First commit!

analysis/analysis.py

@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+from classes.engine import Engine
+from classes.report import Report
+import sys
+import json
+import os
+
+"""
+    This file is called by the frontend to do the analysis.
+"""
+
+def analyze(capture_folder):
+    """This method analyse a pcap. It:
+        1. Launches the detection engine which uses suricata;
+        2. Save the results inside the "assets" subfolder of the capture folder;
+        3. Generates the PDF report and save it in the capture folder. 
+
+    Args:
+        capture_folder (str): The capture folder (eg. /tmp/45FB392D/)
+    """
+    if os.path.isdir(capture_folder):
+
+        alerts = {}
+        
+        # Create the assets folder.
+        if not os.path.isdir(os.path.join(capture_folder, "assets")):
+            os.mkdir(os.path.join(capture_folder, "assets"))
+        
+        # Starts the engine and get alerts
+        engine = Engine(capture_folder)
+        engine.start_engine()
+        alerts = engine.get_alerts()
+        analysis_duration = (engine.analysis_end-engine.analysis_start).seconds
+        
+        # alerts.json writing.
+        with open(os.path.join(capture_folder, "assets/alerts.json"), "w") as f:
+            report = {"high": [], "moderate": [], "low": []}
+            for alert in alerts:
+                if alert["level"] == "High":
+                    report["high"].append(alert)
+                if alert["level"] == "Moderate":
+                    report["moderate"].append(alert)
+                if alert["level"] == "Low":
+                    report["low"].append(alert)
+            f.write(json.dumps(report, indent=4, separators=(',', ': ')))
+
+        # records.json writing.
+        with open(os.path.join(capture_folder, "assets/records.json"), "w") as f:
+            f.write(json.dumps(engine.records, indent=4, separators=(',', ': ')))
+
+        # detection_methods.json writing.
+        with open(os.path.join(capture_folder, "assets/detection_methods.json"), "w") as f:
+            f.write(json.dumps(engine.detection_methods, indent=4, separators=(',', ': ')))
+
+        # errors.json writing.
+        with open(os.path.join(capture_folder, "assets/errors.json"), "w") as f:
+            f.write(json.dumps(engine.errors, indent=4, separators=(',', ': ')))
+
+        # Generate the PDF report
+        report = Report(capture_folder, analysis_duration)
+        report.generate_report()
+
+    else:
+        print("The folder doesn't exist.")
+
+def usage():
+    """Shows the usage output."""
+    print(""" Usage: python analysis.py [capture_folder] where [capture_folder] is a folder containing a capture.pcap file """)
+
+if __name__ == "__main__":
+    if len(sys.argv) == 2:
+        analyze(sys.argv[1])
+    else:
+        usage()
+
+
+

analysis/classes/engine.py

@@ -0,0 +1,739 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+import json
+import os
+import re
+import subprocess as sp
+import sys
+from datetime import datetime
+from ipaddress import IPv4Address, IPv6Address
+
+import ssl
+import socket
+import OpenSSL
+import requests
+
+import pydig
+import whois
+from publicsuffix2 import get_sld
+from netaddr import IPAddress, IPNetwork
+from classes.jarm import get_jarm
+from utils import get_config, get_iocs, get_whitelist
+
+
+class Engine():
+
+    def __init__(self, capture_directory):
+
+        # Set some vars.
+        self.analysis_start = datetime.now()
+        self.connected = self.check_internet()
+        self.working_dir = capture_directory
+        self.assets_dir = f"{capture_directory}/assets/"
+        self.rules_file = "/tmp/rules.rules"
+        self.pcap_path = os.path.join(self.working_dir, "capture.pcap")
+        self.records = []
+        self.alerts = []
+        self.dns = []
+        self.files = []
+        self.whitelist = []
+        self.uncategorized = []
+        self.analysed = []
+        self.dns_failed = []
+        self.dns_checked = []
+        self.cert_checked = []
+        self.errors = []
+        self.analysis_end = None
+
+        # Get configuration
+        self.heuristics_analysis = get_config(("analysis", "heuristics"))
+        self.iocs_analysis = get_config(("analysis", "iocs"))
+        self.whitelist_analysis = get_config(("analysis", "whitelist"))
+        self.active_analysis = get_config(("analysis", "active"))
+        self.userlang = get_config(("frontend", "user_lang"))
+        self.max_ports = get_config(("analysis", "max_ports"))
+        self.http_default_ports = get_config(("analysis", "http_default_ports"))
+        self.tls_default_ports = get_config(("analysis", "tls_default_ports"))
+        self.free_issuers = get_config(("analysis", "free_issuers"))
+        self.max_alerts = get_config(("analysis", "max_alerts"))
+        self.indicators_types = get_config(("analysis", "indicators_types"))
+        
+        # Save detection methods used.
+        self.detection_methods = { "iocs" : self.iocs_analysis, 
+                                   "heuristics" : self.heuristics_analysis, 
+                                   "active" : self.active_analysis }
+
+        # Retreive IOCs.
+        if self.iocs_analysis:
+            self.bl_cidrs = [[IPNetwork(cidr[0]), cidr[1]] for cidr in get_iocs("cidr")]
+            self.bl_hosts = get_iocs("ip4addr") + get_iocs("ip6addr")
+            self.tor_nodes = self.get_tor_nodes()
+            self.bl_domains = get_iocs("domain")
+            self.bl_freedns = get_iocs("freedns")
+            self.bl_certs = get_iocs("sha1cert")
+            self.bl_jarms = get_iocs("jarm")
+            self.bl_nameservers = get_iocs("ns")
+            self.bl_tlds = get_iocs("tld")
+
+        # Retreive whitelisted items.
+        if self.whitelist_analysis:
+            self.wl_cidrs = [IPNetwork(cidr) for cidr in get_whitelist("cidr")]
+            self.wl_hosts = get_whitelist("ip4addr") + get_whitelist("ip6addr") + self.get_public_ip()
+            self.wl_domains = get_whitelist("domain")
+
+        # Load template language
+        if not re.match("^[a-z]{2,3}$", self.userlang): self.userlang = "en"
+       
+        with open(os.path.join(os.path.dirname(os.path.realpath(sys.argv[0])), "locales/{}.json".format(self.userlang))) as f:
+            self.template = json.load(f)["alerts"]
+
+    def check_internet(self) -> bool:
+        """Check the internet link just with a small http request
+        to an URL present in the configuration
+
+        Returns:
+            bool: True if everything works.
+        """
+        try:
+            url = get_config(("network", "internet_check"))
+            requests.get(url, timeout=3)
+            return True
+        except:
+            return False
+
+    def get_public_ip(self) -> list:
+        """Get the public IP address
+
+        Returns:
+            list: list containing the public IP address.
+        """
+        if self.connected:
+            try:
+                return [requests.get("https://api.ipify.org", timeout=3).text]
+            except:
+                return []
+        else:
+            return []
+
+    def start_engine(self):
+        """ This method starts suricata and then launch the 
+            parsers to analyse the output logs. 
+        """
+
+        # Parse the eve.json file.
+        self.parse_eve_file()
+
+        # For each type of records, check it against heuristics.
+        for record in self.records: 
+            if self.whitelist_analysis: self.check_whitelist(record)
+            self.check_domains(record)
+            self.check_flow(record)
+            self.check_tls(record)
+            self.check_http(record)
+
+        # Check for failed DNS answers (if spyguard not connected)
+        for dnsname in list(set(self.dns_failed)):
+            self.check_dnsname(dnsname)
+        
+    def parse_eve_file(self):
+        """This method parses the eve.json file produced by suricata.
+           For each record, it look at the record type and then append the self.record
+           dictionnary which contains valuable data to look at suspicious stuff.
+        """
+        for record in open(f"{self.assets_dir}eve.json", "r").readlines():
+            record = json.loads(record)
+            try:
+                if "flow" in record:
+                    if "app_proto" not in record: record["app_proto"] = "failed"
+                    proto = { "name" : record["app_proto"].upper() if record["app_proto"] != "failed" else record["proto"].upper(), "port" : record["dest_port"] if "dest_port" in record else -1 }
+                   
+                    if record["dest_ip"] not in [r["ip_dst"] for r in self.records]:
+                        self.records.append({
+                            "ip_dst" : record["dest_ip"],
+                            "whitelisted" : False,
+                            "suspicious" : False,
+                            "protocols" : [proto],
+                            "domains" : [],
+                            "certificates" : []
+                        })
+                    else:
+                        for rec in self.records:
+                            if record["dest_ip"] == rec["ip_dst"]:
+                                if proto not in rec["protocols"]:
+                                    rec["protocols"].append(proto)
+            except Exception as e:
+                self.errors.append(f"Issue when processing the following eve record (flow): {json.dumps(record)}")
+
+        for record in open(f"{self.assets_dir}eve.json", "r").readlines():
+            record = json.loads(record)
+            try:
+                if "tls" in record:
+                    for rec in self.records:
+                        if record["dest_ip"] == rec["ip_dst"]:
+                            if "version" in record["tls"]: 
+                                if float(record["tls"]["version"].split(" ")[1]) < 1.3 and not "session_resumed" in record["tls"]:
+                                    if record["tls"] not in rec["certificates"]:
+                                        record["tls"]["port"] = record["dest_port"]
+                                        rec["certificates"].append(record["tls"])
+                                else:
+                                    if "sni" in record["tls"] and record["tls"]["sni"] not in [c["sni"] for c in rec["certificates"]]:
+                                        rec["certificates"].append({ "sni" : record["tls"]["sni"], "version" : record["tls"]["version"], "port" : record["dest_port"] })
+                                    else:
+                                        rec["certificates"].append({ "version" : record["tls"]["version"], "port" : record["dest_port"] })
+            except Exception as e:
+                self.errors.append(f"Issue when processing the following eve record (tls): {json.dumps(record)}")        
+
+        for record in open(f"{self.assets_dir}eve.json", "r").readlines():
+            record = json.loads(record)
+            try:
+                if "http" in record:
+                    for rec in self.records:
+                        if record["dest_ip"] == rec["ip_dst"]:
+                            d = { "hostname" : record["http"]["hostname"] }
+                            if "http_user_agent" in record["http"]:
+                                d["user-agent"] = record["http"]["http_user_agent"]
+                            if "http" in rec:
+                                if not d in rec["http"]:
+                                    rec["http"].append(d)
+                            else:
+                                rec["http"] = [d]
+            except Exception as e:
+                self.errors.append(f"Issue when processing the following eve record (http): {json.dumps(record)}")        
+
+        for record in open(f"{self.assets_dir}eve.json", "r").readlines():
+            record = json.loads(record)
+            try:
+                if "dns" in record:
+                    if record["dns"]["type"] == "answer":
+                        for rec in self.records:
+                            if record["dns"]["rcode"] == "NOERROR":
+                                if "grouped" in record["dns"]:
+                                    if "A" in record["dns"]["grouped"] and rec["ip_dst"] in record["dns"]["grouped"]["A"]:
+                                        if record["dns"]["rrname"] not in rec["domains"]:
+                                            rec["domains"].append(record["dns"]["rrname"])
+                                    elif "AAAA" in record["dns"]["grouped"] and rec["ip_dst"] in record["dns"]["grouped"]["AAAA"]:
+                                        if record["dns"]["rrname"] not in rec["domains"]:
+                                            rec["domains"].append(record["dns"]["rrname"])
+                            elif record["dns"]["rcode"] == "SERVFAIL":
+                                self.dns_failed.append(record["dns"]["rrname"])
+            except Exception as e:
+                self.errors.append(f"Issue when processing the following eve record (dns answer): {json.dumps(record)}")
+
+        # This pass is if SpyGuard is not connected to Internet.
+        # We still analyze the un answered DNS queries.
+        for record in open(f"{self.assets_dir}eve.json", "r").readlines():
+            record = json.loads(record)
+            try:
+                if "dns" in record:
+                    if record["dns"]["type"] == "query":
+                        if record["dns"]["rrname"] not in sum([r["domains"] for r in self.records], []):
+                             self.records.append({
+                                "ip_dst" : "--",
+                                "whitelisted" : False,
+                                "suspicious" : False,
+                                "protocols" : [{"name" : "DNS", "port" : "53"}],
+                                "domains" : [record["dns"]["rrname"]],
+                                "certificates" : []
+                            })
+            except Exception as e:
+                self.errors.append(f"Issue when processing the following eve record (dns query): {json.dumps(record)}")        
+
+        for record in open(f"{self.assets_dir}eve.json", "r").readlines():
+            record = json.loads(record)
+            try:
+                if "alert" in record and record["event_type"] == "alert":
+                    for rec in self.records:
+                        if record["dest_ip"] == rec["ip_dst"]:
+                            rec["suspicious"] = True
+                            self.alerts.append({"title": self.template["SNORT-01"]["title"].format(record["alert"]["signature"]),
+                                                "description": self.template["SNORT-01"]["description"].format(rec["ip_dst"]),
+                                                "host": rec["ip_dst"],
+                                                "level": "High",
+                                                "id": "SNORT-01"})
+
+            except Exception as e:
+                self.errors.append(f"Issue when processing the following eve record (dns answer): {json.dumps(record)}")
+
+
+    def check_whitelist(self, record):
+        """ This method is asked on each record. It:
+
+            1. Check if the associated IP(v4/6) Address can be whitelisted 
+            2. Check if one of the associated domain names can be whitelisted. 
+
+            If its the case, the "whitelisted" key of the record is set to True. 
+            Therefore, the record will be ignored for the rest of the analysis.  
+        Args:
+            record (dict): record to be processed. 
+        """
+
+        try: 
+            assert IPv4Address(record["ip_dst"])
+
+            if IPv4Address('224.0.0.0') <= IPv4Address(record["ip_dst"]) <= IPv4Address('239.255.255.255'):
+                record["whitelisted"] = True
+                return 
+
+            for cidr in self.wl_cidrs:
+                if IPAddress(record["ip_dst"]) in cidr:
+                    record["whitelisted"] = True
+                    return 
+
+            for ip in self.wl_hosts:
+                if record["ip_dst"] == ip:
+                    record["whitelisted"] = True
+                    return 
+        except:
+            pass
+        
+        try:
+            assert IPv6Address(record["ip_dst"])
+
+            if [record["ip_dst"].startswith(prefix) for prefix in ["fe80", "fc00", "ff02"]]: 
+                record["whitelisted"] = True
+                return
+
+            for ip in self.wl_hosts:
+                if record["ip_dst"] == ip:
+                    record["whitelisted"] = True
+                    return
+        except:
+            pass
+        
+        # We check if at least one of the associated 
+        # domains is whitelisted
+        for dom in self.wl_domains:
+            for domain in record["domains"]:
+                if domain.endswith(dom):
+                    record["whitelisted"] = True
+                    return
+        
+    def check_domains(self, record):
+        """Check the domains associated to each record.
+           First this method checks if the record is whitelisted. If not:
+              1. Leverage a low alert if the record don't have any associated DNSName
+              2. Check each domain associated to the record by calling check_dnsname.
+        Args:
+            record (dict): record to be processed.
+        """
+        if record["whitelisted"]: return 
+
+        if self.heuristics_analysis:
+            # Otherwise, we alert the user that an IP haven't been resolved by 
+            # a DNS answer during the session...
+            if record["domains"] == []:
+                record["suspicious"] = True
+                self.alerts.append({"title": self.template["PROTO-05"]["title"].format(record["ip_dst"]),
+                                    "description": self.template["PROTO-05"]["description"].format(record["ip_dst"]),
+                                    "host": record["ip_dst"],
+                                    "level": "Low",
+                                    "id": "PROTO-05"})
+
+        # Check each associated domain.
+        for domain in record["domains"]:
+            if self.check_dnsname(domain): 
+                record["suspicious"] = True
+
+    def check_dnsname(self, dnsname):
+        """Check a domain name against a set of IOCs / heuristics.
+              1. Check if the parent domain is blacklisted. 
+              2. Check if the parent domain is a Free DNS.
+              3. Check if the domain extension is a suspicious TLD.
+              4. Check if the name servers associated to the domain are suspicious.
+              5. Check if the domain have been registered recently - less than one year.
+        Args:
+            record (dict): record to be processed.
+        Returns:
+            supicious (bool) : if an alert has been leveraged. 
+        """
+        suspicious = False
+        
+        if self.iocs_analysis:
+            for domain in self.bl_domains:
+                if dnsname.endswith(domain[0]) and any(t in self.indicators_types for t in [domain[1], "all"]):
+                    if domain[1] == "dual": 
+                        suspicious = True
+                        self.alerts.append({"title": self.template["IOC-12"]["title"],
+                                            "description": self.template["IOC-12"]["description"].format(domain[0]),
+                                            "host": domain[0],
+                                            "level": "Low",
+                                            "id": "IOC-12"})
+                    elif domain[1] == "tracker": 
+                        suspicious = True
+                        self.alerts.append({"title": self.template["IOC-04"]["title"].format(domain[0], "tracker"),
+                                            "description": self.template["IOC-04"]["description"].format(domain[0], "tracker"),
+                                            "host": domain[0],
+                                            "level": "Low",
+                                            "id": "IOC-04"})
+                    elif domain[1] == "doh": 
+                        suspicious = True
+                        self.alerts.append({"title": self.template["IOC-13"]["title"].format(f"{dnsname}"),
+                                                "description": self.template["IOC-13"]["description"].format(f"{dnsname}"),
+                                                "host": dnsname,
+                                                "level": "Low",
+                                                "id": "IOC-13"})
+                    else:
+                        suspicious = True
+                        self.alerts.append({"title": self.template["IOC-03"]["title"].format(dnsname, domain[1].upper()),
+                                            "description": self.template["IOC-03"]["description"].format(dnsname),
+                                            "host": dnsname,
+                                            "level": "High",
+                                            "id": "IOC-03"})
+            for domain in self.bl_freedns:
+                if dnsname.endswith(domain[0]) and any(t in self.indicators_types for t in [domain[1], "all"]):
+                    suspicious = True
+                    self.alerts.append({"title": self.template["IOC-05"]["title"].format(dnsname),
+                                        "description": self.template["IOC-05"]["description"].format(dnsname),
+                                        "host": dnsname,
+                                        "level": "Moderate",
+                                        "id": "IOC-05"})
+                    
+        if self.heuristics_analysis:        
+            for domain in self.bl_tlds:
+                if dnsname.endswith(domain[0]) and any(t in self.indicators_types for t in [domain[1], "all"]):
+                    suspicious = True
+                    self.alerts.append({"title": self.template["IOC-06"]["title"].format(dnsname),
+                                        "description": self.template["IOC-06"]["description"].format(dnsname, domain[0]),
+                                        "host": dnsname,
+                                        "level": "Low",
+                                        "id": "IOC-06"})
+                    
+        if self.active_analysis and self.connected:
+            domain = get_sld(dnsname)
+            if domain not in self.dns_checked:
+                self.dns_checked.append(domain)
+                try:
+                    name_servers = pydig.query(domain, "NS")
+                    if len(name_servers):
+                        for ns in self.bl_nameservers:
+                            if name_servers[0].endswith(".{}.".format(ns[0])) and any(t in self.indicators_types for t in [ns[1], "all"]):
+                                suspicious = True
+                                self.alerts.append({"title": self.template["ACT-01"]["title"].format(dnsname, name_servers[0]),
+                                                    "description": self.template["ACT-01"]["description"].format(dnsname),
+                                                    "host": dnsname,
+                                                    "level": "Moderate",
+                                                    "id": "ACT-01"})
+                except Exception as e:
+                    self.errors.append(f"Issue when doing a dig NS query to {domain}, are you connected? Error: {str(e)}")        
+
+                try:
+                    whois_record = whois.whois(domain)
+                    creation_date = whois_record.creation_date if type(whois_record.creation_date) is not list else whois_record.creation_date[0]
+                    creation_days = abs((datetime.now() - creation_date).days)
+                    if creation_days < 365:
+                        suspicious = True
+                        self.alerts.append({"title": self.template["ACT-02"]["title"].format(dnsname, creation_days),
+                                            "description": self.template["ACT-02"]["description"].format(dnsname),
+                                            "host": dnsname,
+                                            "level": "Moderate",
+                                            "id": "ACT-02"})
+                except Exception as e:
+                    self.errors.append(f"Issue when doing a WHOIS query to {domain}, are you connected? Error: {str(e)}")
+        
+        return suspicious
+        
+
+    def check_flow(self, record):
+        """Check a network flow against a set of IOCs / heuristics.
+              1. Check if the IP Address is blacklisted 
+              2. Check if the IP Address is inside a blacklisted CIDR
+              3. Check if the UDP or ICMP protocol is going outside of the local network. 
+              4. Check if the HTTP protocol is not using default HTTP ports.
+              5. Check if the network flow is using a port > 1024.
+        Args:
+            record (dict): record to be processed.
+        Returns:
+            supicious (bool) : if an alert has been leveraged. 
+        """
+        if record["whitelisted"]: return 
+
+        resolved_host = record["domains"][0] if len(record["domains"]) else record["ip_dst"]
+
+        if self.iocs_analysis:
+            for host in self.bl_hosts:
+                if record["ip_dst"] == host[0] and any(t in self.indicators_types for t in [host[1], "all"]):
+                    if host[1] == "dual": 
+                        record["suspicious"] = True
+                        self.alerts.append({"title": self.template["IOC-12"]["title"],
+                                            "description": self.template["IOC-12"]["description"].format(resolved_host),
+                                            "host": resolved_host,
+                                            "level": "Low",
+                                            "id": "IOC-12"})
+                    if host[1] == "tracker": 
+                        record["suspicious"] = True
+                        self.alerts.append({"title": self.template["IOC-04"]["title"].format(resolved_host, "tracker"),
+                                            "description": self.template["IOC-04"]["description"].format(resolved_host, "tracker"),
+                                            "host": resolved_host,
+                                            "level": "Low",
+                                            "id": "IOC-04"})
+                    elif host[1] == "doh":
+                        if 443 in [p["port"] for p in record["protocols"]]:
+                            record["suspicious"] = True
+                            self.alerts.append({"title": self.template["IOC-13"]["title"].format(f"{resolved_host}"),
+                                                "description": self.template["IOC-13"]["description"].format(f"{resolved_host}"),
+                                                "host": resolved_host,
+                                                "level": "Low",
+                                                "id": "IOC-13"})
+                    else:
+                        record["suspicious"] = True
+                        self.alerts.append({"title": self.template["IOC-01"]["title"].format(resolved_host, record["ip_dst"], host[1].upper()),
+                                            "description": self.template["IOC-01"]["description"].format(f"{resolved_host} ({record['ip_dst']})"),
+                                            "host": resolved_host,
+                                            "level": "High",
+                                            "id": "IOC-01"})
+                    break
+            
+            for host in self.tor_nodes:
+                if record["ip_dst"] == host:
+                    record["suspicious"] = True
+                    self.alerts.append({"title": self.template["IOC-11"]["title"].format(resolved_host, record["ip_dst"]),
+                                        "description": self.template["IOC-11"]["description"].format(f"{resolved_host} ({record['ip_dst']})"),
+                                        "host": resolved_host,
+                                        "level": "High",
+                                        "id": "IOC-11"})
+                    break
+
+            for cidr in self.bl_cidrs:
+                try:
+                    if IPAddress(record["ip_dst"]) in cidr[0] and any(t in self.indicators_types for t in [cidr[1], "all"]):
+                        record["suspicious"] = True
+                        self.alerts.append({"title": self.template["IOC-02"]["title"].format(resolved_host, cidr[0], cidr[1].upper()),
+                                            "description": self.template["IOC-02"]["description"].format(record["ip_dst"]),
+                                            "host": resolved_host,
+                                            "level": "Moderate",
+                                            "id": "IOC-02"})
+                except:
+                    continue
+
+        if self.heuristics_analysis:
+            for protocol in record["protocols"]:
+                if protocol["name"] in ["UDP", "ICMP", "IPV6-ICMP"]:
+                    record["suspicious"] = True
+                    self.alerts.append({"title": self.template["PROTO-01"]["title"].format(protocol["name"], resolved_host),
+                                        "description": self.template["PROTO-01"]["description"].format(protocol["name"], resolved_host),
+                                        "host": resolved_host,
+                                        "level": "Moderate",
+                                        "id": "PROTO-01"})
+                try:
+                    if protocol["port"] >= int(self.max_ports):
+                        record["suspicious"] = True
+                        self.alerts.append({"title": self.template["PROTO-02"]["title"].format("", resolved_host,  self.max_ports),
+                                            "description": self.template["PROTO-02"]["description"].format("", resolved_host, protocol["port"]),
+                                            "host": resolved_host,
+                                            "level": "Low",
+                                            "id": "PROTO-02"})
+                except:
+                    pass
+                
+                if protocol["name"] == "HTTP":
+                    record["suspicious"] = True
+                    self.alerts.append({"title": self.template["PROTO-03"]["title"].format(resolved_host),
+                                        "description": self.template["PROTO-03"]["description"].format(resolved_host),
+                                        "host":  resolved_host,
+                                        "level": "Low",
+                                        "id": "PROTO-03"})
+
+                if protocol["name"] == "HTTP" and protocol["port"] not in self.http_default_ports:
+                    record["suspicious"] = True
+                    self.alerts.append({"title": self.template["PROTO-04"]["title"].format(resolved_host, protocol["port"]),
+                                        "description": self.template["PROTO-04"]["description"].format(resolved_host, protocol["port"]),
+                                        "host":  resolved_host,
+                                        "level": "Moderate",
+                                        "id": "PROTO-04"})
+
+    def check_tls(self, record):
+        """Check a TLS protocol and certificates against a set of IOCs / heuristics.
+        Note since TLS 1.3, the certificate is not exchanged in clear text, therefore 
+        we need to check it "actively" via the method active_check_ssl. 
+
+              1. Check if the TLS record is not using default TLS ports.
+              2. Check if one of the certificates is a free one, like Let's Encrypt.
+              3. Check if the certificate is auto-signed. 
+              4. If the certificate has an SNI, check the domain by calling check_dnsname.
+        Args:
+            record (dict): record to be processed.
+        Returns:
+            supicious (bool) : if an alert has been leveraged. 
+        """
+        if record["whitelisted"]: return
+
+        resolved_host = record["domains"][0] if len(record["domains"]) else record["ip_dst"]
+                
+        for certificate in record["certificates"]:
+
+            try:
+                if "sni" in certificate and certificate["sni"] not in record["domains"]:
+                    if certificate["sni"]:
+                        if self.check_dnsname(certificate["sni"]):
+                            record["suspicious"] = True
+
+                if certificate["port"] not in self.tls_default_ports:
+                    record["suspicious"] = True
+                    self.alerts.append({"title": self.template["SSL-01"]["title"].format(certificate["port"], resolved_host),
+                                        "description": self.template["SSL-01"]["description"].format(resolved_host),
+                                        "host": resolved_host,
+                                        "level": "Moderate",
+                                        "id": "SSL-01"})
+
+                if float(certificate["version"].split(" ")[1]) < 1.3 and "issuerdn" in certificate:
+
+                    if certificate["issuerdn"] in self.free_issuers:
+                        record["suspicious"] = True
+                        self.alerts.append({"title": self.template["SSL-02"]["title"].format(resolved_host),
+                                            "description": self.template["SSL-02"]["description"],
+                                            "host": resolved_host,
+                                            "level": "Moderate",
+                                            "id": "SSL-02"})
+
+                    elif certificate["issuerdn"] == certificate["subject"]:
+                        record["suspicious"] = True
+                        self.alerts.append({"title": self.template["SSL-03"]["title"].format(resolved_host),
+                                            "description": self.template["SSL-03"]["description"].format(resolved_host),
+                                            "host": resolved_host,
+                                            "level": "Moderate",
+                                            "id": "SSL-03"})
+                else:
+                    if self.active_analysis and self.connected:
+                        if "sni" in certificate:
+                            if certificate["sni"] not in self.cert_checked:
+                                self.cert_checked.append(certificate["sni"])
+                                if self.active_check_ssl(certificate["sni"], certificate["port"]):
+                                    record["suspicious"] = True
+                                    break
+                        else:
+                            if resolved_host not in self.cert_checked:
+                                self.cert_checked.append(resolved_host)
+                                if self.active_check_ssl(resolved_host, certificate["port"]):
+                                    record["suspicious"] = True
+                                    break
+            except Exception as e:
+                self.errors.append(f"Issue when processing the following certificate (check_tls): {json.dumps(certificate)}")
+    
+    def get_tor_nodes(self) -> list:
+        """Get a list of TOR nodes from dan.me.uk.
+
+        Returns:
+            list: list of TOR nodes
+        """
+
+        nodes = []
+        if os.path.exists("/tmp/tor_nodes.lst"):
+            with open("/tmp/tor_nodes.lst", "r") as f:
+                for l in f.readlines():
+                    nodes.append(l.strip())
+        else:
+            if self.connected:
+                try:
+                    nodes_list = requests.get("https://www.dan.me.uk/torlist/", timeout=10).text
+                    with open("/tmp/tor_nodes.lst", "w+") as f:
+                        f.write(nodes_list)
+                    for l in nodes_list.splitlines():
+                        nodes.append(l.strip())
+                except:
+                    self.errors.append(f"Issue when trying to get TOR nodes from dan.me.uk")
+        return nodes
+
+
+    def check_http(self, record):
+        """Check the HTTP hostname against a set of IOCs / heuristics.
+        Args:
+            record (dict): record to be processed.
+        Returns:
+            supicious (bool) : if an alert has been leveraged. 
+        """
+        if record["whitelisted"]: return
+
+        if "http" in record:
+            for http in record["http"]:
+                if http["hostname"] not in record["domains"]:
+                    if re.match("^[a-z\.0-9\-]+\.[a-z\-]{2,}$", http["hostname"]):
+                        if http["hostname"]:
+                            if self.check_dnsname(http["hostname"]):
+                                record["suspicious"] = True
+
+    def active_check_ssl(self, host, port):
+        """This method:
+        
+        1. Check the issuer and subject of a certificate directly by connecting
+        to the remote server in order to bypass TLS 1.3+ restrictions. 
+        Most of this method was been taken from: https://tinyurl.com/3vsvhu79
+
+        2. Get the JARM of the remote server by using the standard poc library
+        from sales force. 
+
+        Args:
+            host (str): Host to connect to
+            port (int): Port to connect to
+        """
+        try:
+            suspect = False
+            context = ssl.create_default_context()
+            conn = socket.create_connection((host, port))
+            sock = context.wrap_socket(conn, server_hostname=host)
+            sock.settimeout(5)
+            try:
+                der_cert = sock.getpeercert(True)
+            finally:
+                sock.close()
+
+            if "der_cert" in locals():
+
+                certificate = ssl.DER_cert_to_PEM_cert(der_cert)
+                x509 = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, certificate)
+
+                issuer = dict(x509.get_issuer().get_components())
+                subject = dict(x509.get_subject().get_components())
+                certhash = x509.digest("sha1").decode("utf8").replace(":", "").lower()
+                issuer = ", ".join(f"{k.decode('utf8')}={v.decode('utf8')}" for k, v in issuer.items())
+                subject = ", ".join(f"{k.decode('utf8')}={v.decode('utf8')}" for k, v in subject.items())
+
+                if issuer in self.free_issuers:
+                    self.alerts.append({"title": self.template["SSL-02"]["title"].format(host),
+                                        "description": self.template["SSL-02"]["description"],
+                                        "host": host,
+                                        "level": "Moderate",
+                                        "id": "SSL-02"})
+                    suspect = True
+
+                if issuer == subject:
+                    self.alerts.append({"title": self.template["SSL-03"]["title"].format(host),
+                                        "description": self.template["SSL-03"]["description"].format(host),
+                                        "host": host,
+                                        "level": "Moderate",
+                                        "id": "SSL-03"})
+                    suspect = True
+  
+                if self.iocs_analysis:
+                    for cert in self.bl_certs:
+                        if cert[0] == certhash and any(t in self.indicators_types for t in [cert[1], "all"]):
+                            self.alerts.append({"title": self.template["SSL-04"]["title"].format(host, cert[1].upper()),
+                                                "description": self.template["SSL-04"]["description"].format(host),
+                                                "host": host,
+                                                "level": "High",
+                                                "id": "SSL-04"})
+                            suspect = True
+                    
+                    if self.bl_jarms:
+                        host_jarm = get_jarm(host, port)
+                        for jarm in self.bl_jarms:
+                            if jarm[0] == host_jarm and any(t in self.indicators_types for t in [jarm[1], "all"]):
+                                self.alerts.append({"title": self.template["SSL-05"]["title"].format(host, cert[1].upper()),
+                                                    "description": self.template["SSL-05"]["description"].format(host),
+                                                    "host": host,
+                                                    "level": "High",
+                                                    "id": "SSL-05"})
+                                suspect = True
+            return suspect
+        except:
+            self.errors.append(f"Issue when trying to grab the SSL certificate located at {host}:{port}")
+            return False
+
+    def get_alerts(self):
+        """Retrieves the alerts triggered during the analysis
+
+        Returns:
+            list: list of the alerts.
+        """
+        self.analysis_end = datetime.now()
+        return [dict(t) for t in {tuple(d.items()) for d in self.alerts}]

analysis/classes/jarm.py

@@ -0,0 +1,477 @@
+# Version 1.0 (November 2020)
+#
+# Created by:
+# John Althouse
+# Andrew Smart
+# RJ Nunaly
+# Mike Brady
+#
+# Converted to Python by:
+# Caleb Yu
+#
+# Copyright (c) 2020, salesforce.com, inc.
+# All rights reserved.
+# Licensed under the BSD 3-Clause license.
+# For full license text, see LICENSE.txt file in the repo root or https://opensource.org/licenses/BSD-3-Clause
+#
+
+from __future__ import print_function
+
+import codecs
+import socket
+import struct
+import os
+import random
+import hashlib
+import ipaddress
+
+#Randomly choose a grease value
+def choose_grease():
+    grease_list = [b"\x0a\x0a", b"\x1a\x1a", b"\x2a\x2a", b"\x3a\x3a", b"\x4a\x4a", b"\x5a\x5a", b"\x6a\x6a", b"\x7a\x7a", b"\x8a\x8a", b"\x9a\x9a", b"\xaa\xaa", b"\xba\xba", b"\xca\xca", b"\xda\xda", b"\xea\xea", b"\xfa\xfa"]
+    return random.choice(grease_list)
+
+def packet_building(jarm_details):
+    payload = b"\x16"
+    #Version Check
+    if jarm_details[2] == "TLS_1.3":
+        payload += b"\x03\x01"
+        client_hello = b"\x03\x03"
+    elif jarm_details[2] == "SSLv3":
+        payload += b"\x03\x00"
+        client_hello =  b"\x03\x00"
+    elif jarm_details[2] == "TLS_1":
+        payload += b"\x03\x01"
+        client_hello = b"\x03\x01"
+    elif jarm_details[2] == "TLS_1.1":
+        payload += b"\x03\x02"
+        client_hello = b"\x03\x02"
+    elif jarm_details[2] == "TLS_1.2":
+        payload += b"\x03\x03"
+        client_hello = b"\x03\x03"
+    #Random values in client hello
+    client_hello += os.urandom(32)
+    session_id = os.urandom(32)
+    session_id_length = struct.pack(">B", len(session_id))
+    client_hello += session_id_length
+    client_hello += session_id
+    #Get ciphers
+    cipher_choice = get_ciphers(jarm_details)
+    client_suites_length = struct.pack(">H", len(cipher_choice))
+    client_hello += client_suites_length
+    client_hello += cipher_choice
+    client_hello += b"\x01" #cipher methods
+    client_hello += b"\x00" #compression_methods
+    #Add extensions to client hello
+    extensions = get_extensions(jarm_details)
+    client_hello += extensions
+    #Finish packet assembly
+    inner_length = b"\x00"
+    inner_length += struct.pack(">H", len(client_hello))
+    handshake_protocol = b"\x01"
+    handshake_protocol += inner_length
+    handshake_protocol += client_hello
+    outer_length = struct.pack(">H", len(handshake_protocol))
+    payload += outer_length
+    payload += handshake_protocol
+    return payload
+
+def get_ciphers(jarm_details):
+    selected_ciphers = b""
+    #Two cipher lists: NO1.3 and ALL
+    if jarm_details[3] == "ALL":
+        list = [b"\x00\x16", b"\x00\x33", b"\x00\x67", b"\xc0\x9e", b"\xc0\xa2", b"\x00\x9e", b"\x00\x39", b"\x00\x6b", b"\xc0\x9f", b"\xc0\xa3", b"\x00\x9f", b"\x00\x45", b"\x00\xbe", b"\x00\x88", b"\x00\xc4", b"\x00\x9a", b"\xc0\x08", b"\xc0\x09", b"\xc0\x23", b"\xc0\xac", b"\xc0\xae", b"\xc0\x2b", b"\xc0\x0a", b"\xc0\x24", b"\xc0\xad", b"\xc0\xaf", b"\xc0\x2c", b"\xc0\x72", b"\xc0\x73", b"\xcc\xa9", b"\x13\x02", b"\x13\x01", b"\xcc\x14", b"\xc0\x07", b"\xc0\x12", b"\xc0\x13", b"\xc0\x27", b"\xc0\x2f", b"\xc0\x14", b"\xc0\x28", b"\xc0\x30", b"\xc0\x60", b"\xc0\x61", b"\xc0\x76", b"\xc0\x77", b"\xcc\xa8", b"\x13\x05", b"\x13\x04", b"\x13\x03", b"\xcc\x13", b"\xc0\x11", b"\x00\x0a", b"\x00\x2f", b"\x00\x3c", b"\xc0\x9c", b"\xc0\xa0", b"\x00\x9c", b"\x00\x35", b"\x00\x3d", b"\xc0\x9d", b"\xc0\xa1", b"\x00\x9d", b"\x00\x41", b"\x00\xba", b"\x00\x84", b"\x00\xc0", b"\x00\x07", b"\x00\x04", b"\x00\x05"]
+    elif jarm_details[3] == "NO1.3":
+        list = [b"\x00\x16", b"\x00\x33", b"\x00\x67", b"\xc0\x9e", b"\xc0\xa2", b"\x00\x9e", b"\x00\x39", b"\x00\x6b", b"\xc0\x9f", b"\xc0\xa3", b"\x00\x9f", b"\x00\x45", b"\x00\xbe", b"\x00\x88", b"\x00\xc4", b"\x00\x9a", b"\xc0\x08", b"\xc0\x09", b"\xc0\x23", b"\xc0\xac", b"\xc0\xae", b"\xc0\x2b", b"\xc0\x0a", b"\xc0\x24", b"\xc0\xad", b"\xc0\xaf", b"\xc0\x2c", b"\xc0\x72", b"\xc0\x73", b"\xcc\xa9", b"\xcc\x14", b"\xc0\x07", b"\xc0\x12", b"\xc0\x13", b"\xc0\x27", b"\xc0\x2f", b"\xc0\x14", b"\xc0\x28", b"\xc0\x30", b"\xc0\x60", b"\xc0\x61", b"\xc0\x76", b"\xc0\x77", b"\xcc\xa8", b"\xcc\x13", b"\xc0\x11", b"\x00\x0a", b"\x00\x2f", b"\x00\x3c", b"\xc0\x9c", b"\xc0\xa0", b"\x00\x9c", b"\x00\x35", b"\x00\x3d", b"\xc0\x9d", b"\xc0\xa1", b"\x00\x9d", b"\x00\x41", b"\x00\xba", b"\x00\x84", b"\x00\xc0", b"\x00\x07", b"\x00\x04", b"\x00\x05"]
+    #Change cipher order
+    if jarm_details[4] != "FORWARD":
+        list = cipher_mung(list, jarm_details[4])
+    #Add GREASE to beginning of cipher list (if applicable)
+    if jarm_details[5] == "GREASE":
+        list.insert(0,choose_grease())
+    #Generate cipher list
+    for cipher in list:
+        selected_ciphers += cipher
+    return selected_ciphers
+
+def cipher_mung(ciphers, request):
+    output = []
+    cipher_len = len(ciphers)
+    #Ciphers backward
+    if (request == "REVERSE"):
+        output = ciphers[::-1]
+    #Bottom half of ciphers
+    elif (request == "BOTTOM_HALF"):
+        if (cipher_len % 2 == 1):
+            output = ciphers[int(cipher_len/2)+1:]
+        else:
+            output = ciphers[int(cipher_len/2):]
+    #Top half of ciphers in reverse order
+    elif (request == "TOP_HALF"):
+        if (cipher_len % 2 == 1):
+            output.append(ciphers[int(cipher_len/2)])
+            #Top half gets the middle cipher
+        output += cipher_mung(cipher_mung(ciphers, "REVERSE"),"BOTTOM_HALF")
+    #Middle-out cipher order
+    elif (request == "MIDDLE_OUT"):
+        middle = int(cipher_len/2)
+        # if ciphers are uneven, start with the center.  Second half before first half
+        if (cipher_len % 2 == 1):
+            output.append(ciphers[middle])
+            for i in range(1, middle+1):
+                output.append(ciphers[middle + i])
+                output.append(ciphers[middle - i])
+        else:
+            for i in range(1, middle+1):
+                output.append(ciphers[middle-1 + i])
+                output.append(ciphers[middle - i])
+    return output
+
+def get_extensions(jarm_details):
+    extension_bytes = b""
+    all_extensions = b""
+    grease = False
+    #GREASE
+    if jarm_details[5] == "GREASE":
+        all_extensions += choose_grease()
+        all_extensions += b"\x00\x00"
+        grease = True
+    #Server name
+    all_extensions += extension_server_name(jarm_details[0])
+    #Other extensions
+    extended_master_secret = b"\x00\x17\x00\x00"
+    all_extensions += extended_master_secret
+    max_fragment_length = b"\x00\x01\x00\x01\x01"
+    all_extensions += max_fragment_length
+    renegotiation_info = b"\xff\x01\x00\x01\x00"
+    all_extensions += renegotiation_info
+    supported_groups = b"\x00\x0a\x00\x0a\x00\x08\x00\x1d\x00\x17\x00\x18\x00\x19"
+    all_extensions += supported_groups
+    ec_point_formats = b"\x00\x0b\x00\x02\x01\x00"
+    all_extensions += ec_point_formats
+    session_ticket = b"\x00\x23\x00\x00"
+    all_extensions += session_ticket
+    #Application Layer Protocol Negotiation extension
+    all_extensions += app_layer_proto_negotiation(jarm_details)
+    signature_algorithms = b"\x00\x0d\x00\x14\x00\x12\x04\x03\x08\x04\x04\x01\x05\x03\x08\x05\x05\x01\x08\x06\x06\x01\x02\x01"
+    all_extensions += signature_algorithms
+    #Key share extension
+    all_extensions += key_share(grease)
+    psk_key_exchange_modes = b"\x00\x2d\x00\x02\x01\x01"
+    all_extensions += psk_key_exchange_modes
+    #Supported versions extension
+    if (jarm_details[2] == "TLS_1.3") or (jarm_details[7] == "1.2_SUPPORT"):
+        all_extensions += supported_versions(jarm_details, grease)
+    #Finish assembling extensions
+    extension_length = len(all_extensions)
+    extension_bytes += struct.pack(">H", extension_length)
+    extension_bytes += all_extensions
+    return extension_bytes
+
+#Client hello server name extension
+def extension_server_name(host):
+    ext_sni = b"\x00\x00"
+    ext_sni_length = len(host)+5
+    ext_sni += struct.pack(">H", ext_sni_length)
+    ext_sni_length2 = len(host)+3
+    ext_sni += struct.pack(">H", ext_sni_length2)
+    ext_sni += b"\x00"
+    ext_sni_length3 = len(host)
+    ext_sni += struct.pack(">H", ext_sni_length3)
+    ext_sni += host.encode()
+    return ext_sni
+
+#Client hello apln extension
+def app_layer_proto_negotiation(jarm_details):
+    ext = b"\x00\x10"
+    if (jarm_details[6] == "RARE_APLN"):
+        #Removes h2 and http/1.1
+        alpns = [b"\x08\x68\x74\x74\x70\x2f\x30\x2e\x39", b"\x08\x68\x74\x74\x70\x2f\x31\x2e\x30", b"\x06\x73\x70\x64\x79\x2f\x31", b"\x06\x73\x70\x64\x79\x2f\x32", b"\x06\x73\x70\x64\x79\x2f\x33", b"\x03\x68\x32\x63", b"\x02\x68\x71"]
+    else:
+        #All apln extensions in order from weakest to strongest
+        alpns = [b"\x08\x68\x74\x74\x70\x2f\x30\x2e\x39", b"\x08\x68\x74\x74\x70\x2f\x31\x2e\x30", b"\x08\x68\x74\x74\x70\x2f\x31\x2e\x31", b"\x06\x73\x70\x64\x79\x2f\x31", b"\x06\x73\x70\x64\x79\x2f\x32", b"\x06\x73\x70\x64\x79\x2f\x33", b"\x02\x68\x32", b"\x03\x68\x32\x63", b"\x02\x68\x71"]
+    #apln extensions can be reordered
+    if jarm_details[8] != "FORWARD":
+        alpns = cipher_mung(alpns, jarm_details[8])
+    all_alpns = b""
+    for alpn in alpns:
+        all_alpns += alpn
+    second_length = len(all_alpns)
+    first_length = second_length+2
+    ext += struct.pack(">H", first_length)
+    ext += struct.pack(">H", second_length)
+    ext += all_alpns
+    return ext
+
+#Generate key share extension for client hello
+def key_share(grease):
+    ext = b"\x00\x33"
+    #Add grease value if necessary
+    if grease == True:
+        share_ext = choose_grease()
+        share_ext += b"\x00\x01\x00"
+    else:
+        share_ext = b""
+    group = b"\x00\x1d"
+    share_ext += group
+    key_exchange_length = b"\x00\x20"
+    share_ext += key_exchange_length
+    share_ext += os.urandom(32)
+    second_length = len(share_ext)
+    first_length = second_length+2
+    ext += struct.pack(">H", first_length)
+    ext += struct.pack(">H", second_length)
+    ext += share_ext
+    return ext
+
+#Supported version extension for client hello
+def supported_versions(jarm_details, grease):
+    if (jarm_details[7] == "1.2_SUPPORT"):
+        #TLS 1.3 is not supported
+        tls = [b"\x03\x01", b"\x03\x02", b"\x03\x03"]
+    else:
+        #TLS 1.3 is supported
+        tls = [b"\x03\x01", b"\x03\x02", b"\x03\x03", b"\x03\x04"]
+    #Change supported version order, by default, the versions are from oldest to newest
+    if jarm_details[8] != "FORWARD":
+        tls = cipher_mung(tls, jarm_details[8])
+    #Assemble the extension
+    ext = b"\x00\x2b"
+    #Add GREASE if applicable
+    if grease == True:
+        versions = choose_grease()
+    else:
+        versions = b""
+    for version in tls:
+        versions += version
+    second_length = len(versions)
+    first_length = second_length+1
+    ext += struct.pack(">H", first_length)
+    ext += struct.pack(">B", second_length)
+    ext += versions
+    return ext
+
+#Send the assembled client hello using a socket
+def send_packet(packet, destination_host, destination_port):
+    try:
+        #Determine if the input is an IP or domain name
+        try:
+            if (type(ipaddress.ip_address(destination_host)) == ipaddress.IPv4Address) or (type(ipaddress.ip_address(destination_host)) == ipaddress.IPv6Address):
+                raw_ip = True
+                ip = (destination_host, destination_port)
+        except ValueError as e:
+                ip = (None, None)
+                raw_ip = False
+        #Connect the socket
+        if ":" in destination_host:
+            sock = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)
+            sock.settimeout(10)
+            sock.connect((destination_host, destination_port, 0, 0))
+        else:
+            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+            sock.settimeout(10)
+            sock.connect((destination_host, destination_port))
+        #Resolve IP if given a domain name
+        if raw_ip == False:
+            ip = sock.getpeername()
+        sock.sendall(packet)
+        #Receive server hello
+        data = sock.recv(1484)
+        #Close socket
+        sock.shutdown(socket.SHUT_RDWR)
+        sock.close()
+        return bytearray(data), ip[0]
+    #Timeout errors result in an empty hash
+    except socket.timeout as e:
+        sock.close()
+        return "TIMEOUT", ip[0]
+    except Exception as e:
+        sock.close()
+        return None, ip[0]
+
+#If a packet is received, decipher the details
+def read_packet(data, jarm_details):
+    try:
+        if data == None:
+            return "|||"
+        jarm = ""
+        #Server hello error
+        if data[0] == 21:
+            selected_cipher = b""
+            return "|||"
+        #Check for server hello
+        elif (data[0] == 22) and (data[5] == 2):
+            server_hello_length = int.from_bytes(data[3:5], "big")
+            counter = data[43]
+            #Find server's selected cipher
+            selected_cipher = data[counter+44:counter+46]
+            #Find server's selected version
+            version = data[9:11]
+            #Format
+            jarm += codecs.encode(selected_cipher, 'hex').decode('ascii')
+            jarm += "|"
+            jarm += codecs.encode(version, 'hex').decode('ascii')
+            jarm += "|"
+            #Extract extensions
+            extensions = (extract_extension_info(data, counter, server_hello_length))
+            jarm += extensions
+            return jarm
+        else:
+            return "|||"
+
+    except Exception as e:
+        return "|||"
+
+#Deciphering the extensions in the server hello
+def extract_extension_info(data, counter, server_hello_length):
+    try:
+        #Error handling
+        if (data[counter+47] == 11):
+            return "|"
+        elif (data[counter+50:counter+53] == b"\x0e\xac\x0b") or (data[82:85] == b"\x0f\xf0\x0b"):
+            return "|"
+        elif counter+42 >= server_hello_length:
+            return "|"
+        count = 49+counter
+        length = int(codecs.encode(data[counter+47:counter+49], 'hex'), 16)
+        maximum = length+(count-1)
+        types = []
+        values = []
+        #Collect all extension types and values for later reference
+        while count < maximum:
+            types.append(data[count:count+2])
+            ext_length = int(codecs.encode(data[count+2:count+4], 'hex'), 16)
+            if ext_length == 0:
+                count += 4
+                values.append("")
+            else:
+                values.append(data[count+4:count+4+ext_length])
+                count += ext_length+4
+        result = ""
+        #Read application_layer_protocol_negotiation
+        alpn = find_extension(b"\x00\x10", types, values)
+        result += str(alpn)
+        result += "|"
+        #Add formating hyphens
+        add_hyphen = 0
+        while add_hyphen < len(types):
+            result += codecs.encode(types[add_hyphen], 'hex').decode('ascii')
+            add_hyphen += 1
+            if add_hyphen == len(types):
+                break
+            else:
+                result += "-"
+        return result
+    #Error handling
+    except IndexError as e:
+        result = "|"
+        return result
+
+#Matching cipher extensions to values
+def find_extension(ext_type, types, values):
+    iter = 0
+    #For the APLN extension, grab the value in ASCII
+    if ext_type == b"\x00\x10":
+        while iter < len(types):
+            if types[iter] == ext_type:
+                return ((values[iter][3:]).decode())
+            iter += 1
+    else:
+        while iter < len(types):
+            if types[iter] == ext_type:
+                return values[iter].hex()
+            iter += 1
+    return ""
+
+#Custom fuzzy hash
+def jarm_hash(jarm_raw):
+    #If jarm is empty, 62 zeros for the hash
+    if jarm_raw == "|||,|||,|||,|||,|||,|||,|||,|||,|||,|||":
+        return "0"*62
+    fuzzy_hash = ""
+    handshakes = jarm_raw.split(",")
+    alpns_and_ext = ""
+    for handshake in handshakes:
+        components = handshake.split("|")
+        #Custom jarm hash includes a fuzzy hash of the ciphers and versions
+        fuzzy_hash += cipher_bytes(components[0])
+        fuzzy_hash += version_byte(components[1])
+        alpns_and_ext += components[2]
+        alpns_and_ext += components[3]
+    #Custom jarm hash has the sha256 of alpns and extensions added to the end
+    sha256 = (hashlib.sha256(alpns_and_ext.encode())).hexdigest()
+    fuzzy_hash += sha256[0:32]
+    return fuzzy_hash
+
+#Fuzzy hash for ciphers is the index number (in hex) of the cipher in the list
+def cipher_bytes(cipher):
+    if cipher == "":
+        return "00"
+    list = [b"\x00\x04", b"\x00\x05", b"\x00\x07", b"\x00\x0a", b"\x00\x16", b"\x00\x2f", b"\x00\x33", b"\x00\x35", b"\x00\x39", b"\x00\x3c", b"\x00\x3d", b"\x00\x41", b"\x00\x45", b"\x00\x67", b"\x00\x6b", b"\x00\x84", b"\x00\x88", b"\x00\x9a", b"\x00\x9c", b"\x00\x9d", b"\x00\x9e", b"\x00\x9f", b"\x00\xba", b"\x00\xbe", b"\x00\xc0", b"\x00\xc4", b"\xc0\x07", b"\xc0\x08", b"\xc0\x09", b"\xc0\x0a", b"\xc0\x11", b"\xc0\x12", b"\xc0\x13", b"\xc0\x14", b"\xc0\x23", b"\xc0\x24", b"\xc0\x27", b"\xc0\x28", b"\xc0\x2b", b"\xc0\x2c", b"\xc0\x2f", b"\xc0\x30", b"\xc0\x60", b"\xc0\x61", b"\xc0\x72", b"\xc0\x73", b"\xc0\x76", b"\xc0\x77", b"\xc0\x9c", b"\xc0\x9d", b"\xc0\x9e", b"\xc0\x9f", b"\xc0\xa0", b"\xc0\xa1", b"\xc0\xa2", b"\xc0\xa3",  b"\xc0\xac", b"\xc0\xad", b"\xc0\xae", b"\xc0\xaf", b'\xcc\x13', b'\xcc\x14', b'\xcc\xa8', b'\xcc\xa9', b'\x13\x01', b'\x13\x02', b'\x13\x03', b'\x13\x04', b'\x13\x05']
+    count = 1
+    for bytes in list:
+        strtype_bytes = codecs.encode(bytes, 'hex').decode('ascii')
+        if cipher == strtype_bytes:
+            break
+        count += 1
+    hexvalue = str(hex(count))[2:]
+    #This part must always be two bytes
+    if len(hexvalue) < 2:
+        return_bytes = "0" + hexvalue
+    else:
+        return_bytes = hexvalue
+    return return_bytes
+
+#This captures a single version byte based on version
+def version_byte(version):
+    if version == "":
+        return "0"
+    options = "abcdef"
+    count = int(version[3:4])
+    byte = options[count]
+    return byte
+
+def ParseNumber(number):
+    if number.startswith('0x'):
+        return int(number[2:], 16)
+    else:
+        return int(number)
+
+def get_jarm(destination_host, destination_port):
+    #Select the packets and formats to send
+    #Array format = [destination_host,destination_port,version,cipher_list,cipher_order,GREASE,RARE_APLN,1.3_SUPPORT,extension_orders]
+    tls1_2_forward = [destination_host, destination_port, "TLS_1.2", "ALL", "FORWARD", "NO_GREASE", "APLN", "1.2_SUPPORT", "REVERSE"]
+    tls1_2_reverse = [destination_host, destination_port, "TLS_1.2", "ALL", "REVERSE", "NO_GREASE", "APLN", "1.2_SUPPORT", "FORWARD"]
+    tls1_2_top_half = [destination_host, destination_port, "TLS_1.2", "ALL", "TOP_HALF", "NO_GREASE", "APLN", "NO_SUPPORT", "FORWARD"]
+    tls1_2_bottom_half = [destination_host, destination_port, "TLS_1.2", "ALL", "BOTTOM_HALF", "NO_GREASE", "RARE_APLN", "NO_SUPPORT", "FORWARD"]
+    tls1_2_middle_out = [destination_host, destination_port, "TLS_1.2", "ALL", "MIDDLE_OUT", "GREASE", "RARE_APLN", "NO_SUPPORT", "REVERSE"]
+    tls1_1_middle_out = [destination_host, destination_port, "TLS_1.1", "ALL", "FORWARD", "NO_GREASE", "APLN", "NO_SUPPORT", "FORWARD"]
+    tls1_3_forward = [destination_host, destination_port, "TLS_1.3", "ALL", "FORWARD", "NO_GREASE", "APLN", "1.3_SUPPORT", "REVERSE"]
+    tls1_3_reverse = [destination_host, destination_port, "TLS_1.3", "ALL", "REVERSE", "NO_GREASE", "APLN", "1.3_SUPPORT", "FORWARD"]
+    tls1_3_invalid = [destination_host, destination_port, "TLS_1.3", "NO1.3", "FORWARD", "NO_GREASE", "APLN", "1.3_SUPPORT", "FORWARD"]
+    tls1_3_middle_out = [destination_host, destination_port, "TLS_1.3", "ALL", "MIDDLE_OUT", "GREASE", "APLN", "1.3_SUPPORT", "REVERSE"]
+    #Possible versions: SSLv3, TLS_1, TLS_1.1, TLS_1.2, TLS_1.3
+    #Possible cipher lists: ALL, NO1.3
+    #GREASE: either NO_GREASE or GREASE
+    #APLN: either APLN or RARE_APLN
+    #Supported Verisons extension: 1.2_SUPPPORT, NO_SUPPORT, or 1.3_SUPPORT
+    #Possible Extension order: FORWARD, REVERSE
+    queue = [tls1_2_forward, tls1_2_reverse, tls1_2_top_half, tls1_2_bottom_half, tls1_2_middle_out, tls1_1_middle_out, tls1_3_forward, tls1_3_reverse, tls1_3_invalid, tls1_3_middle_out]
+    jarm = ""
+    #Assemble, send, and decipher each packet
+    iterate = 0
+    while iterate < len(queue):
+        payload = packet_building(queue[iterate])
+        server_hello, ip = send_packet(payload, destination_host, destination_port)
+        #Deal with timeout error
+        if server_hello == "TIMEOUT":
+            jarm = "|||,|||,|||,|||,|||,|||,|||,|||,|||,|||"
+            break
+        ans = read_packet(server_hello, queue[iterate])
+        jarm += ans
+        iterate += 1
+        if iterate == len(queue):
+            break
+        else:
+            jarm += ","
+    #Fuzzy hash
+    return jarm_hash(jarm)

analysis/locales/de.json

@@ -0,0 +1,147 @@
+{
+    "alerts": {
+        "PROTO-01": {
+            "title": "Es besteht {} Kommunikationsverbindung zu {} außerhalb des lokalen Netzwerks.",
+            "description": "Das Protokoll {} wird häufig in internen Netzwerken verwendet. Bitte überprüfen Sie, ob der Host {} andere Warnungen verursacht hat, was auf bösartiges Verhalten hindeuten kann."
+        },
+        "PROTO-02": {
+            "title": "{} Verbindung zu {} zu einem Port größer als oder gleich {}.",
+            "description": "{} Verbindungen zu {} über den Port {} wurden erkannt. Die Verwendung eines nicht standardmäßigen Ports ist manchmal ein Merkmal für bösartige Aktivitäten. Wir empfehlen, die Reputation dieses Hosts zu überprüfen, indem Sie sich andere Warnungen ansehen und im Internet danach suchen."
+        },
+        "PROTO-03": {
+            "title": "Mit dem Host {} wurde per HTTP kommuniziert.",
+            "description": "Ihr Gerät hat mit dem Host {} über das unverschlüsselte HTTP-Protokoll kommuniziert. Auch wenn dieses Verhalten an sich nicht bösartig ist, ist es ungewöhnlich, dass von Smartphone-Anwendungen, die im Hintergrund laufen, HTTP-Kommunikationen ausgehen. Bitte überprüfen Sie die Reputation des Hosts anhand einer Internetsuche."
+        },
+        "PROTO-04": {
+            "title": "Mit dem Host {} wurde über einen nicht standardmäßigen Port ({}) per HTTP kommuniziert.",
+            "description": "Ihr Gerät hat mit dem Host {} über den Port {} über das unverschlüsselte HTTP-Protokoll kommuniziert. Dieses Verhalten ist recht ungewöhnlich. Bitte überprüfen Sie die Reputation des Hosts anhand einer Internetsuche."
+        },
+        "PROTO-05": {
+            "title": "Der Server {} wurde während der Sitzung nicht in einer DNS-Abfrage aufgelöst.",
+            "description": "Das bedeutet, dass der Server {} möglicherweise in keinen Domain-Namen aufgelöst wird oder dass die Auflösung bereits vom Gerät zwischengespeichert wurde. Wenn dieser Host in anderen Warnungen vorkommt, überprüfen Sie ihn bitte."
+        },
+        "IOC-01": {
+            "title": "Es wurde eine Verbindung zu {} hergestellt ({}), was als {} gekennzeichnet ist.",
+            "description": "Der Host {} wurde aufgrund bösartiger Aktivitäten explizit auf die Sperrliste gesetzt. Ihr Gerät ist wahrscheinlich kompromittiert und muss von IT-Sicherheitsexperten genauer untersucht werden."
+        },
+        "IOC-02": {
+            "title": "Kommunikation mit {} unter dem CIDR {}, der als {} gekennzeichnet ist.",
+            "description": "Der Server {} wird in einem Netzwerk gehostet, das für bösartige Aktivitäten bekannt ist. Auch wenn dieses Verhalten an sich nicht bösartig ist, müssen Sie überprüfen, ob dieser Host auch in anderen Warnungen erwähnt wird. Wenn Sie Zweifel haben, suchen Sie im Internet nach diesem Host, um zu sehen, ob er legitim ist."
+        },
+        "IOC-03": {
+            "title": "Es wurde eine DNS-Abfrage zu {} ausgeführt, was als {} gekennzeichnet ist.",
+            "description": "Der in der Aufnahme vorkommende Domain-Name {} wurde explizit als bösartig gekennzeichnet. Dies weist darauf hin, dass Ihr Gerät wahrscheinlich kompromittiert ist und eingehend untersucht werden muss."
+        },
+        "IOC-04": {
+            "title": "Es wurde eine DNS-Abfrage zu {} ausgeführt, was als {} gekennzeichnet ist.",
+            "description": "Der in der Aufnahme vorkommende Domain-Name {} wurde explizit als Tracker gekennzeichnet. Dies weist darauf hin, dass eine der aktiven Apps Ihren Standort geografisch verfolgt."
+        },
+        "IOC-05": {
+            "title": "Es wurde eine DNS-Abfrage zur Domain {} ausgeführt, die einen Free-DNS-Dienst nutzt.",
+            "description": "Der Domain-Name {} nutzt einen Free-DNS-Dienst. Dienste dieser Art werden häufig von Cyberkriminellen oder staatlich unterstützten Angreifern bei ihren Operationen genutzt. Es ist sehr verdächtig, dass eine im Hintergrund laufende Anwendung einen solchen Dienst verwendet. Bitte untersuchen Sie das näher."
+        },
+        "IOC-06": {
+            "title": "Es wurde eine DNS-Abfrage zur Domain {} ausgeführt, die eine verdächtige TLD enthält.",
+            "description": "Der Domain-Name {} nutzt eine verdächtige Top-Level-Domain ({}). Diese nicht-generische TLD ist zwar selbst nicht bösartig, wird aber häufig von Cyberkriminellen und bei staatlich unterstützten Operationen verwendet. Bitte überprüfen Sie diese Domain anhand einer Internetsuche. Wenn dieser Host in anderen Warnungen erwähnt wird, können Sie ihn als sehr verdächtig betrachten."
+        },
+        "IOC-07": {
+            "title": "Ein Zertifikat, das mit {} Aktivitäten verknüpft ist, wurde in der Kommunikationsverbindung zu {} gefunden.",
+            "description": "Das Zertifikat ({}), das mit {} verknüpft ist, wurde explizit als bösartig gekennzeichnet. Dies weist darauf hin, dass Ihr Gerät wahrscheinlich kompromittiert ist und eine forensische Analyse benötigt."
+        },
+        "IOC-08": {
+            "title": "Es wurde eine HTTP-Abfrage zu {} ausgeführt, was als {} gekennzeichnet ist.",
+            "description": "Der in der Aufnahme vorkommende Domain-Name {} wurde explizit als bösartig gekennzeichnet. Dies weist darauf hin, dass Ihr Gerät wahrscheinlich kompromittiert ist und eingehend untersucht werden muss."
+        },
+        "IOC-09": {
+            "title": "Es wurde eine HTTP-Abfrage zur Domain {} ausgeführt, die einen Free-DNS-Dienst nutzt.",
+            "description": "Der Domain-Name {} nutzt einen Free-DNS-Dienst. Dienste dieser Art werden häufig von Cyberkriminellen oder staatlich unterstützten Angreifern bei ihren Operationen genutzt. Es ist sehr verdächtig, dass eine im Hintergrund laufende Anwendung einen solchen Dienst verwendet. Bitte untersuchen Sie das näher."
+        },
+        "IOC-10": {
+            "title": "Es wurde eine HTTP-Abfrage zur Domain {} ausgeführt, die eine verdächtige TLD enthält.",
+            "description": "Der Domain-Name {} nutzt eine verdächtige Top-Level-Domain ({}). Diese nicht-generische TLD ist zwar selbst nicht bösartig, wird aber häufig von Cyberkriminellen und bei staatlich unterstützten Operationen verwendet. Bitte überprüfen Sie diese Domain anhand einer Internetsuche. Wenn dieser Host in anderen Warnungen erwähnt wird, können Sie ihn als sehr verdächtig betrachten."
+        },
+        "IOC-11": {
+            "title": "Verbindung zu {} ({}), die als TOR-Knoten referenziert wird.",
+            "description": "Der Server {} wird als Knoten im TOR-Anonymisierungsnetzwerk referenziert. Das analysierte Gerät scheint TOR zu verwenden oder mit einem Server zu kommunizieren, der als TOR-Eingangs- oder -Ausgangsknoten konfiguriert ist. Einige Angreifer nutzen TOR auf ihren Servern, um ihre Spuren zu verwischen."
+        },
+        "IOC-12": {
+            "title": "Eine Anwendung fordert einen legitimen Dienst an, der möglicherweise doppelt verwendet wird."
+            "description": "Der Server {} wird für legitime Zwecke verwendet. Einige Angreifer können ihn jedoch verwenden, um mit ihren Implantaten zu interagieren. Es wird empfohlen, zu überprüfen, ob das analysierte Gerät eine legitime Anwendung enthält, die diesen Dienst verwendet."
+        },
+        "IOC-13": {
+            "title": "Mindestens eine Anwendung verwendet verschlüsselte DNS-Abfragen."
+            "description": "Der DNS over HTTPs server {} wurde während der Erfassung kontaktiert. Dies scheint darauf hinzuweisen, dass mindestens eine Anwendung diese Technik verwendet, um ihre DNS-Anfragen zu verschlüsseln. Diese Funktion schränkt die Scanfunktionen von SpyGuard ein. Wenn diese Funktion auf dem analysierten Gerät nicht aktiviert ist, kann es sich lohnen, herauszufinden, welche App diese Methode verwendet."
+        },
+        "ACT-01": {
+            "title": "Die Domain {} nutzt einen verdächtigen Nameserver ({}).",
+            "description": "Der Domain-Name {} nutzt einen Nameserver, der explizit mit bösartigen Aktivitäten in Verbindung gebracht wird. Viele Cyberkriminelle und staatlich unterstützte Angreifer nutzen Registrare dieser Art, weil sie Kryptowährungen und anonyme Zahlungen zulassen. Es wird empfohlen, diese Domain und die damit verknüpfte laufende Anwendung mithilfe einer forensischen Analyse des Telefons näher zu untersuchen."
+        },
+        "ACT-02": {
+            "title": "Die Domain {} wurde vor kurzem (vor {} Tagen) erstellt.",
+            "description": "Der Domainname {} ist neu. Auch wenn dies nicht von Natur aus böswillig ist, richten Angreifer häufig für jede Kampagne eine neue Infrastruktur ein, die zur Verwendung neu registrierter Domainnamen führen kann."
+        },
+        "SSL-01": {
+            "title": "SSL-Verbindung über einen nicht standardmäßigen Port ({})",
+            "description": "Es ist ungewöhnlich, dass SSL-Verbindungen von Smartphones über einen nicht standardmäßigen Port hergestellt werden. Das kann durchaus legitim sein, aber wir empfehlen dennoch, die Reputation von {} zu überprüfen. Sehen Sie sich dazu den entsprechenden WHOIS-Eintrag, das zugehörige autonome System und das Erstellungsdatum an und suchen Sie im Internet danach."
+        },
+        "SSL-02": {
+            "title": "Eine SSL-Verbindung zu {} verwendet ein kostenloses Zertifikat.",
+            "description": "Kostenlose Zertifikate – wie z. B. Let's Encrypt – werden gerne von Command-and-Control-Servern verwendet, die mit bösartigen Implants und Phishing-Webseiten in Verbindung stehen. Wir empfehlen, den mit diesem Zertifikat verknüpften Host zu überprüfen. Sehen Sie sich dazu seinen Domain-Namen und das Erstellungsdatum an oder überprüfen Sie die Reputation des Hosts im Internet."
+        },
+        "SSL-03": {
+            "title": "Das mit {} verknüpfte Zertifikat ist selbstsigniert.",
+            "description": "Die Verwendung von selbstsignierten Zertifikaten ist in der Infrastruktur von Angreifern weit verbreitet. Wir empfehlen, den mit diesem Zertifikat verknüpften Host {} zu überprüfen. Sehen Sie sich dazu seinen Domain-Namen (falls vorhanden), den WHOIS-Eintrag und das Erstellungsdatum an und überprüfen Sie die Reputation des Hosts im Internet."
+        },
+        "SSL-04": {
+            "title": "Das mit {} verknüpfte Zertifikat ist mit böswilligen Aktivitäten ({})" verknüpft,
+            "description": "Das mit server {} verknüpfte Zertifikat wurde explizit als bösartig eingestuft. Ihr Gerät sieht kompromittiert aus und muss von einem professionellen Team weiter untersucht werden."
+        },
+        "SSL-05": {
+            "title": "Die SSL-Konfiguration von {} ist mit bösartigen Aktivitäten ({})" verknüpft,
+            "description": "Der serverbezogene JARM-Hash {} wurde explizit mit bösartigen Aktivitäten verknüpft. Ihr Gerät ist möglicherweise kompromittiert und muss von einem professionellen Team weiter untersucht werden."
+        },
+        "ADV-01": {
+            "title": "Überprüfen Sie die Warnungen für {}",
+            "description": "Bitte überprüfen Sie die Reputation des Hosts {}. Dieser scheint bösartig zu sein, da er während der Sitzung {} Warnungen verursacht hat."
+        },
+        "SNORT-01": {
+            "title": "Suricata-Regel ausgelöst: {}",
+            "description": "Eine Netzwerkerkennungsregel wurde ausgelöst. Es ist wahrscheinlich, dass Ihr Gerät kompromittiert wurde oder verdächtiges Verhalten aufweist."
+        }
+    },
+    "report": {
+        "numbers": [
+            "eine",
+            "zwei",
+            "drei",
+            "vier",
+            "fünf",
+            "sechs",
+            "sieben",
+            "acht",
+            "neun"
+        ],
+        "suspect_title": "Verdächtige Kommunikationsverbindungen",
+        "uncat_title": "Kommunikationsverbindungen ohne Kategorie",
+        "whitelist_title": "Kommunikationsverbindungen auf der Zulassungsliste",
+        "protocol": "Protokoll",
+        "domain": "Domain",
+        "dst_ip": "Ziel-IP-Adresse",
+        "dst_port": "Ziel-Portnummer",
+        "device_mac": "MAC-Adresse des Geräts",
+        "report_generated_on": "Bericht erstellt am",
+        "capture_duration": "Aufnahmedauer",
+        "packets_number": "Anzahl der Pakete",
+        "capture_sha1": "SHA1-Aufnahme",
+        "report_for_the_capture": "Bericht zur Aufnahme",
+        "report_footer": "Dieser Bericht wurde von einem SpyGuard-Gerät automatisch erstellt. Wenn Sie Fragen haben, Bugs melden oder Feedback geben möchten, kontaktieren Sie uns unter contact@spyguard.io.",
+        "high_msg": "Ihr Gerät scheint kompromittiert zu sein, da Sie {} Warnung(en) der Stufe \"Hoch\" haben.",
+        "moderate_msg": "Sie haben {} Warnungen der Stufe \"Mittel\": Ihr Gerät könnte kompromittiert sein. Bitte sehen Sie sich die Warnungen sorgfältig an.",
+        "low_msg": "Sie haben nur {} Warnungen der Stufe \"Niedrig\": Überprüfen Sie sie gerne.",
+        "none_msg": "Alles sieht gut aus – kein Warnungen. Sehen Sie sich gerne auch die nicht kategorisierten Kommunikationsverbindungen an, falls welche vorhanden sind.",
+        "detection_methods": "Nachweismethoden",
+        "analysis_duration": "Analysezeit",
+        "instance_uuid": "Instanz von SpyGuard",
+        "seconds" : "zweite"
+    }
+}

analysis/locales/en.json

@@ -0,0 +1,147 @@
+{
+    "alerts": {
+        "PROTO-01": {
+            "title": "{} communication going outside the local network to {}.",
+            "description": "The {} protocol is commonly used in internal networks. Please, verify if the host {} leveraged other alerts which may indicates a possible malicious behavior."
+        },
+        "PROTO-02": {
+            "title": "{} connection to {} to a port over or equal to {}.",
+            "description": "{} connections have been seen to {} by using the port {}. The use of non-standard port can be sometimes associated to malicious activities. We recommend to check if this host has a good reputation by looking on other alerts and search it on the internet."
+        },
+        "PROTO-03": {
+            "title": "HTTP communications have been done to the host {}",
+            "description": "Your device exchanged with the host {} by using HTTP, an unencrypted protocol. Even if this behavior is not malicious by itself, it is unusual to see HTTP communications issued from smartphone applications running in the background. Please check the host reputation by searching it on the internet."
+        },
+        "PROTO-04": {
+            "title": "HTTP communications have been seen to the host {} on a non standard port ({}).",
+            "description": "Your device exchanged with the host {} by using HTTP, an unencrypted protocol on the port {}. This behavior is quite unusual. Please check the host reputation by searching it on the internet."
+        },
+        "PROTO-05": {
+            "title": "The server {} hasn't been resolved by any DNS query during the session",
+            "description": "It means that the server {} is likely not resolved by any domain name or the resolution has already been cached by the device. If the host appears in other alerts, please check it."
+        },
+        "IOC-01": {
+            "title": "A connection has been made to {} ({}) which is tagged as {}.",
+            "description": "The host {} has been explicitly blacklisted for malicious activities. Your device is likely compromised and needs to be investigated more deeply by IT security professionals."
+        },
+        "IOC-02": {
+            "title": "Communication to {} under the CIDR {} which is tagged as {}.",
+            "description": "The server {} is hosted under a network which is known to host malicious activities. Even if this behavior is not malicious by itself, you need to check if other alerts are also mentioning this host. If you have some doubts, please search this host on the internet to see if its legit or not."
+        },
+        "IOC-03": {
+            "title": "A DNS request have been done to {} which is tagged as {}.",
+            "description": "The domain name {} seen in the capture has been explicitly tagged as malicious. This indicates that your device is likely compromised and needs to be investigated deeply."
+        },
+        "IOC-04": {
+            "title": "A DNS request have been done to {} which is tagged as {}.",
+            "description": "The domain name {} seen in the capture has been explicitly tagged as a Tracker. This indicates that one of the active apps is geo-tracking your moves."
+        },
+        "IOC-05": {
+            "title": "A DNS request have been done to the domain {} which is a Free DNS.",
+            "description": "The domain name {} is using a Free DNS service. This kind of service is commonly used by cybercriminals or state-sponsored threat actors during their operations. It is very suspicious that an application running in background use this kind of service, please investigate."
+        },
+        "IOC-06": {
+            "title": "A DNS request have been done to the domain {} which contains a suspect TLD.",
+            "description": "The domain name {} is using a suspect Top Level Domain ({}). Even not malicious, this non-generic TLD is used regularly by cybercrime or state-sponsored operations. Please check this domain by searching it on an internet search engine. If other alerts are related to this host, please consider it as very suspicious."
+        },
+        "IOC-07": {
+            "title": "A certificate associated to {} activities have been found in the communication to {}.",
+            "description": "The certificate ({}) associated to {} has been explicitly tagged as malicious. This indicates that your device is likely compromised and need a forensic analysis."
+        },
+        "IOC-08": {
+            "title": "An HTTP request have been done to {} which is tagged as {}.",
+            "description": "The domain name {} seen in the capture has been explicitly tagged as malicious. This indicates that your device is likely compromised and needs to be investigated deeply."
+        },
+        "IOC-09": {
+            "title": "An HTTP request have been done to the domain {} which is a Free DNS.",
+            "description": "The domain name {} is using a Free DNS service. This kind of service is commonly used by cybercriminals or state-sponsored threat actors during their operations. It is very suspicious that an application running in background use this kind of service, please investigate."
+        },
+        "IOC-10": {
+            "title": "An HTTP request have been done to the domain {} which contains a suspect TLD.",
+            "description": "The domain name {} is using a suspect Top Level Domain ({}). Even not malicious, this non-generic TLD is used regularly by cybercrime or state-sponsored operations. Please check this domain by searching it on an internet search engine. If other alerts are related to this host, please consider it as very suspicious."
+        },
+        "IOC-11": {
+            "title": "Connection to {} ({}) which is referenced as a TOR node.",
+            "description": "The server {} is referenced as a node on the TOR anonymization network. The analyzed device appears to be using TOR or communicating with a server configured as a TOR input or output node. Some attackers use TOR on their servers to cover their tracks."
+        },
+        "IOC-12": {
+            "title": "An application requests a legitimate service that may have a dual use .",
+            "description": "The server {} is used for legitimate purposes. However, some attackers can use it to interact with their implants. It is adviced to check that the analyzed device contains a legitimate application which use this service."
+        },
+        "IOC-13": {
+            "title": "At least one application uses encrypted DNS queries.",
+            "description": "The DNS over HTTPs server {} was contacted during the capture. This seems to indicate that at least one application uses this technique to encrypt its DNS requests. This feature limits the scanning capabilities of SpyGuard. If this feature is not enabled on the analyzed device, it may be worth finding out which app is using this method."
+        },
+        "ACT-01": {
+            "title": "The domain {} is using a suspect nameserver ({}).",
+            "description": "The domain name {} is using a nameserver that has been explicitly tagged to be associated to malicious activities. Many cybercriminals and state-sponsored threat actors are using this kind of registrars because they allow cryptocurrencies and anonymous payments. It is adviced to investigate on this domain and the associated running application by doing a forensic analysis of the phone."
+        },
+        "ACT-02": {
+            "title": "The domain {} have been created quite recently ({} days ago).",
+            "description": "The domain name {} is quite new. Even this is not malicious by itself, its quite common for attackers to set up new infrastructure for each attack campaign which can lead to the use of recently registered domain names."
+        },
+        "SSL-01": {
+            "title": "SSL connection done on a non standard port ({}) to {}",
+            "description": "It is not common to see SSL connections issued from smartphones using non-standard ports. Even this can be totally legit, we recommend to check the reputation of {}, by looking at its WHOIS record, the associated autonomus system, its creation date, and by searching it the internet."
+        },
+        "SSL-02": {
+            "title": "An SSL connection to {} is using a free certificate.",
+            "description": "Free certificates — such as Let's Encrypt — are wildly used by command and control servers associated to malicious implants or phishing web pages. We recommend to check the host associated to this certificate, by looking at the domain name, its creation date, or by checking its reputation on the internet."
+        },
+        "SSL-03": {
+            "title": "The certificate associated to {} is self-signed.",
+            "description": "The use of self-signed certificates is a common thing for attacker infrastructure. We recommend to check the host {} which is associated to this certificate, by looking at the domain name (if any), its WHOIS record, its creation date, and by checking its reputation on the internet."
+        },
+        "SSL-04": {
+            "title": "The certificate associated with {} is linked to malicious activity ({}).",
+            "description": "The certificate associated with server {} has been explicitly categorized as malicious. Your device looks compromised and needs to be further investigated by a professional team."
+        },
+        "SSL-05": {
+            "title": "The SSL configuration of {} is linked to malicious activity ({}).",
+            "description": "The server-related JARM hash {} has been explicitly associated with malicious activity. Your device is possibly compromised and needs to be further investigated by a professional team."
+        },
+        "ADV-01": {
+            "title": "Check the alerts for {}",
+            "description": "Please, check the reputation of the host {}, this one seems to be malicious as it leveraged {} alerts during the session."
+        },
+        "SNORT-01": {
+            "title": "Suricata rule tiggered: {}",
+            "description": "A network detection rule has been triggered. It's likely that your device has been compromised or have some suspect behaviour."
+        }
+    },
+    "report": {
+        "numbers": [
+            "one",
+            "two",
+            "three",
+            "four",
+            "five",
+            "six",
+            "seven",
+            "eight",
+            "nine"
+        ],
+        "suspect_title": "Suspect communications",
+        "uncat_title": "Uncategorized communications",
+        "whitelist_title": "Whitelisted communications",
+        "protocol": "Protocol",
+        "domain": "Domain",
+        "dst_ip": "Dst IP address",
+        "dst_port": "Dst port number",
+        "device_mac": "Device MAC address",
+        "report_generated_on": "Report generated on",
+        "capture_duration": "Capture duration",
+        "packets_number": "Number of packets",
+        "capture_sha1": "Capture SHA1",
+        "report_for_the_capture": "Report for the capture",
+        "report_footer": "This report has been autogenerated by a SpyGuard device. For any question, bug report or feedback, please contact contact@spyguard.io.",
+        "high_msg": "Your device seems to be compromised as you have {} high alert(s).",
+        "moderate_msg": "You have {} moderate alert(s), your device might be compromised. Please look at them carefully.",
+        "low_msg": "You have only {} low alert(s), don't hesitate to check them.",
+        "none_msg": "Everything looks fine, zero alerts. Don't hesitate to check the uncategorized communications, if any.",
+        "detection_methods": "Detection methods",
+        "analysis_duration": "Analysis duration",
+        "instance_uuid": "SpyGuard instance",
+        "seconds" : "second(s)"
+    }
+}

analysis/locales/es.json

@@ -0,0 +1,147 @@
+{
+    "alerts": {
+        "PROTO-01": {
+            "title": "Comunicación {} saliente desde la red local hacia {}.",
+            "description": "El protocolo {} se usa comúnmente en redes internas. Por favor verifique si el host {} ha emitido otras alertas que puedan indicar un posible comportamiento malicioso"
+        },
+        "PROTO-02": {
+            "title": "Conexión {} hacia {} en un puerto superior o igual a {}.",
+            "description": "Se han identificado conexiones {} hacia {} usando el puerto {}. El uso de un puerto no standard puede estar asociado a actividad maliciosa. Recomendamos verificar la reputación de este host mediante la comprobación de otras alertas y búsquedas en Internet."
+        },
+        "PROTO-03": {
+            "title": "Se han realizado comunicaciones HTTP hacia el host {}",
+            "description": "Su dispositivo se ha comunicado con el host {} mediante HTTP, un protocolo sin cifrar. Aunque este comportamiento no tiene porque ser malicioso por sí mismo, no es del todo común ver comunicaciones HTTP emitidas desde aplicaciones móviles ejecutándose en segundo plano. Por favor verifique la reputación de este host mediante su búsqueda en Internet."
+        },
+        "PROTO-04": {
+            "title": "Se han realizado comunicaciones HTTP hacia el host {} en un puerto ({}) no standard.",
+            "description": "Su dispositivo se ha comunicado con el host {} mediante HTTP, un protocolo sin cifrado, en el puerto {}. Este comportamiento es bastante inusual. Por favor verifique la reputación de este host mediante su búsqueda en Internet."
+        },
+        "PROTO-05": {
+            "title": "El servidor {} no ha sido resuelto por ningún servidor DNS durante la sesión.",
+            "description": "Significa que el servidor {} probablemente no resuelve a ningún nombre de dominio o su resolución ha sido cacheada por el dispositivo. Por favor, compruebe si este host aparece en otras alertas."
+        },
+        "IOC-01": {
+            "title": "Se ha realizado una conexión a {} ({}) que está etiquetada como {}.",
+            "description": "El host {} ha sido explícitamente añadido a la lista negra por actividad maliciosa. Su dispositivo está probablemente comprometido y necesita ser investigado en profundidad por un profesional de seguridad IT."
+        },
+        "IOC-02": {
+            "title": "Comunicación hacia {} incluida en el CIDR {} que está etiquetada como {}.",
+            "description": "El servidor {} está hospedado en una red conocida por albergar actividades maliciosas. Aunque este comportamiento no es malicioso de por sí, por favor compruebe si el host aparece en otras alertas y verifique la reputación del mismo en Internet."
+        },
+        "IOC-03": {
+            "title": "Se ha realizado una petición DNS a {} que está etiquetada como {}.",
+            "description": "El dominio {} identificado en la captura ha sido explícitamente etiquetado como malicioso. Esto indica que su dispositivo está probablemente comprometido y debe ser investigado en profundidad."
+        },
+        "IOC-04": {
+            "title": "Se ha realizado una petición DNS a {} que está etiquetada como {}.",
+            "description": "El dominio {} identificado en la captura ha sido explícitamente etiquetado como Tracker. Esto indica que la aplicación asociada está monitorizando su posición geográfica."
+        },
+        "IOC-05": {
+            "title": "Se ha realizado una petición DNS al dominio {} que es un DNS gratuito.",
+            "description": "El dominio {} está usando un servicio DNS gratuito. Este tipo de servicios es comúnmente utilizado por cibercriminales y otros actores de amenazas. Es altamente sospechoso que una aplicación ejecutándose en segundo plano use este tipo de servicios. Por favor investigue."
+        },
+        "IOC-06": {
+            "title": "Se ha realizado una petición DNS al dominio {} que contiene un TLD sospechoso.",
+            "description": "El dominio {} está usando un dominio de primero nivel -TLD- ({}). Aunque no sea malicioso, este TLP no-genérico es usado por cibercriminales y otros actores de amenazas con regularidad. Verifique este dominio mediante su búsqueda en Internet. Si hay otras alertas relacionadas con este host, por favor considérelo como muy sospechoso."
+        },
+        "IOC-07": {
+            "title": "Un certificado asociado a actividades {} ha sido identificado en una comunicación hacia {}.",
+            "description": "El certificado ({}) asociado a {} ha sido explícitamente etiquetado como malicioso. Esto indica que su dispositivo está probablemente comprometido y necesita ser analizado en profundidad por un especialista forense."
+        },
+        "IOC-08": {
+            "title": "Se ha realizado una petición HTTP a {} que está etiquetada como {}.",
+            "description": "El dominio {} identificado en la captura ha sido explícitamente etiquetado como malicioso. Esto indica que su dispositivo está probablemente comprometido y debe ser investigado en profundidad."
+        },
+        "IOC-09": {
+            "title": "Se ha realizado una petición HTTP al dominio {} que es un DNS gratuito.",
+            "description": "El dominio {} está usando un servicio DNS gratuito. Este tipo de servicios es comúnmente utilizado por cibercriminales y otros actores de amenazas. Es altamente sospechoso que una aplicación ejecutándose en segundo plano use este tipo de servicios. Por favor investigue."
+        },
+        "IOC-10": {
+            "title": "Se ha realizado una petición HTTP al dominio {} que contiene un TLD sospechoso.",
+            "description": "El dominio {} está usando un dominio de primero nivel -TLD- ({}). Aunque no sea malicioso, este TLP no-genérico es usado por cibercriminales y otros actores de amenazas con regularidad. Verifique este dominio mediante su búsqueda en Internet. Si hay otras alertas relacionadas con este host, por favor considérelo como muy sospechoso."
+        },
+        "IOC-11": {
+            "title": "Conexión a {} ({}) a la que se hace referencia como un nodo TOR.",
+            "description": "El servidor {} es referenciado como un nodo en la red de anonimización TOR. El dispositivo analizado parece estar usando TOR o comunicándose con un servidor configurado como un nodo de entrada o salida de TOR. Algunos atacantes utilizan TOR en sus servidores para cubrir sus pistas."
+        },
+        "IOC-12": {
+            "title": "Una aplicación solicita un servicio legítimo que puede tener un doble uso .",
+            "description": "El servidor {} se utiliza para fines legítimos. Sin embargo, algunos atacantes pueden usarlo para interactuar con sus implantes. Se recomienda comprobar que el dispositivo analizado contiene una aplicación legítima que utiliza este servicio."
+        },
+        "IOC-13": {
+            "title": "Al menos una aplicación utiliza consultas DNS cifradas.",
+            "description": "El servidor DNS sobre HTTPs {} fue contactado durante la captura. Esto parece indicar que al menos una aplicación utiliza esta técnica para cifrar sus solicitudes de DNS. Esta característica limita las capacidades de escaneo de SpyGuard. Si esta función no está habilitada en el dispositivo analizado, puede valer la pena averiguar qué aplicación está utilizando este método."
+        },
+        "ACT-01": {
+            "title": "El dominio {} está usando un servidor de nombres sospechoso ({}).",
+            "description": "El nombre de dominio {} usa un servidor de nombres que ha sido explícitamente etiquetado como asociado a actividad maliciosa. Muchos ciberdelincuentes y otros actores de amenazas utilizan este tipo de registradores ya que aceptan criptomonedas y pagos anónimos. Se recomienda investigar este dominio y la aplicación en ejecución asociada mediante un análisis forense del dispositivo."
+        },
+        "ACT-02": {
+            "title": "El dominio {} se creó recientemente (hay {} días).",
+            "description": "El nombre de dominio {} es nuevo. Incluso esto no es intrínsecamente malicioso, es bastante común que los atacantes configuren una nueva infraestructura para cada campaña, lo que puede llevar al uso de nombres de dominio recién registrados."
+        },
+        "SSL-01": {
+            "title": "Conexión SSL realizada mediante un puerto no standard ({}) a {}",
+            "description": "Las conexiones SSL desde dispositivos móviles usando puertos no standard no son muy comunes. Aunque pudiera ser totalmente legítima, recomendamos verificar la reputación de {}, comprobando su registro WHOIS, su sistema autónomo asociado y su fecha de creación mediante su búsqueda en Internet."
+        },
+        "SSL-02": {
+            "title": "Conexión SSL a {} està usando un certificado gratuito",
+            "description": "Certificados gratuitos - como Let's Encrypt — son ampliamente utilizados por servidores de control asociados a software malicioso o webs de phishing. Recomendamos verificar el host asociado a esta certificado comprobando el nombre de dominio, su fecha de creación y verificando su reputación en Internet."
+        },
+        "SSL-03": {
+            "title": "El certificado asociado a {} es autofirmado.",
+            "description": "El uso de certificados autofirmados es un elemento común en infraestructuras utilizadas por atacantes. Recomendamos comprobar el host {} que está asociado a este certificado, especialmente su nombre de dominio (en caso de existir), su registro WHOIS, su fecha de creación y verificando su reputación en Internet."
+        },
+        "SSL-04": {
+            "title": "El certificado asociado con {} está vinculado a una actividad maliciosa ({}).",
+            "description": "El certificado asociado con server {} ha sido categorizado explícitamente como malicioso. Su dispositivo parece comprometido y necesita ser investigado por un equipo profesional."
+        },
+        "SSL-05": {
+            "title": "La configuración SSL de {} está vinculada a una actividad maliciosa ({}).",
+            "description": "El hash JARM relacionado con el servidor {} se ha asociado explícitamente con actividad maliciosa. Su dispositivo está posiblemente comprometido y necesita ser investigado por un equipo profesional."
+        },
+        "ADV-01": {
+            "title": "Compruebe las alertas para {}",
+            "description": "Por favor, verifique la reputación del host {}, ya que parece ser malicioso por aparecer en {} alertas durante la sesión."
+        },
+        "SNORT-01": {
+            "title": "Regla Suricata activada: {}",
+            "description": "Una regla de detección ha sido activada. Probablemente su dispositivo está comprometido o presenta comportamiento sospechoso."
+        }
+    },
+    "report": {
+        "numbers": [
+            "uno",
+            "dos",
+            "tres",
+            "cuatro",
+            "cinco",
+            "seis",
+            "siete",
+            "ocho",
+            "nueve"
+        ],
+        "suspect_title": "Comunicaciones sospechosas",
+        "uncat_title": "Comunicaciones no categorizadas",
+        "whitelist_title": "Comunicaciones en lista blanca",
+        "protocol": "Protocolo",
+        "domain": "Dominio",
+        "dst_ip": "Dirección IP destino",
+        "dst_port": "Puerto destino número",
+        "device_mac": "Dirección MAC dispositivo",
+        "report_generated_on": "Informe generado en",
+        "capture_duration": "Duración captura",
+        "packets_number": "Número de paquetes",
+        "capture_sha1": "Captura SHA1",
+        "report_for_the_capture": "Informe de la captura",
+        "report_footer": "Este informe ha sido autogenerado por un dispositivo SpyGuard. Para cualquier pregunta, informe de fallos o feedback por favor contacte con contact@spyguard.io.",
+        "high_msg": "Su dispositivo parece estar comprometido ya que tiene {} alerta(s) de nivel alto.",
+        "moderate_msg": "Tienes {} alerta(s) de nivel moderado, su dispositivo podría estar comprometido. Por favor revíselas detenidamente.",
+        "low_msg": "Solamente tiene {} alertas(s) de nivel bajo, por favor revíselas.",
+        "none_msg": "Todo se ve bien, cero alertas. No dude en comprobar las comunicaciones no clasificadas (en caso de haberlas).",
+        "detection_methods": "Métodos de detección",
+        "analysis_duration": "Tiempo de análisis",
+        "instance_uuid": "Instancia de SpyGuard",
+        "seconds" : "segundo(s)"
+    }
+}

analysis/locales/fr.json

@@ -0,0 +1,147 @@
+{
+    "alerts": {
+        "PROTO-01": {
+            "title": "Une communication {} va à l'extérieur du réseau jusqu'à {}.",
+            "description": "Le protocole {} est généralement utilisé dans des réseaux internes. Vérifiez si le serveur {} a soulevé d'autres alertes. Ceci pourrait indiquer la présence d'une possible application malveillante."
+        },
+        "PROTO-02": {
+            "title": "Connexion {} vers {} sur un port au dessus ou égal à {}.",
+            "description": "Des connexions {} vers {} ont été vues utilisant le port {}. L'utilisation d'un numéro de port non standard peut être associé à des activités malveillantes. Nous recommandons de vérifier si ce serveur possède une bonne réputation en regardant les autres alertes et en le cherchant sur Internet."
+        },
+        "PROTO-03": {
+            "title": "Des communications HTTP ont été réalisées vers {}",
+            "description": "Votre appareil a communiqué avec le serveur {} en utilisant HTTP, un protocole non chiffré. Même si ce n'est pas malveillant en tant que tel, il est rare de voir des communications HTTP issues d'applications installées sur des smartphones exécutées en arrière plan. Il est conseillé de vérifier la réputation du serveur en le recherchant sur Internet."
+        },
+        "PROTO-04": {
+            "title": "Des communications HTTP ont été réalisées vers {} sur un port non standard ({}).",
+            "description": "Votre appareil a communiqué vers le serveur {} en utilisant HTTP, un protocole non chiffré sur le port {}. Ce type de communication peut être signe d'une activité malveillante sur votre appareil car il est très rare qu'HTTP utilise ce port. Il est conseillé de vérifier la réputation du serveur en le recherchant sur Internet."
+        },
+        "PROTO-05": {
+            "title": "Le serveur {} n'a pas été résolu par le protocole DNS durant la session",
+            "description": "Cela signifie que le serveur {} ne possède pas de nom de domaine associé ou que sa résolution a déjà été mise en cache par votre appareil. Si le serveur apparait dans d'autres alertes, merci de vérifier sa réputation."
+        },
+        "IOC-01": {
+            "title": "Connexion vers {} ({}) qui est tagué en tant que {}.",
+            "description": "Le serveur {} est connu pour être associé à des activités malveillantes. Votre appareil est surement compromis et doit être investigué plus en détails par une équipe professionnelle."
+        },
+        "IOC-02": {
+            "title": "Connexion vers {} appartenant au bloc réseau {} qui est tagué en tant que {}.",
+            "description": "Le serveur {} est hébergé dans un réseau qui est connu pour abriter des activités malveillantes. Même si ce n'est pas malveillant en tant que tel, vous devez regarder si d'autres alertes mentionnent ce serveur. Si vous avez certains doutes, recherchez sur Internet ce serveur pour savoir s'il semble être légitime ou non."
+        },
+        "IOC-03": {
+            "title": "Requête DNS vers le domaine {} qui est tagué en tant que {}.",
+            "description": "Le serveur {} vers lequel communique votre appareil a été explicitement catégorisé en tant que malveillant. Votre appareil est sûrement compromis et doit être investigué plus en détails par une équipe professionnelle."
+        },
+        "IOC-04": {
+            "title": "Requête DNS vers le domaine {} qui est tagué en tant que {}.",
+            "description": "Le nom de domaine {} vers lequel communique votre appareil a été explicitement catégorisé comme un tracker. Ceci indique d'une application active sur votre appareil est entrain de vous géo-localiser."
+        },
+        "IOC-05": {
+            "title": "Requête DNS vers le domaine {} qui est un domaine gratuit.",
+            "description": "Le nom de domaine {} utilise un service de noms de domaine gratuits. Ce type de service est couramment utilisé par les cybercriminels ou des acteurs associés à des États au cours de leurs opérations d'espionnage. Il est très suspect qu'une application exécutée en arrière-plan utilise ce type de service, veuillez enquêter."
+        },
+        "IOC-06": {
+            "title": "Requête DNS vers le domaine {} contenant une extension suspecte.",
+            "description": "Le nom de domaine {} utilise une extension suspecte ({}). Même si cela n'est pas malveillant en-soi, l'utilisation d'une extension non générique est l'apanage d'acteurs cybercriminels et étatiques durant leurs opérations. Veuillez vérifier la pertinance de ce domaine en le recherchant sur un moteur de recherche Internet. Si d'autres alertes sont liées à ce dernier, veuillez le considérer comme très suspect."
+        },
+        "IOC-07": {
+            "title": "Un certificat associé à des activités de {} a été vu lors de communications vers {}.",
+            "description": "Le certificat ({}) associé au serveur {} a été explicitement catégorisé comme malveillant. Votre appareil est sûrement compromis et doit être investigué plus en détails par une équipe professionnelle."
+        },
+        "IOC-08": {
+            "title": "Requête HTTP vers le domaine {} qui est tagué en tant que {}.",
+            "description": "Le serveur {} vers lequel communique votre appareil a été explicitement catégorisé en tant que malveillant. Votre appareil est sûrement compromis et doit être investigué plus en détails par une équipe professionnelle."
+        },
+        "IOC-09": {
+            "title": "Requête HTTP vers le domaine {} qui est un domaine gratuit.",
+            "description": "Le nom de domaine {} utilise un service de noms de domaine gratuits. Ce type de service est couramment utilisé par les cybercriminels ou des acteurs associés à des États au cours de leurs opérations d'espionnage. Il est très suspect qu'une application exécutée en arrière-plan utilise ce type de service, veuillez enquêter."
+        },
+        "IOC-10": {
+            "title": "Requête HTTP vers le domaine {} contenant une extension suspecte.",
+            "description": "Le nom de domaine {} utilise une extension suspecte ({}). Même si cela n'est pas malveillant en-soi, l'utilisation d'une extension non générique est l'apanage d'acteurs cybercriminels et étatiques durant leurs opérations. Veuillez vérifier la pertinance de ce domaine en le recherchant sur un moteur de recherche Internet. Si d'autres alertes sont liées à ce dernier, veuillez le considérer comme très suspect."
+        },
+        "IOC-11": {
+            "title": "Connexion vers {} ({}) qui est référencé en tant que noeud TOR.",
+            "description": "Le serveur {} est référencé en tant que noeud sur le réseau d'anonymisation TOR. Le dispositif analysé semble utiliser TOR ou communique avec un serveur configuré comme noeud d'entrée ou de sortie TOR. Certains attaquants utilisent TOR sur leurs serveurs afin de brouiller les pistes."
+        },
+        "IOC-12": {
+            "title": "Une application requête un service pouvant avoir un double emploi.",
+            "description": "Le serveur {} est utilisé à des fins légitimes. Toutefois, certains attaquants s'en servent pour intéragir avec leurs implants. Il est conseillé de vérifier que l'appareil analysé contient bien une application légitime utilisant ce service."
+        },
+        "IOC-13": {
+            "title": "Au moins une application utilise des requêtes DNS chiffrées",
+            "description": "Le résolveur de noms utilisant HTTPs {} a été contacté durant la capture. Ceci semble indiquer qu'au moins une application utilise cette technique permettant de chiffrer les requêtes DNS. Cette fonctionnalité limite les capacités d'analyse de SpyGuard. Si cette fonctionnalité n'est pas activée sur le dispositif analysé, il peut être intéressant de découvrir quelle application utilise cette méthode."
+        },
+        "ACT-01": {
+            "title": "Le domaine {} utilise un serveur de noms suspect ({}).",
+            "description": "Le nom de domaine {} utilise un serveur de noms qui a été explicitement catégorisé comme associé à des activités malveillantes. Plusieurs cybercriminels et acteurs étatiques utilisent ce type de serveurs de noms car ils autorisent les paiements anonymes grâce aux cryptomonnaies. Il est conseillé d'investiguer sur ce domaine et l'application s'y connectant en réalisant une analyse post-mortem de l'appareil analysé."
+        },
+        "ACT-02": {
+            "title": "Le domaine {} a été créé récemment (il y a {} jours).",
+            "description": "Le nom de domaine {} est nouveau. Même ce n'est pas malveillant en soi, il est assez courant pour les attaquants de mettre en place une nouvelle infrastructure pour chaque campagne, ce qui peut conduire à l'utilisation de noms de domaine récemment enregistrés."
+        },
+        "SSL-01": {
+            "title": "Connexion SSL utilisant un port non standard ({}) vers {}",
+            "description": "Il n'est pas commun de voir des connexions SSL issues de smartphones utiliser des ports non standards. Même si cela peut être totalement légitime, il est recommandé d'évaluer la réputation du serveur {}, en regardant son enregistrement WHOIS, son système autonome, sa date de création et en le recherchant sur Internet."
+        },
+        "SSL-02": {
+            "title": "Une connexion SSL vers {} utilise un certificat gratuit.",
+            "description": "Les certificats gratuits — tels que Let's Encrypt - sont largement utilisés par des serveurs de commande et de contrôle associés à des implants malveillants ou à des pages Web de phishing. Nous vous recommandons de vérifier le serveur associé à ce certificat, en regardant le nom de domaine, sa date de création, ou en vérifiant sa réputation sur Internet."
+        },
+        "SSL-03": {
+            "title": "Le certificat associé à {} est auto-signé.",
+            "description": "L'utilisation de certificats auto-signés est une chose courante pour des infrastructures d'attaque associées à des activités malveillantes. Nous vous recommandons de vérifier le serveur {} qui est associé à ce certificat, en regardant le nom de domaine (le cas échéant), son enregistrement WHOIS, sa date de création, et en vérifiant sa réputation sur Internet."
+        },
+        "SSL-04": {
+            "title": "Le certificat associé à {} est lié à des activités malveillantes ({}).",
+            "description": "Ce certificat associé au serveur {} a été explicitement catégorisé en tant que malveillant. Votre appareil est sûrement compromis et doit être investigué plus en détails par une équipe professionnelle."
+        },
+        "SSL-05": {
+            "title": "La configuration SSL de {} est associé à des activités malveillantes ({}).",
+            "description": "Le hash JARM lié au serveur {} a été explicitement associé à des activités malveillantes. Votre appareil est sûrement compromis et doit être investigué plus en détails par une équipe professionnelle."
+        },
+        "ADV-01": {
+            "title": "Vérifiez les alertes liées au serveur {}",
+            "description": "Merci de vérifier la réputation et les alertes liées au serveur {}, ce dernier semble malveillant, ayant engendré {} alertes durant la session de capture."
+        },
+        "SNORT-01": {
+            "title": "Règle suricata déclanchée : {}",
+            "description": "Une règle de détection de réseau a été déclenchée. Il est probable que votre appareil ait été compromis ou présente un comportement suspect."
+        }
+    },
+    "report": {
+        "numbers": [
+            "une",
+            "deux",
+            "trois",
+            "quatre",
+            "cinq",
+            "six",
+            "sept",
+            "huit",
+            "neuf"
+        ],
+        "suspect_title": "Communications suspectes",
+        "uncat_title": "Communications non catégorisées",
+        "whitelist_title": "Communications légitimes",
+        "protocol": "Protocole",
+        "domain": "Domaine",
+        "dst_ip": "Adresse IP",
+        "dst_port": "Port",
+        "device_mac": "Adresse MAC de l'appareil",
+        "report_generated_on": "Rapport généré le ",
+        "capture_duration": "Durée de la capture",
+        "packets_number": "Nombre de paquets",
+        "capture_sha1": "SHA1 de la capture",
+        "report_for_the_capture": "Rapport pour la capture",
+        "report_footer": "Ce rapport a été automatiquement généré par une instance de SpyGuard. Pour toute question et retours, n'hésitez pas à contacter contact@spyguard.io.",
+        "high_msg": "Votre appareil semble être compromis car vous avez {} alerte(s) élevée(s).",
+        "moderate_msg": "Vous avez {} alerte(s) modérée(s), votre appareil peut être compromis. Regardez ces alertes en détail.",
+        "low_msg": "Vous avez uniquement {} alerte(s) faibles, n'hésitez pas à les consulter.",
+        "none_msg": "Toute semble normal, vous avez aucune alerte. Cependant, n'hésitez pas à regarder les communications non catégorisées.",
+        "detection_methods": "Méthodes de détection",
+        "analysis_duration": "Durée d'analyse",
+        "instance_uuid": "Instance de SpyGuard",
+        "seconds" : "seconde(s)"
+    }
+}

analysis/locales/it.json

@@ -0,0 +1,147 @@
+{
+    "alerts": {
+        "PROTO-01": {
+            "title": "{} comunicazione in uscita dalla rete locale a {}.",
+            "description": "Il protocollo {} è comunemente utilizzato nelle reti interne. Verificare se l'host {} ha sfruttato altri avvisi, fattore che potrebbe indicare un possibile comportamento dannoso."
+        },
+        "PROTO-02": {
+            "title": "{} connessione a {} tramite una porta superiore o uguale a {}.",
+            "description": "Sono state rilevate {} connessioni a {} tramite la porta {}. L'utilizzo di una porta non standard a volte può essere associato ad attività dannose. È consigliabile verificare se questo host ha una buona reputazione esaminando altri avvisi ed effettuando una ricerca in Internet."
+        },
+        "PROTO-03": {
+            "title": "Sono state generate comunicazioni HTTP dirette all'host {}",
+            "description": "Il dispositivo ha effettuato uno scambio con l'host {} utilizzando HTTP, un protocollo non criptato. Anche se questo comportamento non è dannoso in sé, è raro rilevare comunicazioni HTTP generate da applicazioni per smartphone in esecuzione in background. Controllare la reputazione dell'host effettuando una ricerca in Internet."
+        },
+        "PROTO-04": {
+            "title": "Sono state rilevate comunicazioni HTTP dirette all'host {} su una porta non standard ({}).",
+            "description": "Il dispositivo ha effettuato uno scambio con l'host {} utilizzando HTTP, un protocollo non criptato sulla porta {}. Questo comportamento è decisamente insolito. Controllare la reputazione dell'host effettuando una ricerca in Internet."
+        },
+        "PROTO-05": {
+            "title": "Il server {} non è stato risolto da nessuna query DNS durante la sessione",
+            "description": "Questo indica che il server {} probabilmente non è stato risolto da nessun nome di dominio o che la risoluzione è già stata memorizzata nella cache dal dispositivo. Se l'host viene visualizzato in altri avvisi, controllarlo."
+        },
+        "IOC-01": {
+            "title": "È stata stabilita una connessione a {} ({}) con contrassegno {}.",
+            "description": "L'host {} è stato esplicitamente inserito nella blacklist per attività dannose. Probabilmente il dispositivo è compromesso e deve essere esaminato più a fondo da professionisti della sicurezza IT."
+        },
+        "IOC-02": {
+            "title": "Comunicazione a {} con il CIDR {} con contrassegno {}.",
+            "description": "Il server {} è ospitato in una rete nota per l'hosting di attività dannose. Nonostante questo comportamento non sia dannoso in sé, è necessario verificare se l'host è menzionato anche in altri avvisi. In caso di dubbi, cercare l'host in Internet per scoprire se è legittimo o meno."
+        },
+        "IOC-03": {
+            "title": "È stata effettuata una richiesta DNS a {} con contrassegno {}.",
+            "description": "Il nome di dominio {} visualizzato nell'acquisizione è stato esplicitamente contrassegnato come dannoso. Questo indica che il dispositivo è potenzialmente compromesso e deve essere esaminato a fondo."
+        },
+        "IOC-04": {
+            "title": "È stata effettuata una richiesta DNS a {} con contrassegno {}.",
+            "description": "Il nome di dominio {} visualizzato nell'acquisizione è stato esplicitamente contrassegnato come Tracker. Questo indica che una delle app attive esegue la geolocalizzazione dei movimenti dell'utente."
+        },
+        "IOC-05": {
+            "title": "È stata effettuata una richiesta DNS al dominio {} che è un servizio Free DNS.",
+            "description": "Il nome di dominio {} utilizza un servizio Free DNS. Questo tipo di servizio è comunemente utilizzato durante le operazioni di criminali informatici o autori di attacchi commissionati da stati esteri. L'utilizzo di questo tipo di servizio da parte di un'applicazione in esecuzione in background è molto sospetto e richiede ulteriori indagini."
+        },
+        "IOC-06": {
+            "title": "È stata effettuata una richiesta DNS al dominio {} contenente un dominio di primo livello sospetto.",
+            "description": "Il nome di dominio {} utilizza un dominio di primo livello sospetto ({}). Anche se non dannoso, questo dominio di primo livello non generico viene utilizzato regolarmente durante le operazioni di criminali informatici o autori di attacchi commissionati da stati esteri. Controllare questo dominio effettuando una ricerca tramite un motore di ricerca Internet. Se altri avvisi sono correlati all'host, è necessario considerare questo elemento molto sospetto."
+        },
+        "IOC-07": {
+            "title": "Nella comunicazione a {} è stato rilevato un certificato associato ad attività {}.",
+            "description": "Il certificato ({}) associato a {} è stato esplicitamente contrassegnato come dannoso. Questo indica che il dispositivo è potenzialmente compromesso e necessita di un'analisi forense."
+        },
+        "IOC-08": {
+            "title": "È stata effettuata una richiesta HTTP a {} con contrassegno {}.",
+            "description": "Il nome di dominio {} visualizzato nell'acquisizione è stato esplicitamente contrassegnato come dannoso. Questo indica che il dispositivo è potenzialmente compromesso e deve essere esaminato a fondo."
+        },
+        "IOC-09": {
+            "title": "È stata effettuata una richiesta HTTP al dominio {} che è un servizio Free DNS.",
+            "description": "Il nome di dominio {} utilizza un servizio Free DNS. Questo tipo di servizio è comunemente utilizzato durante le operazioni di criminali informatici o autori di attacchi commissionati da stati esteri. L'utilizzo di questo tipo di servizio da parte di un'applicazione in esecuzione in background è molto sospetto e richiede ulteriori indagini."
+        },
+        "IOC-10": {
+            "title": "È stata effettuata una richiesta HTTP al dominio {} contenente un dominio di primo livello sospetto.",
+            "description": "Il nome di dominio {} utilizza un dominio di primo livello sospetto ({}). Anche se non dannoso, questo dominio di primo livello non generico viene utilizzato regolarmente durante le operazioni di criminali informatici o autori di attacchi commissionati da stati esteri. Controllare questo dominio effettuando una ricerca tramite un motore di ricerca Internet. Se altri avvisi sono correlati all'host, è necessario considerare questo elemento molto sospetto."
+        },
+        "IOC-11": {
+            "title": "Connessione a {} ({}) a cui si fa riferimento come nodo TOR.",
+            "description": "Il server {} è un nodo della rete di anonimizzazione TOR. Il dispositivo analizzato sembra utilizzare TOR o comunicare con un server configurato come un nodo di ingresso o di uscita TOR. Alcuni attaccanti usano TOR sui loro server per coprire le loro tracce."
+        },
+        "IOC-12": {
+            "title": "Un'applicazione richiede un servizio legittimo che può avere un doppio uso .",
+            "description": "Il server {} viene utilizzato per scopi legittimi. Tuttavia, alcuni attaccanti possono utilizzarlo per interagire con i loro impianti. Si consiglia di verificare che il dispositivo analizzato contenga un'applicazione legittima che utilizza questo servizio."
+        },
+        "IOC-13": {
+            "title": "Almeno un'applicazione utilizza query DNS crittografate.",
+            "description": "Il DNS sul server https {} è stato contattato durante la cattura. Questo sembra indicare che almeno un'applicazione utilizza questa tecnica per crittografare le sue richieste DNS. Questa funzione limita le capacità di scansione di SpyGuard. Se questa funzione non è abilitata sul dispositivo analizzato, può essere la pena scoprire quale applicazione sta utilizzando questo metodo."
+        },
+        "ACT-01": {
+            "title": "Il dominio {} utilizza un server dei nomi sospetto ({}).",
+            "description": "Il nome di dominio {} utilizza un server dei nomi che è stato esplicitamente contrassegnato come associato ad attività dannose. Molti criminali informatici e autori di attacchi commissionati da stati esteri utilizzano questo tipo di registrar poiché sono ammessi criptovalute e pagamenti anonimi. È consigliabile indagare su questo dominio e sull'applicazione in esecuzione associata eseguendo un'analisi forense del telefono."
+        },
+        "ACT-02": {
+            "title": "Il dominio {} è stato creato di recente ({} giorni fa)",
+            "description": "Il nome di dominio {} è nuovo. Anche questo non è intrinsecamente dannoso, è abbastanza comune per gli aggressori impostare una nuova infrastruttura per ogni campagna, che può portare all'uso di nomi di dominio appena registrati."
+        },
+        "SSL-01": {
+            "title": "Connessione SSL eseguita su una porta non standard ({}) a {}",
+            "description": "Non è comune rilevare connessioni SSL generate da smartphone tramite porte non standard. Anche se questo può essere del tutto legittimo, è consigliabile controllare la reputazione di {} prestando attenzione al record WHOIS, al sistema autonomo associato e alla data di creazione, nonché effettuando una ricerca in Internet."
+        },
+        "SSL-02": {
+            "title": "Una connessione SSL a {} utilizza un certificato gratuito.",
+            "description": "I certificati gratuiti, come Let's Encrypt, sono ampiamente utilizzati dai server di comando e controllo associati a insediamenti dannosi o pagine Web di phishing. È consigliabile controllare l'host associato a questo certificato, prestando attenzione al nome di dominio e alla data di creazione o verificandone la reputazione in Internet."
+        },
+        "SSL-03": {
+            "title": "Il certificato associato a {} è autofirmato.",
+            "description": "L'utilizzo di certificati autofirmati è una consuetudine per l'infrastruttura degli autori degli attacchi. È consigliabile controllare l'host {} associato a questo certificato, prestando attenzione all'eventuale nome di dominio, al record WHOIS e alla data di creazione, nonché verificandone la reputazione in Internet."
+        },
+        "SSL-04": {
+            "title": "Il certificato associato a {} è collegato ad attività dannose ({}).",
+            "description": "Il certificato associato al server {} è stato esplicitamente classificato come dannoso. Il dispositivo sembra compromesso e deve essere ulteriormente indagato da un team di professionisti."
+        },
+        "SSL-05": {
+            "title": "La configurazione SSL di {} è collegata ad attività dannose ({}).",
+            "description": "L'hash JARM relativo al server {} è stato esplicitamente associato ad attività dannose. Il dispositivo è probabilmente compromessa e deve essere ulteriormente indagato da un team di professionisti."
+        },
+        "ADV-01": {
+            "title": "Controllare gli avvisi per {}",
+            "description": "Controllare la reputazione dell'host {}, che sembra di natura dannosa poiché ha sfruttato {} avvisi durante la sessione."
+        },
+        "SNORT-01": {
+            "title": "Regola Suricata attivata: {}",
+            "description": "È stata attivata una regola di rilevamento della rete. È probabile che il dispositivo sia stato compromesso o che presenti comportamenti sospetti."
+        }
+    },
+    "report": {
+        "numbers": [
+            "uno",
+            "due",
+            "tre",
+            "quattro",
+            "cinque",
+            "sei",
+            "sette",
+            "otto",
+            "nove"
+        ],
+        "suspect_title": "Comunicazioni sospette",
+        "uncat_title": "Comunicazioni non categorizzate",
+        "whitelist_title": "Comunicazioni inserite nella whitelist",
+        "protocol": "Protocollo",
+        "domain": "Dominio",
+        "dst_ip": "Indirizzo IP di destinazione",
+        "dst_port": "Numero della porta di destinazione",
+        "device_mac": "Indirizzo MAC dispositivo",
+        "report_generated_on": "Rapporto generato in data",
+        "capture_duration": "Durata acquisizione",
+        "packets_number": "Numero di pacchetti",
+        "capture_sha1": "SHA1 acquisizione",
+        "report_for_the_capture": "Rapporto relativo all'acquisizione",
+        "report_footer": "Questo rapporto è stato generato automaticamente da un dispositivo SpyGuard. Per eventuali domande, segnalazioni di bug o feedback, contattare contact@spyguard.io.",
+        "high_msg": "Sembra che il dispositivo sia compromesso poiché sono presenti {} avvisi con priorità elevata.",
+        "moderate_msg": "Sono presenti {} avvisi con priorità moderata, è possibile che il dispositivo sia compromesso. Esaminarli con attenzione.",
+        "low_msg": "Sono presenti solo {} avvisi con priorità bassa da controllare.",
+        "none_msg": "Sembra tutto a posto, non sono presenti avvisi. Controllare eventuali comunicazioni non categorizzate.",
+        "detection_methods": "Metodi di rilevamento",
+        "analysis_duration": "Tempo di analisi",
+        "instance_uuid": "Istanza di SpyGuard",
+        "seconds" : "secondi"
+    }
+}

analysis/locales/pt.json

@@ -0,0 +1,147 @@
+{
+    "alerts": {
+        "PROTO-01": {
+            "title": "Comunicação {} externa à rede local para {}.",
+            "description": "O protocolo {} é comumente usado em redes internas. Verifique se o host {} acionou outros alertas que possam indicar um possível comportamento malicioso."
+        },
+        "PROTO-02": {
+            "title": "Conexão {} a {} para uma porta maior ou igual a {}.",
+            "description": "Conexões {} foram detectadas por {} usando a porta {}. O uso da porta não padrão é comumente associado a atividades maliciosas. É recomendado verificar se esse host tem uma boa reputação verificando outros alertas e pesquisando-o na internet."
+        },
+        "PROTO-03": {
+            "title": "Comunicações HTTP foram realizadas com o host {}",
+            "description": "O dispositivo foi conectado ao host {} por meio de HTTP, um protocolo não criptografado. Mesmo que esse comportamento, por si só, não seja malicioso, é incomum que comunicações HTTP sejam estabelecidas por meio de aplicativos móveis em segundo plano. Verifique a reputação do host pesquisando-o na Internet."
+        },
+        "PROTO-04": {
+            "title": "Comunicações HTTP foram detectadas pelo host {} por meio de uma porta não padrão ({}).",
+            "description": "O dispositivo foi conectado ao host {} por meio de HTTP, um protocolo não criptografado na porta {}. Esse comportamento é incomum. Verifique a reputação do host pesquisando-o na Internet."
+        },
+        "PROTO-05": {
+            "title": "O servidor {} não foi resolvido por nenhuma consulta de DNS durante a sessão",
+            "description": "Isso significa provavelmente que o servidor {} não foi resolvido por nenhum nome de domínio ou a resolução já foi armazenada pelo dispositivo. Se o host aparecer em outros alertas, verifique-os."
+        },
+        "IOC-01": {
+            "title": "Uma conexão foi estabelecida com {} ({}) e marcada como {}.",
+            "description": "O host {} foi explicitamente bloqueado devido a atividades maliciosas. O dispositivo provavelmente foi comprometido e precisa ser analisado com cuidado por profissionais de segurança de TI."
+        },
+        "IOC-02": {
+            "title": "Comunicação com {} com o CIDR {} marcado como {}.",
+            "description": "O host {} está hospedado em uma rede que é conhecida por atividades maliciosas. Mesmo que o comportamento, por si só, não seja malicioso, é necessário verificar se outros alertas são gerados para esse host. Em caso de dúvidas, pesquise esse host na internet para verificar sua autenticidade."
+        },
+        "IOC-03": {
+            "title": "Uma solicitação de DNS foi feita para {}, marcado como {}.",
+            "description": "O nome de domínio {} visto na captura foi explicitamente marcado como malicioso. Isso indica que o dispositivo provavelmente foi comprometido e precisa ser analisado com cuidado."
+        },
+        "IOC-04": {
+            "title": "Uma solicitação de DNS foi feita para {}, marcado como {}.",
+            "description": "O nome de domínio {} visto na captura foi explicitamente marcado como um Tracker. Isso indica que um dos aplicativos ativos está rastreando sua localização."
+        },
+        "IOC-05": {
+            "title": "Uma solicitação de DNS foi feita para o domínio {}, que é um DNS gratuito.",
+            "description": "O nome de domínio {} está usando um serviço de DNS gratuito. Esse tipo de serviço é comumente usado por cibercriminosos ou agências de inteligência estatais no exercício de suas funções. É muito suspeito que aplicativos em execução em segundo plano usem esse tipo de serviço e isso deve ser analisado com cuidado."
+        },
+        "IOC-06": {
+            "title": "Uma solicitação de DNS foi feita para o domínio {}, que contém um TLD (domínio de nível superior) suspeito.",
+            "description": "O nome de domínio {} está usando um TLD suspeito ({}). Mesmo não sendo malicioso, esse TLD não genérico é frequentemente usado por cibercriminosos ou agências de inteligência estatais. Analise a reputação do domínio pesquisando-o na internet. Se outros alertas forem observados, considere esse host como muito suspeito."
+        },
+        "IOC-07": {
+            "title": "Um certificado associado a atividades de {} foi encontrado na comunicação para {}.",
+            "description": "O certificado ({}) associado a {} foi explicitamente marcado como malicioso. Isso indica que o dispositivo provavelmente foi comprometido e precisa de uma análise forense."
+        },
+        "IOC-08": {
+            "title": "Uma solicitação de HTTP foi feita para {}, marcado como {}.",
+            "description": "O nome de domínio {} visto na captura foi explicitamente marcado como malicioso. Isso indica que o dispositivo provavelmente foi comprometido e precisa ser analisado com cuidado."
+        },
+        "IOC-09": {
+            "title": "Uma solicitação de HTTP foi feita para o domínio {}, que é um DNS gratuito.",
+            "description": "O nome de domínio {} está usando um serviço de DNS gratuito. Esse tipo de serviço é comumente usado por cibercriminosos ou agências de inteligência estatais no exercício de suas funções. É muito suspeito que aplicativos em execução em segundo plano usem esse tipo de serviço e isso deve ser analisado com cuidado."
+        },
+        "IOC-10": {
+            "title": "Uma solicitação de HTTP foi feita para o domínio {}, que contém um TLD (domínio de nível superior) suspeito.",
+            "description": "O nome de domínio {} está usando um TLD suspeito ({}). Mesmo não sendo malicioso, esse TLD não genérico é frequentemente usado por cibercriminosos ou agências de inteligência estatais. Analise a reputação do domínio pesquisando-o na internet. Se outros alertas forem observados, considere esse host como muito suspeito."
+        },
+        "IOC-11": {
+            "title": "Conexão com {} ({}) que é referenciado como um nó TOR.",
+            "description": "O servidor {} é referenciado como um nó na rede de anonimização do TOR. O dispositivo analisado parece estar usando TOR ou se comunicando com um servidor configurado como um nó de entrada ou saída TOR. Alguns atacantes usam o TOR em seus servidores para cobrir seus rastros."
+        },
+        "IOC-12": {
+            "title": "Um aplicativo solicita um serviço legítimo que pode ter um uso duplo",
+            "description": "O servidor {} é usado para fins legítimos. Contudo, alguns atacantes podem usá- lo para interagir com os seus implantes. É aconselhável verificar se o dispositivo analisado contém um aplicativo legítimo que usa esse serviço."
+        },
+        "IOC-13": {
+            "title": "Pelo menos um aplicativo usa consultas DNS criptografadas.",
+            "description": "O servidor DNS over https {} foi contatado durante a captura. Isso parece indicar que pelo menos um aplicativo usa essa técnica para criptografar suas solicitações de DNS. Esse recurso limita os recursos de verificação do SpyGuard. Se esse recurso não estiver ativado no dispositivo analisado, pode valer a pena descobrir qual aplicativo está usando esse método."
+        },
+        "ACT-01": {
+            "title": "O domínio {} está usando um servidor de nomes suspeito ({}).",
+            "description": "O nome de domínio {} está usando um servidor de nomes explicitamente marcado como associado a atividades maliciosas. Muitos cibercriminosos e agentes de inteligência estatais usam esse tipo de registradores porque isso permite pagamentos com criptomoedas e anônimos. É recomendável investigar esse domínio e o aplicativo em execução por meio de uma análise forense do telefone."
+        },
+        "ACT-02": {
+            "title": "O domínio {} foi criado recentemente ({} dias atrás).",
+            "description": "O nome de domínio {} é novo. Mesmo que isso não seja intrinsecamente malicioso, é bastante comum que os invasores configurem uma nova infraestrutura para cada campanha, o que pode levar ao uso de nomes de domínio recém-registrados."
+        },
+        "SSL-01": {
+            "title": "Conexão SSL feita em uma porta não padrão ({}) para {}",
+            "description": "Não é comum ver conexões SSL a partir de dispositivos móveis usando portas não padrão. Mesmo que a conexão pareça ser autêntica, é recomendável analisar a reputação de {} verificando pesquisando na internet o registro de domínio, o sistema autônomo associado e a data de criação."
+        },
+        "SSL-02": {
+            "title": "Uma conexão SSL com {} está usando um certificado gratuito.",
+            "description": "Certificados gratuitos, como o Let's Encrypt, são amplamente usados por servidores de comando e controle associados a arquivos maliciosos ou páginas de phishing. É recomendável analisar o host associado a esse certificado verificando o nome de domínio, a data de criação ou pesquisando sua reputação na internet."
+        },
+        "SSL-03": {
+            "title": "O certificado associado a {} é autoassinado.",
+            "description": "O uso de certificados autoassinados é comum na infraestrutura de invasores. É recomendável analisar o host {} que está associado a esse certificado verificando o nome e o registro de domínio (se houver), a data de criação e sua reputação na internet."
+        },
+        "SSL-04": {
+            "title": "O certificado associado a {} está vinculado a atividades maliciosas ({}).",
+            "description": "O certificado associado ao servidor {} foi explicitamente categorizado como malicioso. Seu dispositivo parece comprometido e precisa ser investigado por uma equipe profissional."
+        },
+        "SSL-05": {
+            "title": "A configuração SSL de {} está ligada à atividade maliciosa ({}).",
+            "description": "O hash JARM {} relacionado ao servidor foi explicitamente associado à atividade maliciosa. Seu dispositivo está possivelmente comprometido e precisa ser investigado por uma equipe profissional."
+        },
+        "ADV-01": {
+            "title": "Verifique os alertas para {}",
+            "description": "Verifique a reputação do host {}, este parece ser malicioso, pois acionou alertas para {} durante a sessão."
+        },
+        "SNORT-01": {
+            "title": "Regra do Suricata acionada: {}",
+            "description": "Uma regra de detecção de rede foi acionada. É provável que o dispositivo tenha sido comprometido ou apresente comportamento suspeito."
+        }
+    },
+    "report": {
+        "numbers": [
+            "um",
+            "dois",
+            "três",
+            "quatro",
+            "cinco",
+            "seis",
+            "sete",
+            "oito",
+            "nove"
+        ],
+        "suspect_title": "Comunicações suspeitas",
+        "uncat_title": "Comunicações não categorizadas",
+        "whitelist_title": "Comunicações permitidas",
+        "protocol": "Protocolo",
+        "domain": "Domínio",
+        "dst_ip": "Endereço IP do dst",
+        "dst_port": "Número da porta do dst",
+        "device_mac": "Endereço MAC do dispositivo",
+        "report_generated_on": "Relatório criado em",
+        "capture_duration": "Duração da captura",
+        "packets_number": "Número de pacotes",
+        "capture_sha1": "Captura SHA1",
+        "report_for_the_capture": "Relatório da captura",
+        "report_footer": "Este relatório foi gerado automaticamente por um dispositivo SpyGuard. Em caso de dúvidas, relatório de erros ou comentários, envie uma mensagem para contact@spyguard.io.",
+        "high_msg": "O dispositivo parece estar comprometido porque você tem {} alerta(s) crítico(s).",
+        "moderate_msg": "Você tem {} alerta(s) moderado(s), seu dispositivo pode estar comprometido. Analise-os com cuidado.",
+        "low_msg": "Você tem apenas {} alerta(s) leve(s), não deixe de verificá-los.",
+        "none_msg": "Tudo parece estar bem, zero alertas. Não deixe de verificar comunicações não categorizadas, se houver.",
+        "detection_methods": "Métodos de detecção",
+        "analysis_duration": "Tempo de análise",
+        "instance_uuid": "Instância do SpyGuard",
+        "seconds": "segunda(s)"
+    }
+}

analysis/locales/ru.json

@@ -0,0 +1,147 @@
+{
+    "alerts": {
+        "PROTO-01": {
+            "title": "Обнаружено подключение {}, ведущее за пределы локальной сети к {}.",
+            "description": "Протокол {} обычно используется во внутренних сетях. Проверьте, выдавало ли устройство {} другие предупреждения, которые могут свидетельствовать о вредоносной активности."
+        },
+        "PROTO-02": {
+            "title": "Подключение {} к {} установлено на порте, равном или более {}.",
+            "description": "Обнаружено {} подключений к {} с использованием порта {}. Использование нестандартного порта иногда может свидетельствовать о вредоносной активности. Рекомендуется проверить репутацию этого устройства, просмотрев другие предупреждения и выполнив их поиск в интернете."
+        },
+        "PROTO-03": {
+            "title": "Установлено HTTP-подключение к устройству {}",
+            "description": "Ваше устройство обменивается данными с устройством {} по незашифрованному протоколу HTTP. Даже если такое поведение само по себе не является вредоносным, фоновое исходящее HTTP-подключение является нетипичным для приложений, работающих на смартфоне в фоновом режиме. Проверьте репутацию устройства, выполнив поиск в интернете."
+        },
+        "PROTO-04": {
+            "title": "Установлено HTTP-подключение к устройству {} через нестандартный порт ({}).",
+            "description": "Ваше устройство обменивается данными с устройством {} по незашифрованному протоколу HTTP через порт {}. Такое поведение является нетипичным. Проверьте репутацию устройства, выполнив поиск в интернете."
+        },
+        "PROTO-05": {
+            "title": "Сервер {} не разрешался никакими DNS-запросами во время сеанса",
+            "description": "Это, вероятно, означает, что сервер {} не разрешен ни одним доменным именем или разрешение уже кешировано устройством. Если устройство фигурирует в других предупреждениях, проверьте его."
+        },
+        "IOC-01": {
+            "title": "Установлено соединение с {} ({}), отмеченным как {}.",
+            "description": "Устройство {} было явно занесено в черный список за выполнение вредоносных действий. Ваше устройство, вероятно, взломано. Требуется более тщательное расследование специалистами по IT-безопасности."
+        },
+        "IOC-02": {
+            "title": "Подключение к {}, отмеченному как {}, в рамках бесклассовой адресации {}.",
+            "description": "Сервер {} размещен в сети, в которой размещаются объекты, выполняющие вредоносные действия. Даже если такое поведение само по себе не является вредоносным, необходимо проверить, не упоминается ли это устройство в других предупреждениях. При наличии сомнений выполните поиск этого устройства в интернете и выясните, является ли его поведение легитимным."
+        },
+        "IOC-03": {
+            "title": "Выполнен DNS-запрос к {}, отмеченному как {}.",
+            "description": "Доменное имя {}, обнаруженное при сборе данных, явно отмечено как вредоносное. Это указывает на то, что ваше устройство, вероятно, взломано и требуется тщательное расследование."
+        },
+        "IOC-04": {
+            "title": "Выполнен DNS-запрос к {}, отмеченному как {}.",
+            "description": "Доменное имя {}, обнаруженное при сборе данных, явно отмечено как геотрекер. Это указывает, что одно из активных приложений отслеживает ваши перемещения."
+        },
+        "IOC-05": {
+            "title": "Выполнен DNS-запрос к домену {}, использующему бесплатную службу DNS.",
+            "description": "Доменное имя {} использует бесплатную службу DNS. Такие службы обычно используются киберпреступниками или спонсируемыми государством злоумышленниками для атак. Очень подозрительно, что приложение, работающее в фоновом режиме, использует такую службу. Требуется расследование."
+        },
+        "IOC-06": {
+            "title": "Выполнен DNS-запрос к домену {}, содержащему подозрительный домен верхнего уровня.",
+            "description": "Доменное имя {} использует подозрительный домен верхнего уровня ({}). Даже не являясь вредоносным, этот не универсальный домен верхнего уровня регулярно используется киберпреступниками или спонсируемыми государством злоумышленниками. Проверьте этот домен, выполнив поиск в интернете. Если с этим устройством связаны другие предупреждения, это очень подозрительно."
+        },
+        "IOC-07": {
+            "title": "Сертификат, связанный с действиями {}, был обнаружен при взаимодействии с {}.",
+            "description": "Сертификат ({}), связанный с {}, явно отмечен как вредоносный. Это указывает на то, что ваше устройство, вероятно, взломано и требуется провести экспертный анализ."
+        },
+        "IOC-08": {
+            "title": "Выполнен HTTP-запрос к {}, отмеченному как {}.",
+            "description": "Доменное имя {}, обнаруженное при сборе данных, явно отмечено как вредоносное. Это указывает на то, что ваше устройство, вероятно, взломано и требуется тщательное расследование."
+        },
+        "IOC-09": {
+            "title": "Выполнен HTTP-запрос к домену {}, использующему бесплатную службу DNS.",
+            "description": "Доменное имя {} использует бесплатную службу DNS. Такие службы обычно используются киберпреступниками или спонсируемыми государством злоумышленниками для атак. Очень подозрительно, что приложение, работающее в фоновом режиме, использует такую службу. Требуется расследование."
+        },
+        "IOC-10": {
+            "title": "Выполнен HTTP-запрос к домену {}, содержащему подозрительный домен верхнего уровня.",
+            "description": "Доменное имя {} использует подозрительный домен верхнего уровня ({}). Даже не являясь вредоносным, этот не универсальный домен верхнего уровня регулярно используется киберпреступниками или спонсируемыми государством злоумышленниками. Проверьте этот домен, выполнив поиск в интернете. Если с этим устройством связаны другие предупреждения, это очень подозрительно."
+        },
+        "IOC-11": {
+            "title": "Соединение с {} ({}), которое упоминается как узел TOR.",
+            "description": "На сервер {} ссылаются как на узел в сети анонимизации TOR. Анализируемое устройство, по-видимому, использует TOR или взаимодействует с сервером, настроенным как входной или выходной узел TOR. Некоторые злоумышленники используют TOR на своих серверах, чтобы замести следы."
+        },
+        "IOC-12": {
+            "title": "заявка запрашивает законную услугу, которая может иметь двойное назначение .",
+            "description": "Сервер {} используется в законных целях. Однако некоторые злоумышленники могут использовать его для взаимодействия со своими имплантатами. Рекомендуется проверить, что анализируемое устройство содержит законное приложение, которое использует эту службу."
+        },
+        "IOC-13": {
+            "title": "По крайней мере одно приложение использует зашифрованные DNS запросы",
+            "description": "Во время захвата был установлен контакт с DNS через сервер HTPs {}. Это, кажется, указывает на то, что по крайней мере одно приложение использует эту технику для шифрования своих DNS-запросов. Эта функция ограничивает возможности сканирования SpyGuard. Если эта функция не включена на анализируемом устройстве, возможно, стоит выяснить, какое приложение использует этот метод."
+        },
+        "ACT-01": {
+            "title": "Домен {} использует подозрительный сервер имен ({}).",
+            "description": "Доменное имя {} использует сервер имен, который явно отмечен как связанный с вредоносными действиями. Многие киберпреступники и спонсируемые государством злоумышленники пользуются такими регистраторами, поскольку они позволяют использовать криптовалюту и анонимные платежи. Рекомендуется исследовать этот домен и связанные с ним работающие приложения, выполнив экспертный анализ телефона."
+        },
+        "ACT-02": {
+            "title": "Домен {} был создан недавно ({} дней назад).",
+            "description": "Доменное имя {} новое. Даже это не является вредоносным по своей сути, злоумышленники довольно часто создают новую инфраструктуру для каждой кампании атаки, что может привести к использованию недавно зарегистрированных доменных имен."
+        },
+        "SSL-01": {
+            "title": "SSL-подключение к {} выполнено через нестандартный порт ({})",
+            "description": "SSL-подключение со смартфонов с использованием нестандартных портов является нетипичным. Даже если это действие является абсолютно легитимным, рекомендуется проверить репутацию {}, просмотрев его запись WHOIS, связанную автономную систему, дату создания, а также выполнив поиск в интернете."
+        },
+        "SSL-02": {
+            "title": "SSL-подключение к {} использует бесплатный сертификат.",
+            "description": "Бесплатные сертификаты, такие как Let's Encrypt, широко используются командными серверами, связанными со встраиваемым вредоносным кодом или фишинговыми веб-страницами. Рекомендуется проверить устройство, связанное с этим сертификатом, изучив его доменное имя, дату создания и репутацию в интернете."
+        },
+        "SSL-03": {
+            "title": "Сертификат, связанный с {}, является самоподписанным.",
+            "description": "Использование самоподписанных сертификатов типично для инфраструктуры злоумышленников. Рекомендуется проверить устройство {}, связанное с этим сертификатом, изучив его доменное имя (если имеется), запись WHOIS, дату создания и репутацию в интернете."
+        },
+        "SSL-04": {
+            "title": "Сертификат, связанный с {} связан с вредоносной деятельностью ({})",
+            "description": "Сертификат, связанный с сервером {} был явно классифицирован как вредоносный. Ваше устройство выглядит скомпрометированным и нуждается в дальнейшем исследовании профессиональной командой."
+        },
+        "SSL-05": {
+            "title": "Конфигурация SSL {} связана с вредоносной деятельностью ({}).",
+            "description": "Связанный с сервером хэш JARM {} был явно связан с вредоносной деятельностью. Ваше устройство, возможно, скомпрометировано и нуждается в дальнейшем расследовании профессиональной командой."
+        },
+        "ADV-01": {
+            "title": "Проверьте предупреждения для {}",
+            "description": "Проверьте репутацию устройства {}. Оно кажется вредоносным, поскольку для него сработало {} предупрежд. во время сеанса."
+        },
+        "SNORT-01": {
+            "title": "Сработало правило Suricata: {}",
+            "description": "Сработало правило обнаружения в сети. Вероятно, ваше устройство взломано или ведет себя подозрительно."
+        }
+    },
+    "report": {
+        "numbers": [
+            "один",
+            "два",
+            "три",
+            "четыре",
+            "пять",
+            "шесть",
+            "семь",
+            "восемь",
+            "девять"
+        ],
+        "suspect_title": "Подозрительные подключения",
+        "uncat_title": "Неклассифицированные подключения",
+        "whitelist_title": "Разрешенные подключения",
+        "protocol": "Протокол",
+        "domain": "Домен",
+        "dst_ip": "IP-адрес назначения",
+        "dst_port": "Номер порта назначения",
+        "device_mac": "MAC-адрес устройства",
+        "report_generated_on": "Дата формирования отчета",
+        "capture_duration": "Продолжительность сбора данных",
+        "packets_number": "Количество пакетов",
+        "capture_sha1": "Сбор данных SHA1",
+        "report_for_the_capture": "Отчет для сбора данных",
+        "report_footer": "Этот отчет был автоматически сформирован устройством SpyGuard. С любыми вопросами, сообщениями об ошибках или отзывами обращайтесь по адресу contact@spyguard.io.",
+        "high_msg": "Вероятно, ваше устройство взломано, поскольку у вас {} предупрежд. высокого уровня.",
+        "moderate_msg": "У вас {} предупрежд. среднего уровня. Возможно, ваше устройство взломано. Внимательно изучите их.",
+        "low_msg": "У вас {} предупрежд. низкого уровня, проверьте их.",
+        "none_msg": "Предупреждения отсутствуют, система выглядит защищенной. Не забывайте проверять неклассифицированные подключения, если они имеются.",
+        "detection_methods": "Mетоды обнаружения",
+        "analysis_duration": "Время анализа",
+        "instance_uuid": "SpyGuard Экземпляр",
+        "seconds": "секунды"
+    }
+}

analysis/utils.py

@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+import sqlite3
+import datetime
+import yaml
+import sys
+import json
+import os
+from functools import reduce
+
+# I'm not going to use an ORM for that.
+parent = os.path.split(os.path.dirname(os.path.abspath(sys.argv[0])))[0]
+conn = sqlite3.connect(os.path.join(parent, "database.sqlite3"))
+cursor = conn.cursor()
+
+
+def get_iocs(ioc_type):
+    """
+        Get a list of IOCs specified by their type.
+        :return: list of IOCs
+    """
+    cursor.execute(
+        "SELECT value, tag FROM iocs WHERE type = ? ORDER BY value", (ioc_type,))
+    res = cursor.fetchall()
+    return [[r[0], r[1]] for r in res] if res is not None else []
+
+
+def get_whitelist(elem_type):
+    """
+        Get a list of whitelisted elements specified by their type.
+        :return: list of elements
+    """
+    cursor.execute(
+        "SELECT element FROM whitelist WHERE type = ? ORDER BY element", (elem_type,))
+    res = cursor.fetchall()
+    return [r[0] for r in res] if res is not None else []
+
+
+def get_config(path):
+    """
+        Read a value from the configuration
+        :return: value (it can be any type)
+    """
+    config = yaml.load(open(os.path.join(parent, "config.yaml"),
+                            "r"), Loader=yaml.SafeLoader)
+    return reduce(dict.get, path, config)
+
+
+def get_device(token):
+    """
+        Read the device configuration from device.json file.
+        :return: dict - the device configuration
+    """
+    try:
+        with open("/tmp/{}/device.json".format(token), "r") as f:
+            return json.load(f)
+    except:
+        pass
+
+
+def get_apname():
+    """
+        Read the current name of the Access Point from
+        the hostapd configuration file
+        :return: str - the AP name
+    """
+    try:
+        with open("/tmp/hostapd.conf", "r") as f:
+            for l in f.readlines():
+                if "ssid=" in l:
+                    return l.replace("ssid=", "").strip()
+    except:
+        pass