Python main示例

示例#1

def createIOC(md5, config_dict):
    items = [
        ("contains", "Network", "Network/DNS", "string",
         config_dict["Domain"]),
        ("is", "PortItem", "PortItem/remotePort", "string",
         config_dict["Port"]),
        ("is", "ProcessItem", "ProcessItem/name", "string",
         config_dict["StartUp Name"]),
        ("is", "RegistryItem", "RegistryItem/Value", "string",
         config_dict["Registry Key"]),
    ]
    IOC = ioc.main(items)
    database.insertIOC(md5, IOC)

示例#2

文件： _VirusRat.py 项目： 5l1v3r1/CAPE-1

def createIOC(md5, dict):
    items = []
    domain = dict["Domain"]
    items.append(("contains", "Network", "Network/DNS", "string", domain))
    items.append(
        ("is", "PortItem", "PortItem/remotePort", "string", dict["Port"]))

    install = [("is", "ProcessItem", "ProcessItem/name", "string",
                dict["StartUp Name"]),
               ("is", "RegistryItem", "RegistryItem/Value", "string",
                dict["Registry Key"])]
    for x in install:
        items.append(x)
    IOC = ioc.main(items)
    database.insertIOC(md5, IOC)

示例#3

文件： _VirusRat.py 项目： Antelox/RATDecoders

def createIOC(md5, dict):
	items = []
	domain = dict["Domain"]
	items.append(("contains", "Network", "Network/DNS", "string", domain))
	items.append(("is", "PortItem", "PortItem/remotePort", "string", dict["Port"]))
	
	install = [
			   ("is", "ProcessItem", "ProcessItem/name", "string", dict["StartUp Name"]), 
			   ("is", "RegistryItem", "RegistryItem/Value", "string", dict["Registry Key"])

			  ]
	for x in install:
		items.append(x)
	IOC = ioc.main(items)
	database.insertIOC(md5, IOC)