Merge pull request #1 from lawndoc/main

Add CSVs and automate detection artifact generation

.github/workflows/generate_artifacts.yml

@@ -0,0 +1,47 @@
+name: "Generate Artifacts"
+
+on:
+  push:
+    branches:
+      - "main"
+    paths:
+      - "leaked/**"
+      - "malicious/**"
+  workflow_dispatch:
+
+jobs:
+  generate-artifacts:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install dependencies
+        run: |
+          pip install -r ./scripts/requirements.txt
+
+      - name: Generate CSVs
+        working-directory: ./scripts
+        run: |
+          python generate_csv.py
+
+      - name: Generate YARA
+        working-directory: ./scripts
+        run: |
+          python generate_yara.py
+
+      - name: Update repository
+        run: |
+          git config --local user.name "GitHub Actions [Bot]"
+          git config --local user.email "github-actions[bot]@users.noreply.github.com"
+          git add yara
+          git add csv
+          git commit -m "Auto-generated detection artifacts"
+          git push
+

.gitignore

@@ -0,0 +1,14 @@
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+

csv/leaked.csv

@@ -0,0 +1,6 @@
+name,status,source,description,references,date,author,issuer,timestamp,serial
+msi_leaked_certificate,revoked,leaked,Leaked certificate from MicroStar International (MSI) driver package.,https://thehackernews.com/2023/05/msi-data-breach-private-code-signing.html,31-08-2023,WithSecure,DigiCert SHA2 Assured ID Code Signing CA,,0b:88:60:32:86:1d:95:53:c6:8f:80:33:13:a9:89:75
+lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS.,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5
+lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS.,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18
+hangil_it_leaked_certificate,revoked,leaked,"Leaked Hangil IT Co., Ltd certificate utilised by various malware.",,15-11-2023,Riccardo Ancarani,Sectigo Public Code Signing CA R36,,01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45
+anydesk_leaked_certificate,revoked,leaked,AnyDesk Revoked Certificates after public statement: https://anydesk.com/en/public-statement,https://github.com/Neo23x0/signature-base/blob/master/yara/gen_anydesk_compromised_cert_feb23.yar,07-02-2024,Florian Roth,DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,1706486400,0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8

csv/malicious.csv

@@ -0,0 +1,3 @@
+name,status,source,description,references,date,author,issuer,timestamp,serial
+lamera_dprk_certificate,revoked,malicious,Certificate utilised to sign malware attributed to North Korea.,https://labs.withsecure.com/publications/no-pineapple-dprk-targeting-of-medical-research-and-technology-sector,31-08-2023,WithSecure,LAMERA CORPORATION LIMITED,,87:9f:a9:42:f9:f0:97:b7:4f:d6:f7:da:bc:f1:74:5a
+hacking_team_malicious_certificate,expired,malicious,Certificate utilised by Hacking Team.,https://www.trendmicro.com/vinfo/fr/security/news/vulnerabilities-and-exploits/the-hacking-team-leak-zero-days-patches-and-more-zero-days,15-11-2023,WithSecure,VeriSign Class 3 Code Signing 2010 CA,,0f:1b:43:48:4a:13:69:c8:30:38:dc:24:e7:77:8b:7d

scripts/generate_csv.py

@@ -0,0 +1,33 @@
+import csv
+import glob
+import yaml
+
+for folder in ("leaked", "malicious"):
+    yml_files = glob.glob(f"../{folder}/*.yml", recursive=True)
+    csv_file = open(f"../csv/{folder}.csv", "w")
+    csv_writer = csv.writer(csv_file)
+    csv_writer.writerow(["name","status","source","description","references","date","author","issuer","timestamp","serial"])
+
+    # Generate the csv file for each folder
+    for yml_file in yml_files:
+        # Load the yml file
+        with open(yml_file, 'r') as stream:
+            try:
+                yml = yaml.safe_load(stream)
+            except yaml.YAMLError as exc:
+                print(exc)
+        for serial in yml["serial"]:
+            # Generate the csv entry
+            csv_writer.writerow([
+                yml["name"],
+                yml["meta"]["status"],
+                yml["meta"]["source"],
+                yml["meta"]["description"].strip().replace("\n", " "),
+                yml["meta"]["references"],
+                yml["meta"]["date"],
+                yml["meta"]["author"],
+                yml["issuer"],
+                str(yml["timestamp"]) if "timestamp" in yml else "",
+                serial
+            ])
+    csv_file.close()

scripts/requirements.txt

@@ -0,0 +1,3 @@
+Jinja2==3.1.3
+MarkupSafe==2.1.5
+PyYAML==6.0.1

yara/anydesk_leaked_certificate.yar

@@ -0,0 +1,18 @@
+import "pe"
+
+rule leaked_anydesk_leaked_certificate {
+   meta:
+      status = "revoked"
+      source = "leaked"
+      description = "AnyDesk Revoked Certificates after public statement: https://anydesk.com/en/public-statement"
+      references = "https://github.com/Neo23x0/signature-base/blob/master/yara/gen_anydesk_compromised_cert_feb23.yar"
+      date = "07-02-2024"
+      author = "Florian Roth"
+      
+   condition:
+      uint16(0) == 0x5a4d and pe.timestamp > 1706486400 and
+      for any i in (0 .. pe.number_of_signatures) : (
+         pe.signatures[i].issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and
+         pe.signatures[i].serial == "0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8"
+      )
+}

yara/hacking_team_malicious_certificate.yar

@@ -0,0 +1,18 @@
+import "pe"
+
+rule malicious_hacking_team_malicious_certificate {
+   meta:
+      status = "expired"
+      source = "malicious"
+      description = "Certificate utilised by Hacking Team."
+      references = "https://www.trendmicro.com/vinfo/fr/security/news/vulnerabilities-and-exploits/the-hacking-team-leak-zero-days-patches-and-more-zero-days"
+      date = "15-11-2023"
+      author = "WithSecure"
+      
+   condition:
+      uint16(0) == 0x5a4d and 
+      for any i in (0 .. pe.number_of_signatures) : (
+         pe.signatures[i].issuer contains "VeriSign Class 3 Code Signing 2010 CA" and
+         pe.signatures[i].serial == "0f:1b:43:48:4a:13:69:c8:30:38:dc:24:e7:77:8b:7d"
+      )
+}

yara/hangil_it_leaked_certificate.yar

@@ -0,0 +1,18 @@
+import "pe"
+
+rule leaked_hangil_it_leaked_certificate {
+   meta:
+      status = "revoked"
+      source = "leaked"
+      description = "Leaked Hangil IT Co., Ltd certificate utilised by various malware."
+      references = ""
+      date = "15-11-2023"
+      author = "Riccardo Ancarani"
+      
+   condition:
+      uint16(0) == 0x5a4d and 
+      for any i in (0 .. pe.number_of_signatures) : (
+         pe.signatures[i].issuer contains "Sectigo Public Code Signing CA R36" and
+         pe.signatures[i].serial == "01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45"
+      )
+}