#!/usr/bin/env python3
"""Agent for hunting supply chain compromise indicators in software dependencies and builds."""

import json
import argparse
import hashlib
import re
import subprocess
from datetime import datetime
from pathlib import Path


KNOWN_COMPROMISED_PACKAGES = {
    "event-stream": "npm", "ua-parser-js": "npm", "coa": "npm",
    "colors": "npm", "faker": "npm", "node-ipc": "npm",
    "ctx": "pypi", "phpass": "pypi",
}


def scan_npm_lockfile(lockfile_path):
    """Scan package-lock.json for suspicious dependencies."""
    with open(lockfile_path) as f:
        data = json.load(f)
    findings = []
    packages = data.get("packages", data.get("dependencies", {}))
    for name, info in packages.items():
        pkg_name = name.split("node_modules/")[-1] if "node_modules/" in name else name
        if not pkg_name:
            continue
        if pkg_name in KNOWN_COMPROMISED_PACKAGES:
            findings.append({
                "package": pkg_name, "version": info.get("version", ""),
                "severity": "CRITICAL", "reason": "known_compromised",
            })
        resolved = info.get("resolved", "")
        if resolved and not resolved.startswith("https://registry.npmjs.org/"):
            findings.append({
                "package": pkg_name, "resolved": resolved,
                "severity": "HIGH", "reason": "non_standard_registry",
            })
        if info.get("hasInstallScript", False):
            findings.append({
                "package": pkg_name, "version": info.get("version", ""),
                "severity": "MEDIUM", "reason": "install_script",
            })
    return findings


def scan_pip_requirements(req_path):
    """Scan pip requirements.txt for suspicious packages."""
    findings = []
    with open(req_path) as f:
        for line in f:
            line = line.strip()
            if not line or line.startswith("#"):
                continue
            match = re.match(r"^([a-zA-Z0-9_.-]+)", line)
            if not match:
                continue
            pkg = match.group(1)
            if pkg.lower() in KNOWN_COMPROMISED_PACKAGES:
                findings.append({
                    "package": pkg, "line": line,
                    "severity": "CRITICAL", "reason": "known_compromised",
                })
            if "--index-url" in line or "--extra-index-url" in line:
                findings.append({
                    "package": pkg, "line": line,
                    "severity": "HIGH", "reason": "custom_index",
                })
            if re.search(r"git\+https?://", line):
                findings.append({
                    "package": pkg, "line": line,
                    "severity": "MEDIUM", "reason": "git_dependency",
                })
    return findings


def verify_binary_hashes(manifest_path):
    """Verify binary hashes against a known-good manifest."""
    with open(manifest_path) as f:
        manifest = json.load(f)
    results = []
    for entry in manifest:
        filepath = entry.get("path", "")
        expected_hash = entry.get("sha256", "")
        if not Path(filepath).exists():
            results.append({"path": filepath, "status": "MISSING", "severity": "HIGH"})
            continue
        sha = hashlib.sha256()
        with open(filepath, "rb") as bf:
            for chunk in iter(lambda: bf.read(8192), b""):
                sha.update(chunk)
        actual = sha.hexdigest()
        if actual != expected_hash:
            results.append({
                "path": filepath, "expected": expected_hash, "actual": actual,
                "status": "MISMATCH", "severity": "CRITICAL",
            })
    return results


def scan_build_logs(log_path):
    """Scan CI/CD build logs for supply chain indicators."""
    suspicious_patterns = [
        (r"curl\s+.*\|\s*(sh|bash)", "CRITICAL", "pipe_to_shell"),
        (r"wget\s+.*&&\s*chmod\s+\+x", "HIGH", "download_and_execute"),
        (r"npm\s+install\s+--registry\s+(?!https://registry\.npmjs\.org)", "HIGH", "custom_registry"),
        (r"pip\s+install\s+--index-url\s+(?!https://pypi\.org)", "HIGH", "custom_pypi"),
        (r"docker\s+pull\s+(?!docker\.io/|gcr\.io/|ghcr\.io/)", "MEDIUM", "untrusted_registry"),
    ]
    findings = []
    with open(log_path) as f:
        for i, line in enumerate(f, 1):
            for pattern, severity, category in suspicious_patterns:
                if re.search(pattern, line, re.IGNORECASE):
                    findings.append({
                        "line_number": i, "content": line.strip()[:300],
                        "pattern": category, "severity": severity,
                    })
    return findings


def check_dependency_confusion(internal_packages, public_registry="npm"):
    """Check if internal package names exist on public registries."""
    findings = []
    for pkg in internal_packages:
        try:
            if public_registry == "npm":
                result = subprocess.run(
                    ["npm", "view", pkg, "name"], capture_output=True, text=True, timeout=10)
            else:
                result = subprocess.run(
                    ["pip", "index", "versions", pkg], capture_output=True, text=True, timeout=10)
            if result.returncode == 0:
                findings.append({
                    "package": pkg, "registry": public_registry,
                    "severity": "CRITICAL", "reason": "dependency_confusion_risk",
                })
        except (subprocess.TimeoutExpired, FileNotFoundError):
            continue
    return findings


def main():
    parser = argparse.ArgumentParser(description="Supply Chain Compromise Hunter")
    parser.add_argument("--npm-lock", help="Path to package-lock.json")
    parser.add_argument("--pip-req", help="Path to requirements.txt")
    parser.add_argument("--manifest", help="Path to hash manifest JSON")
    parser.add_argument("--build-log", help="Path to CI/CD build log")
    parser.add_argument("--output", default="supply_chain_hunt_report.json")
    args = parser.parse_args()

    report = {"generated_at": datetime.utcnow().isoformat(), "findings": {}}

    if args.npm_lock:
        f = scan_npm_lockfile(args.npm_lock)
        report["findings"]["npm_scan"] = f
        print(f"[+] NPM lock findings: {len(f)}")

    if args.pip_req:
        f = scan_pip_requirements(args.pip_req)
        report["findings"]["pip_scan"] = f
        print(f"[+] Pip requirements findings: {len(f)}")

    if args.manifest:
        f = verify_binary_hashes(args.manifest)
        report["findings"]["hash_verification"] = f
        print(f"[+] Binary hash mismatches: {len([x for x in f if x.get('status') == 'MISMATCH'])}")

    if args.build_log:
        f = scan_build_logs(args.build_log)
        report["findings"]["build_log_scan"] = f
        print(f"[+] Build log findings: {len(f)}")

    with open(args.output, "w") as fout:
        json.dump(report, fout, indent=2, default=str)
    print(f"[+] Report saved to {args.output}")


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""Supply Chain Compromise Detection - Analyzes logs for T1195.002 indicators."""

import json, csv, argparse, datetime, re
from collections import defaultdict
from pathlib import Path

DETECTION_PATTERNS = [
    r'update.*cmd\\.exe',
    r'installer.*powershell',
    r'setup.*wscript',
    r'patch.*mshta',
]

def parse_logs(path):
    p = Path(path)
    if p.suffix == ".json":
        with open(p, encoding="utf-8") as f:
            data = json.load(f)
            return data if isinstance(data, list) else data.get("events", [])
    elif p.suffix == ".csv":
        with open(p, encoding="utf-8-sig") as f:
            return [dict(r) for r in csv.DictReader(f)]
    return []

def analyze_event(event):
    cmd = event.get("CommandLine", event.get("command_line", event.get("ProcessCommandLine", "")))
    content = event.get("Task_Content", event.get("Parameters", event.get("RawEventData", "")))
    search_text = f"{cmd} {content}"
    risk = 0
    indicators = []
    for pattern in DETECTION_PATTERNS:
        if re.search(pattern, search_text, re.IGNORECASE):
            risk += 25
            indicators.append(f"Pattern match: {pattern}")
    if not indicators:
        return None
    risk = min(risk, 100)
    return {
        "technique": "T1195.002",
        "command_line": cmd[:500] if cmd else content[:500],
        "hostname": event.get("Computer", event.get("DeviceName", event.get("hostname", "unknown"))),
        "user": event.get("User", event.get("AccountName", event.get("UserId", "unknown"))),
        "timestamp": event.get("_time", event.get("timestamp", event.get("UtcTime", event.get("Timestamp", "")))),
        "risk_score": risk,
        "risk_level": "CRITICAL" if risk >= 75 else "HIGH" if risk >= 50 else "MEDIUM" if risk >= 25 else "LOW",
        "indicators": indicators,
    }

def run_hunt(input_path, output_dir):
    print(f"[*] Supply Chain Compromise Hunt - {datetime.datetime.now().isoformat()}")
    events = parse_logs(input_path)
    findings = [f for f in (analyze_event(e) for e in events) if f]
    Path(output_dir).mkdir(parents=True, exist_ok=True)
    slug = "hunting_for_supply_c"
    with open(Path(output_dir) / f"{slug}_findings.json", "w", encoding="utf-8") as f:
        json.dump({"hunt_id": f"TH-{datetime.date.today()}", "total_events": len(events), "findings": findings}, f, indent=2)
    with open(Path(output_dir) / "hunt_report.md", "w", encoding="utf-8") as f:
        f.write(f"# Supply Chain Compromise Hunt Report\n\n")
        f.write(f"**Date**: {datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n")
        f.write(f"**Findings**: {len(findings)}\n\n")
        for finding in sorted(findings, key=lambda x: x["risk_score"], reverse=True)[:20]:
            f.write(f"### [{finding['risk_level']}] {finding['technique']}\n")
            f.write(f"- **Host**: {finding['hostname']}\n")
            f.write(f"- **Indicators**: {', '.join(finding['indicators'])}\n\n")
    print(f"[+] {len(findings)} findings written to {output_dir}")

def main():
    p = argparse.ArgumentParser(description="Supply Chain Compromise Detection")
    sp = p.add_subparsers(dest="cmd")
    h = sp.add_parser("hunt"); h.add_argument("--input", "-i", required=True); h.add_argument("--output", "-o", default="./hunting_for_sup_output")
    sp.add_parser("queries")
    args = p.parse_args()
    if args.cmd == "hunt": run_hunt(args.input, args.output)
    elif args.cmd == "queries":
        print("=== Detection Queries ===")
        print("See references/workflows.md for platform-specific queries")
    else: p.print_help()

if __name__ == "__main__": main()