inquest/python-inquestlabsEine pythonische Schnittstelle und ein Befehlszeilentool zur Interaktion mit der InQuest Labs API.
Eine Pythonic-Schnittstelle und ein Befehlszeilenwerkzeug für die Interaktion mit der InQuest Labs API. Beachten Sie, dass für die Interaktion mit dieser API kein API-Schlüssel erforderlich ist. Ein API-Schlüssel bietet jedoch die Möglichkeit, den Lookback zu erhöhen, Ratenbegrenzungen aufzuheben und verfügbare Samples herunterzuladen. Benutzer können sich per OAuth anmelden, um API-Schlüssel zu generieren. Die Anmeldung ist kostenlos. Die Authentifizierung wird über LinkedIn, Twitter, Google und Github unterstützt.
Durchsuchbare API-Dokumentation mit Codebeispielen in mehreren Sprachen: https://labs.inquest.net/docs/
OpenAPI-(Swagger-)Spezifikation: https://app.swaggerhub.com/apis-docs/InQuest.net/InQuestLabs/1.0
Die empfohlene Methode zur Installation der InQuest Labs API CLI ist die Verwendung von pipx. Dabei werden das Paket und alle Abhängigkeiten in einer isolierten virtuellen Umgebung installiert, die leicht aufgerufen werden kann.
pipx install inquestlabs
Alternativ, oder falls Sie inquestlabs als Bibliothek verwenden möchten, können Sie es mit pip installieren.
pip install inquestlabs
Um die verfügbaren Befehlszeilenwerkzeuge und Optionen zu sehen, sehen Sie sich die Ausgabe von inquestlabs --help an. Sie sieht in etwa so aus:
InQuest Labs Command Line Driver
Usage:
inquestlabs [options] dfi list
inquestlabs [options] dfi details <sha256> [--attributes]
inquestlabs [options] dfi download <sha256> <path> [--encrypt]
inquestlabs [options] dfi attributes <sha256> [--filter=<filter>]
inquestlabs [options] dfi search (code|context|metadata|ocr) <keyword>
inquestlabs [options] dfi search (md5|sha1|sha256|sha512) <hash>
inquestlabs [options] dfi search (domain|email|filename|filepath|ip|registry|url|xmpid) <ioc>
inquestlabs [options] dfi sources
inquestlabs [options] dfi upload <path>
inquestlabs [options] iocdb list
inquestlabs [options] iocdb search <keyword>
inquestlabs [options] iocdb sources
inquestlabs [options] repdb list
inquestlabs [options] repdb search <keyword>
inquestlabs [options] repdb sources
inquestlabs [options] yara (b64re|base64re) <regex> [(--big-endian|--little-endian)]
inquestlabs [options] yara hexcase <instring>
inquestlabs [options] yara uint <instring> [--offset=<offset>] [--hex]
inquestlabs [options] yara widere <regex> [(--big-endian|--little-endian)]
inquestlabs [options] yara cidr <ipv4>
inquestlabs [options] lookup ip <ioc>
inquestlabs [options] lookup domain <ioc>
inquestlabs [options] report <ioc>
inquestlabs [options] stats
inquestlabs [options] setup <apikey>
inquestlabs [options] trystero list-days
inquestlabs [options] trystero list-samples <yyyy-mm-dd>
Options:
--attributes Include attributes with DFI record.
--api=<apikey> Specify an API key.
--big-endian Toggle big endian.
--config=<config> Configuration file with API key [default: ~/.iqlabskey].
--debug Docopt debugging.
--encrypt Zip sample with password 'infected' before downloading.
--filter=<filter> Filter by attributes type (domain, email, filename, filepath, ip, registry, url, xmpid)
-h --help Show this screen.
--hex Treat <instring> as hex bytes.
-l --limits Show remaining API credits and limit reset window.
--little-endian Toggle little endian.
--offset=<offset> Specify an offset other than 0 for the trigger.
--proxy=<proxy> Intermediate proxy
--timeout=<timeout> Maximum amount of time to wait for IOC report.
--verbose=<level> Verbosity level, outputs to stderr [default: 0].
--version Show version.
Die folgenden Drittanbieter-Projekte integrieren sich in InQuest Labs:
Kontaktieren Sie uns oder reichen Sie einen Pull-Request ein, um Ihr Projekt aufnehmen zu lassen.
Die überwiegende Mehrheit der Angriffe (>90 %) erfolgt über E-Mails. Das „Trystero-Projekt" ist unser Codename für ein Experiment, das wir aktiv durchführen, um die Sicherheitswirksamkeit der beiden größten E-Mail-Anbieter, Google und Microsoft, gegen reale, neu auftretende Malware zu messen. Die Grundidee ist folgende: Wir nehmen täglich reale Bedrohungen und schleusen sie durch die beiden beliebtesten Cloud-E-Mail-Anbieter, Google und Microsoft. Wir überwachen, welche Samples den Posteingang erreichen, und vergleichen die Ergebnisse im Laufe der Zeit. Sie können mehr darüber lesen, Grafiken ansehen, Daten erkunden und Ergebnisse unter InQuest Labs: Trystero Project vergleichen. Wenn Sie den Testkorpus weiter erkunden möchten, stehen Ihnen die folgenden beiden Befehlszeilenoptionen zur Verfügung:
Für eine Liste der Tage, an denen wir das Trystero-Projekt durchgeführt haben, sowie die Anzahl der an jedem Tag gesammelten Samples. Beachten Sie, dass first_record den frühesten Datensatz (2020-08-09) kennzeichnet.
$ inquestlabs trystero list-days | jq .
{
"2021-01-08": 27,
"2021-01-09": 26,
"2021-04-20": 47,
"2020-12-31": 304,
"2021-01-03": 21,
"2021-01-01": 7,
"2021-01-06": 35,
"2021-01-07": 17,
"2021-01-04": 17,
"2021-01-05": 20,
"2021-06-14": 8,
"2021-07-27": 55,
"2021-03-28": 17,
"2021-03-29": 18,
"2021-03-26": 269,
"2021-03-27": 52,
"2021-03-24": 169,
"2021-03-25": 543,
"2021-03-22": 5,
"2021-03-23": 197,
"2021-03-20": 28,
"2021-03-21": 46,
"2021-04-12": 5,
"2021-04-13": 23,
"2021-03-18": 142,
"2021-04-11": 13,
"2021-04-16": 28,
"2021-04-17": 94,
"2021-04-14": 30,
"2021-04-15": 46,
"2021-06-21": 9,
"2021-04-18": 13,
"2021-04-19": 16,
"2021-04-07": 40,
"2021-06-20": 33,
"2021-07-11": 22,
"2021-08-09": 22,
"first_record": "2020-08-09",
"2021-06-22": 23,
"2021-05-20": 490,
"2021-01-19": 139,
"2021-01-18": 16,
"2021-04-26": 11,
"2020-12-20": 3,
"2020-12-23": 124,
"2021-05-07": 60,
"2021-01-11": 42,
"2021-01-10": 5,
"2021-01-13": 4,
"2021-01-15": 35,
"2021-01-14": 115,
"2021-01-17": 15,
"2021-01-16": 26,
"2021-07-10": 43,
"2021-04-02": 117,
"2021-06-24": 88,
"2021-06-25": 67,
"2021-04-05": 16,
"2021-05-21": 741,
"2021-06-26": 4,
"2021-03-31": 54,
"2021-03-30": 51,
"2021-06-23": 48,
"2021-04-04": 18,
"2021-02-21": 9,
"2021-02-20": 113,
"2021-02-23": 47,
"2021-02-22": 10,
"2021-02-25": 235,
"2021-02-24": 54,
"2021-02-27": 39,
"2021-02-26": 42,
"2021-04-09": 15,
"2021-02-28": 19,
"2021-04-06": 32,
"2021-07-22": 147,
"2021-04-08": 42,
"2021-05-22": 1314,
"2021-04-24": 35,
"2021-05-02": 22,
"2021-01-28": 60,
"2021-01-29": 183,
"2020-11-06": 1,
"2021-01-25": 19,
"2021-01-26": 42,
"2020-11-05": 2,
"2021-01-20": 1168,
"2020-11-03": 26,
"2021-01-22": 516,
"2021-01-23": 361,
"2021-03-01": 12,
"2021-03-02": 117,
"2021-03-03": 31,
"2021-03-04": 17,
"2021-03-05": 11,
"2021-03-06": 10,
"2021-03-07": 9,
"2021-03-08": 13,
"2021-03-09": 19,
"2021-04-03": 45,
"2021-05-03": 7,
"2021-02-14": 5,
"2021-02-15": 8,
"2021-02-16": 19,
"2021-02-17": 426,
"2021-02-10": 113,
"2021-02-11": 107,
"2021-02-12": 77,
"2021-02-13": 67,
"2021-02-18": 40,
"2021-02-19": 121,
"2021-05-24": 20,
"2021-06-30": 64,
"2021-08-05": 30,
"2021-08-04": 406,
"2021-08-07": 30,
"2021-08-06": 49,
"2021-08-01": 582,
"2021-08-03": 154,
"2021-08-02": 60,
"2021-07-13": 17,
"2021-01-31": 19,
"2021-01-30": 144,
"2021-05-05": 95,
"2021-07-12": 174,
"2020-11-15": 1,
"2021-04-10": 24,
"2021-03-17": 113,
"2021-03-16": 92,
"2021-02-09": 389,
"2021-02-08": 26,
"2021-03-13": 197,
"2021-03-12": 147,
"2020-08-28": 1,
"2021-03-10": 595,
"2021-02-03": 87,
"2021-02-02": 48,
"2021-02-01": 13,
"2020-08-25": 26,
"2021-02-07": 33,
"2021-02-06": 27,
"2021-02-05": 103,
"2021-02-04": 141,
"2021-05-28": 33,
"2021-07-15": 51,
"2021-06-06": 154,
"2021-06-09": 33,
"2021-07-14": 43,
"2021-03-15": 26,
"2021-06-08": 33,
"2020-12-18": 55,
"2020-12-19": 14,
"2021-03-14": 26,
"2021-08-10": 36,
"2021-04-29": 122,
"2020-12-11": 1,
"2020-12-15": 4,
"2020-12-16": 18,
"2020-12-17": 22,
"2021-05-19": 180,
"2021-03-11": 168,
"2020-11-26": 1,
"2021-07-16": 16,
"2021-05-27": 236,
"2020-08-26": 22,
"2021-05-06": 71,
"2021-04-28": 51,
"2020-08-27": 7,
"2020-08-31": 1,
"2020-08-24": 5,
"2021-05-31": 16,
"2021-05-30": 11,
"2021-05-18": 242,
"2020-09-22": 1,
"2020-09-25": 1,
"2020-09-26": 1,
"2020-08-22": 63,
"2021-06-07": 22,
"2021-05-01": 20,
"2020-08-23": 2,
"2021-01-24": 35,
"2021-06-27": 2,
"2020-08-20": 26,
"2020-12-07": 1,
"2020-12-05": 6,
"2020-12-04": 4,
"2020-12-03": 3,
"2021-01-27": 99,
"2021-01-21": 73,
"2021-07-09": 30,
"2021-04-27": 35,
"2021-07-29": 184,
"2021-06-11": 30,
"2021-05-26": 27,
"2021-07-23": 54,
"2021-07-20": 5,
"2021-07-26": 17,
"2021-06-12": 26,
"2021-07-24": 7,
"2021-07-04": 8,
"2021-06-13": 9,
"2021-05-23": 31,
"2021-04-01": 47,
"2021-06-15": 15,
"2021-03-19": 189,
"2021-07-07": 31,
"2021-06-16": 10,
"2021-06-05": 49,
"2021-06-18": 20,
"2021-04-25": 24,
"2021-07-02": 50,
"2021-06-19": 135,
"2020-09-02": 3,
"2020-09-01": 2,
"2020-09-05": 1,
"2020-09-04": 11,
"2021-06-03": 36,
"2021-07-30": 505,
"2021-04-23": 48,
"2020-08-19": 93,
"2021-05-15": 38,
"2021-06-02": 50,
"2021-05-14": 575,
"2020-12-29": 457,
"2021-04-22": 61,
"2021-05-17": 14,
"2021-05-16": 4,
"2021-05-04": 79,
"2021-04-30": 288,
"2021-06-01": 49,
"2021-07-08": 46,
"2021-05-13": 156,
"2021-04-21": 75,
"2021-07-05": 19,
"2021-07-06": 23,
"2021-05-12": 23,
"2021-07-01": 64,
"2020-08-21": 29,
"2021-07-03": 44,
"2021-06-29": 4,
"2021-05-25": 83
}
Sie können weitere Details zu jedem Sample aus einem beliebigen Tageskorpus erhalten. Die enthaltenen Informationen ähneln der Ausgabe von dfi list, mit dem Zusatz von bypasses, das angibt, welcher Anbieter umgangen wurde, und available_on_labs, das angibt, ob das Sample auf labs.inquest.net eingesehen werden kann.
$ inquestlabs trystero list-samples 2021-06-29 | jq .
[
{
"analysis_completed": true,
"bypasses": "google,microsoft",
"subcategory": "macro_hunter",
"classification": "MALICIOUS",
"subcategory_url": "https://github.com/InQuest/yara-rules/blob/master/labs.inquest.net/macro_hunter.rule",
"file_type": "OLE",
"image": false,
"vt_positives": 3,
"inquest_alerts": [
{
"category": "info",
"description": "Detected macro logic that can write data to the file system.",
"reference": null,
"title": "Macro with File System Write"
},
{
"category": "evasive",
"description": "Detected a macro with an elusive start-up hook. These esoteric hooks result in automated macro logic execution which may not be detected by dynamic analysis systems.",
"reference": null,
"title": "Macro with Esoteric Startup Hook"
},
{
"category": "info",
"description": "Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.",
"reference": null,
"title": "Macro with Startup Hook"
},
{
"category": "malicious",
"description": "An InQuest machine-learning model classified this macro as potentially malicious.",
"reference": null,
"title": "InQuest Machine Learning"
},
{
"category": "suspicious",
"description": "Detected macro logic that will load additional functionality from Dynamically Linked Libraries (DLLs). While not explicitly malicious, this is a common tactic for accessing APIs that are not otherwised exposed via Visual Basic for Applications (VBA).",
"reference": null,
"title": "Macro with DLL Reference"
}
],
"downloadable": true,
"available_on_labs": true,
"vt_weight": 0,
"last_inquest_featext": "2021-06-28T04:16:36",
"first_seen": "2021-06-28T04:15:47",
"sha256": "c1df09944fe4eb4f7f86bd3a342e4548e584290167623959bca58acef4e25a1d",
"mime_type": "application/cdfv2",
"size": 1305088
},
{
"analysis_completed": true,
"bypasses": "microsoft",
"subcategory": "macro_hunter",
"classification": "MALICIOUS",
"subcategory_url": "https://github.com/InQuest/yara-rules/blob/master/labs.inquest.net/macro_hunter.rule",
"file_type": "OLE",
"image": false,
"vt_positives": 12,
"inquest_alerts": [
{
"category": "info",
"description": "Detected macro logic that can write data to the file system.",
"reference": null,
"title": "Macro with File System Write"
},
{
"category": "info",
"description": "Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.",
"reference": null,
"title": "Macro with Startup Hook"
},
{
"category": "info",
"description": "Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...",
"reference": null,
"title": "Macro Contains Suspicious String"
},
{
"category": "suspicious",
"description": "Detected a macro that leverages Windows Management Instrumentation (WMI) functionality.",
"reference": null,
"title": "WMI Functionality"
}
],
"downloadable": true,
"available_on_labs": true,
"vt_weight": 6.199999809265137,
"last_inquest_featext": "2021-06-28T12:14:44",
"first_seen": "2021-06-28T12:13:41",
"sha256": "59876f4baebcc78f3fcc944b24efb475f5030f6bb10190f4c07a6af5fa5c1568",
"mime_type": "application/cdfv2",
"size": 22528
},
{
"analysis_completed": false,
"bypasses": "google,microsoft",
"subcategory": "maldoc_hunter",
"classification": "MALICIOUS",
"subcategory_url": "https://github.com/InQuest/yara-rules/blob/master/labs.inquest.net/maldoc_hunter.rule",
"file_type": "OTHER",
"image": false,
"vt_positives": 9,
"inquest_alerts": [
{
"category": "info",
"description": "Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.",
"reference": null,
"title": "Windows PE Executable"
},
{
"category": "suspicious",
"description": "Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.",
"reference": null,
"title": "Base64 Encoded URL"
}
],
"downloadable": false,
"available_on_labs": false,
"vt_weight": 5.800000190734863,
"last_inquest_featext": null,
"first_seen": "2021-06-28T12:58:56",
"sha256": "bd736e5b4dc9e802a4b9c4cab0d1e0df872ce3c42091142d50b7520dc02abaad",
"mime_type": "application/x-msi",
"size": 4687360
},
{
"analysis_completed": false,
"bypasses": "microsoft",
"subcategory": "maljar_hunter",
"classification": "MALICIOUS",
"subcategory_url": "https://github.com/InQuest/yara-rules/blob/master/labs.inquest.net/maljar_hunter.rule",
"file_type": "OTHER",
"image": false,
"vt_positives": 9,
"inquest_alerts": [],
"downloadable": false,
"available_on_labs": false,
"vt_weight": 3.5999999046325684,
"last_inquest_featext": null,
"first_seen": "2021-06-28T13:43:23",
"sha256": "e4ae2b5eb9b8549a322354dff9e88a0a356646351f5087e2d6ef91a630ef6007",
"mime_type": "application/x-java-applet",
"size": 19799
}
]