geekscrapy

IOC deception difficulty

Playing with the idea to feed into other attribution tools. Calulates the difficulty to deceive given an IOC type.

IOC type	Overall difficulty	Trivial (1)	Medium (2)	Hard (3)
IP	2	VPN hosting provider e.g. rentable IP space. Has many ports exposed	Bastian host few ports exposed. Contained within a company which has few security function


	# fields = ordered list of sorting fields
	# obs = an iterator of objects where fields are present (fields MUST exist)
	# order_desc = Sort descending(false)
	# ignore_case = put field vales to lowercase, generates less overlap
	# top_count = return the top X
	def histo(fields, obs, order_desc=True, ignore_case=False, top_count=None):

	master = []

	import lief, os, sys

	path = sys.argv[1]
	fnames = os.listdir(path)

	for f in fnames:

	print('****** : {}{}'.format(path, f))

	exebin = lief.parse(filepath=path+f)

	# https://github.com/daringjoker/Assembly-refrence
	# Copy data_dict = {"AAA": {"Instruction...

	data_dict = {"AAA": {"Instruction...

	def pretty(d, indent=0):
	for key, value in d.items():
	print('\t' * indent + str(key))
	if isinstance(value, dict):
	pretty(value, indent+1)

	from visidata import *

	option(name='delta_timedelta', default='days=1', helpstr='delta between date columns. This should be in the timedelta kwarg format such as days=1, or hours=3')
	option(name='delta_nocase', default=True, helpstr='compare keycol strings ignoring case')
	option(name='delta_round_timedelta', default=True, helpstr='draw a line where the time delta is rounded down. The delta will be rounded down')
	option(name='delta_int', default=0, helpstr='delta between integers/floats for cpmparison')
	option(name='delta_nKeyCols', default=-1, helpstr='number of keyColumns to compare. -1 is all')

	theme('color_delta', 'underline', 'color of a row which is different to the one below')