def test_round_trip(self):
        o = Capability()
        o2 = round_trip(o, True)

        self.assertEqual(o.to_dict(), o2.to_dict())
Esempio n. 2
0
 def test_capability(self):
     capability = Capability()
     capability.description = UNICODE_STR
     capability2 = round_trip(capability)
     self.assertEqual(capability.description, capability2.description)
 def test_id_autoset(self):
     o = Capability()
     self.assertNotEqual(o.id_, None)
Esempio n. 4
0
 def test_capability(self):
     capability = Capability()
     capability.description = UNICODE_STR
     capability2 = round_trip(capability)
     self.assertEqual(capability.description, capability2.description)
o1 = AssociatedObject()
o1.properties = WinHook()
o1.properties.type_ = "WH_KEYBOARD_LL"
o1.association_type = VocabString()
o1.association_type.value = "output"
o1.association_type.xsi_type = "maecVocabs:ActionObjectAssociationTypeVocab-1.0"
act.associated_objects.append(o1)

# Create the behavior
bhv = Behavior()
bhv.action_composition = BehavioralActions()
bhv.action_composition.action_reference = [BehavioralActionReference()]
bhv.action_composition.action_reference[0].action_id = act.id_

# Create the capability
cap = Capability()
cap.name = "spying"
obj = CapabilityObjective()
obj.name = VocabString()
obj.name.value = "capture keyboard input"
obj.name.xsi_type = "maecVocabs:SpyingTacticalObjectivesVocab-1.0"
obj.behavior_reference = [BehaviorReference()]
obj.behavior_reference[0].behavior_idref = bhv.id_
cap.add_tactical_objective(obj)

# Build up the full Package/Malware Subject/Analysis/Bundle hierarchy
p.add_malware_subject(ms)
b.add_action(act)
b.add_behavior(bhv)
b.add_capability(cap)
ms.add_analysis(a)
Esempio n. 6
0
    def test_round_trip(self):
        o = Capability()
        o2 = round_trip(o, True)

        self.assertEqual(o.to_dict(), o2.to_dict())
Esempio n. 7
0
# Set the Malware Instance Object Attributes with an Object constructed from the dictionary
subject.set_malware_instance_object_attributes(subject_object)
# Create the Associated Object Dictionary for use in the Action
associated_object = AssociatedObject()
associated_object.properties = File()
associated_object.properties.file_name = "abcd.dll"
associated_object.properties.size_in_bytes = "123456"
associated_object.association_type = AssociationType()
associated_object.association_type.value = "output"
associated_object.association_type.xsi_type = "maecVocabs:ActionObjectAssociationTypeVocab-1.0"
# Create the Action from another dictionary
action = MalwareAction()
action.name = "create file"
action.name.xsi_type = "maecVocabs:FileActionNameVocab-1.0"
action.associated_objects = AssociatedObjects()
action.associated_objects.append(associated_object)
# Add the Action to the Bundle
bundle.add_action(action)
# Create the Capability from another dictionary
capability = Capability()
capability.name = "persistence"
# Add the Capability to the Bundle
bundle.add_capability(capability)
# Add the Bundle to the Malware Subject
subject.add_findings_bundle(bundle)
# Add the Malware Subject to the Package
package.add_malware_subject(subject)
# Export the Package Bindings Object to an XML file and use the namespaceparser for writing out the namespace definitions
package.to_xml_file("sample_maec_package.xml", {"http://example.com/": "example"})
print "Wrote to sample_maec_package.xml"
o1 = AssociatedObject()
o1.properties = WinHook()
o1.properties.type_ = "WH_KEYBOARD_LL"
o1.association_type = VocabString()
o1.association_type.value = "output"
o1.association_type.xsi_type = "maecVocabs:ActionObjectAssociationTypeVocab-1.0"
act.associated_objects.append(o1)

# Create the behavior
bhv = Behavior()
bhv.action_composition = BehavioralActions()
bhv.action_composition.action_reference = [BehavioralActionReference()]
bhv.action_composition.action_reference[0].action_id = act.id_

# Create the capability
cap = Capability()
cap.name = "spying"
obj = CapabilityObjective()
obj.name = VocabString()
obj.name.value = "capture keyboard input"
obj.name.xsi_type = "maecVocabs:SpyingTacticalObjectivesVocab-1.0"
obj.behavior_reference = [BehaviorReference()]
obj.behavior_reference[0].behavior_idref = bhv.id_
cap.add_tactical_objective(obj)

# Build up the full Package/Malware Subject/Analysis/Bundle hierarchy
p.add_malware_subject(ms)
b.add_action(act)
b.add_behavior(bhv)
b.add_capability(cap)
ms.add_analysis(a)