chaitanyakrishna / YaraIOCDownloader

This script will download IOCs based on the rule name defined in Yara rules and leverages abuse.ch API service to fetch the IOCs

YaraIOCDownloader

This script will download IOCs based on the rule name defined in Yara rules and leverages abuse.ch API service to fetch the IOCs

Usage

$python YaraIOC_Downloader.py -h
__   __                ___ ___   ____
\ \ / /_ _ _ __ __ _  |_ _/ _ \ / ___|
 \ V / _` | '__/ _` |  | | | | | |
  | | (_| | | | (_| |  | | |_| | |___
  |_|\__,_|_|  \__,_| |___\___/ \____|

 ____                      _                 _
|  _ \  _____      ___ __ | | ___   __ _  __| | ___ _ __
| | | |/ _ \ \ /\ / / '_ \| |/ _ \ / _` |/ _` |/ _ \ '__|
| |_| | (_) \ V  V /| | | | | (_) | (_| | (_| |  __/ |
|____/ \___/ \_/\_/ |_| |_|_|\___/ \__,_|\__,_|\___|_|



usage: YaraIOC_Downloader.py [-h] [-s SINGLE_RULE_NAME]
                             [-f FILE_CONTAINING_RULE_NAME] [-t TIMEOUT]
                             [-th THREADNUMBER] -o OUTPUT

Yara Scanner v1.0

Optional Arguments:
  -h, --help            show this help message and exit
  
  -s SINGLE_RULE_NAME, --single SINGLE_RULE_NAME
                        Give Single Yara Rule Name
  -f FILE_CONTAINING_RULE_NAME, --file FILE_CONTAINING_RULE_NAME
                        File Containing Yara Rule Name, One Yara Rule Name in
                        One Line.
  -t TIMEOUT, --timeout TIMEOUT 
                        HTTP Request Timeout. default=60
  -th THREADNUMBER, --thread THREADNUMBER 
                        Parallel HTTP Request Number. default=100

Required Arguments:

  -o OUTPUT, --output OUTPUT Output file name.

Single Rulename

$python YaraIOC_Downloader.py -s LockbitBlack_Loader -o LockbitBlack_Loader
__   __                ___ ___   ____
\ \ / /_ _ _ __ __ _  |_ _/ _ \ / ___|
\ V / _` | '__/ _` |  | | | | | |
| | (_| | | | (_| |  | | |_| | |___
|_|\__,_|_|  \__,_| |___\___/ \____|

____                      _                 _
|  _ \  _____      ___ __ | | ___   __ _  __| | ___ _ __
| | | |/ _ \ \ /\ / / '_ \| |/ _ \ / _` |/ _` |/ _ \ '__|
| |_| | (_) \ V  V /| | | | | (_) | (_| | (_| |  __/ |
|____/ \___/ \_/\_/ |_| |_|_|\___/ \__,_|\__,_|\___|_|



========================================================================================================================
[Date: 22-08-2022] [Time: 13:22:06] [INFO] Initiating Yara IOC Downloader ...
========================================================================================================================
[Date: 22-08-2022] [Time: 13:22:06] [INFO] Fetching IOCs from Yara Rule Name: LockbitBlack_Loader
========================================================================================================================
[Date: 22-08-2022] [Time: 13:22:08] [INFO] Removing Duplicates ...
[Date: 22-08-2022] [Time: 13:22:09] [INFO] Done!
========================================================================================================================

Fetch IOCs from rule name containing from a file

$type rule.txt
Guloader_VBScript
LATAMHotel_Obfuscated_BAT
lnk_from_chinese
loader_win_bumblebee

$YaraIOC Downloader>python YaraIOC_Downloader.py -f rule.txt -o yararules-iocs
__   __                ___ ___   ____
\ \ / /_ _ _ __ __ _  |_ _/ _ \ / ___|
\ V / _` | '__/ _` |  | | | | | |
| | (_| | | | (_| |  | | |_| | |___
|_|\__,_|_|  \__,_| |___\___/ \____|

____                      _                 _
|  _ \  _____      ___ __ | | ___   __ _  __| | ___ _ __
| | | |/ _ \ \ /\ / / '_ \| |/ _ \ / _` |/ _` |/ _ \ '__|
| |_| | (_) \ V  V /| | | | | (_) | (_| | (_| |  __/ |
|____/ \___/ \_/\_/ |_| |_|_|\___/ \__,_|\__,_|\___|_|



========================================================================================================================
[Date: 22-08-2022] [Time: 13:23:50] [INFO] Initiating Yara IOC Downloader ...
========================================================================================================================
[Date: 22-08-2022] [Time: 13:23:50] [INFO] [Progress: 1/4] Fetching IOCs from Yara Rule Name: Guloader_VBScript
[Date: 22-08-2022] [Time: 13:23:55] [INFO] [Progress: 2/4] Fetching IOCs from Yara Rule Name: loader_win_bumblebee
[Date: 22-08-2022] [Time: 13:23:59] [INFO] [Progress: 3/4] Fetching IOCs from Yara Rule Name: LATAMHotel_Obfuscated_BAT
[Date: 22-08-2022] [Time: 13:24:02] [INFO] [Progress: 4/4] Fetching IOCs from Yara Rule Name: lnk_from_chinese
Error:  'data'
========================================================================================================================
[Date: 22-08-2022] [Time: 13:24:05] [INFO] Removing Duplicates ...
[Date: 22-08-2022] [Time: 13:24:05] [INFO] Done!
========================================================================================================================