Skip to content

This code pulls hashes from MalwareBazaar's API and uploads them into Cisco AMP's Simple Custom Detections Lists via AMP's v1 API.

Notifications You must be signed in to change notification settings

avnyc/MalwareBazaar_and_Cisco_AMP

Repository files navigation

MalwareBazaar_and_Cisco_AMP

This code pulls SHA-256 hashes from MalwareBazaar and uploads the hashes into Cisco AMP's Simple Custom Detections Lists. The individual strain list along with the aggregate list are updated. Screenshots accompany the function calls and show the results. Yes, I am aware that most malware is polymorphic or metamorpic. Thank you, Ross, for improving upon the codebase!

  1. pull_from_malware_bazaar_api() Create text files for all malware strains.
  2. create_master_df_from_malware_bazaar() Add all strains into one text file.
  3. all_hashes_in_amp_df = pull_main_hash_list() Create a text file with all hashes from AMP.
  4. compare_differences(all_hashes_in_amp_df) Compare the differences on a txt file basis. If no differences exist delete text file. If differences exist, leave only differences in the txt file and delete the remaining hashes.
  5. insert_amp_sha256() Update list with new hashes. This is on a per strain basis and the one dominant hash list.

About

This code pulls hashes from MalwareBazaar's API and uploads them into Cisco AMP's Simple Custom Detections Lists via AMP's v1 API.

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages