QR Codes & XSOAR: How to Make it Work?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
L3 Networker

Title_QR-Codes-and-XSOAR-How-to-Make-It-Work_palo-alto-networks.jpg

Getting XSOAR to Read QE Codes 

 

Evolved into an attack vector method, malicious QR codes are seamlessly embedded in emails and documents, deceiving the victim into scanning and reading them.

QR Code ExampleQR Code Example

 

 

 

 

 

The above news articles are just a few I have been able to find on the topic.

 

So What Can We Do?

 

Well, a good start would be to add the capability to XSOAR to detect and read these QR codes, extract the data and the URL (if available) and do what we always do: enrich and respond.

 

 

import cv2

def detect_qrcode_image(path):

    img = cv2.imread(path)
    detect = cv2.QRCodeDetector()
    value, points, straight_qrcode = detect.detectAndDecode(img)

    if points is not None:
        result = { "Detected" : True, "Value" : str(value)}
    else:
        result = { "Detected" : False}


    return CommandResults(
        outputs_prefix="QR.Data",
        outputs=result
    )


def main():
    try:
        entry_id = demisto.args().get('entry_id')
        file_path = demisto.executeCommand("getFilePath", {
            "id": entry_id
        })[0].get('Contents').get('path')
        return_results(detect_qrcode_image(file_path))
    except Exception as ex:
        demisto.error(traceback.format_exc())  # print the traceback
        return_error(f'Failed to execute qrcodereader. Error: {str(ex)}')


if __name__ in ('__main__', '__builtin__', 'builtins'):
    main()

 

 

The above code only needs the demisto/opencv container, at the time of writing, the version was 1.0.0.78792.

 

So now we can simply use this code as automation in our playbooks or playground to extract the value, which will be stored under QR in the context data.

 

Fig 2_QR-Codes-and-XSOAR-How-to-Make-It-Work_palo-alto-networks.png

 

Help other community members know this post is helpful by giving it a thumbs up! 

 

  • 3856 Views
  • 0 comments
  • 3 Likes
Register or Sign-in
Labels
Top Liked Authors