ioc_tweet
This script allows you to gather Indicator of Compromise (IoCs) from Twitter and send them to MISP
for Threat Intelligence analysis. The script uses the Tweepy and PyMISP
Python libraries.
The script needs the following configuration:
- config->config.ini: Twitter API configuration, MISP url and MISP API key.
- config->keywords.txt: The terms that you to want to monitor on Twitter.
- config->filters.txt: The filters for avoiding false positives in your alerts. The script checks if the tweets gathered contain any of these keywords.
How it works?
It's very simple.
-
The script reads your keywords.txt file, and it searches the keywords of the file one by one on Twitter.
-
If you have typed -a option, the script will read your filters.txt file, and it will check if the tweets gathered contain any of your filters.
-
If you type -m option together with -a, you will send the alerts to your MISP instance.
Usage
Gathering IoCs on Twitter.
python main.pyOutput example
[*] Searching IoC's on Twitter:
[*] Checking if the tweets gathered contain any keyword from your list.
[+] Tweet containing: opendir
[!] Tweet by beefyspace on 2021-05-17 08:17:14:
[!] #phishing
[!] #opendir
[!] #fastdomain
[!]Tweet content:
RT @ecarlesi: Possible threat on hxxps:https://goldfieldcatering[.]com/wordpress-5[.]7[.]1[.]zip #phishing #opendir #fastdomain
[*] Number of tweets gathered: 1Gathering IoCs on Twitter and checking if there are tweets containing any of your filters words.
python main.py -aOutput example (same as above)
[*] Searching IoC's on Twitter:
[*] Checking if the tweets gathered contain any keyword from your list.
[+] Tweet containing: opendir
[!] Tweet by beefyspace on 2021-05-17 08:17:14:
[!] #phishing
[!] #opendir
[!] #fastdomain
[!]Tweet content:
RT @ecarlesi: Possible threat on hxxps:https://goldfieldcatering[.]com/wordpress-5[.]7[.]1[.]zip #phishing #opendir #fastdomain
[*] Number of tweets gathered: 1Sending alerts detected to your MISP instance.
python main.py -a -m[*] Searching IoC's on Twitter:
[*] Checking if the tweets gathered contain any keyword from your list.
[+] Tweet containing: opendir
[!] Tweet by beefyspace on 2021-05-17 08:17:14:
[!] #phishing
[!] #opendir
[!] #fastdomain
[!]Tweet content:
RT @ecarlesi: Possible threat on hxxps:https://goldfieldcatering[.]com/wordpress-5[.]7[.]1[.]zip #phishing #opendir #fastdomain
[*] Number of tweets gathered: 1
[*] Sending alerts to MISP
[*] Event with ID 1355 has been successfully stored.