mysticmomba/AirlockTools
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

Zar-Branch (#6)

Browse Source 
Co-authored-by: = <=>
Co-authored-by: Driven-Element <129630760+Driven-Element@users.noreply.github.com>
Reviewed-on: brotoskyj/AirlockTools#6
Co-authored-by: brotoskyj <jbrotosky@gmail.com>
Co-committed-by: brotoskyj <jbrotosky@gmail.com>
This commit was merged in pull request #6.
This commit is contained in:
brotoskyj
2025-08-22 09:27:16 -04:00
committed by brotoskyj
parent 4d25a21ddb
commit ccbf716418
13 changed files with 159 additions and 62606 deletions
Download Patch File Download Diff File Expand all files Collapse all files
utils/hashfunctions.py
+24 -14
View File
@@ -8,12 +8,12 @@ def aggregateHashes(executions_json) -> pd.DataFrame:
"""
Takes the executions, aggregates all the data with sha256 as primary, then returns aggregated dataframe
"""
data = executions_json.json()
data = json.loads(executions_json)
df = pd.DataFrame(data["response"]["exechistories"])
if df.empty:
return df
print(df)
# Aggregate by sha256, deduplicate lists, and preserve order
agg_df = df.groupby("sha256").agg(lambda x: list(dict.fromkeys(x))).reset_index()
@@ -64,16 +64,17 @@ def augmentAggregatedHashes(url, agg_df: pd.DataFrame) -> pd.DataFrame:
df_api = pd.DataFrame(rows)
aug_df = agg_df.merge(df_api, on="sha256", how="left")
df = agg_df.merge(df_api, on="sha256", how="left")
aug_df = df[['sha256', 'filename_x', 'description', 'productname', 'productversion', 'publisher_y', 'publisher_x', 'netdomain', 'hostname', 'username', 'pprocess', 'gprocess', 'commandline', 'reputation_lastseen', 'reputation_scannercount', 'reputation_scannermatch', 'reputation_status', 'reputation_threatlevel', 'reputation_threatname', 'reputation_timestamp']]
return aug_df
def categorizeHashes(aug_df: pd.DataFrame, threat_tolerance: int, untrusted_publishers: list):
if untrusted_publishers is None:
untrusted_publishers = []
if untrusted_publishers is None:
untrusted_publishers = []
df = aug_df.copy()
def reputationtool(row, threat_tolerance):
df = aug_df.copy()
def reputationtool(row, threat_tolerance):
if row["reputation_scannermatch"] == "N/A":
return True
try:
@@ -83,11 +84,20 @@ def categorizeHashes(aug_df: pd.DataFrame, threat_tolerance: int, untrusted_publ
pass
return False
mask_needsreview = (df["publisher_y"] == "Not Signed") & df.apply(lambda row: reputationtool(row, threat_tolerance), axis=1)
mask_approved = (df["publisher_y"] != "Not Signed") & (~df["publisher_y"].isin(untrusted_publishers))
mask_needsreview = (df["publisher_y"] == "Not Signed") & df.apply(lambda row: reputationtool(row, threat_tolerance), axis=1)
needsreview_df = df[mask_needsreview]
approved_df = df[mask_approved]
remaining_df = df[~(mask_needsreview | mask_approved)]
mask_approved = (
((df["publisher_y"] != "Not Signed") & (~df["publisher_y"].isin(untrusted_publishers))) &
(df["publisher_y"] != "Not Signed") # explicitly signed
) | (
(df["publisher_y"] == "Not Signed") &
(~df.apply(lambda row: reputationtool(row, threat_tolerance), axis=1)) &
(~df["publisher_y"].isin(untrusted_publishers)) # exclude untrusted even if unsigned
)
return needsreview_df, approved_df, remaining_df
needsreview_df = df[mask_needsreview]
approved_df = df[mask_approved]
remaining_df = df[~(mask_needsreview | mask_approved)]
return needsreview_df, approved_df, remaining_df