Reverting Back to Working Branch
This commit is contained in:
brotoskyj
@@ -1,4 +1,7 @@
|
||||
.env
|
||||
*.html
|
||||
<<<<<<< HEAD
|
||||
*.csv
|
||||
=======
|
||||
>>>>>>> ccbf716 (Zar-Branch (#6))
|
||||
*__pycache__*
|
||||
@@ -20,7 +20,10 @@ import utils.allowlist
|
||||
import utils.hashfunctions
|
||||
import utils.pathfunctions
|
||||
import utils.allowfunctions
|
||||
<<<<<<< HEAD
|
||||
import utils.colortext as ct
|
||||
=======
|
||||
>>>>>>> ccbf716 (Zar-Branch (#6))
|
||||
import urllib3
|
||||
import pandas as pd
|
||||
|
||||
@@ -77,6 +80,7 @@ def menu_main():
|
||||
else:
|
||||
print(ct.colorText("Invalid choice. Please try again.","red"))
|
||||
|
||||
<<<<<<< HEAD
|
||||
def menu_local_approve():
|
||||
while True:
|
||||
print("\n--- Submenu ---")
|
||||
@@ -158,6 +162,59 @@ def menu_prepare_to_enforce():
|
||||
print(ct.colorText(" [✗] This step has not been completed","red"))
|
||||
|
||||
print(ct.colorText("4. Add hash threat information to list of executions", "cyan"))
|
||||
=======
|
||||
augmented.to_html("z_augmented_list.html", index=False)
|
||||
|
||||
badpublisherlist = []
|
||||
categorized = utils.hashfunctions.categorizeHashes(augmented, 5, badpublisherlist)
|
||||
categorized[0].to_html("z_needs_review.html", index=False)
|
||||
categorized[1].to_html("z_approved_hashes.html", index=False)
|
||||
categorized[2].to_html("z_remaining.html", index=False)
|
||||
|
||||
if choice == '4':
|
||||
html_file = "z_augmented_list.html"
|
||||
augmented_df = pd.read_html(html_file)
|
||||
print(augmented_df)
|
||||
combined_df = pd.concat(augmented_df, ignore_index=True)
|
||||
|
||||
path_eligible, path_ineligible = utils.pathfunctions.filepathInitialGroup(combined_df)
|
||||
path_eligible.to_html("z_eligble_paths.html", index=False)
|
||||
path_ineligible.to_html("z_ineligible_paths.html",index=False)
|
||||
|
||||
if choice == '5':
|
||||
|
||||
executionhist = utils.allowlist.allowlistexechistories(url,True)
|
||||
#print(executionhist)
|
||||
|
||||
aggregated = utils.hashfunctions.aggregateHashes(executionhist)
|
||||
print(aggregated)
|
||||
|
||||
augmented = utils.hashfunctions.augmentAggregatedHashes(url,aggregated)
|
||||
print(augmented)
|
||||
|
||||
augmented.to_html("z_augmented_list.html", index=False)
|
||||
html_file = "z_augmented_list.html"
|
||||
augmented_df = pd.read_html(html_file)
|
||||
combined_df = pd.concat(augmented_df, ignore_index=True)
|
||||
|
||||
path_eligible, path_ineligible = utils.pathfunctions.filepathInitialGroup(combined_df)
|
||||
path_eligible.to_html("z_eligble_paths.html", index=False)
|
||||
path_ineligible.to_html("z_ineligible_paths.html",index=False)
|
||||
|
||||
badpublisherlist = ["Brave Software, Inc.", "Zoom Video Communications, Inc."]
|
||||
categorized = utils.hashfunctions.categorizeHashes(augmented, 5, badpublisherlist)
|
||||
categorized[0].to_html("z_needs_review.html", index=False)
|
||||
categorized[1].to_html("z_approved_hashes.html", index=False)
|
||||
categorized[2].to_html("z_remaining.html", index=False)
|
||||
|
||||
allowpaths = utils.allowfunctions.filter_and_drop(categorized[1],path_eligible,4)
|
||||
allowpaths.to_html("z_allowed_paths.html", index=False)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
>>>>>>> ccbf716 (Zar-Branch (#6))
|
||||
|
||||
if os.path.exists(f"dataframe_csv\\df_augmented_combo_{first_policy}_{second_policy}.csv") == True:
|
||||
print(ct.colorText(" [✓] This step has been completed","green"))
|
||||
|
||||
@@ -0,0 +1,5 @@
|
||||
hashes = ''
|
||||
while True:
|
||||
inputhash = input("Hash: ")
|
||||
hashes = hashes + ',' + inputhash
|
||||
print(hashes)
|
||||
+75
-1
@@ -17,7 +17,10 @@ import requests
|
||||
import json
|
||||
import os
|
||||
import time
|
||||
<<<<<<< HEAD
|
||||
import utils.colortext as ct
|
||||
=======
|
||||
>>>>>>> ccbf716 (Zar-Branch (#6))
|
||||
|
||||
def pullPolicyExechistories(url, choice, policiesnames, outputjson: bool):
|
||||
|
||||
@@ -73,4 +76,75 @@ def listPolicies(url):
|
||||
policyids.append(list['groupid'])
|
||||
choice = input(ct.colorText("Select Policy Group: ", "white"))
|
||||
choice = int(choice) - 1
|
||||
return choice, policiesnames
|
||||
<<<<<<< HEAD
|
||||
return choice, policiesnames
|
||||
=======
|
||||
checkpoint = '000000000000000000000000'
|
||||
json_output = {'error': 'Success', 'response': {'exechistories': []}}
|
||||
while True:
|
||||
json_response_data = checkpoint_stomper(checkpoint, url, policiesnames[choice], headers)
|
||||
if not json_response_data['response']['exechistories']:
|
||||
break
|
||||
for index, item in enumerate(json_response_data['response']['exechistories']):
|
||||
if index == len(json_response_data['response']['exechistories']) -1:
|
||||
checkpoint = item['checkpoint']
|
||||
print(f"Date Greater than 30 Days, Stepping to new Checkpoint. {item['checkpoint']}")
|
||||
else:
|
||||
if (datetime.date.today() - datetime.timedelta(days=10) > datetime.datetime.strptime(item['datetime'].replace(' +0000 UTC', ''), '%Y-%m-%dT%H:%M:%SZ').date()):
|
||||
pass
|
||||
else:
|
||||
#json_output['response']['exechistories'].append(json_response_data['response']['exechistories'][1])
|
||||
for output in json_response_data['response']['exechistories']:
|
||||
json_output['response']['exechistories'].append(output)
|
||||
json_output = json.dumps(json_output)
|
||||
if outputjson == True:
|
||||
return json_output
|
||||
#endpoint = url + '/v1/logging/exechistories'
|
||||
#payload_dict = {
|
||||
# "type":[1, 2, 6, 7],
|
||||
# "checkpoint":"000000000000000000000000",
|
||||
# "policy": [policiesnames[choice]]
|
||||
#}
|
||||
#payload = json.dumps(payload_dict)
|
||||
#print(payload)
|
||||
#response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False)
|
||||
#parse_text = json.loads(response.text)
|
||||
#text_response = checkpoint_stomper(parse_text['response']['exechistories'], url, policiesnames[choice])
|
||||
#
|
||||
#if outputjson == False:
|
||||
# return response
|
||||
#
|
||||
#parse_text = json.loads(response.text)
|
||||
#
|
||||
#for item in parse_text['response']['exechistories']:
|
||||
# print(item['checkpoint'])
|
||||
# print(item['datetime'])
|
||||
# print(item['hostname'])
|
||||
# print(item['filename'])
|
||||
# checkpoint_stomper(item['checkpoint'], endpoint, headers, policiesnames[choice])
|
||||
|
||||
def checkpoint_stomper(checkpoint, url, policy, headers):
|
||||
endpoint = url + '/v1/logging/exechistories'
|
||||
payload_dict = {
|
||||
"type":[1,2,6,7],
|
||||
"checkpoint": checkpoint,
|
||||
"policy": [policy]
|
||||
}
|
||||
payload = json.dumps(payload_dict)
|
||||
response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False)
|
||||
parse_text = json.loads(response.text)
|
||||
return parse_text
|
||||
#for index, item in enumerate(parse_text):
|
||||
# if index == len(parse_text) - 1:
|
||||
# checkpoint = item['checkpoint']
|
||||
# print(f"Time: {item['datetime']} Checkpoint: {item['checkpoint']}")
|
||||
# response_fuzzer(checkpoint, url, policyname)
|
||||
# else:
|
||||
# if (datetime.date.today() - datetime.timedelta(days=30) > datetime.datetime.strptime(item['datetime'].replace( ' +0000 UTC', ''), '%Y-%m-%dT%H:%M:%SZ').date()):
|
||||
# pass
|
||||
# else:
|
||||
# response_fuzzer(checkpoint, url, policyname)
|
||||
|
||||
|
||||
print("Finished")
|
||||
>>>>>>> ccbf716 (Zar-Branch (#6))
|
||||
|
||||
@@ -90,15 +90,22 @@ def categorizeHashes(aug_df: pd.DataFrame, threat_tolerance: int, untrusted_publ
|
||||
|
||||
df = aug_df.copy()
|
||||
|
||||
<<<<<<< HEAD
|
||||
def reputationtool(row):
|
||||
val = row["reputation_scannermatch"]
|
||||
if pd.isna(val) or val == "N/A":
|
||||
return row["publisher_y"] == "Not Signed"
|
||||
=======
|
||||
def reputationtool(row, threat_tolerance):
|
||||
if row["reputation_scannermatch"] == "N/A":
|
||||
return True
|
||||
>>>>>>> ccbf716 (Zar-Branch (#6))
|
||||
try:
|
||||
return int(val) > threat_tolerance
|
||||
except (ValueError, TypeError):
|
||||
return row["publisher_y"] == "Not Signed"
|
||||
|
||||
<<<<<<< HEAD
|
||||
df["reputation_flag"] = df.apply(reputationtool, axis=1)
|
||||
|
||||
mask_needsreview = (
|
||||
@@ -125,3 +132,22 @@ def categorizeHashes(aug_df: pd.DataFrame, threat_tolerance: int, untrusted_publ
|
||||
unapproved_df = df[~(mask_needsreview | mask_approved)]
|
||||
|
||||
return needsreview_df, approved_df, unapproved_df
|
||||
=======
|
||||
mask_needsreview = (df["publisher_y"] == "Not Signed") & df.apply(lambda row: reputationtool(row, threat_tolerance), axis=1)
|
||||
|
||||
mask_approved = (
|
||||
((df["publisher_y"] != "Not Signed") & (~df["publisher_y"].isin(untrusted_publishers))) &
|
||||
(df["publisher_y"] != "Not Signed") # explicitly signed
|
||||
) | (
|
||||
(df["publisher_y"] == "Not Signed") &
|
||||
(~df.apply(lambda row: reputationtool(row, threat_tolerance), axis=1)) &
|
||||
(~df["publisher_y"].isin(untrusted_publishers)) # exclude untrusted even if unsigned
|
||||
)
|
||||
|
||||
|
||||
needsreview_df = df[mask_needsreview]
|
||||
approved_df = df[mask_approved]
|
||||
remaining_df = df[~(mask_needsreview | mask_approved)]
|
||||
|
||||
return needsreview_df, approved_df, remaining_df
|
||||
>>>>>>> ccbf716 (Zar-Branch (#6))
|
||||
|
||||
@@ -57,21 +57,56 @@ def filepathInitialGroup(df: pd.DataFrame):
|
||||
break
|
||||
return join_parts(prefix)
|
||||
|
||||
<<<<<<< HEAD
|
||||
# Step 6: Group directories by shared prefix
|
||||
=======
|
||||
# Step 6: Group directories by shared prefix using custom logic
|
||||
"""
|
||||
Loop through each directory path
|
||||
directories: list of all directory paths.
|
||||
groups: will hold lists of grouped directories.
|
||||
used: tracks which directories have already been grouped.
|
||||
"""
|
||||
>>>>>>> ccbf716 (Zar-Branch (#6))
|
||||
directories = df["directory"].tolist()
|
||||
groups = []
|
||||
used = set()
|
||||
|
||||
#For Each directory, compare it with others
|
||||
"""
|
||||
Skip if already grouped.
|
||||
Start a new group with the current path.
|
||||
parts_i is the list of folder names in the path (e.g., ["C:", "Users", "John", "Documents"]).
|
||||
"""
|
||||
|
||||
for i, path in enumerate(directories):
|
||||
if path in used:
|
||||
continue
|
||||
group = [path]
|
||||
parts_i = get_parts(path)
|
||||
|
||||
<<<<<<< HEAD
|
||||
for j in range(i + 1, len(directories)):
|
||||
parts_j = get_parts(directories[j])
|
||||
common = os.path.commonprefix([parts_i, parts_j])
|
||||
|
||||
=======
|
||||
#Compare with all other directories: For each other directory, split it into parts and find the common prefix (shared folder structure).
|
||||
"""
|
||||
Logic:
|
||||
If the directory is deep (>3 parts) and shares at least 3 parts → group it.
|
||||
If it's exactly 3 parts long and shares at least 2 → group it.
|
||||
Or, if it shares all but one part and is deep → group it.
|
||||
These rules are designed to:
|
||||
Group directories that are closely related in structure.
|
||||
Avoid grouping unrelated paths that just happen to start similarly.
|
||||
"""
|
||||
|
||||
for j in range(i + 1, len(directories)):
|
||||
parts_j = get_parts(directories[j])
|
||||
common = os.path.commonprefix([parts_i, parts_j])
|
||||
#Apply grouping rules
|
||||
>>>>>>> ccbf716 (Zar-Branch (#6))
|
||||
if (len(parts_i) > 3 and len(common) >= 3) or (len(parts_i) == 3 and len(common) >= 2):
|
||||
group.append(directories[j])
|
||||
used.add(directories[j])
|
||||
@@ -99,7 +134,11 @@ def filepathInitialGroup(df: pd.DataFrame):
|
||||
path_eligible = grouped_df[grouped_df["depth"] > 2].drop(columns=["depth"])
|
||||
path_ineligible = grouped_df[grouped_df["depth"] <= 2].drop(columns=["depth"])
|
||||
|
||||
<<<<<<< HEAD
|
||||
# Step 10: Move entries from eligible to ineligible if grouped_directory contains excluded directories
|
||||
=======
|
||||
# Step 10: Move entries from eligible to ineligible if grouped_directory contains 'C:\Users' or 'c$\Users'
|
||||
>>>>>>> ccbf716 (Zar-Branch (#6))
|
||||
mask = path_eligible["grouped_directory"].str.contains(r"(?i)(?:\\Users|\\c\$\\Users|inetpub\\wwwroot|windows\\temp)", na=False)
|
||||
move_to_ineligible = path_eligible[mask]
|
||||
path_eligible = path_eligible[~mask]
|
||||
|
||||
Reference in New Issue
Block a user