diff --git a/.github/workflows/generate_artifacts.yml b/.github/workflows/generate_artifacts.yml new file mode 100644 index 0000000..e82c602 --- /dev/null +++ b/.github/workflows/generate_artifacts.yml @@ -0,0 +1,47 @@ +name: "Generate Artifacts" + +on: + push: + branches: + - "main" + paths: + - "leaked/**" + - "malicious/**" + workflow_dispatch: + +jobs: + generate-artifacts: + runs-on: ubuntu-latest + + steps: + - name: Check out repository + uses: actions/checkout@v4 + + - name: Setup Python + uses: actions/setup-python@v5 + with: + python-version: "3.11" + + - name: Install dependencies + run: | + pip install -r ./scripts/requirements.txt + + - name: Generate CSVs + working-directory: ./scripts + run: | + python generate_csv.py + + - name: Generate YARA + working-directory: ./scripts + run: | + python generate_yara.py + + - name: Update repository + run: | + git config --local user.name "GitHub Actions [Bot]" + git config --local user.email "github-actions[bot]@users.noreply.github.com" + git add yara + git add csv + git commit -m "Auto-generated detection artifacts" + git push + diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..e22547d --- /dev/null +++ b/.gitignore @@ -0,0 +1,14 @@ +# Environments +.env +.venv +env/ +venv/ +ENV/ +env.bak/ +venv.bak/ + +# Byte-compiled / optimized / DLL files +__pycache__/ +*.py[cod] +*$py.class + diff --git a/csv/leaked.csv b/csv/leaked.csv new file mode 100644 index 0000000..0ffbc55 --- /dev/null +++ b/csv/leaked.csv @@ -0,0 +1,6 @@ +name,status,source,description,references,date,author,issuer,timestamp,serial +msi_leaked_certificate,revoked,leaked,Leaked certificate from MicroStar International (MSI) driver package.,https://thehackernews.com/2023/05/msi-data-breach-private-code-signing.html,31-08-2023,WithSecure,DigiCert SHA2 Assured ID Code Signing CA,,0b:88:60:32:86:1d:95:53:c6:8f:80:33:13:a9:89:75 +lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS.,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5 +lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS.,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18 +hangil_it_leaked_certificate,revoked,leaked,"Leaked Hangil IT Co., Ltd certificate utilised by various malware.",,15-11-2023,Riccardo Ancarani,Sectigo Public Code Signing CA R36,,01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45 +anydesk_leaked_certificate,revoked,leaked,AnyDesk Revoked Certificates after public statement: https://anydesk.com/en/public-statement,https://github.com/Neo23x0/signature-base/blob/master/yara/gen_anydesk_compromised_cert_feb23.yar,07-02-2024,Florian Roth,DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,1706486400,0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8 diff --git a/csv/malicious.csv b/csv/malicious.csv new file mode 100644 index 0000000..e0353e0 --- /dev/null +++ b/csv/malicious.csv @@ -0,0 +1,3 @@ +name,status,source,description,references,date,author,issuer,timestamp,serial +lamera_dprk_certificate,revoked,malicious,Certificate utilised to sign malware attributed to North Korea.,https://labs.withsecure.com/publications/no-pineapple-dprk-targeting-of-medical-research-and-technology-sector,31-08-2023,WithSecure,LAMERA CORPORATION LIMITED,,87:9f:a9:42:f9:f0:97:b7:4f:d6:f7:da:bc:f1:74:5a +hacking_team_malicious_certificate,expired,malicious,Certificate utilised by Hacking Team.,https://www.trendmicro.com/vinfo/fr/security/news/vulnerabilities-and-exploits/the-hacking-team-leak-zero-days-patches-and-more-zero-days,15-11-2023,WithSecure,VeriSign Class 3 Code Signing 2010 CA,,0f:1b:43:48:4a:13:69:c8:30:38:dc:24:e7:77:8b:7d diff --git a/scripts/generate_csv.py b/scripts/generate_csv.py new file mode 100644 index 0000000..e2596b6 --- /dev/null +++ b/scripts/generate_csv.py @@ -0,0 +1,33 @@ +import csv +import glob +import yaml + +for folder in ("leaked", "malicious"): + yml_files = glob.glob(f"../{folder}/*.yml", recursive=True) + csv_file = open(f"../csv/{folder}.csv", "w") + csv_writer = csv.writer(csv_file) + csv_writer.writerow(["name","status","source","description","references","date","author","issuer","timestamp","serial"]) + + # Generate the csv file for each folder + for yml_file in yml_files: + # Load the yml file + with open(yml_file, 'r') as stream: + try: + yml = yaml.safe_load(stream) + except yaml.YAMLError as exc: + print(exc) + for serial in yml["serial"]: + # Generate the csv entry + csv_writer.writerow([ + yml["name"], + yml["meta"]["status"], + yml["meta"]["source"], + yml["meta"]["description"].strip().replace("\n", " "), + yml["meta"]["references"], + yml["meta"]["date"], + yml["meta"]["author"], + yml["issuer"], + str(yml["timestamp"]) if "timestamp" in yml else "", + serial + ]) + csv_file.close() diff --git a/scripts/requirements.txt b/scripts/requirements.txt new file mode 100644 index 0000000..5a874cf --- /dev/null +++ b/scripts/requirements.txt @@ -0,0 +1,3 @@ +Jinja2==3.1.3 +MarkupSafe==2.1.5 +PyYAML==6.0.1 diff --git a/yara/anydesk_leaked_certificate.yar b/yara/anydesk_leaked_certificate.yar new file mode 100644 index 0000000..5211fae --- /dev/null +++ b/yara/anydesk_leaked_certificate.yar @@ -0,0 +1,18 @@ +import "pe" + +rule leaked_anydesk_leaked_certificate { + meta: + status = "revoked" + source = "leaked" + description = "AnyDesk Revoked Certificates after public statement: https://anydesk.com/en/public-statement" + references = "https://github.com/Neo23x0/signature-base/blob/master/yara/gen_anydesk_compromised_cert_feb23.yar" + date = "07-02-2024" + author = "Florian Roth" + + condition: + uint16(0) == 0x5a4d and pe.timestamp > 1706486400 and + for any i in (0 .. pe.number_of_signatures) : ( + pe.signatures[i].issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and + pe.signatures[i].serial == "0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8" + ) +} \ No newline at end of file diff --git a/yara/hacking_team_malicious_certificate.yar b/yara/hacking_team_malicious_certificate.yar new file mode 100644 index 0000000..b021a2f --- /dev/null +++ b/yara/hacking_team_malicious_certificate.yar @@ -0,0 +1,18 @@ +import "pe" + +rule malicious_hacking_team_malicious_certificate { + meta: + status = "expired" + source = "malicious" + description = "Certificate utilised by Hacking Team." + references = "https://www.trendmicro.com/vinfo/fr/security/news/vulnerabilities-and-exploits/the-hacking-team-leak-zero-days-patches-and-more-zero-days" + date = "15-11-2023" + author = "WithSecure" + + condition: + uint16(0) == 0x5a4d and + for any i in (0 .. pe.number_of_signatures) : ( + pe.signatures[i].issuer contains "VeriSign Class 3 Code Signing 2010 CA" and + pe.signatures[i].serial == "0f:1b:43:48:4a:13:69:c8:30:38:dc:24:e7:77:8b:7d" + ) +} \ No newline at end of file diff --git a/yara/hangil_it_leaked_certificate.yar b/yara/hangil_it_leaked_certificate.yar new file mode 100644 index 0000000..140e6c7 --- /dev/null +++ b/yara/hangil_it_leaked_certificate.yar @@ -0,0 +1,18 @@ +import "pe" + +rule leaked_hangil_it_leaked_certificate { + meta: + status = "revoked" + source = "leaked" + description = "Leaked Hangil IT Co., Ltd certificate utilised by various malware." + references = "" + date = "15-11-2023" + author = "Riccardo Ancarani" + + condition: + uint16(0) == 0x5a4d and + for any i in (0 .. pe.number_of_signatures) : ( + pe.signatures[i].issuer contains "Sectigo Public Code Signing CA R36" and + pe.signatures[i].serial == "01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45" + ) +} \ No newline at end of file