StealthOps/utils.py at main · presack/StealthOps · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
"""Shared utility functions for StealthOps."""

from __future__ import annotations

import re


def refang(indicator: str) -> str:
    """Strip common defanging characters from an indicator string.

    Handles: [.] (.) [dot] (dot) [:] hxxp:// hxxps://
    """
    s = indicator.strip()
    # Protocol defanging — must run before dot replacement
    s = re.sub(r"^hxxps://", "https://", s, flags=re.IGNORECASE)
    s = re.sub(r"^hxxp://", "http://", s, flags=re.IGNORECASE)
    # Colon defanging
    s = s.replace("[:]", ":")
    # Dot defanging
    s = s.replace("[.]", ".")
    s = s.replace("(.)", ".")
    s = re.sub(r"\[dot\]", ".", s, flags=re.IGNORECASE)
    s = re.sub(r"\(dot\)", ".", s, flags=re.IGNORECASE)
    return s