maximelb

import limacharlie
import json
import tempfile
import os
import shutil
import shlex
import subprocess

########################################################
# Setting This Up

maximelb

import limacharlie

# The is_interactive allows us to do sensor.simpleRequest() calls
# and get the response inline in this script.
lc = limacharlie.Manager( is_interactive = True, inv_id = "init-artifact-col" )

for sensor in lc.sensors():
  # If a sensor is offline, we'll just skip it.
  if not sensor.isOnline():
    print( "skipping %s since it's not online" % ( sensor.sid, ) )

maximelb

import limacharlie

OID = ""
KEY = ""

lc = limacharlie.Manager( oid = OID, secret_api_key = KEY, is_interactive = True, inv_id = "simple_commands" )

for sensor in lc.sensors():
    if not sensor.isOnline():

maximelb

op: ends with
event: NEW_PROCESS
path: event/FILE_PATH
value: excel.exe
case sensitive: false
with descendant:
    op: is
    event: NETWORK_CONNECTIONS
    path: event/NETWORK_ACTIVITY/IS_OUTGOING
    value: 1

maximelb

op: ends with
event: NEW_PROCESS
path: event/FILE_PATH
value: excel.exe
case sensitive: false
with descendant:
    op: is
    event: NETWORK_CONNECTIONS
    path: event/NETWORK_ACTIVITY/DESTINATION/PORT
    value: 22

maximelb

import limacharlie

OID = ""
KEY = ""

DEVICE_TAG_PREFIX = "dev_"
TAG_FOR_SECONDS = 60 * 60 * 24 * 365 * 10 # Just tag for 10y for now.

lc = limacharlie.Manager( oid = OID, secret_api_key = KEY, is_interactive = True, inv_id = "dev_tagging" )