CheckSender

For phishing incidents, check the sender of the email via Pipl search

python · Pipl

Details

IDCheckSender
Languagepython
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Tagsserver phishing

README

Checks the sender of the email via a Pipl search. Use this script for phishing incidents.

Script Data

Name Description
Script Type python
Tags server, phishing

Dependencies

This script uses the following commands and scripts.

  • pipl-search

Inputs

Argument Name Description
email The email address to look up. If omitted, the script will instead extract with regular expression from the fullmail argument, where the phishing email should be provided.
fullmail The raw email text to regex the sender from.

Outputs

There are no outputs for this script.

Source

CheckSender.py CheckSender_test.py CheckSender.yml
Download History Raw 
from CheckSender import get_sender_from_text, format_data


def test_get_sender_from_text():
    """
    Given:
        - Text with email address.
    When:
        - Running the get_sender_from_text function.
    Then:
        - Validating the sender email is correct.
    """
    sender = get_sender_from_text("from: test1@gmail.com")
    assert sender == "test1@gmail.com"


def test_get_sender_from_text_no_address_found():
    """
    Given:
        - Text without email address.
    When:
        - Running the get_sender_from_text function.
    Then:
        - Validating the sender email is empty.
    """
    sender = get_sender_from_text("from: test1gmail.com")
    assert sender == ""


def test_format_data():
    """
    Given:
        - data output from pipl-search command.
    When:
        - Running the format_data function.
    Then:
        - Validating the outputs as expected.
    """
    data = format_data([{"Account": {"IDs": "1,2,3", "Addresses": ["test1@gmail.com", "test2@gmail.com"]}}])
    assert data == [{"Account": "IDs: 1,2,3\nAddresses: test1@gmail.com,\ntest2@gmail.com"}]