Merge pull request #1718 from kevoreilly/private

private folder integration

lib/cuckoo/common/objects.py

@@ -74,10 +74,14 @@
     import yara
 
     HAVE_YARA = True
+    if not int(yara.__version__[0]) >= 4:
+        raise ImportError("Missed library. Run: poetry install")
 except ImportError:
+    print("Missed library. Run: poetry install")
     HAVE_YARA = False
 
 
+
 log = logging.getLogger(__name__)
 
 yara_error = {
@@ -438,28 +442,28 @@ def init_yara(self):
         """Generates index for yara signatures."""
 
         categories = ("binaries", "urls", "memory", "CAPE", "macro", "monitor")
-
         log.debug("Initializing Yara...")
 
         # Generate root directory for yara rules.
         yara_root = os.path.join(CUCKOO_ROOT, "data", "yara")
-
+        priacte_yara_root = os.path.join(CUCKOO_ROOT, "private", "yara")
         # Loop through all categories.
         for category in categories:
+            rules, indexed = {}, []
             # Check if there is a directory for the given category.
-            category_root = os.path.join(yara_root, category)
-            if not path_exists(category_root):
-                log.warning("Missing Yara directory: %s?", category_root)
-                continue
+            for path in (yara_root, priacte_yara_root):
+                category_root = os.path.join(path, category)
+                if not path_exists(category_root):
+                    log.warning("Missing Yara directory: %s?", category_root)
+                    continue
 
-            rules, indexed = {}, []
-            for category_root, _, filenames in os.walk(category_root, followlinks=True):
-                for filename in filenames:
-                    if not filename.endswith((".yar", ".yara")):
-                        continue
-                    filepath = os.path.join(category_root, filename)
-                    rules[f"rule_{category}_{len(rules)}"] = filepath
-                    indexed.append(filename)
+                for category_root, _, filenames in os.walk(category_root, followlinks=True):
+                    for filename in filenames:
+                        if not filename.endswith((".yar", ".yara")):
+                            continue
+                        filepath = os.path.join(category_root, filename)
+                        rules[f"rule_{category}_{len(rules)}"] = filepath
+                        indexed.append(filename)
 
                 # Need to define each external variable that will be used in the
             # future. Otherwise Yara will complain.

lib/cuckoo/core/startup.py

@@ -20,6 +20,10 @@
 import modules.processing
 import modules.reporting
 import modules.signatures
+
+# Private
+import private.signatures
+
 from lib.cuckoo.common.colors import cyan, red, yellow
 from lib.cuckoo.common.config import Config
 from lib.cuckoo.common.constants import CUCKOO_ROOT
@@ -31,15 +35,6 @@
 from lib.cuckoo.core.plugins import import_package, import_plugin, list_plugins
 from lib.cuckoo.core.rooter import rooter, socks5s, vpns
 
-try:
-    import yara
-
-    HAVE_YARA = True
-    if not int(yara.__version__[0]) >= 4:
-        raise ImportError("Missed library: poetry run pip install yara-python>=4.0.0 -U")
-except ImportError:
-    print("Missed library: poetry run pip install yara-python>=4.0.0 -U")
-    HAVE_YARA = False
 
 log = logging.getLogger()
 
@@ -259,8 +254,10 @@ def init_modules():
     import_package(modules.processing)
     # Import all signatures.
     import_package(modules.signatures)
+    # Import all private signatures
+    import_package(private.signatures)
     if len(os.listdir(os.path.join(CUCKOO_ROOT, "modules", "signatures"))) < 5:
-        log.warning("Suggestion: looks like you didn't install community, execute: python3 utils/community.py -h")
+        log.warning("Suggestion: looks like you didn't install community, execute: poetry run python utils/community.py -h")
     # Import all reporting modules.
     import_package(modules.reporting)
     # Import all feeds modules.

private/README.md

@@ -0,0 +1 @@
+### All custom signatures, yaras, etc should be placed in this folder