/
detect-suspicious-orig.zeek
52 lines (45 loc) · 1.36 KB
/
detect-suspicious-orig.zeek
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
@load base/frameworks/notice/main
@load base/protocols/smtp/main
module SMTP;
export {
redef enum Notice::Type += {
Suspicious_Origination
};
## Places where it's suspicious for mail to originate from represented
## as all-capital, two character country codes (e.g., US). It requires
## Zeek to be built with GeoIP support.
option suspicious_origination_countries: set[string] = {};
option suspicious_origination_networks: set[subnet] = {};
}
event log_smtp(rec: Info)
{
local ip: addr;
local loc: geo_location;
if ( rec?$x_originating_ip )
{
ip = rec$x_originating_ip;
loc = lookup_location(ip);
if ( (loc?$country_code &&
loc$country_code in suspicious_origination_countries) ||
ip in suspicious_origination_networks )
{
NOTICE([$note=Suspicious_Origination,
$msg=fmt("An email originated from %s (%s).",
loc?$country_code ? loc$country_code : "", ip),
$id=rec$id]);
}
}
if ( rec?$path )
{
ip = rec$path[|rec$path|-1];
loc = lookup_location(ip);
if ( (loc?$country_code &&
loc$country_code in suspicious_origination_countries) ||
ip in suspicious_origination_networks )
{
NOTICE([$note=Suspicious_Origination,
$msg=fmt("Based up Received headers, email originated from %s (%s).", loc?$country_code ? loc$country_code : "", ip),
$id=rec$id]);
}
}
}