shell script for exe/rar

exe-detect-shell/detect-exe-rar.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+scriptpath=/usr/local/bro/logs
+outpath=/usr/local/bro/scripts/http
+
+# search http.log for the following file types and make sure they are not in the ignore url list
+# if you wish to white list a domain, add it to the ignore_url list
+grep -E "application/x-rar-compressed|application/x-executable|application/x-dosexec" $scriptpath/current/http.log | grep -vE -f $outpath/ignore_url > $outpath/exe_urls
+# gawk the time and change it to human readable
+grep -vE -f $outpath/detected $outpath/exe_urls | gawk '{$1=strftime("%c",$1)} {print $1 " - " $9 " - " $10}' > $outpath/final
+# set out as var.
+out=$outpath/final
+# go through list and send you an email 
+if [[ -s $out ]] ; then
+cat - $outpath/final << EOF | /usr/sbin/sendmail -t
+TO:you@yourplace.com
+FROM:Bro@bro.com
+SUBJECT: Executeable and RAR downloaded
+
+EOF
+# add to detected, this is so you won't alert on ones that you have already been emailed about
+# I log the epoch timestamp in the detected file.
+cat $outpath/exe_urls | awk '{print $1}' >> $outpath/detected
+# sort the detected, so that when you compare there will be no errors
+sort -u $outpath/detected > $outpath/temp123
+mv $outpath/temp123 $outpath/detected
+#clean up
+rm $outpath/final
+
+else
+#clean up
+rm $outpath/final
+fi ;

exe-detect-shell/detected.txt

@@ -0,0 +1,33 @@
+1333468858.729128
+1333474757.383710
+1333477108.622698
+1333477109.060468
+1333477141.585073
+1333477153.558739
+1333478058.323574
+1333479160.769022
+1333479290.767940
+1333481554.580217
+1333481911.928482
+1333494311.880608
+1333543713.306489
+1333543982.102409
+1333545670.381191
+1333549590.900500
+1333549683.292319
+1333549879.526497
+1333556218.433454
+1333556279.879306
+1333556325.209982
+1333556325.240037
+1333560942.681424
+1333561687.642802
+1333569752.752920
+1333572861.544529
+1333577509.624219
+1333577893.106340
+1333578177.120778
+1333628286.686692
+1333628406.575427
+1333628690.129576
+1333628798.635300

exe-detect-shell/ignore_url.txt

@@ -0,0 +1,34 @@
+sun.com
+dell.com
+ati.com
+adobe.com
+apple.com
+download.windowsupdate.com
+swtor.com
+pack.google.com
+upgrade.spotify.com
+aol.com
+microsoft.com
+macromedia.com
+nvidia.com
+avg.com
+symantecliveupdate.com
+securityresponse.symantec.com
+download.tuxfamily.org
+cdn.wacom.com
+download.oracle.com
+ninite.com
+apnmedia.ask.com
+swp.zenimax.com
+dl.google.com
+wholetomato.com
+dist.divx.com
+eveonline.com
+lookeen.net
+topogun.com
+mozilla.cdn.leaseweb.com
+downloadmirror.intel.com
+fraps.com
+backups.smartbear.s3.amazonaws.com
+software-files-a.cnet.com
+download.spotify.com