXTERNAL_NET')),\n",
       "              ('dst_port', (True, '$HTTP_PORTS'))]),\n",
       " 'options': OrderedDict([(0,\n",
       "               ('msg',\n",
       "                [' \"CrowdStrike VOODOO BEAR VBS Backdoor [CSIT-18082]\"'])),\n",
       "              (1, ('flow', [' established', ' to_server'])),\n",
       "              (2, ('content', [' \"POST\"'])),\n",
       "              (3, ('http_method', '')),\n",
       "              (4,\n",
       "               ('content',\n",
       "                [' \"Content-Type:|20|application/x-www-form-urlencoded\"'])),\n",
       "              (5, ('http_header', '')),\n",
       "              (6, ('content', [' \"ui=en-US&\"'])),\n",
       "              (7, ('http_client_body', '')),\n",
       "              (8, ('depth', [' 9'])),\n",
       "              (9, ('content', [' \"_LinkId=\"'])),\n",
       "              (10, ('http_client_body', '')),\n",
       "              (11, ('within', [' 13'])),\n",
       "              (12, ('classtype', [' trojan-activity'])),\n",
       "              (13, ('metadata', [' service http'])),\n",
       "              (14, ('sid', ['8001209'])),\n",
       "              (15, ('rev', ['20180523'])),\n",
       "              (16,\n",
       "               ('reference',\n",
       "                ['url',\n",
       "                 'falcon.crowdstrike.com/intelligence/reports/CSIT-18082']))])}"
      ]
     },
     "execution_count": 4,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "Parser(rules[2]).all"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.10.4"
  },
  "orig_nbformat": 4,
  "vscode": {
   "interpreter": {
    "hash": "2ab98c4b59af728aa8bd9922870b996a7fc5861c87b81242319b92eec59b5fef"
   }
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}