@@ -0,0 +1,2691 @@
+import re%0Afrom datetime import timedelta%0A%0Afrom core import Feed%0Aimport logging%0A%0Afrom core.observables import Hostname, Ip%0A%0A%0Aclass BambenekOsintIpmaster(Feed):%0A    default_values = %7B%0A        %22frequency%22:%0A            timedelta(minutes=60),%0A        %22name%22:%0A            %22BambenekOsintIpmaster%22,%0A        %22source%22:%0A            %22http://osint.bambenekconsulting.com/feeds/c2-masterlist.txt%22,%0A        %22description%22:%0A            %22Master Feed of known, active and non-sinkholed C&Cs indicators (Bambenek)%22,%0A    %7D%0A    pattern = 'Master Indicator Feed for (%5Cw+) non-sinkholed domains'%0A    reg = re.compile(pattern)%0A%0A    def update(self):%0A        for line in self.update_lines():%0A            print(line)%0A            self.analyze(line)%0A%0A    def analyze(self, line):%0A        if not line or line%5B0%5D.startswith(%22#%22):%0A            return%0A%0A        tokens = line.split(',')%0A        c2_domain = %5B%5D%0A        ips_c2 = %5B%5D%0A        names_servers = %5B%5D%0A        ip_names_servers = %5B%5D%0A        context_feed = %5B%5D%0A        if len(tokens) == 6:%0A            c2_domain = tokens%5B0%5D%0A            ips_c2 = tokens%5B1%5D.split('%7C')%0A            names_servers = tokens%5B2%5D.split('%7C')%0A            ip_names_servers = tokens%5B3%5D.split('%7C')%0A            context_feed = tokens%5B4%5D%0A%0A            m = BambenekOsintIpmaster.reg.match(context_feed)%0A            malware_family = ''%0A            if m:%0A                malware_family = m.group(1)%0A%0A            context = %7B%0A                %22status%22: context_feed,%0A                %22name servers%22: names_servers,%0A                %22source%22: self.name%0A            %7D%0A            tags = %5Bmalware_family%5D%0A            c2 = None%0A            if c2_domain:%0A                c2 = Hostname.get_or_create(value=c2_domain)%0A                c2.add_context(context)%0A                c2.tag(tags)%0A%0A                for ip in ips_c2:%0A                    if ip:%0A                        ip_obs = Ip.get_or_create(value=ip)%0A                        ip_obs.tag(tags)%0A                        if c2:%0A                            c2.active_link_to(ip_obs, %22IP%22, self.source)%0A%0A            for name_server in names_servers:%0A                if name_server:%0A                    ns_obs = Hostname.get_or_create(value=name_server)%0A                    c2.active_link_to(ns_obs, 'NS', self.source)%0A                    ns_obs.tag(tags)%0A                    ns_obs.add_context(context)%0A%0A            for ip_ns in ip_names_servers:%0A                if ip_ns:%0A                    ip_ns_obs = Ip.get_or_create(value=ip_ns)%0A                    c2.active_link_to(ip_ns_obs, 'IP NS', self.source)%0A                    ip_ns_obs.tag(tags)%0A                    ip_ns_obs.add_context(context)%0A        else:%0A            logging.error('Parsing error in line: %25s' %25 line)%0A

add bambenek osint feed (#248) (fixes #247)