Merge pull request GreedyBear-Project#562 from intelowlproject/develop

1.6.7

Author: mlodic

.env_template

@@ -13,4 +13,4 @@ COMPOSE_FILE=docker/default.yml:docker/local.override.yml
 #COMPOSE_FILE=docker/default.yml:docker/local.override.yml:docker/elasticsearch.yml
 
 # If you want to run a specific version, populate this
-# REACT_APP_INTELOWL_VERSION="1.6.6"
+# REACT_APP_INTELOWL_VERSION="1.6.7"

.github/CODEOWNERS

@@ -0,0 +1 @@
+frontend/* @drosetti

.github/dependabot.yml

@@ -7,17 +7,13 @@ updates:
       interval: "weekly"
       day: "tuesday"
     target-branch: "develop"
-    reviewers:
-      - mlodic
 
   - package-ecosystem: "npm"
     directory: "/frontend"
     schedule:
       interval: "weekly"
       day: "tuesday"
     target-branch: "develop"
-    reviewers:
-      - drosetti
 
 
   - package-ecosystem: "docker"
@@ -26,8 +22,6 @@ updates:
       interval: "weekly"
       day: "tuesday"
     target-branch: "develop"
-    reviewers:
-      - mlodic
 
 
   - package-ecosystem: "github-actions"
@@ -36,5 +30,3 @@ updates:
       interval: "weekly"
       day: "tuesday"
     target-branch: "develop"
-    reviewers:
-      - mlodic

docker/.version

@@ -1 +1 @@
-REACT_APP_GREEDYBEAR_VERSION="1.6.6"
+REACT_APP_GREEDYBEAR_VERSION="1.6.7"

greedybear/admin.py

@@ -5,7 +5,7 @@
 from django.contrib import admin, messages
 from django.db.models import Q
 from django.utils.translation import ngettext
-from greedybear.models import IOC, CommandSequence, CowrieSession, GeneralHoneypot, MassScanners, Sensors, Statistics
+from greedybear.models import IOC, CommandSequence, CowrieSession, GeneralHoneypot, MassScanners, Sensors, Statistics, WhatsMyIP
 
 logger = logging.getLogger(__name__)
 
@@ -23,6 +23,13 @@ class StatisticsModelAdmin(admin.ModelAdmin):
     search_help_text = ["search for the IP address source"]
 
 
+@admin.register(WhatsMyIP)
+class WhatsMyIPModelAdmin(admin.ModelAdmin):
+    list_display = ["domain", "added"]
+    search_fields = ["domain"]
+    search_help_text = ["search for the domain"]
+
+
 @admin.register(MassScanners)
 class MassScannersModelAdmin(admin.ModelAdmin):
     list_display = ["ip_address", "added", "reason"]

greedybear/celery.py

@@ -126,4 +126,9 @@ def setup_loggers(*args, **kwargs):
         "schedule": crontab(hour=4, minute=3, day_of_week=0),
         "options": {"queue": "default"},
     },
+    "get_whatsmyip": {
+        "task": "greedybear.tasks.get_whatsmyip",
+        "schedule": crontab(hour=4, minute=3, day_of_week=6),
+        "options": {"queue": "default"},
+    },
 }

greedybear/cronjobs/attacks.py

@@ -13,7 +13,7 @@
 from greedybear.cronjobs.base import ElasticJob
 from greedybear.cronjobs.scoring.scoring_jobs import UpdateScores
 from greedybear.cronjobs.sensors import ExtractSensors
-from greedybear.models import IOC, GeneralHoneypot, MassScanners, Sensors
+from greedybear.models import IOC, GeneralHoneypot, MassScanners, Sensors, WhatsMyIP, iocType
 from greedybear.settings import EXTRACTION_INTERVAL, LEGACY_EXTRACTION
 
 
@@ -68,10 +68,27 @@ def _add_ioc(self, ioc, attack_type: str, general=None):
             ioc_record.number_of_days_seen = len(ioc_record.days_seen)
         ioc_record.scanner = attack_type == SCANNER
         ioc_record.payload_request = attack_type == PAYLOAD_REQUEST
-        ioc_record.save()
-        self.ioc_records.append(ioc_record)
-        self._threatfox_submission(ioc_record, ioc.related_urls)
-        return ioc_record
+
+        filtered = False
+        if ioc_record.type == iocType.DOMAIN:
+            filtered = self._filter_whatsmyip(ioc_record.name)
+
+        if filtered:
+            return None
+        else:
+            ioc_record.save()
+            self.ioc_records.append(ioc_record)
+            self._threatfox_submission(ioc_record, ioc.related_urls)
+            return ioc_record
+
+    def _filter_whatsmyip(self, domain):
+        try:
+            WhatsMyIP.objects.get(domain=domain)
+        except WhatsMyIP.DoesNotExist:
+            return False
+        else:
+            self.log.info(f"{domain=} is a whats-my-ip domain. Filtering it.")
+            return True
 
     def _threatfox_submission(self, ioc_record: "IOC", related_urls: list):
         # we submit only payload request IOCs for now because they are more reliable
@@ -101,7 +118,7 @@ def _threatfox_submission(self, ioc_record: "IOC", related_urls: list):
         if ioc_record.log4j:
             seen_honeypots.append("log4pot")
         for honeypot in ioc_record.general_honeypot.all():
-            seen_honeypots.append(honeypot)
+            seen_honeypots.append(honeypot.name)
         seen_honeypots_str = ", ".join(seen_honeypots)
 
         json_data = {

greedybear/cronjobs/cowrie.py

@@ -36,9 +36,10 @@ def _get_scanners(self):
             ioc.cowrie = True
             self.log.info(f"found IP {ioc.name} by honeypot cowrie")
             ioc = self._add_ioc(ioc, attack_type=SCANNER)
-            self.added_scanners += 1
-            self._extract_possible_payload_in_messages(ioc.name)
-            self._get_sessions(ioc)
+            if ioc:
+                self.added_scanners += 1
+                self._extract_possible_payload_in_messages(ioc.name)
+                self._get_sessions(ioc)
 
     def _extract_possible_payload_in_messages(self, scanner_ip):
         # looking for URLs inside attacks payloads

greedybear/cronjobs/whatsmyip.py

@@ -0,0 +1,25 @@
+import requests
+from greedybear.cronjobs.base import Cronjob
+from greedybear.models import IOC, WhatsMyIP
+
+
+class WhatsMyIPCron(Cronjob):
+    def run(self) -> None:
+        r = requests.get("https://raw.githubusercontent.com/MISP/misp-warninglists/refs/heads/main/lists/whats-my-ip/list.json", timeout=10)
+        json_file = r.json()
+        for domain in json_file["list"]:
+            try:
+                WhatsMyIP.objects.get(domain=domain)
+            except WhatsMyIP.DoesNotExist:
+                self.log.info(f"added new whatsmyip domain {domain=}")
+                WhatsMyIP(domain=domain).save()
+                self._remove_old_ioc(domain)
+
+    def _remove_old_ioc(self, domain):
+        try:
+            ioc = IOC.objects.get(name=domain)
+        except IOC.DoesNotExist:
+            pass
+        else:
+            ioc.delete()
+            self.log.info(f"deleted whatsmyip {domain=}")

greedybear/migrations/0022_whatsmyip.py

@@ -0,0 +1,25 @@
+# Generated by Django 4.2.20 on 2025-07-18 17:45
+
+import datetime
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("greedybear", "0021_massscanners_greedybear__ip_addr_2aa484_idx"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="WhatsMyIP",
+            fields=[
+                ("id", models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name="ID")),
+                ("domain", models.CharField(max_length=256)),
+                ("added", models.DateTimeField(default=datetime.datetime.now)),
+            ],
+            options={
+                "indexes": [models.Index(fields=["domain"], name="greedybear__domain_f89b04_idx")],
+            },
+        ),
+    ]