brotoskyj
145 lines
4.2 KiB
Python
145 lines
4.2 KiB
Python
import dotenv
|
|
import os
|
|
import requests
|
|
dotenv.load_dotenv()
|
|
|
|
def teamswebhook(victimname, date_discovered, domain, group, ip_address, description):
|
|
webhook_url = os.getenv('WEBHOOK_URL')
|
|
|
|
headers = {"Content-Type": "application/json"}
|
|
|
|
adaptive_card = {
|
|
"type": "AdaptiveCard",
|
|
"body": [
|
|
{
|
|
"type": "TextBlock",
|
|
"size": "Medium",
|
|
"weight": "Bolder",
|
|
"text": "Ransomware.live Alert!"
|
|
},
|
|
{
|
|
"type": "ColumnSet",
|
|
"columns": [
|
|
{
|
|
"type": "Column",
|
|
"items": [
|
|
{
|
|
"type": "TextBlock",
|
|
"weight": "Bolder",
|
|
"text": f"{victimname}",
|
|
"wrap": "true"
|
|
},
|
|
{
|
|
"type": "TextBlock",
|
|
"spacing": "None",
|
|
"text": f"{date_discovered}",
|
|
"isSubtle": "true",
|
|
"wrap": "true"
|
|
}
|
|
],
|
|
"width": "stretch"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"type": "TextBlock",
|
|
"text": f"{description}",
|
|
"wrap": "true"
|
|
},
|
|
{
|
|
"type": "ColumnSet",
|
|
"separator": "true",
|
|
"columns": [
|
|
{
|
|
"type": "Column",
|
|
"width": "stretch",
|
|
"items": [
|
|
{
|
|
"type": "TextBlock",
|
|
"text": "Domain",
|
|
"wrap": "true"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"type": "Column",
|
|
"width": "stretch",
|
|
"items": [
|
|
{
|
|
"type": "TextBlock",
|
|
"text": f"{domain}",
|
|
"wrap": "true"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"type": "ColumnSet",
|
|
"columns": [
|
|
{
|
|
"type": "Column",
|
|
"width": "stretch",
|
|
"items": [
|
|
{
|
|
"type": "TextBlock",
|
|
"text": "IP Addresses",
|
|
"wrap": "true"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"type": "Column",
|
|
"width": "stretch",
|
|
"items": [
|
|
{
|
|
"type": "TextBlock",
|
|
"text": f"{ip_address}",
|
|
"wrap": "true"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"type": "ColumnSet",
|
|
"columns": [
|
|
{
|
|
"type": "Column",
|
|
"width": "stretch",
|
|
"items": [
|
|
{
|
|
"type": "TextBlock",
|
|
"text": "Ransomware Group",
|
|
"wrap": "true"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"type": "Column",
|
|
"width": "stretch",
|
|
"items": [
|
|
{
|
|
"type": "TextBlock",
|
|
"text": f"{group}",
|
|
"wrap": "true"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
|
|
"version": "1.6"
|
|
}
|
|
|
|
payload = {
|
|
"card": adaptive_card
|
|
}
|
|
|
|
response = requests.post(webhook_url, headers=headers, json=payload)
|
|
|
|
if response.ok:
|
|
print("✅ Card sent to Teams successfully!")
|
|
else:
|
|
print(f"❌ Failed to send card: {response.status_code} - {response.text}") |