Usage
This page describes the various features of this project.
Run analysis with one observable
corcli -d google.com
corcli -u https://google.com
corcli -i 1.1.1.1
corcli -ha 8ED4B4ED952526D89899E723F3488DE4
corcli -m samurai@arasaka.io
corcli -f ~/case78/suspicious.eml
Information
- The observables will be submitted as TLP:AMBER and PAP:AMBER by default.
- You can select one or more analysers using the selector or the aliases.
corcli
will display by default the summary reports of the jobs:
$ corcli -cf corcli.toml -d google.com -a doh
Analysis in progress for google.com ....
---
Result for analyzer GoogleDNS_resolve_1_0_0:
- info / GoogleDNS:RecordsCount="30"
Warning
Do not be fooled if the summary is empty for some analysers. For instance, the URLhaus_2_0
analyser does not provide a summary report when a hit is positive but instead use -e option to extract the observables.
Run analysis with multiple observables (bulk)
The bulk feature has the ability to submit to Cortex all observables contained in a file line by line. For instance, the hashes contained in hash.txt
will be checked against CIRCL's hashlookup and VirusTotal.
corcli -b hash.txt
corcli -b hash.txt -a hashlookup -a vt
Display extracted artifacts
Display only the result of the extracted artifacts. Simply use the option -e
. For instance, you can list the URLs or domain names extracted by FileInfo
out of a malicious MS Office document.
corcli -f ~/eml/maldoc.xls -a fileinfo -e
corcli -b hash.txt -a hashlookup -a vt -e
Example
Output should be like:
$ corcli -cf corcli.toml -u <URL> -e
No alias selected. Going to selector...
[?] Select one or multiple analysers:
◯ GoogleSafebrowsing_2_0
❯ ◉ URLhaus_2_0
◯ Urlscan_io_Search_0_1_1
Analysis in progress for <URL> ....
---
Result for analyzer URLhaus_2_0:
- [hash]: fb8ae5afbca62ae62460f62e34b1ee5b
- [url]: https://urlhaus-api.abuse.ch/v1/download/1c513007d30a3f3ab3afc3bcad825ddad14da7251de2d7df6b5ff627dd568ff9/
- [hash]: 1c513007d30a3f3ab3afc3bcad825ddad14da7251de2d7df6b5ff627dd568ff9
- [url]: https://urlhaus-api.abuse.ch/v1/download/be2ce0c619189917669d61d19e767702cf4c5e8da173a91a02342a2fe9958a9e/
- [hash]: eac675648aa4f47ebc7ebec3b093699c
- [url]: https://urlhaus-api.abuse.ch/v1/download/d689433260877df317a4627388481fc391380ea7056805b0edc9d5f140333a65/
- [hash]: d689433260877df317a4627388481fc391380ea7056805b0edc9d5f140333a65
- [hash]: 27aa481dc427fee7f30c8632539a785f
- [hash]: be2ce0c619189917669d61d19e767702cf4c5e8da173a91a02342a2fe9958a9e
- [url]: https://urlhaus-api.abuse.ch/v1/download/723ab6d0ccf063714557018bc6f2b06bae854143599b23971b476ebc985d94b5/
Download a file attachment
You can download files extracted by Cortex. Use the option -df
to download an attachment for instance.
corcli -f ./suspicious.eml -e eml -df
Information
- The files will be dropped in the current file path.
- The files will be zip password-protected with
malware
.
Use another Cortex instance
You can use another Cortex instance included in your configuration file or by entering the URL.
corcli -f ./suspicious.eml -e eml -ci dui
corcli -d google.com -c https://pain.local
Information
Using the option -ci
we set precise the cortex instance name stated in the configuration file. For instance : [cortex-instance.dev]