First Commit

utils/database.py

@@ -0,0 +1,25 @@
+import pathlib
+import sqlite3
+
+conn = sqlite3.connect('database.db')
+cursor = conn.cursor()
+
+def createdatabasefile():
+    pathlib.Path("database.db").touch(exist_ok=True)
+    cursor.execute("SELECT * FROM sqlite_master WHERE type='table' AND name='active_attacks'")
+    result = cursor.fetchone()
+    if result is None:
+        cursor.execute('''CREATE TABLE active_attacks
+                       (vendor_name text, date_accessed datetime)
+                       ''')
+        conn.commit()
+
+def checkdatabase(victimname, date_discovered):
+    query = f"SELECT vendor_name FROM active_attacks WHERE vendor_name= ?"
+    cursor.execute(query, (victimname,))
+    result = cursor.fetchone()
+    if result is None:
+        query = f"INSERT INTO active_attacks VALUES ('{victimname}', '{date_discovered}')"
+        cursor.execute(query)
+        conn.commit()
+        return False

utils/teamsconnector.py

@@ -0,0 +1,145 @@
+import dotenv
+import os
+import requests
+dotenv.load_dotenv()
+
+def teamswebhook(victimname, date_discovered, domain, group, ip_address, description):
+    webhook_url = os.getenv('WEBHOOK_URL')
+
+    headers = {"Content-Type": "application/json"}
+
+    adaptive_card = {
+    "type": "AdaptiveCard",
+    "body": [
+        {
+            "type": "TextBlock",
+            "size": "Medium",
+            "weight": "Bolder",
+            "text": "Ransomware.live Alert!"
+        },
+        {
+            "type": "ColumnSet",
+            "columns": [
+                {
+                    "type": "Column",
+                    "items": [
+                        {
+                            "type": "TextBlock",
+                            "weight": "Bolder",
+                            "text": f"{victimname}",
+                            "wrap": "true"
+                        },
+                        {
+                            "type": "TextBlock",
+                            "spacing": "None",
+                            "text": f"{date_discovered}",
+                            "isSubtle": "true",
+                            "wrap": "true"
+                        }
+                    ],
+                    "width": "stretch"
+                }
+            ]
+        },
+        {
+            "type": "TextBlock",
+            "text": f"{description}",
+            "wrap": "true"
+        },
+        {
+            "type": "ColumnSet",
+            "separator": "true",
+            "columns": [
+                {
+                    "type": "Column",
+                    "width": "stretch",
+                    "items": [
+                        {
+                            "type": "TextBlock",
+                            "text": "Domain",
+                            "wrap": "true"
+                        }
+                    ]
+                },
+                {
+                    "type": "Column",
+                    "width": "stretch",
+                    "items": [
+                        {
+                            "type": "TextBlock",
+                            "text": f"{domain}",
+                            "wrap": "true"
+                        }
+                    ]
+                }
+            ]
+        },
+        {
+            "type": "ColumnSet",
+            "columns": [
+                {
+                    "type": "Column",
+                    "width": "stretch",
+                    "items": [
+                        {
+                            "type": "TextBlock",
+                            "text": "IP Addresses",
+                            "wrap": "true"
+                        }
+                    ]
+                },
+                {
+                    "type": "Column",
+                    "width": "stretch",
+                    "items": [
+                        {
+                            "type": "TextBlock",
+                            "text": f"{ip_address}",
+                            "wrap": "true"
+                        }
+                    ]
+                }
+            ]
+        },
+        {
+            "type": "ColumnSet",
+            "columns": [
+                {
+                    "type": "Column",
+                    "width": "stretch",
+                    "items": [
+                        {
+                            "type": "TextBlock",
+                            "text": "Ransomware Group",
+                            "wrap": "true"
+                        }
+                    ]
+                },
+                {
+                    "type": "Column",
+                    "width": "stretch",
+                    "items": [
+                        {
+                            "type": "TextBlock",
+                            "text": f"{group}",
+                            "wrap": "true"
+                        }
+                    ]
+                }
+            ]
+        }
+    ],
+    "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
+    "version": "1.6"
+}
+
+    payload = {
+        "card": adaptive_card
+    }
+
+    response = requests.post(webhook_url, headers=headers, json=payload)
+
+    if response.ok:
+        print("✅ Card sent to Teams successfully!")
+    else:
+        print(f"❌ Failed to send card: {response.status_code} - {response.text}")