malware_script.py

#BigFix automation script
#queries BigFix DB for SAIT computers whose local Trend Micro modules are
#reporting malware detections. It then sends emails to the
#sait-security@lists.berkeley.edu address to notify the InfoSec team of any
#infections.
#Authored by Joshua Scherschel
import csv
import requests
import ssl
import urllib2
import os
import s
from subprocess import call
import datetime
from datetime import date
from eval_relevance import eval_rel

from malware_severity import TrendMicroRiskAssessment

today = date.today()
if not os.path.isfile('/home/infosec/bigfix/osx_tickets.txt'):
	call(['touch', '/home/infosec/bigfix/osx_tickets.txt'])
if not os.path.isfile('/home/infosec/bigfix/win_tickets.txt'):
	call(['touch', '/home/infosec/bigfix/win_tickets.txt'])

#Get a list of vulnerable win computers with a brief description of what compromised each respective computer

relevanceExpr = """(names of computers of it, id of computers of it, "NA", operating systems of computers of it, values of results from (bes properties whose (name of it = "User Name")) of computers of it, values of it) of results of property 1 of fixlet 21 of bes site whose (name of it = "Trend Core Protection Module")"""
windows = eval_rel(relevanceExpr)
win_results_set = set()
for val in windows:
	#val[4] += val[5] #this chunk gets rid of some obnoxious , delimited splitting in the dates
	#del val[4]
	#val[4] = val[4][2:-1]
	val[5] = val[5][2:]
	if val[7] == ' 9' or val[8] == ' 1': #this bit changes the NA value to something more descirptive (if possible)
		val[2] = 'Quarantined'
	elif val[7] == ' 0':
		val[2] = 'Cleaned'
	elif val[7] == ' 2' or val[8] == ' 10':
		val[2] = 'Deleted'
	elif val[7] == ' 3' or val[8] == ' 12':
		val[2] = 'Renamed'
	elif val[7] == ' 4' or val[8] == ' 13' and val[8] == ' 1':
		val[2] = 'Access Denied'
	elif val[7] == ' 4' or val[8] == ' 13' and val[8] != ' 1':
		val[2] = 'Passed'
	elif val[7] == ' 25':
		val[2] = 'Passed a potential security risk'
	elif val[7] == ' 81':
		val[2] = "File is encrypted"
	else:
		val[2] = 'Unknown at this time'
	to_str = '' #this bit encodes the modified values as a comman delimited string
	for i in val:
		if i[0] == ' ':
			to_str += (i[1:] + ',')
		else:
			to_str += i + ','
	win_results_set.add(to_str)

#same thing as above except for OSX
rel_expr = """(names of computers of it, id of computers of it, "NA", operating systems of computers of it, values of results from (bes properties whose (name of it = "User Name")) of computers of it, values of it) of results of property whose (name of it = "Detected Viruses") of fixlet 5 of bes site whose (name of it = "Trend Micro Mac Protection Module")"""
osx = eval_rel(rel_expr)
osx_results_set = set()
for val in osx:
	#val[4] += val[5]
	#del val[5]
	#val[4] = val[4][2:-1]
	val[5] = val[5][2:]
	#include stuff here for quarantined files when you know the codes
	val[2] = 'Unknown at this time'
	to_str = ''
	for i in val:
		if i[0] == ' ':
			to_str += i[1:] + ','
		else:
			to_str += i + ','
	osx_results_set.add(to_str)

#import last report's tickets and determine which ones are no longer reported, which ones are new
win_tickets_set = set([line.strip() for line in open('/home/infosec/bigfix/win_tickets.txt')])
to_delete = set()
for ticket in win_tickets_set:
	if ticket not in win_results_set:
		to_delete.add(ticket)
	else:
		win_results_set.remove(ticket)
win_tickets_set -= to_delete
#craft emails and send with s.py
for result in win_results_set:
	print result
	win_tickets_set.add(result)
	result = result.split(',')
#	urgent_msg = 'Trend Micro is reporting that the possible infection has been quarantined.'
#	if result[2] != 'Quarantined':
#		urgent_msg = 'Either Trend Micro is reporting that the possible infection has not been quarantined, or the status is not known at this time.'
	email_body = """
	BigFix Automated Report: Possible Trend Micro infection detection
	Additional details: borealis.rescomp.berkeley.edu:/home/infosec/bigfix/reports/report_{0}
	Name: {1}
	ID: {2}
	Operating System: {3}
	Username: {4}
	Time of Detection: {5}
	Description: {6}
	File Path: {7}
	Infection Status: {8}
	Time of Report: {9}
	""".format(today, result[0], result[1], result[3], result[4], result[5], result[6], result[10], result[2], datetime.datetime.today().strftime("%d %b %Y %X"))
	s.send_mail('{0}: BigFix has Detected a Possible Infection {1}'.format(result[0], result[6]), email_body)
#write win tickets to file
win_tickets_file = open('/home/infosec/bigfix/win_tickets.txt', 'wb')
for ticket in win_tickets_set:
	win_tickets_file.write('{0}\n'.format(ticket))
win_tickets_file.close()

#same as above except for OSX
#read in osx tickets and ID those no longer reported/new ones
to_delete = set()
osx_tickets_set = set([line.strip() for line in open('/home/infosec/bigfix/osx_tickets.txt')])
for ticket in osx_tickets_set:
	if ticket not in osx_results_set:
		to_delete.add(ticket)
	else:
		osx_results_set.remove(ticket)
osx_tickets_set -= to_delete
#craft emails
for result in osx_results_set:
	print result
	osx_tickets_set.add(result)
	result = result.split(',')
#	urgent_msg = 'Trend Micro is reporting that the possible infection has been quarantined.'
#	if result[2] != 'Quarantined':
#		urgent_msg = 'Either Trend Micro is reporting that the possible infection has not been quarantined, or the status is not known at this time.'
	email_body = """
	BigFix Automated Report: Possible Trend Micro infection detection
	Additional details: borealis.rescomp.berkeley.edu:/home/infosec/bigfix/reports/report_{0}
	Name: {1}
	ID: {2}
	Operating System: {3}
	Username: {4}
	Time of Detection: {5}
	Description: {6}
	File Path: {7}
	Infection Status: {8}
	Time of Report: {9}
	""".format(today, result[0], result[1], result[3], result[4], result[5], result[6], result[9], result[2], datetime.datetime.today().strftime("%d %b %Y %X"))
	s.send_mail('{0}: BigFix has Detected a Possible Infection {1}'.format(result[0], result[6]), email_body)
#save osx tickets to file
osx_tickets_file = open('/home/infosec/bigfix/osx_tickets.txt', 'wb')
for ticket in osx_tickets_set:
	osx_tickets_file.write('{0}\n'.format(ticket))
osx_tickets_file.close()

#create reports
#currently owned by root and root group, so we can't actually read them :| (TO-DO)
if not os.path.isfile('/home/infosec/bigifx/reports/report_{0}.csv'.format(today)):
	call(['touch', '/home/infosec/bigfix/reports/report_{0}.csv'.format(today)])
with open('/home/infosec/bigfix/reports/report_{0}.csv'.format(today), 'wb') as csvfile:
	w = csv.writer(csvfile, delimiter=',')
	w.writerow(['Possible Infection Report for {0}'.format(today)])
	w.writerow('')
	w.writerow(['Windows Infections'])
	w.writerow(['Computer Name', 'Computer ID', 'Quarantined Status', 'OS', 'Username', 'Time of Detection', 'Infection Description', 'Status', 'Filepath'])
	for i in win_tickets_set:
		i = i.split(',')
		w.writerow([i[0], i[1], i[2], i[3], i[4], i[5], i[6], i[7], i[10]])
	w.writerow('')
	w.writerow(['OSX Infections'])
	w.writerow(['Computer Name', 'Computer ID', 'Quarantined Status', 'OS', 'Username', 'Time of Detection', 'Description', 'Value #1', 'Filepath'])
	for i in osx_tickets_set:
		i = i.split(',')
		w.writerow([i[0], i[1], i[2], i[3], i[4], i[5], i[6], i[7], i[9]])