QR Codes & XSOAR: How to Make it Work?

Getting XSOAR to Read QE Codes

Evolved into an attack vector method, malicious QR codes are seamlessly embedded in emails and documents, deceiving the victim into scanning and reading them.

QR Code Example

The above news articles are just a few I have been able to find on the topic.

So What Can We Do?

Well, a good start would be to add the capability to XSOAR to detect and read these QR codes, extract the data and the URL (if available) and do what we always do: enrich and respond.

import cv2

def detect_qrcode_image(path):

    img = cv2.imread(path)
    detect = cv2.QRCodeDetector()
    value, points, straight_qrcode = detect.detectAndDecode(img)

    if points is not None:
        result = { "Detected" : True, "Value" : str(value)}
    else:
        result = { "Detected" : False}


    return CommandResults(
        outputs_prefix="QR.Data",
        outputs=result
    )


def main():
    try:
        entry_id = demisto.args().get('entry_id')
        file_path = demisto.executeCommand("getFilePath", {
            "id": entry_id
        })[0].get('Contents').get('path')
        return_results(detect_qrcode_image(file_path))
    except Exception as ex:
        demisto.error(traceback.format_exc())  # print the traceback
        return_error(f'Failed to execute qrcodereader. Error: {str(ex)}')


if __name__ in ('__main__', '__builtin__', 'builtins'):
    main()

The above code only needs the demisto/opencv container, at the time of writing, the version was 1.0.0.78792.

So now we can simply use this code as automation in our playbooks or playground to extract the value, which will be stored under QR in the context data.

Fig 2_QR-Codes-and-XSOAR-How-to-Make-It-Work_palo-alto-networks.png