Searching Multiple Orgs for IOCs

 

The command line interface (CLI) for LimaCharlie now supports searching for indicators of compromise (IOC) across multiple organizations. Users can use the CLI to search for file hashes, file paths, IP addresses, domains and users across all organizations under their control with a single command.

The new CLI command supports multiple arguments and the output is written human-readable to stdout or to a file as YAML. The following man page outlines all available options and provides an example.

-----------------------------------------------------------------------
It's in limacharlie 2.8.0:
pip install limacharlie --user

Example usage:
$ limacharlie-search --help
usage: limacharlie.io search [-h] -t TYPE -o IOC [-i INFO]
                             [--case-insensitive] [--with-wildcards]
                             [-e ENVIRONMENT] [--output OUTPUT]
optional arguments:
  -h, --help            show this help message and exit
  -t TYPE, --type TYPE  the IOC type to search for, one of: file_hash,
                        file_name, file_path, ip, domain, user.
  -o IOC, --ioc IOC     the valid of the IOC to search for
  -i INFO, --info INFO  the type of information to return, one of "summary" or
                        "locations", "summary" is default.
  --case-insensitive    make the search case insensitive.
  --with-wildcards      make the search using the "%" wildcard.
  -e ENVIRONMENT, --environment ENVIRONMENT
                        the name of the LimaCharlie environment (as defined in
                        ~/.limacharlie) to use, otherwise all environments are
                        used.
  --output OUTPUT       location where to send output, "-" by default outputs
                        human readable to stdout, otherwise it should be a
                        file where YAML will be written to.

Example run:
$ limacharlie-search -t file_path -o %nject% --with-wildcards --case-insensitive -i locations
Querying 2 environments for %nject% (file_path) to -.
Skipping test-lon-1 (95a34ec2-48cd-471c-bc34-cccb0257c16a) as Insight is not enabled.
replicant (c82e5c17-d519-4ef5-a4ac-c454a95d31ca)
=========================================
2ccd01e7-b201-4c3d-9436-25a9bd896e69:
  first_ts: 1549124137
  hostname: win-5kc7e0ng1od
  last_ts: 1549149822
  sid: 2ccd01e7-b201-4c3d-9436-25a9bd896e69
334a15a5-a39d-43d1-b7d5-f7b604db1bc0:
  first_ts: 1549116394
  hostname: win-5kc7e0ng1od
  last_ts: 1549116395
  sid: 334a15a5-a39d-43d1-b7d5-f7b604db1bc0
Done, 2 results.
-----------------------------------------------------------------------
All Eyes
 

Christopher Luft

My name is Christopher Luft and I am an artist turned computer scientist turned something else.