Example #1
0
def test_multiple_qualifiers():
    exp_and = stix2.AndBooleanExpression([stix2.EqualityComparisonExpression("network-traffic:dst_ref.type",
                                                                             "domain-name"),
                                          stix2.EqualityComparisonExpression("network-traffic:dst_ref.value",
                                                                             "example.com")])
    exp_ob = stix2.ObservationExpression(exp_and)
    qual_rep = stix2.RepeatQualifier(5)
    qual_within = stix2.WithinQualifier(stix2.IntegerConstant(1800))
    exp = stix2.QualifiedObservationExpression(stix2.QualifiedObservationExpression(exp_ob, qual_rep), qual_within)
    assert str(exp) == "[network-traffic:dst_ref.type = 'domain-name' AND network-traffic:dst_ref.value = 'example.com'] REPEATS 5 TIMES WITHIN 1800 SECONDS"  # noqa
Example #2
0
def test_hash_followed_by_registryKey_expression():
    hash_exp = stix2.EqualityComparisonExpression("file:hashes.MD5",
                                                  stix2.HashConstant("79054025255fb1a26e4bc422aef54eb4", "MD5"))
    o_exp1 = stix2.ObservationExpression(hash_exp)
    reg_exp = stix2.EqualityComparisonExpression(stix2.ObjectPath("windows-registry-key", ["key"]),
                                                 stix2.StringConstant("HKEY_LOCAL_MACHINE\\foo\\bar"))
    o_exp2 = stix2.ObservationExpression(reg_exp)
    fb_exp = stix2.FollowedByObservationExpression([o_exp1, o_exp2])
    para_exp = stix2.ParentheticalExpression(fb_exp)
    qual_exp = stix2.WithinQualifier(stix2.IntegerConstant(300))
    exp = stix2.QualifiedObservationExpression(para_exp, qual_exp)
    assert str(exp) == "([file:hashes.MD5 = '79054025255fb1a26e4bc422aef54eb4'] FOLLOWEDBY [windows-registry-key:key = 'HKEY_LOCAL_MACHINE\\\\foo\\\\bar']) WITHIN 300 SECONDS"  # noqa
    def __generate_observation_expression(self, size):
        """
        Generate a random complex observation expression, which may consist of
        sub-expressions and qualifiers.

        :param size: The size of the desired observation expression, in terms of
            the number of simple comparison expressions it must contain
        :return: The observation expression AST
        """
        assert size > 0

        # The generation strategy is similar to that for comparison expressions
        # (see __generate_complex_comparison_expression()).  It is generated in
        # two parts of random size; one side is constructed as a sub-expression.

        if size == 1:
            obs_expr = stix2.ObservationExpression(
                self.__generate_complex_comparison_expression(1))

        else:
            lsize = random.randint(0, size)
            rsize = size - lsize

            if random.random() < 0.5:
                # Parenthesize right case
                obs_exprs = [
                    stix2.ObservationExpression(
                        self.__generate_complex_comparison_expression(sz))
                    for sz in _rand_series(lsize)
                ]

                if rsize > 0:
                    obs_exprs.append(
                        stix2.ParentheticalExpression(
                            self.__generate_observation_expression(rsize)))

            else:
                # Parenthesize left case
                if lsize == 0:
                    obs_exprs = []
                else:
                    obs_exprs = [
                        stix2.ParentheticalExpression(
                            self.__generate_observation_expression(lsize))
                    ]

                obs_exprs.extend(
                    stix2.ObservationExpression(
                        self.__generate_complex_comparison_expression(sz))
                    for sz in _rand_series(rsize))

            ast_class = random.choice(
                (stix2.AndObservationExpression, stix2.OrObservationExpression,
                 stix2.FollowedByObservationExpression))

            obs_expr = ast_class(obs_exprs)

        if random.random() < self.__config.probability_qualifier:
            qualifier = self.__generate_random_qualifier()
            obs_expr = stix2.QualifiedObservationExpression(
                obs_expr, qualifier)

        return obs_expr