1919URL_MALPEDIA = 'https://raw.githubusercontent.com/certtools/malware_name_mapping/master/malpedia.csv'
2020URL_MISP = 'https://raw.githubusercontent.com/MISP/misp-galaxy/main/clusters/threat-actor.json'
2121
22- REGEX_FROM_HUMAN = re .compile (r"((?P<res1>[a-z])(?=[A-Z])|" # "fooBar"
23- r"(?P<res2>.)(\\ )(?=[^\]])|" # "foo bar" but not "foo[-_ ]?bar"
24- r"(?P<res3>[^\[-])\\-(?=[^-]))" ) # "foo-bar" but not "foo[-_ ]?bar"
22+ REGEX_FROM_HUMAN = re .compile (r"((?P<res1>[a-z])(?=[A-Z])|" # "fooBar"
23+ r"(?P<res2>.)(\\ )(?=[^\]])|" # "foo bar" but not "foo[-_ ]?bar"
24+ r"(?P<res3>[^\[-])\\-(?=[^-]))" ) # "foo-bar" but not "foo[-_ ]?bar"
2525IDENTIFIER_FROM_HUMAN = re .compile (r"[^a-z0-9]+" )
2626
2727
@@ -75,7 +75,7 @@ def generate_regex_from_human(*values):
7575 return "^(%s)$" % "|" .join (newvalues )
7676
7777
78- def download (url : str = URL , add_default = False , params = None , include_malpedia = False ,
78+ def download (url : str = URL , add_default = False , params = None , include_malpedia = False ,
7979 include_misp = False , mwnmp_ignore_adware = False ):
8080 download = requests .get (url )
8181 download .raise_for_status ()
@@ -96,7 +96,7 @@ def download(url: str=URL, add_default=False, params=None, include_malpedia=Fals
9696 names = [actor ["value" ]] + actor .get ("meta" , {}).get ("synonyms" , [])
9797 identifier = ("%s-generic"
9898 "" % IDENTIFIER_FROM_HUMAN .sub ("-" ,
99- actor ["value" ].lower ()))
99+ actor ["value" ].lower ()))
100100 rule_name = "misp-threat-actors-%s" % identifier
101101
102102 rules .append (generate_rule (generate_regex_from_human (* names ),
0 commit comments