gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2025-12-23 07:28:34 -08:00
Code Issues Packages Projects Releases Wiki Activity

small improvements

Browse Source
This commit is contained in:
doomedraven
2020-12-01 20:31:56 +01:00
parent b4827fcb00
commit 5920552649
2 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
capa/render/dictionary.py
View File

@@ -72,12 +72,13 @@ def render_capabilities(doc, ostream):
else: else:
capability = "%s (%d matches)" % (rule["meta"]["name"], count) capability = "%s (%d matches)" % (rule["meta"]["name"], count)
ostream["CAPABILITY"].setdefault(capability, rule["meta"]["namespace"]) ostream["CAPABILITY"].setdefault(rule["meta"]["namespace"], list())
ostream["CAPABILITY"][rule["meta"]["namespace"]].append(capability)
def render_attack(doc, ostream): def render_attack(doc, ostream):
""" """
example:: example::
{'ATT&CK': {'COLLECTION': ['Input Capture::Keylogging [T1056.001]'], {'ATTCK': {'COLLECTION': ['Input Capture::Keylogging [T1056.001]'],
'DEFENSE EVASION': ['Obfuscated Files or Information [T1027]', 'DEFENSE EVASION': ['Obfuscated Files or Information [T1027]',
'Virtualization/Sandbox Evasion::System Checks ' 'Virtualization/Sandbox Evasion::System Checks '
'[T1497.001]'], '[T1497.001]'],
@@ -87,7 +88,7 @@ def render_attack(doc, ostream):
'EXECUTION': ['Shared Modules [T1129]']} 'EXECUTION': ['Shared Modules [T1129]']}
} }
""" """
ostream["ATT&CK"] = dict() ostream["ATTCK"] = dict()
tactics = collections.defaultdict(set) tactics = collections.defaultdict(set)
for rule in rutils.capability_rules(doc): for rule in rutils.capability_rules(doc):
if not rule["meta"].get("att&ck"): if not rule["meta"].get("att&ck"):
@@ -114,7 +115,7 @@ def render_attack(doc, ostream):
inner_rows.append("%s::%s %s" % (technique, subtechnique, id)) inner_rows.append("%s::%s %s" % (technique, subtechnique, id))
else: else:
raise RuntimeError("unexpected ATT&CK spec format") raise RuntimeError("unexpected ATT&CK spec format")
ostream["ATT&CK"].setdefault(tactic.upper(), inner_rows) ostream["ATTCK"].setdefault(tactic.upper(), inner_rows)
def render_mbc(doc, ostream): def render_mbc(doc, ostream):

2
scripts/capa_as_library.py
View File

@@ -29,3 +29,5 @@ meta["analysis"].update(counts)
capa_json = json.loads(capa.render.render_json(meta, rules, capabilities)) capa_json = json.loads(capa.render.render_json(meta, rules, capabilities))
# ...as human readable text table # ...as human readable text table
capa_texttable = capa.render.render_default(meta, rules, capabilities) capa_texttable = capa.render.render_default(meta, rules, capabilities)
# ...as python dictionary, simplified as textable but in dictionary
capa_dict = capa.render.render_dictionary(meta, rules, capabilities)