Import hashes: File Format?

[bernhardschmid]

I want to import some hashes into out ESM Server to have them blocked by Traps. Which format should the input file have?

[thinson · Accepted solution]

We use the XML format so that we can force the malware verdict. When we deployed Traps we had the assistance of a Traps PSE. He wrote a short powershell script that will take a txt file of SHA256 hashes and convert them into an XML file that you can then import. This works in 3.4.X and 4.0.X.

# This script reads a text file of SHA256 hashes and creates an XML for importing
# into the Traps ESM Policies > Hash Control page.  If these are imported
# 'with verdict', they will appear as "Hash Control" verdicts of "Malware" 

# --------  VARIABLES -----------
# Process name to apply to each hash import
$ImportAsName = "ImportedProcessHash.exe"
# Text file/path of SHA256 hashes to build XML from
$HashStringsFile = ($PSScriptRoot) + "\Hashes.txt"
# File name/path for resulting import XML file
$TrapsImportFile = ($PSScriptRoot) + "\TrapsHashImports.xml"
Write-Host "Creating $TrapsImportFile"
 
# get an XMLTextWriter to create the XML
$XmlWriter = New-Object System.XMl.XmlTextWriter($TrapsImportFile,$Null)
 
# choose a pretty formatting:
$xmlWriter.Formatting = 'Indented'
$xmlWriter.Indentation = 1
$XmlWriter.IndentChar = "`t"
 
# write the header
$xmlWriter.WriteStartDocument()

# create root element "machines" and add some attributes to it
$XmlWriter.WriteComment('Hashes to Import')
$xmlWriter.WriteStartElement('ArrayOfHashProcessItem')
$XmlWriter.WriteAttributeString('xmlns', 'http://schemas.datacontract.org/2004/07/Cyvera.Common.Interfaces.Policy')
$XmlWriter.WriteAttributeString('xmlns:i', 'http://www.w3.org/2001/XMLSchema-instance')

# Read hashes text file and add XML data for each
$Hashes = ((get-content $HashStringsFile) | Sort-Object)
$Hashes | ForEach-Object {
    # Create element HashProcessItem node
    $xmlWriter.WriteStartElement('HashProcessItem')
    #$XmlWriter.WriteAttributeString('test', 'something')

        # Add pieces of information:
        $xmlWriter.WriteElementString('FileSizeMb','0')
        $xmlWriter.WriteElementString('Hash',$_)
        $xmlWriter.WriteElementString('ProcessName',$ImportAsName)
        $xmlWriter.WriteElementString('Result','Malware')
        $xmlWriter.WriteElementString('Type','Unprotected')

    # Close HashProcessItem node
    $xmlWriter.WriteEndElement()
}

# Close ArrayOfHashProcessItem node
$xmlWriter.WriteEndElement()
 
# finalize the document:
$xmlWriter.WriteEndDocument()
$xmlWriter.Flush()
$xmlWriter.Close()

notepad $TrapsImportFile

[bernhardschmid]

Thank you, works like a charm with 4.1.1