admin/cisagov-snafflepy
1
0
Fork 0
mirror of https://github.com/cisagov/snafflepy synced 2026-09-24 18:22:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #30 from robert-todora/dev

Browse Source 
fixed issue with ssn classification
This commit is contained in:
Robert Todora
2023-07-31 15:24:59 -04:00
committed by GitHub
parent 9b0abed77a 748a0285bd
commit 61707f1095
1 changed files with 34 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
snaffcore/classifier.py
+17 -10
View File
@@ -58,18 +58,11 @@ def is_interest_file(file:RemoteFile, rules: Rules, smb_client: SMBClient, share
ssn_regex = str("^\d{{3}}-\d{{2}}-\d{{4}}$") ssn_regex = str("^\d{{3}}-\d{{2}}-\d{{4}}$")
# Non-file shares # Non-file shares
if str(share).lower().find("ipc") or str(share).lower().find("print"): # if str(share).lower().find("ipc") or str(share).lower().find("print"):
pass # pass
else: # else:
file_data = ""
file.get(smb_client)
# MVP Build only, check for SSN in files # MVP Build only, check for SSN in files
with open(str(file.tmp_filename)) as f:
file_data = f.read(10000)
if re.search(ssn_regex, file_text):
file_triage = termcolor.colored(f"{{Red}}\\\\{file.target}\\{share}\\{file.name} <SsnRegexFound>", "light_yellow", "on_white")
print(file_text, file_triage)
# MVP Build only, check for backup files # MVP Build only, check for backup files
for ext in backup_ext_list: for ext in backup_ext_list:
@@ -85,10 +78,24 @@ def is_interest_file(file:RemoteFile, rules: Rules, smb_client: SMBClient, share
for cred in cred_list: for cred in cred_list:
if re.search(str(cred), str(file.name).lower()): if re.search(str(cred), str(file.name).lower()):
file_triage = termcolor.colored(f"{{Black}}\\\\{file.target}\\{share}\\{file.name} <KeepFilesWithInterestName>", "black", "on_white") file_triage = termcolor.colored(f"{{Black}}\\\\{file.target}\\{share}\\{file.name} <KeepFilesWithInterestName>", "black", "on_white")
try:
file.get(smb_client) file.get(smb_client)
print(file_text, file_triage) print(file_text, file_triage)
except FileRetrievalError as e:
smb_client.handle_download_error(share, file.name, e)
file_data = ""
try:
file.get(smb_client)
with open(str(file.tmp_filename), 'rb') as f:
file_data = str(f.read(10000))
if re.search(ssn_regex, file_data):
file_triage = termcolor.colored(f"{{Red}}\\\\{file.target}\\{share}\\{file.name} <SsnRegexFound>", "light_yellow", "on_white")
print(file_text, file_triage)
except FileRetrievalError as e:
smb_client.handle_download_error(share, file.name, e)
def is_interest_share(share, rules: Rules): def is_interest_share(share, rules: Rules):