Import hashes: File Format?

Reply
L1 Bithead

Import hashes: File Format?

I want to import some hashes into out ESM Server to have them blocked by Traps. Which format should the input file have?
Tags (3)
L2 Linker

Re: Import hashes: File Format?

We use the XML format so that we can force the malware verdict. When we deployed Traps we had the assistance of a Traps PSE. He wrote a short powershell script that will take a txt file of SHA256 hashes and convert them into an XML file that you can then import. This works in 3.4.X and 4.0.X.

 

# This script reads a text file of SHA256 hashes and creates an XML for importing
# into the Traps ESM Policies > Hash Control page.  If these are imported
# 'with verdict', they will appear as "Hash Control" verdicts of "Malware" 

# --------  VARIABLES -----------
# Process name to apply to each hash import
$ImportAsName = "ImportedProcessHash.exe"
# Text file/path of SHA256 hashes to build XML from
$HashStringsFile = ($PSScriptRoot) + "\Hashes.txt"
# File name/path for resulting import XML file
$TrapsImportFile = ($PSScriptRoot) + "\TrapsHashImports.xml"
Write-Host "Creating $TrapsImportFile"
 
# get an XMLTextWriter to create the XML
$XmlWriter = New-Object System.XMl.XmlTextWriter($TrapsImportFile,$Null)
 
# choose a pretty formatting:
$xmlWriter.Formatting = 'Indented'
$xmlWriter.Indentation = 1
$XmlWriter.IndentChar = "`t"
 
# write the header
$xmlWriter.WriteStartDocument()

# create root element "machines" and add some attributes to it
$XmlWriter.WriteComment('Hashes to Import')
$xmlWriter.WriteStartElement('ArrayOfHashProcessItem')
$XmlWriter.WriteAttributeString('xmlns', 'http://schemas.datacontract.org/2004/07/Cyvera.Common.Interfaces.Policy')
$XmlWriter.WriteAttributeString('xmlns:i', 'http://www.w3.org/2001/XMLSchema-instance')

# Read hashes text file and add XML data for each
$Hashes = ((get-content $HashStringsFile) | Sort-Object)
$Hashes | ForEach-Object {
    # Create element HashProcessItem node
    $xmlWriter.WriteStartElement('HashProcessItem')
    #$XmlWriter.WriteAttributeString('test', 'something')

        # Add pieces of information:
        $xmlWriter.WriteElementString('FileSizeMb','0')
        $xmlWriter.WriteElementString('Hash',$_)
        $xmlWriter.WriteElementString('ProcessName',$ImportAsName)
        $xmlWriter.WriteElementString('Result','Malware')
        $xmlWriter.WriteElementString('Type','Unprotected')

    # Close HashProcessItem node
    $xmlWriter.WriteEndElement()
}

# Close ArrayOfHashProcessItem node
$xmlWriter.WriteEndElement()
 
# finalize the document:
$xmlWriter.WriteEndDocument()
$xmlWriter.Flush()
$xmlWriter.Close()

notepad $TrapsImportFile
L1 Bithead

Re: Import hashes: File Format?

Thank you, works like a charm with 4.1.1

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!