IntelMQ-users February 2020

intelmq-users@lists.cert.at

4 participants
3 discussions

Reverse DNS Expert - unusual behavior
by Tomislav Protega 31 Mar '20

31 Mar '20

Hi, recently I noticed that reverse DNS expert bot doesn't correctly apply the reverse lookup results for IP. Meaning, the right value (result) is not applied for the right JSON event. It's like it's skipping it and then applies it to other event. There are no errors in log file for the bot. For the illustration: Let say that hostname for IP 1.1.1.1 is "xx.yyy.zz", but instead the mentioned hostname becomes applied under wrong JSON event for the IP which in real has no PTR record in DNS. Of course, there are events which have applied right PTR record for the IP, but in rare situations. This case is not the issue with raw events which already contain hostname in origin feed. Anyone notice such behavor, or could take a look at already processed data and see if the "source.reverse_dns" has right value applied against IP? Regards, -- Tomislav

2 5

Long filenames and Generic Mail Attachment Fetcher
by Patrick Forsberg 28 Feb '20

28 Feb '20

Hi, I'm pretty sure some of you (at least Sebastian) is aware of this, but there is currently a problem with the intelmq.bots.collectors.mail.collector_mail_attach and attachments with long filenames. The error is not in the bot itself, but in the underlying imbox library that doesn't handle long filenames spread over multiple "filename*=" lines in Content-Disposition. The end result is that some attachments will probably fail to be extracted and it will look similar to the following line in the Collector log. Shadowserver-Mail-Attachment-Fetcher-Collector - INFO - Attachment sv.zip didn't match regex. There is a non merged pull request in the imbox Git repository to handle this but it hasn't been merged with the main repo. The solution is to patch imbox/parser.py I've attached my patch against the pip3 version of imbox (slightly different to the umerged Git pull request) Regards, Patrick Forsberg SUNET CERT

2 1

IntelMQ
by UCC-CERT 20 Feb '20

20 Feb '20

Dear Experts, We currently have a mail box which contains only shadow server feeds attachment files in a zipped form. The IntelMQ is able to read the emails but cannot extract and forward them to the shadow server parser. We need your assistance . See details below Configuration From Runtime.conf ---------------------------------------------------------------------------- -------------------------- "Mail-Attachment-Fetcher-Collector": { "parameters": { "extract_files": "True", "attach_regex": "[A-Za-z:0-9\\.\\_ \\[\\]\\-]", "folder": "INBOX", "mail_host": "imap.xxxx.xxx", "mail_password": "xxxxxxxxxx", "mail_ssl": true, "mail_user": "johndoe", "name": "Via IMAP", "provider": "ShadowServer", "rate_limit": 86400, "subject_regex": "[A-Za-z:0-9 \\[\\]\\-]" }, "name": "Mail Attachment Fetcher", "group": "Collector", "module": "intelmq.bots.collectors.mail.collector_mail_attach", "description": "Monitor IMAP mailboxes and retrieve mail attachments", "enabled": true, "run_mode": "continuous" Below are the logs tail -n 1000 Mail-Attachment-Fetcher-Collector.log 2020-02-18 18:31:12,672 - Mail-Attachment-Fetcher-Collector - INFO - Email report read. 2020-02-18 18:31:19,310 - Mail-Attachment-Fetcher-Collector - INFO - Email report read. 2020-02-18 18:31:25,574 - Mail-Attachment-Fetcher-Collector - INFO - Email report read. 2020-02-18 18:31:31,816 - Mail-Attachment-Fetcher-Collector - INFO - Email report read. Should you need any further information, please do not hesitate to contact me. Thanks Regards, Vincent M UG-CERT

4 10

2025

2024

2023

2022

2021

2020

2019

2018

2017

IntelMQ-users February 2020