yrral-nerraw / soc-threat-hunting Goto Github PK

This is a collection of scripts to help SOC analysts perform their duties which often have them querying information from many different sources which can be a strain on time and resources.

Not everything is currently documented here, and many of the scripts require API keys or other external tools to be installed to get fully up and running, will look to make a better install package later, but for now if you can benefit please take and use what you can. Also not all scripts here are in completed form yet.


####################################################

usage: alienvault-check [-h] [-ip IP] [-host HOST] [-url URL] [-hash HASH]
                        [-file FILE]

OTX CLI Example

optional arguments:
  -h, --help  show this help message and exit
  -ip IP      IP eg; 4.4.4.4
  -host HOST  Hostname eg; www.alienvault.com
  -url URL    URL eg; http://www.alienvault.com
  -hash HASH  Hash of a file eg; 7b42b35832855ab4ff37ae9b8fa9e571
  -file FILE  Path to a file, eg; malware.exe

####################################################

usage: cymon-check [-h] [-u URL] [-i IP] [-ha HASH] [-d DOMAIN]

Script to check Cymon for IoC's

optional arguments:
  -h, --help            show this help message and exit
  -u URL, --url URL     Url to scan in cymon
  -i IP, --ip IP        IP to check in cymon
  -ha HASH, --hash HASH
                        Search a hash in cymon
  -d DOMAIN, --domain DOMAIN
                        Domain to check in cymon

Developed by Brian Laskowski on 09-05-18

####################################################

usage: virustotal [-h] [-u URL] [-i IP] [-ha HASH] [-d DOMAIN]

Script to check Virustotal for IoC's

optional arguments:
  -h, --help            show this help message and exit
  -u URL, --url URL     Url to submit to Virustotal
  -i IP, --ip IP        IP to check in Virustotal
  -ha HASH, --hash HASH
                        Search a hash in Virustotal
  -d DOMAIN, --domain DOMAIN
                        Domain to check in Virustotal

Developed by Brian Laskowski on 09-04-18

####################################################

usage: shodan [-h] [-i IP]

Script to check against Shodan

optional arguments:
  -h, --help      show this help message and exit
  -i IP, --ip IP  IP to check in Shodan

Developed by Brian Laskowski on 11-8-18

####################################################

usage: abuse-mail-check.py [-h]

Script to scrap safelinks from emails and scan via Urlscan.io Virustotal and
Talos Reputation Database. Takes input from the Copy/Paste Buffer, no aruments
necessary

optional arguments:
  -h, --help  show this help message and exit

Developed by Brian Laskowski on 02-03-19

####################################################