diff --git a/analyzers/EmlParser/parse.py b/analyzers/EmlParser/parse.py index 0934aaca6..981ed902e 100755 --- a/analyzers/EmlParser/parse.py +++ b/analyzers/EmlParser/parse.py @@ -8,6 +8,7 @@ import hashlib import base64 from pprint import pprint +import iocextract class EmlParserAnalyzer(Analyzer): @@ -43,6 +44,26 @@ def summary(self, raw): return {"taxonomies": taxonomies} + def artifacts(self, raw): + artifacts = [] + urls = list(iocextract.extract_urls(str(raw))) + ipv4s = list(iocextract.extract_ipv4s(str(raw))) + mail_addresses = list(iocextract.extract_emails(str(raw))) + hashes = list(iocextract.extract_hashes(str(raw))) + + if urls: + for u in urls: + artifacts.append(self.build_artifact('url',str(u))) + if ipv4s: + for i in ipv4s: + artifacts.append(self.build_artifact('ip',str(i))) + if mail_addresses: + for e in mail_addresses: + artifacts.append(self.build_artifact('mail',str(e))) + if hashes: + for h in hashes: + artifacts.append(self.build_artifact('hash',str(h))) + return artifacts def parseEml(filepath): diff --git a/analyzers/EmlParser/requirements.txt b/analyzers/EmlParser/requirements.txt index f1b90baeb..b23ebd9b8 100644 --- a/analyzers/EmlParser/requirements.txt +++ b/analyzers/EmlParser/requirements.txt @@ -1,3 +1,4 @@ cortexutils;python_version>='3.5' eml_parser python-magic +iocextract \ No newline at end of file