Graylog2 / Graylog2/graylog2-server

Add MalwareBazaar as data adapter [Enterprise]

Open
#15,452 0 comments 0 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Add the possibility to use the malware bazaar database as data adapter like `ThreatFox IOC Lookup [Enterprise]` and `URLhaus Malware Distribution URL Lookup [Enterprise]`.

## What?

I think you can reuse a lot of the code of the URLhaus or ThreatFox data adapter.
One difference is that you need to download three files for MD5, SHA1 and SHA256 file hashes.
There is only one IoC per line to import.

**Download**
https://bazaar.abuse.ch/export/
```
SHA256 hashes: Recent additions ( [download](https://bazaar.abuse.ch/export/txt/sha256/recent/))
SHA256 hashes: Full data dump ( [download](https://bazaar.abuse.ch/export/txt/sha256/full/) - zip compressed)
MD5 hashes: Recent additions ( [download](https://bazaar.abuse.ch/export/txt/md5/recent/))
MD5 hashes: Full data dump ( [download](https://bazaar.abuse.ch/export/txt/md5/full/) - zip compressed)
SHA1 hashes: Recent additions ( [download](https://bazaar.abuse.ch/export/txt/sha1/recent/))
SHA1 hashes: Full data dump ( [download](https://bazaar.abuse.ch/export/txt/sha1/full/) - zip compressed)
```
**File example**
```
################################################################
# MalwareBazaar recent malware samples (SHA256 hashes) #
# Last updated: 2023-05-09 04:21:38 UTC #
# #
# Terms Of Use: https://bazaar.abuse.ch/faq/#tos #
# For questions please contact bazaar [at] abuse.ch #
################################################################
#
# sha256_hash
e2ff7b616289111a5961d9a49317abdf3d0d419b809c8b68b9171c49bbe3b99a
a82d9973b94775a22a63b0950482faf242f8ebb2f4766fb3390971b151ce245f
f72382801e0b77a6f5e7c0c657c7e4257e423ff2dd28b5182cb93885bd121cfa
cd6dc1691f951e4a045783a83a44cb52ad4455729e2e08215a1e2dc4bfbddd2a
3f40ed87dc0052881ae3db841936deb4d41d2301d87e2e8a506d1f14f82269f3
fd2c0eaaa0978b3fde44ea05b31116abd55a4e582209aa2888850e5b5145ca86
17fdb16fc4312428d82c8aeef4a5f6df16b8d6e1c97c35fcd3bbf5d1ab7e4d02
ce3760474f136ea0d77a0751c17c0368a089f2fd0c128e878fbaec5db822df13
ce111709cc0ad487615e8484f84a14a4d4b3b457336c5d766382264629f698f3
75c0dd632ce9b1397d9e7faa7351bf6ded47c50d688f1f96ba278b9b3bce4396
20f406e59b8ed724d0cbf5885f7b828e69f8496ebf065b9dcbfedc01d741789f
0bb78df6c8e049c7a33d2656555e15388a59ee96bde6f221ac5494b959cd60eb
d817131a06e282101d1da0a44df9b273f2c65bd0f4dd7cd9ef8e74ed49ce57e4
a377c8dc153f10dea704911d7320ecf1a70d8156514e9bb988943cdf186b650f
33d19ef3e937679341017f230d096df286eeed85afe5af4862ae8a9ef31db6bd
```

## Why?

In my opinion, being able to search file hashes for malware would be a big advantage, because with Sysmon and other log sources, you get the file hashes in Graylog.

## Your Environment

* Graylog Version: 5.0.6
* Opensearch Version: 2.3
* MongoDB Version: 6.0.5
* Operating System: SLES 15
* Browser version: any

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.