From 63083e65ea7b587bf4873cfc52a61617b144ee77 Mon Sep 17 00:00:00 2001 From: "C.J. May" Date: Fri, 9 Feb 2024 02:28:20 -0600 Subject: [PATCH 01/14] created csv generation script and CI workflow --- .github/workflows/generate_csv.yml | 43 ++++++++++++++++++++++++++++++ csv/leaked.csv | 11 ++++++++ csv/malicious.csv | 5 ++++ scripts/generate_csv.py | 32 ++++++++++++++++++++++ 4 files changed, 91 insertions(+) create mode 100644 .github/workflows/generate_csv.yml create mode 100644 csv/leaked.csv create mode 100644 csv/malicious.csv create mode 100644 scripts/generate_csv.py diff --git a/.github/workflows/generate_csv.yml b/.github/workflows/generate_csv.yml new file mode 100644 index 0000000..1e42408 --- /dev/null +++ b/.github/workflows/generate_csv.yml @@ -0,0 +1,43 @@ +name: "Generate Artifacts" + +on: + push: + branches: + - "main" + paths: + - "leaked/**" + - "malicious/**" + workflow_dispatch: + +jobs: + generate-artifacts: + runs-on: ubuntu-latest + + steps: + - name: Check out repository + uses: actions/checkout@v4 + + - name: Setup Python + uses: actions/setup-python@v5 + with: + python-version: "3.11" + + - name: Generate CSVs + working-directory: ./scripts + run: | + python generate-csv.py + + - name: Generate YARA + working-directory: ./scripts + run: | + python generate-yara.py + + - name: Update repository + run: | + git config --global user.name "GitHub Actions [Bot]" + git config --global user.email "noreply@github.com" + git add yara + git add csv + git commit -m "Auto-generated detection artifacts" + git push + diff --git a/csv/leaked.csv b/csv/leaked.csv new file mode 100644 index 0000000..dae00de --- /dev/null +++ b/csv/leaked.csv @@ -0,0 +1,11 @@ +name,status,source,description,references,date,author,issuer,timestamp,serial +msi_leaked_certificate,revoked,leaked,Leaked certificate from MicroStar International (MSI) driver package. +,https://thehackernews.com/2023/05/msi-data-breach-private-code-signing.html,31-08-2023,WithSecure,DigiCert SHA2 Assured ID Code Signing CA,,0b:88:60:32:86:1d:95:53:c6:8f:80:33:13:a9:89:75 +lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS. +,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5 +lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS. +,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18 +hangil_it_leaked_certificate,revoked,leaked,Leaked Hangil IT Co., Ltd certificate utilised by various malware. +,,15-11-2023,Riccardo Ancarani,Sectigo Public Code Signing CA R36,,01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45 +anydesk_leaked_certificate,revoked,leaked,AnyDesk Revoked Certificates after public statement: https://anydesk.com/en/public-statement +,https://github.com/Neo23x0/signature-base/blob/master/yara/gen_anydesk_compromised_cert_feb23.yar,07-02-2024,Florian Roth,DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,1706486400,0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8 diff --git a/csv/malicious.csv b/csv/malicious.csv new file mode 100644 index 0000000..bbf2110 --- /dev/null +++ b/csv/malicious.csv @@ -0,0 +1,5 @@ +name,status,source,description,references,date,author,issuer,timestamp,serial +lamera_dprk_certificate,revoked,malicious,Certificate utilised to sign malware attributed to North Korea. +,https://labs.withsecure.com/publications/no-pineapple-dprk-targeting-of-medical-research-and-technology-sector,31-08-2023,WithSecure,LAMERA CORPORATION LIMITED,,87:9f:a9:42:f9:f0:97:b7:4f:d6:f7:da:bc:f1:74:5a +hacking_team_malicious_certificate,expired,malicious,Certificate utilised by Hacking Team. +,https://www.trendmicro.com/vinfo/fr/security/news/vulnerabilities-and-exploits/the-hacking-team-leak-zero-days-patches-and-more-zero-days,15-11-2023,WithSecure,VeriSign Class 3 Code Signing 2010 CA,,0f:1b:43:48:4a:13:69:c8:30:38:dc:24:e7:77:8b:7d diff --git a/scripts/generate_csv.py b/scripts/generate_csv.py new file mode 100644 index 0000000..d7b8a48 --- /dev/null +++ b/scripts/generate_csv.py @@ -0,0 +1,32 @@ +import glob +import yaml + +for folder in ("leaked", "malicious"): + yml_files = glob.glob(f"../{folder}/*.yml", recursive=True) + csv_content = "name,status,source,description,references,date,author,issuer,timestamp,serial\n" + + # Generate the csv file for each folder + for yml_file in yml_files: + # Load the yml file + with open(yml_file, 'r') as stream: + try: + yml = yaml.safe_load(stream) + except yaml.YAMLError as exc: + print(exc) + for serial in yml["serial"]: + # Generate the csv entry + entry = ",".join([ + yml["name"], + yml["meta"]["status"], + yml["meta"]["source"], + yml["meta"]["description"], + yml["meta"]["references"], + yml["meta"]["date"], + yml["meta"]["author"], + yml["issuer"], + str(yml["timestamp"]) if "timestamp" in yml else "", + serial + ]) + csv_content += f"{entry}\n" + with open(f"../csv/{folder}.csv", "w") as f: + f.write(csv_content) From 1a67878cd0ff42d5b84395ef1ca6bb11f08b3fe4 Mon Sep 17 00:00:00 2001 From: "C.J. May" Date: Fri, 9 Feb 2024 02:33:14 -0600 Subject: [PATCH 02/14] git config might be breaking workflow runner --- .github/workflows/generate_csv.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/generate_csv.yml b/.github/workflows/generate_csv.yml index 1e42408..e058b23 100644 --- a/.github/workflows/generate_csv.yml +++ b/.github/workflows/generate_csv.yml @@ -34,8 +34,8 @@ jobs: - name: Update repository run: | - git config --global user.name "GitHub Actions [Bot]" - git config --global user.email "noreply@github.com" + git config --local user.name "GitHub Actions [Bot]" + git config --local user.email "noreply@github.com" git add yara git add csv git commit -m "Auto-generated detection artifacts" From 2398330e7c5d23a364b1bad63bb1d3f99793c184 Mon Sep 17 00:00:00 2001 From: "C.J. May" Date: Fri, 9 Feb 2024 02:39:23 -0600 Subject: [PATCH 03/14] fix script file names --- .github/workflows/generate_csv.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/generate_csv.yml b/.github/workflows/generate_csv.yml index e058b23..58338db 100644 --- a/.github/workflows/generate_csv.yml +++ b/.github/workflows/generate_csv.yml @@ -25,12 +25,12 @@ jobs: - name: Generate CSVs working-directory: ./scripts run: | - python generate-csv.py + python generate_csv.py - name: Generate YARA working-directory: ./scripts run: | - python generate-yara.py + python generate_yara.py - name: Update repository run: | From 8d9ed18aa858209b6f912cedf9d3b31945010877 Mon Sep 17 00:00:00 2001 From: "C.J. May" Date: Fri, 9 Feb 2024 11:47:31 -0600 Subject: [PATCH 04/14] added gitignore --- .gitignore | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 .gitignore diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..e22547d --- /dev/null +++ b/.gitignore @@ -0,0 +1,14 @@ +# Environments +.env +.venv +env/ +venv/ +ENV/ +env.bak/ +venv.bak/ + +# Byte-compiled / optimized / DLL files +__pycache__/ +*.py[cod] +*$py.class + From 7d00a1d82d4e7364490daaa0b42232089dafd8aa Mon Sep 17 00:00:00 2001 From: "C.J. May" Date: Fri, 9 Feb 2024 11:51:13 -0600 Subject: [PATCH 05/14] added script requirements --- scripts/requirements.txt | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 scripts/requirements.txt diff --git a/scripts/requirements.txt b/scripts/requirements.txt new file mode 100644 index 0000000..5a874cf --- /dev/null +++ b/scripts/requirements.txt @@ -0,0 +1,3 @@ +Jinja2==3.1.3 +MarkupSafe==2.1.5 +PyYAML==6.0.1 From b7fecf20e72fe05ec15efec440f696a57d4e026d Mon Sep 17 00:00:00 2001 From: "C.J. May" Date: Fri, 9 Feb 2024 11:52:43 -0600 Subject: [PATCH 06/14] install requirements in workflow --- .github/workflows/generate_csv.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/generate_csv.yml b/.github/workflows/generate_csv.yml index 58338db..fb435c5 100644 --- a/.github/workflows/generate_csv.yml +++ b/.github/workflows/generate_csv.yml @@ -22,6 +22,10 @@ jobs: with: python-version: "3.11" + - name: Install dependencies + run: | + pip install -r ./scripts/requirements.txt + - name: Generate CSVs working-directory: ./scripts run: | From 13b979f2c40d8cb1cb5795cd0e8e951172939c61 Mon Sep 17 00:00:00 2001 From: "GitHub Actions [Bot]" Date: Fri, 9 Feb 2024 17:53:34 +0000 Subject: [PATCH 07/14] Auto-generated detection artifacts --- csv/leaked.csv | 12 ++++++------ yara/anydesk_leaked_certificate.yar | 18 ++++++++++++++++++ yara/hacking_team_malicious_certificate.yar | 18 ++++++++++++++++++ yara/hangil_it_leaked_certificate.yar | 18 ++++++++++++++++++ 4 files changed, 60 insertions(+), 6 deletions(-) create mode 100644 yara/anydesk_leaked_certificate.yar create mode 100644 yara/hacking_team_malicious_certificate.yar create mode 100644 yara/hangil_it_leaked_certificate.yar diff --git a/csv/leaked.csv b/csv/leaked.csv index dae00de..a323b5d 100644 --- a/csv/leaked.csv +++ b/csv/leaked.csv @@ -1,11 +1,11 @@ name,status,source,description,references,date,author,issuer,timestamp,serial -msi_leaked_certificate,revoked,leaked,Leaked certificate from MicroStar International (MSI) driver package. -,https://thehackernews.com/2023/05/msi-data-breach-private-code-signing.html,31-08-2023,WithSecure,DigiCert SHA2 Assured ID Code Signing CA,,0b:88:60:32:86:1d:95:53:c6:8f:80:33:13:a9:89:75 -lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS. -,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5 -lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS. -,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18 hangil_it_leaked_certificate,revoked,leaked,Leaked Hangil IT Co., Ltd certificate utilised by various malware. ,,15-11-2023,Riccardo Ancarani,Sectigo Public Code Signing CA R36,,01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45 anydesk_leaked_certificate,revoked,leaked,AnyDesk Revoked Certificates after public statement: https://anydesk.com/en/public-statement ,https://github.com/Neo23x0/signature-base/blob/master/yara/gen_anydesk_compromised_cert_feb23.yar,07-02-2024,Florian Roth,DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,1706486400,0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8 +lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS. +,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5 +lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS. +,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18 +msi_leaked_certificate,revoked,leaked,Leaked certificate from MicroStar International (MSI) driver package. +,https://thehackernews.com/2023/05/msi-data-breach-private-code-signing.html,31-08-2023,WithSecure,DigiCert SHA2 Assured ID Code Signing CA,,0b:88:60:32:86:1d:95:53:c6:8f:80:33:13:a9:89:75 diff --git a/yara/anydesk_leaked_certificate.yar b/yara/anydesk_leaked_certificate.yar new file mode 100644 index 0000000..5211fae --- /dev/null +++ b/yara/anydesk_leaked_certificate.yar @@ -0,0 +1,18 @@ +import "pe" + +rule leaked_anydesk_leaked_certificate { + meta: + status = "revoked" + source = "leaked" + description = "AnyDesk Revoked Certificates after public statement: https://anydesk.com/en/public-statement" + references = "https://github.com/Neo23x0/signature-base/blob/master/yara/gen_anydesk_compromised_cert_feb23.yar" + date = "07-02-2024" + author = "Florian Roth" + + condition: + uint16(0) == 0x5a4d and pe.timestamp > 1706486400 and + for any i in (0 .. pe.number_of_signatures) : ( + pe.signatures[i].issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and + pe.signatures[i].serial == "0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8" + ) +} \ No newline at end of file diff --git a/yara/hacking_team_malicious_certificate.yar b/yara/hacking_team_malicious_certificate.yar new file mode 100644 index 0000000..b021a2f --- /dev/null +++ b/yara/hacking_team_malicious_certificate.yar @@ -0,0 +1,18 @@ +import "pe" + +rule malicious_hacking_team_malicious_certificate { + meta: + status = "expired" + source = "malicious" + description = "Certificate utilised by Hacking Team." + references = "https://www.trendmicro.com/vinfo/fr/security/news/vulnerabilities-and-exploits/the-hacking-team-leak-zero-days-patches-and-more-zero-days" + date = "15-11-2023" + author = "WithSecure" + + condition: + uint16(0) == 0x5a4d and + for any i in (0 .. pe.number_of_signatures) : ( + pe.signatures[i].issuer contains "VeriSign Class 3 Code Signing 2010 CA" and + pe.signatures[i].serial == "0f:1b:43:48:4a:13:69:c8:30:38:dc:24:e7:77:8b:7d" + ) +} \ No newline at end of file diff --git a/yara/hangil_it_leaked_certificate.yar b/yara/hangil_it_leaked_certificate.yar new file mode 100644 index 0000000..140e6c7 --- /dev/null +++ b/yara/hangil_it_leaked_certificate.yar @@ -0,0 +1,18 @@ +import "pe" + +rule leaked_hangil_it_leaked_certificate { + meta: + status = "revoked" + source = "leaked" + description = "Leaked Hangil IT Co., Ltd certificate utilised by various malware." + references = "" + date = "15-11-2023" + author = "Riccardo Ancarani" + + condition: + uint16(0) == 0x5a4d and + for any i in (0 .. pe.number_of_signatures) : ( + pe.signatures[i].issuer contains "Sectigo Public Code Signing CA R36" and + pe.signatures[i].serial == "01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45" + ) +} \ No newline at end of file From 73d2ee5e8ea1bc397f10e10b202c8f9d3a6af22a Mon Sep 17 00:00:00 2001 From: "C.J. May" Date: Fri, 9 Feb 2024 11:55:56 -0600 Subject: [PATCH 08/14] fix description formatting --- scripts/generate_csv.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/generate_csv.py b/scripts/generate_csv.py index d7b8a48..2e6ff35 100644 --- a/scripts/generate_csv.py +++ b/scripts/generate_csv.py @@ -19,7 +19,7 @@ for folder in ("leaked", "malicious"): yml["name"], yml["meta"]["status"], yml["meta"]["source"], - yml["meta"]["description"], + yml["meta"]["description"].strip().replace("\n", " "), yml["meta"]["references"], yml["meta"]["date"], yml["meta"]["author"], From b8e90c26c40e31122b50e3948cb6a00cbf2ff6d4 Mon Sep 17 00:00:00 2001 From: "GitHub Actions [Bot]" Date: Fri, 9 Feb 2024 17:56:57 +0000 Subject: [PATCH 09/14] Auto-generated detection artifacts --- csv/leaked.csv | 15 +++++---------- csv/malicious.csv | 6 ++---- 2 files changed, 7 insertions(+), 14 deletions(-) diff --git a/csv/leaked.csv b/csv/leaked.csv index a323b5d..015b7bc 100644 --- a/csv/leaked.csv +++ b/csv/leaked.csv @@ -1,11 +1,6 @@ name,status,source,description,references,date,author,issuer,timestamp,serial -hangil_it_leaked_certificate,revoked,leaked,Leaked Hangil IT Co., Ltd certificate utilised by various malware. -,,15-11-2023,Riccardo Ancarani,Sectigo Public Code Signing CA R36,,01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45 -anydesk_leaked_certificate,revoked,leaked,AnyDesk Revoked Certificates after public statement: https://anydesk.com/en/public-statement -,https://github.com/Neo23x0/signature-base/blob/master/yara/gen_anydesk_compromised_cert_feb23.yar,07-02-2024,Florian Roth,DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,1706486400,0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8 -lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS. -,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5 -lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS. -,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18 -msi_leaked_certificate,revoked,leaked,Leaked certificate from MicroStar International (MSI) driver package. -,https://thehackernews.com/2023/05/msi-data-breach-private-code-signing.html,31-08-2023,WithSecure,DigiCert SHA2 Assured ID Code Signing CA,,0b:88:60:32:86:1d:95:53:c6:8f:80:33:13:a9:89:75 +hangil_it_leaked_certificate,revoked,leaked,Leaked Hangil IT Co., Ltd certificate utilised by various malware.,,15-11-2023,Riccardo Ancarani,Sectigo Public Code Signing CA R36,,01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45 +anydesk_leaked_certificate,revoked,leaked,AnyDesk Revoked Certificates after public statement: https://anydesk.com/en/public-statement,https://github.com/Neo23x0/signature-base/blob/master/yara/gen_anydesk_compromised_cert_feb23.yar,07-02-2024,Florian Roth,DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,1706486400,0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8 +lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS.,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5 +lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS.,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18 +msi_leaked_certificate,revoked,leaked,Leaked certificate from MicroStar International (MSI) driver package.,https://thehackernews.com/2023/05/msi-data-breach-private-code-signing.html,31-08-2023,WithSecure,DigiCert SHA2 Assured ID Code Signing CA,,0b:88:60:32:86:1d:95:53:c6:8f:80:33:13:a9:89:75 diff --git a/csv/malicious.csv b/csv/malicious.csv index bbf2110..92429f4 100644 --- a/csv/malicious.csv +++ b/csv/malicious.csv @@ -1,5 +1,3 @@ name,status,source,description,references,date,author,issuer,timestamp,serial -lamera_dprk_certificate,revoked,malicious,Certificate utilised to sign malware attributed to North Korea. -,https://labs.withsecure.com/publications/no-pineapple-dprk-targeting-of-medical-research-and-technology-sector,31-08-2023,WithSecure,LAMERA CORPORATION LIMITED,,87:9f:a9:42:f9:f0:97:b7:4f:d6:f7:da:bc:f1:74:5a -hacking_team_malicious_certificate,expired,malicious,Certificate utilised by Hacking Team. -,https://www.trendmicro.com/vinfo/fr/security/news/vulnerabilities-and-exploits/the-hacking-team-leak-zero-days-patches-and-more-zero-days,15-11-2023,WithSecure,VeriSign Class 3 Code Signing 2010 CA,,0f:1b:43:48:4a:13:69:c8:30:38:dc:24:e7:77:8b:7d +lamera_dprk_certificate,revoked,malicious,Certificate utilised to sign malware attributed to North Korea.,https://labs.withsecure.com/publications/no-pineapple-dprk-targeting-of-medical-research-and-technology-sector,31-08-2023,WithSecure,LAMERA CORPORATION LIMITED,,87:9f:a9:42:f9:f0:97:b7:4f:d6:f7:da:bc:f1:74:5a +hacking_team_malicious_certificate,expired,malicious,Certificate utilised by Hacking Team.,https://www.trendmicro.com/vinfo/fr/security/news/vulnerabilities-and-exploits/the-hacking-team-leak-zero-days-patches-and-more-zero-days,15-11-2023,WithSecure,VeriSign Class 3 Code Signing 2010 CA,,0f:1b:43:48:4a:13:69:c8:30:38:dc:24:e7:77:8b:7d From e4fba531f99240e21b1532da7e37d6fe03cf6ed5 Mon Sep 17 00:00:00 2001 From: "C.J. May" Date: Fri, 9 Feb 2024 12:00:32 -0600 Subject: [PATCH 10/14] strip extra commas --- scripts/generate_csv.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scripts/generate_csv.py b/scripts/generate_csv.py index 2e6ff35..2a44810 100644 --- a/scripts/generate_csv.py +++ b/scripts/generate_csv.py @@ -19,10 +19,10 @@ for folder in ("leaked", "malicious"): yml["name"], yml["meta"]["status"], yml["meta"]["source"], - yml["meta"]["description"].strip().replace("\n", " "), - yml["meta"]["references"], + yml["meta"]["description"].strip().replace("\n", " ").replace(",", ""), + yml["meta"]["references"].replace(",", ""), yml["meta"]["date"], - yml["meta"]["author"], + yml["meta"]["author"].replace(",", ""), yml["issuer"], str(yml["timestamp"]) if "timestamp" in yml else "", serial From 4be9e2ee310b16fb196885bcf59653cfe4d1b517 Mon Sep 17 00:00:00 2001 From: "GitHub Actions [Bot]" Date: Fri, 9 Feb 2024 18:01:01 +0000 Subject: [PATCH 11/14] Auto-generated detection artifacts --- csv/leaked.csv | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/csv/leaked.csv b/csv/leaked.csv index 015b7bc..f2a19dc 100644 --- a/csv/leaked.csv +++ b/csv/leaked.csv @@ -1,5 +1,5 @@ name,status,source,description,references,date,author,issuer,timestamp,serial -hangil_it_leaked_certificate,revoked,leaked,Leaked Hangil IT Co., Ltd certificate utilised by various malware.,,15-11-2023,Riccardo Ancarani,Sectigo Public Code Signing CA R36,,01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45 +hangil_it_leaked_certificate,revoked,leaked,Leaked Hangil IT Co. Ltd certificate utilised by various malware.,,15-11-2023,Riccardo Ancarani,Sectigo Public Code Signing CA R36,,01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45 anydesk_leaked_certificate,revoked,leaked,AnyDesk Revoked Certificates after public statement: https://anydesk.com/en/public-statement,https://github.com/Neo23x0/signature-base/blob/master/yara/gen_anydesk_compromised_cert_feb23.yar,07-02-2024,Florian Roth,DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,1706486400,0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8 lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS.,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5 lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS.,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18 From 48f2733eaa849f51b538bb7063c6a6986197b069 Mon Sep 17 00:00:00 2001 From: "C.J. May" Date: Fri, 9 Feb 2024 12:17:42 -0600 Subject: [PATCH 12/14] rename workflow --- .github/workflows/{generate_csv.yml => generate_artifacts.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename .github/workflows/{generate_csv.yml => generate_artifacts.yml} (100%) diff --git a/.github/workflows/generate_csv.yml b/.github/workflows/generate_artifacts.yml similarity index 100% rename from .github/workflows/generate_csv.yml rename to .github/workflows/generate_artifacts.yml From 3b5c9a67ab8b2094b41795cb027d87b00465c081 Mon Sep 17 00:00:00 2001 From: "C.J. May" Date: Tue, 13 Feb 2024 13:18:16 -0600 Subject: [PATCH 13/14] fix github bot email address --- .github/workflows/generate_artifacts.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/generate_artifacts.yml b/.github/workflows/generate_artifacts.yml index fb435c5..e82c602 100644 --- a/.github/workflows/generate_artifacts.yml +++ b/.github/workflows/generate_artifacts.yml @@ -39,7 +39,7 @@ jobs: - name: Update repository run: | git config --local user.name "GitHub Actions [Bot]" - git config --local user.email "noreply@github.com" + git config --local user.email "github-actions[bot]@users.noreply.github.com" git add yara git add csv git commit -m "Auto-generated detection artifacts" From 843118ca2423877be7c15fad4f34875ea1d2df99 Mon Sep 17 00:00:00 2001 From: "C.J. May" Date: Wed, 28 Feb 2024 23:11:52 -0600 Subject: [PATCH 14/14] use python csv writer --- csv/leaked.csv | 12 ++++++------ csv/malicious.csv | 6 +++--- scripts/generate_csv.py | 17 +++++++++-------- 3 files changed, 18 insertions(+), 17 deletions(-) diff --git a/csv/leaked.csv b/csv/leaked.csv index f2a19dc..0ffbc55 100644 --- a/csv/leaked.csv +++ b/csv/leaked.csv @@ -1,6 +1,6 @@ -name,status,source,description,references,date,author,issuer,timestamp,serial -hangil_it_leaked_certificate,revoked,leaked,Leaked Hangil IT Co. Ltd certificate utilised by various malware.,,15-11-2023,Riccardo Ancarani,Sectigo Public Code Signing CA R36,,01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45 -anydesk_leaked_certificate,revoked,leaked,AnyDesk Revoked Certificates after public statement: https://anydesk.com/en/public-statement,https://github.com/Neo23x0/signature-base/blob/master/yara/gen_anydesk_compromised_cert_feb23.yar,07-02-2024,Florian Roth,DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,1706486400,0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8 -lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS.,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5 -lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS.,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18 -msi_leaked_certificate,revoked,leaked,Leaked certificate from MicroStar International (MSI) driver package.,https://thehackernews.com/2023/05/msi-data-breach-private-code-signing.html,31-08-2023,WithSecure,DigiCert SHA2 Assured ID Code Signing CA,,0b:88:60:32:86:1d:95:53:c6:8f:80:33:13:a9:89:75 +name,status,source,description,references,date,author,issuer,timestamp,serial +msi_leaked_certificate,revoked,leaked,Leaked certificate from MicroStar International (MSI) driver package.,https://thehackernews.com/2023/05/msi-data-breach-private-code-signing.html,31-08-2023,WithSecure,DigiCert SHA2 Assured ID Code Signing CA,,0b:88:60:32:86:1d:95:53:c6:8f:80:33:13:a9:89:75 +lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS.,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5 +lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS.,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18 +hangil_it_leaked_certificate,revoked,leaked,"Leaked Hangil IT Co., Ltd certificate utilised by various malware.",,15-11-2023,Riccardo Ancarani,Sectigo Public Code Signing CA R36,,01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45 +anydesk_leaked_certificate,revoked,leaked,AnyDesk Revoked Certificates after public statement: https://anydesk.com/en/public-statement,https://github.com/Neo23x0/signature-base/blob/master/yara/gen_anydesk_compromised_cert_feb23.yar,07-02-2024,Florian Roth,DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,1706486400,0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8 diff --git a/csv/malicious.csv b/csv/malicious.csv index 92429f4..e0353e0 100644 --- a/csv/malicious.csv +++ b/csv/malicious.csv @@ -1,3 +1,3 @@ -name,status,source,description,references,date,author,issuer,timestamp,serial -lamera_dprk_certificate,revoked,malicious,Certificate utilised to sign malware attributed to North Korea.,https://labs.withsecure.com/publications/no-pineapple-dprk-targeting-of-medical-research-and-technology-sector,31-08-2023,WithSecure,LAMERA CORPORATION LIMITED,,87:9f:a9:42:f9:f0:97:b7:4f:d6:f7:da:bc:f1:74:5a -hacking_team_malicious_certificate,expired,malicious,Certificate utilised by Hacking Team.,https://www.trendmicro.com/vinfo/fr/security/news/vulnerabilities-and-exploits/the-hacking-team-leak-zero-days-patches-and-more-zero-days,15-11-2023,WithSecure,VeriSign Class 3 Code Signing 2010 CA,,0f:1b:43:48:4a:13:69:c8:30:38:dc:24:e7:77:8b:7d +name,status,source,description,references,date,author,issuer,timestamp,serial +lamera_dprk_certificate,revoked,malicious,Certificate utilised to sign malware attributed to North Korea.,https://labs.withsecure.com/publications/no-pineapple-dprk-targeting-of-medical-research-and-technology-sector,31-08-2023,WithSecure,LAMERA CORPORATION LIMITED,,87:9f:a9:42:f9:f0:97:b7:4f:d6:f7:da:bc:f1:74:5a +hacking_team_malicious_certificate,expired,malicious,Certificate utilised by Hacking Team.,https://www.trendmicro.com/vinfo/fr/security/news/vulnerabilities-and-exploits/the-hacking-team-leak-zero-days-patches-and-more-zero-days,15-11-2023,WithSecure,VeriSign Class 3 Code Signing 2010 CA,,0f:1b:43:48:4a:13:69:c8:30:38:dc:24:e7:77:8b:7d diff --git a/scripts/generate_csv.py b/scripts/generate_csv.py index 2a44810..e2596b6 100644 --- a/scripts/generate_csv.py +++ b/scripts/generate_csv.py @@ -1,9 +1,12 @@ +import csv import glob import yaml for folder in ("leaked", "malicious"): yml_files = glob.glob(f"../{folder}/*.yml", recursive=True) - csv_content = "name,status,source,description,references,date,author,issuer,timestamp,serial\n" + csv_file = open(f"../csv/{folder}.csv", "w") + csv_writer = csv.writer(csv_file) + csv_writer.writerow(["name","status","source","description","references","date","author","issuer","timestamp","serial"]) # Generate the csv file for each folder for yml_file in yml_files: @@ -15,18 +18,16 @@ for folder in ("leaked", "malicious"): print(exc) for serial in yml["serial"]: # Generate the csv entry - entry = ",".join([ + csv_writer.writerow([ yml["name"], yml["meta"]["status"], yml["meta"]["source"], - yml["meta"]["description"].strip().replace("\n", " ").replace(",", ""), - yml["meta"]["references"].replace(",", ""), + yml["meta"]["description"].strip().replace("\n", " "), + yml["meta"]["references"], yml["meta"]["date"], - yml["meta"]["author"].replace(",", ""), + yml["meta"]["author"], yml["issuer"], str(yml["timestamp"]) if "timestamp" in yml else "", serial ]) - csv_content += f"{entry}\n" - with open(f"../csv/{folder}.csv", "w") as f: - f.write(csv_content) + csv_file.close()