Cuckoo

本文說明如何將 Cuckoo 與 Google Security Operations 整合。

在 Google Security Operations 中設定 Cuckoo 整合

使用 CA 憑證設定 Cuckoo 整合

如有需要，您可以透過 CA 憑證檔案驗證連線。

開始之前，請確認下列事項：

  • CA 憑證檔案
  • 最新版 Cuckoo 整合功能

如要設定與 CA 憑證的整合，請完成下列步驟：

  1. 將 CA 憑證檔案剖析為 Base64 字串。
  2. 開啟整合設定參數頁面。
  3. 將字串插入「CA Certificate File」欄位。
  4. 如要測試整合項目是否設定成功，請選取「驗證 SSL」核取方塊，然後按一下「測試」。

在 Google SecOps 中設定 Cuckoo 整合

請參閱這篇說明文章，瞭解在 Google SecOps 中設定整合功能的詳細操作說明。

整合參數

請使用下列參數設定整合：

參數顯示名稱 類型 預設值 為必填項目 說明
執行個體名稱 字串 不適用 否 您要設定整合的執行個體名稱。
說明 字串 不適用 否 執行個體的說明。
API 根目錄 字串 http://x.x.x.x:8090 是 Cuckoo 執行個體的位址。
網頁介面地址 字串 http://x.x.x.x:8000 是 Cuckoo Web UI 執行個體的位址。
警告門檻 整數 5.0 是 不適用
CA 憑證檔案 字串 不適用 否 不適用
驗證 SSL 核取方塊 已取消勾選 否 如果 Cuckoo 連線需要 SSL 驗證，請勾選這個核取方塊。
遠端執行 核取方塊 已取消勾選 否

勾選這個欄位，即可遠端執行設定的整合項目。

勾選後，系統會顯示選取遠端使用者 (服務專員) 的選項。
API 權杖 密碼 不適用 否 整合的 API 權杖。

動作

引爆檔案

說明

提交檔案以供分析並取得報告，也稱為非同步。

參數

參數顯示名稱 類型 預設值 為必填項目 說明
檔案路徑 字串 不適用 是 要提交的檔案路徑。

執行日期

這項操作會對所有實體執行。

動作執行結果

指令碼執行結果
指令碼結果名稱 價值選項 範例
max_score 不適用 不適用
JSON 結果
{
    "powershell8693919272434274241.ps1": {
        "info": {
            "category": "file",
            "added": 1547640117.991152,
            "monitor": "22c39cbb35f4d916477b47453673bc50bcd0df09",
            "package": "ps1",
            "started": 1547640190.471362,
            "route": "internet",
            "custom": null,
            "machine": {
                "status": "stopped",
                "shutdown_on": "2019-01-16 12:28:55",
                "started_on": "2019-01-16 12:03:16",
                "manager": "VirtualBox",
                "label": "win7x6427",
                "name": "win7x6427"
            },
            "ended": 1547641736.394026,
            "score": 6.6,
            "platform": "windows",
            "version": "2.0.6",
            "owner": null,
            "git": {
                "head": "03731c4c136532389e93239ac6c3ad38441f81a7",
                "fetch_head": "03731c4c136532389e93239ac6c3ad38441f81a7"
            },
            "options": "procmemdump=yes,route=internet",
            "id": 889621,
            "duration": 1545
        },
        "signatures":
        [{
            "families": [],
            "description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
            "name": "network_cnc_http",
            "markcount": 1,
            "references": [],
            "marks":
            [{
                "suspicious_features": "Connection to IP address",
                "type": "generic",
                "suspicious_request": "GET http://1.1.1.1:8080/"
            }],
            "severity": 2
        }, {
            "families": [],
            "description": "Connects to smtp.live.com, possibly for spamming or data exfiltration",
            "name": "smtp_live",
            "markcount": 1,
            "references": [],
            "marks":
            [{
                "category": "domain",
                "type": "ioc",
                "ioc": "smtp.live.com",
                "description": null
            }],
            "severity": 2
        }, {
            "families": [],
            "description": "Connects to smtp.mail.yahoo.com, possibly for spamming or data exfiltration",
            "name": "smtp_yahoo",
            "markcount": 1,
            "references": [],
            "marks":
            [{
                "category": "domain",
                "type": "ioc",
                "ioc": "smtp.mail.yahoo.com",
                "description": null
            }],
            "severity": 2
        }]
    }
}

引爆網址

說明

傳送要分析的網址並取得報告，也稱為非同步。

參數

不適用

執行日期

這項動作會對網址實體執行。

動作執行結果

指令碼執行結果
指令碼結果名稱 價值選項 範例
is_success True/False is_success:False
JSON 結果
[
    {
        "EntityResult": {
            "info": {
                "category": "url",
                "git": {
                    "head": "03731c4c136532389e93239ac6c3ad38441f81a7",
                    "fetch_head": "03731c4c136532389e93239ac6c3ad38441f81a7"
                },
                "monitor": "22c39cbb35f4d916477b47453673bc50bcd0df09",
                "package": "ie",
                "started": null,
                "route": "internet",
                "custom": null,
                "machine": {
                    "status": "stopped",
                    "shutdown_on": "2019-01-16 13:14:26",
                    "label": "win7x6412",
                    "manager": "VirtualBox",
                    "started_on": "2019-01-16 12:48:54",
                    "name": "win7x6412"
                },
                "ended": 1547644467.207864,
                "added": null,
                "id": 889669,
                "platform": null,
                "version": "2.0.6",
                "owner": null,
                "score": 4.4,
                "options": "procmemdump=yes,route=internet",
                "duration": null
            },
            "signatures": [{
                "families": [],
                "description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
                "name": "network_cnc_http",
                "markcount": 1,
                "references": [],
                "marks": [{
                    "suspicious_features": "Connection to IP address",
                    "type": "generic",
                    "suspicious_request": "GET http://1.1.1.1:8080/"
                }],
                "severity": 2
            }, {
                "families": [],
                "description": "Performs some HTTP requests",
                "name": "network_http",
                "markcount": 9,
                "references": [],
                "marks": [{
                    "category": "request",
                    "ioc": "GET http://crl.microsoft.com/pki/crl/products/WinPCA.crl",
                    "type": "ioc",
                    "description": null
                }, {
                    "category": "request",
                    "ioc": "GET http://www.microsoft.com/pki/crl/products/WinPCA.crl",
                    "type": "ioc",
                    "description": null
                }, {
                    "category": "request",
                    "ioc": "GET http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
                    "type": "ioc",
                    "description": null
                }],
                "severity": 2
            }, {
                "families": [],
                "description": "Communicates with host for which no DNS query was performed",
                "name": "nolookup_communication",
                "markcount": 11,
                "references": [],
                "marks": [{
                    "host": "1.1.1.1",
                    "type": "generic"
                }, {
                    "host": "1.1.1.1",
                    "type": "generic"
                }, {
                    "host": "1.1.1.1",
                    "type": "generic"
                }],
                "severity": 3
            }]},
        "Entity": "http://digi.ba/eng/#pgc-56-0-0"
    }
]
實體擴充

如果分數超過門檻，實體會標示為可疑 (True)。否則為 False。

補充資料欄位名稱 邏輯 - 適用時機
Cuckoo_Score 不適用
task_id 不適用

取得報告

說明

依 ID (也稱為非同步) 取得特定工作的報表。

參數

參數顯示名稱 類型 預設值 為必填項目 說明
工作 ID 字串 不適用 是

工作 ID。

範例：10

執行日期

這項操作會對所有實體執行。

動作執行結果

指令碼執行結果
指令碼結果名稱 價值選項 範例
分數 不適用 不適用
JSON 結果
{
    "info": {
        "category": "file",
        "added": 1547640117.991152,
        "monitor": "22c39cbb35f4d916477b47453673bc50bcd0df09",
        "package": "ps1",
        "started": 1547640190.471362,
        "route": "internet",
        "custom": null,
        "machine": {
            "status": "stopped",
            "shutdown_on": "2019-01-16 12:28:55",
            "started_on": "2019-01-16 12:03:16",
            "manager": "VirtualBox",
            "label": "win7x6427",
            "name": "win7x6427"
        },
        "ended": 1547641736.394026,
        "score": 6.6,
        "platform": "windows",
        "version": "2.0.6",
        "owner": null,
        "git": {
            "head": "03731c4c136532389e93239ac6c3ad38441f81a7",
            "fetch_head": "03731c4c136532389e93239ac6c3ad38441f81a7"
        },
        "options": "procmemdump=yes,route=internet",
        "id": 889621,
        "duration": 1545
    },
    "signatures": [{
        "families": [],
        "description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
        "name": "network_cnc_http",
        "markcount": 1,
        "references": [],
        "marks": [{
            "suspicious_features": "Connection to IP address",
            "type": "generic",
            "suspicious_request": "GET http://1.1.1.1:8080/"
        }],
        "severity": 2
    }, {
        "families": [],
        "description": "Connects to smtp.live.com, possibly for spamming or data exfiltration",
        "name": "smtp_live",
        "markcount": 1,
        "references": [],
        "marks": [{
            "category": "domain",
            "type": "ioc",
            "ioc": "smtp.live.com",
            "description": null
        }],
        "severity": 2
    }, {
        "families": [],
        "description": "Connects to smtp.mail.yahoo.com, possibly for spamming or data exfiltration",
        "name": "smtp_yahoo",
        "markcount": 1,
        "references": [],
        "marks": [{
            "category": "domain",
            "type": "ioc",
            "ioc": "smtp.mail.yahoo.com",
            "description": null
        }],
        "severity": 2
    }]
}

乒乓

說明

測試連線。

參數

不適用

執行日期

這項操作會對所有實體執行。

動作執行結果

指令碼執行結果
指令碼結果名稱 價值選項 範例
is_success True/False is_success:False

還有其他問題嗎？向社群成員和 Google SecOps 專業人員尋求答案。