def main():
    ioc = etree.parse('6d2a1b03-b216-4cd8-9a9e-8827af6ebf93.ioc')

    stix_package = STIXPackage()

    ttp = TTP()
    malware_instance = MalwareInstance()
    malware_instance.names = ['Zeus', 'twexts', 'sdra64', 'ntos']

    ttp = TTP(title="Zeus")
    ttp.behavior = Behavior()
    ttp.behavior.add_malware_instance(malware_instance)

    indicator = Indicator(title="Zeus", description="Finds Zeus variants, twexts, sdra64, ntos")

    tm = OpenIOCTestMechanism()
    tm.ioc = ioc
    tm.producer = InformationSource(identity=Identity(name="Mandiant"))
    time = Time()
    time.produced_time = "0001-01-01T00:00:00"
    tm.producer.time = time
    tm.producer.references = ["http://openioc.org/iocs/6d2a1b03-b216-4cd8-9a9e-8827af6ebf93.ioc"]
    indicator.test_mechanisms = TestMechanisms([tm])
    indicator.add_indicated_ttp(TTP(idref=ttp.id_))

    stix_package.add_indicator(indicator)
    stix_package.add_ttp(ttp)

    print(stix_package.to_xml(encoding=None))
Exemplo n.º 2
0
 def from_dict(cls, dict_repr, return_obj=None):
     if not dict_repr:
         return None
     
     if not return_obj:
         return_obj = cls()
     
     identity_dict = dict_repr.get('identity', None)
     time_dict = dict_repr.get('time', None)
     
     if identity_dict:
         xsi_type = identity_dict.get('xsi:type')
         if xsi_type:
             type_name = xsi_type.split(":")[1]
             if  type_name == CIQIdentity3_0Instance._XML_TYPE:
                 return_obj.identity = CIQIdentity3_0Instance.from_dict(identity_dict)
             else:
                 raise TypeError('No known class for xsi:type: %s' % (xsi_type))
         else:
             return_obj.identity = Identity.from_dict(identity_dict)
             
     if time_dict:
         return_obj.time = Time.from_dict(time_dict)
     
     return return_obj
 def from_dict(system_dict, system_class = None):
     if not system_dict:
         return None
     if not system_class:
         system_ = System()
     else:
         system_ = system_class
     system_.available_physical_memory = UnsignedLong.from_dict(system_dict.get('available_physical_memory'))
     system_.bios_info = BIOSInfo.from_dict(system_dict.get('bios_info'))
     system_.date = Date.from_dict(system_dict.get('date'))
     system_.hostname = String.from_dict(system_dict.get('hostname'))
     system_.local_time = Time.from_dict(system_dict.get('local_time'))
     system_.network_interface_list = NetworkInterfaceList.from_list(system_dict.get('network_interface_list'))
     system_.os = OS.from_dict(system_dict.get('os'))
     system_.processor = String.from_dict(system_dict.get('processor'))
     system_.processor_architecture = String.from_dict(system_dict.get('processor_architecture'))
     system_.system_time = Time.from_dict(system_dict.get('system_time'))
     system_.timezone_dst = String.from_dict(system_dict.get('timezone_dst'))
     system_.timezone_standard = String.from_dict(system_dict.get('timezone_standard'))
     system_.total_physical_memory = UnsignedLong.from_dict(system_dict.get('total_physical_memory'))
     system_.uptime = Duration.from_dict(system_dict.get('uptime'))
     system_.username = String.from_dict(system_dict.get('username'))
     return system_
 def from_obj(system_obj, system_class = None):
     if not system_obj:
         return None
     if not system_class:
         system_ = System()
     else:
         system_ = system_class
     system_.available_physical_memory = UnsignedLong.from_obj(system_obj.get_Available_Physical_Memory())
     system_.bios_info = BIOSInfo.from_obj(system_obj.get_BIOS_Info())
     system_.date = Date.from_obj(system_obj.get_Date())
     system_.hostname = String.from_obj(system_obj.get_Hostname())
     system_.local_time = Time.from_obj(system_obj.get_Local_Time())
     system_.network_interface_list = NetworkInterfaceList.from_obj(system_obj.get_Network_Interface_List())
     system_.os = OS.from_obj(system_obj.get_OS())
     system_.processor = String.from_obj(system_obj.get_Processor())
     system_.processor_architecture = String.from_obj(system_obj.get_Processor_Architecture())
     system_.system_time = Time.from_obj(system_obj.get_System_Time())
     system_.timezone_dst = String.from_obj(system_obj.get_Timezone_DST())
     system_.timezone_standard = String.from_obj(system_obj.get_Timezone_Standard())
     system_.total_physical_memory = UnsignedLong.from_obj(system_obj.get_Total_Physical_Memory())
     system_.uptime = Duration.from_obj(system_obj.get_Uptime())
     system_.username = String.from_obj(system_obj.get_Username())
     return system_
 def from_obj(measure_source_obj):
     if not measure_source_obj:
         return None
     measure_source_ = MeasureSource()
     measure_source_.class_ = measure_source_obj.get_class()
     measure_source_.source_type = measure_source_obj.get_source_type()
     measure_source_.name = measure_source_obj.get_name()
     measure_source_.information_source_type = VocabString.from_obj(measure_source_obj.get_Information_Source_Type())
     measure_source_.tool_type = VocabString.from_obj(measure_source_obj.get_Tool_Type())
     measure_source_.description = StructuredText.from_obj(measure_source_obj.get_Description())
     measure_source_.contributors = Personnel.from_obj(measure_source_obj.get_Contributors())
     measure_source_.time = Time.from_obj(measure_source_obj.get_Time())
     measure_source_.tools = ToolInformationList.from_obj(measure_source_obj.get_Tools())
     measure_source_.platform = None #TODO: add support
     measure_source_.system = ObjectProperties.from_obj(measure_source_obj.get_System())
     measure_source_.instance = ObjectProperties.from_obj(measure_source_obj.get_Instance())
     return measure_source_
 def from_dict(measure_source_dict):
     if not measure_source_dict:
         return None
     measure_source_ = MeasureSource()
     measure_source_.class_ = measure_source_dict.get('class')
     measure_source_.source_type = measure_source_dict.get('source_type')
     measure_source_.name = measure_source_dict.get('name')
     measure_source_.information_source_type = VocabString.from_dict(measure_source_dict.get('information_source_type'))
     measure_source_.tool_type = VocabString.from_dict(measure_source_dict.get('tool_type'))
     measure_source_.description = StructuredText.from_dict(measure_source_dict.get('description'))
     measure_source_.contributors = Personnel.from_list(measure_source_dict.get('contributors'))
     measure_source_.time = Time.from_dict(measure_source_dict.get('time'))
     measure_source_.tools = ToolInformationList.from_list(measure_source_dict.get('tools'))
     measure_source_.platform = None #TODO: add support
     measure_source_.system = ObjectProperties.from_dict(measure_source_dict.get('system'))
     measure_source_.instance = ObjectProperties.from_dict(measure_source_dict.get('instance'))
     return measure_source_
Exemplo n.º 7
0
 def from_obj(cls, obj, return_obj=None):
     if not obj:
         return None
     
     if not return_obj:
         return_obj = cls()
     
     if obj.get_Identity():
         identity_obj = obj.get_Identity()
         if isinstance(identity_obj, ciq_identity_binding.CIQIdentity3_0InstanceType):
             return_obj.identity = CIQIdentity3_0Instance.from_obj(identity_obj)
         elif type(identity_obj) == stix_common_binding.IdentityType:
             return_obj.identity = Identity.from_obj(identity_obj)
     
     if obj.get_Time():
         return_obj.time = Time.from_obj(obj.get_Time())
         
     return return_obj
Exemplo n.º 8
0
def to_stix(obj, items_to_convert=[], loaded=False, bin_fmt="raw"):
    """
    Converts a CRITs object to a STIX document.

    The resulting document includes standardized representations
    of all related objects noted within items_to_convert.

    :param items_to_convert: The list of items to convert to STIX/CybOX
    :type items_to_convert: Either a list of CRITs objects OR
                            a list of {'_type': CRITS_TYPE, '_id': CRITS_ID} dicts
    :param loaded: Set to True if you've passed a list of CRITs objects as
                    the value for items_to_convert, else leave False.
    :type loaded: bool
    :param bin_fmt: Specifies the format for Sample data encoding.
                    Options: None (don't include binary data in STIX output),
                                "raw" (include binary data as is),
                                "base64" (base64 encode binary data)

    :returns: A dict indicating which items mapped to STIX indicators, ['stix_indicators']
                which items mapped to STIX observables, ['stix_observables']
                which items are included in the resulting STIX doc, ['final_objects']
                and the STIX doc itself ['stix_obj'].
    """

    from cybox.common import Time, ToolInformationList, ToolInformation
    from stix.common import StructuredText, InformationSource
    from stix.core import STIXPackage, STIXHeader
    from stix.common.identity import Identity

    # These lists are used to determine which CRITs objects
    # go in which part of the STIX document.
    ind_list = ['Indicator']
    obs_list = [
        'Certificate', 'Domain', 'Email', 'IP', 'PCAP', 'RawData', 'Sample'
    ]
    actor_list = ['Actor']

    # Store message
    stix_msg = {
        'stix_incidents': [],
        'stix_indicators': [],
        'stix_observables': [],
        'stix_actors': [],
        'final_objects': []
    }

    if not loaded:  # if we have a list of object metadata, load it before processing
        items_to_convert = [
            class_from_id(item['_type'], item['_id'])
            for item in items_to_convert
        ]

    # add self to the list of items to STIXify
    if obj not in items_to_convert:
        items_to_convert.append(obj)

    # add any email attachments
    attachments = []
    for obj in items_to_convert:
        if obj._meta['crits_type'] == 'Email':
            for rel in obj.relationships:
                if rel.relationship == RelationshipTypes.CONTAINS:
                    atch = class_from_id('Sample', rel.object_id)
                    if atch not in items_to_convert:
                        attachments.append(atch)
    items_to_convert.extend(attachments)

    # grab ObjectId of items
    refObjs = {key.id: 0 for key in items_to_convert}

    relationships = {}
    stix = []
    from stix.indicator import Indicator as S_Ind
    for obj in items_to_convert:
        obj_type = obj._meta['crits_type']
        if obj_type == class_from_type('Event')._meta['crits_type']:
            stx, release = to_stix_incident(obj)
            stix_msg['stix_incidents'].append(stx)
        elif obj_type in ind_list:  # convert to STIX indicators
            stx, releas = to_stix_indicator(obj)
            stix_msg['stix_indicators'].append(stx)
            refObjs[obj.id] = S_Ind(idref=stx.id_)
        elif obj_type in obs_list:  # convert to CybOX observable
            if obj_type == class_from_type('Sample')._meta['crits_type']:
                stx, releas = to_cybox_observable(obj, bin_fmt=bin_fmt)
            else:
                stx, releas = to_cybox_observable(obj)

            # wrap in stix Indicator
            ind = S_Ind()
            for ob in stx:
                ind.add_observable(ob)
            ind.title = "CRITs %s Top-Level Object" % obj_type
            ind.description = ("This is simply a CRITs %s top-level "
                               "object, not actually an Indicator. "
                               "The Observable is wrapped in an Indicator"
                               " to facilitate documentation of the "
                               "relationship." % obj_type)
            ind.confidence = 'None'
            stx = ind
            stix_msg['stix_indicators'].append(stx)
            refObjs[obj.id] = S_Ind(idref=stx.id_)
        elif obj_type in actor_list:  # convert to STIX actor
            stx, releas = to_stix_actor(obj)
            stix_msg['stix_actors'].append(stx)

        # get relationships from CRITs objects
        for rel in obj.relationships:
            if rel.object_id in refObjs:
                relationships.setdefault(stx.id_, {})
                relationships[stx.id_][rel.object_id] = (
                    rel.relationship, rel.rel_confidence.capitalize(),
                    rel.rel_type)

        stix_msg['final_objects'].append(obj)
        stix.append(stx)

    # set relationships on STIX objects
    for stix_obj in stix:
        for rel in relationships.get(stix_obj.id_, {}):
            if isinstance(refObjs.get(rel), S_Ind):  # if is STIX Indicator
                stix_obj.related_indicators.append(refObjs[rel])
                rel_meta = relationships.get(stix_obj.id_)[rel]
                stix_obj.related_indicators[-1].relationship = rel_meta[0]
                stix_obj.related_indicators[-1].confidence = rel_meta[1]

                # Add any Email Attachments to CybOX EmailMessage Objects
                if isinstance(stix_obj, S_Ind):
                    if 'EmailMessage' in stix_obj.observable.object_.id_:
                        if rel_meta[0] == 'Contains' and rel_meta[
                                2] == 'Sample':
                            email = stix_obj.observable.object_.properties
                            email.attachments.append(refObjs[rel].idref)

    tool_list = ToolInformationList()
    tool = ToolInformation("CRITs", "MITRE")
    tool.version = settings.CRITS_VERSION
    tool_list.append(tool)
    i_s = InformationSource(time=Time(produced_time=datetime.now()),
                            identity=Identity(name=settings.COMPANY_NAME),
                            tools=tool_list)

    if obj._meta['crits_type'] == "Event":
        stix_desc = obj.description()
        stix_int = obj.event_type()
        stix_title = obj.title()
    else:
        stix_desc = "STIX from %s" % settings.COMPANY_NAME
        stix_int = "Collective Threat Intelligence"
        stix_title = "Threat Intelligence Sharing"
    header = STIXHeader(information_source=i_s,
                        description=StructuredText(value=stix_desc),
                        package_intents=[stix_int],
                        title=stix_title)

    stix_msg['stix_obj'] = STIXPackage(incidents=stix_msg['stix_incidents'],
                                       indicators=stix_msg['stix_indicators'],
                                       threat_actors=stix_msg['stix_actors'],
                                       stix_header=header,
                                       id_=uuid.uuid4())

    return stix_msg
Exemplo n.º 9
0
    def set_produced_time(self, produced_time):
        '''The produced date variable must be in ISO 8601 format'''
        if not self.producer.time:
            self.producer.time = Time()

        self.producer.time.produced_time = produced_time
Exemplo n.º 10
0
    def set_received_time(self, received_time):
        '''Set the time when this indicator was received'''
        if not self.producer.time:
            self.producer.time = Time()

        self.producer.time.received_time = received_time
Exemplo n.º 11
0
from stix.incident.impact_assessment import Effects
from stix.common import References

# setup stix document
stix_package = STIXPackage()

# add incident and confidence
breach = Incident()
breach.description = "Parity Wallet Hacked"
breach.confidence = "High"  # investigators were able to thoroughly validate the incident, Low means not yet validated

# stamp with reporter
breach.reporter = InformationSource()
breach.reporter.description = "https://paritytech.io/blog/security-alert.html"

breach.reporter.time = Time()
breach.reporter.time.produced_time = datetime.strptime(
    "2017-11-08", "%Y-%m-%d")  # when they submitted it

breach.reporter.identity = Identity()
breach.reporter.identity.name = "parity technologies ltd"

# set incident-specific timestamps
breach.time = incidentTime()
breach.title = "The Multi-sig Hack"
breach.time.initial_compromise = datetime.strptime("2017-11-06", "%Y-%m-%d")
breach.time.incident_discovery = datetime.strptime("2017-11-08", "%Y-%m-%d")
#breach.time.restoration_achieved = datetime.strptime("2012-08-10", "%Y-%m-%d")
breach.time.incident_reported = datetime.strptime("2017-11-08", "%Y-%m-%d")

# add the impact
Exemplo n.º 12
0
    def build(self):
        self.stix_header.title = self.pulse["name"]
        self.stix_header.description = self.pulse["description"]
        self.stix_header.short_description = "%spulse/%s" % (
            PULSE_SERVER_BASE, str(self.pulse["id"]))
        self.stix_header.package_intents.append(PackageIntent.TERM_INDICATORS)
        self.stix_header.information_source = InformationSource()
        self.stix_header.information_source.time = Time()
        self.stix_header.information_source.description = "Alienvault OTX - https://otx.alienvault.com/"
        self.stix_header.information_source.time.produced_time = self.pulse[
            "modified"]
        self.stix_header.information_source.identity = Identity()
        self.stix_header.information_source.identity.name = "Alienvault OTX"

        self.stix_package.stix_header = self.stix_header

        hashes = []
        addresses = []
        domains = []
        urls = []
        mails = []

        for p_indicator in self.pulse["indicators"]:
            if p_indicator["type"] in self.hash_translation:
                new_ind = Indicator()
                new_ind.description = p_indicator["description"]
                new_ind.title = "%s from %spulse/%s" % (
                    p_indicator["indicator"], PULSE_SERVER_BASE,
                    str(self.pulse["id"]))
                file_ = File()
                hash_ = Hash(p_indicator["indicator"],
                             self.hash_translation[p_indicator["type"]])
                file_.add_hash(hash_)
                observable_ = Observable(file_)

            elif p_indicator["type"] in self.address_translation:
                new_ind = Indicator()
                new_ind.description = p_indicator["description"]
                new_ind.title = "%s from %spulse/%s" % (
                    p_indicator["indicator"], PULSE_SERVER_BASE,
                    str(self.pulse["id"]))
                ipv4_ = Address.from_dict({
                    'address_value':
                    p_indicator["indicator"],
                    'category':
                    self.address_translation[p_indicator["type"]]
                })
                observable_ = Observable(ipv4_)

            elif p_indicator["type"] in self.name_translation:
                new_ind = Indicator()
                new_ind.description = p_indicator["description"]
                new_ind.title = "%s from %spulse/%s" % (
                    p_indicator["indicator"], PULSE_SERVER_BASE,
                    str(self.pulse["id"]))
                domain_ = DomainName.from_dict({
                    'value':
                    p_indicator["indicator"],
                    'type':
                    'FQDN'
                })
                observable_ = Observable(domain_)

            elif p_indicator["type"] == "URL":
                new_ind = Indicator()
                new_ind.description = p_indicator["description"]
                new_ind.title = "%s from %spulse/%s" % (
                    p_indicator["indicator"], PULSE_SERVER_BASE,
                    str(self.pulse["id"]))
                url_ = URI.from_dict({
                    'value': p_indicator["indicator"],
                    'type': URI.TYPE_URL
                })
                observable_ = Observable(url_)

            elif p_indicator["type"] == "email":
                email_ = Address.from_dict({
                    'address_value':
                    p_indicator["indicator"],
                    'category':
                    Address.CAT_EMAIL
                })
                observable_ = Observable(email_)

            # elif p_indicator["type"] == "CVE":
            #    vuln_ = Vulnerability()
            #    vuln_.cveid = p_indicator["indicator"].upper()
            #    observable_ = Observable(vuln_)

            elif p_indicator["type"] == "Mutex":
                mutex_ = Mutex.from_dict({
                    'named': True,
                    'name': p_indicator["indicator"]
                })
                observable_ = Observable(mutex_)

            elif p_indicator["type"] == "CIDR":
                nrange = IP(p_indicator["indicator"])
                nrange_values = nrange.strNormal(3).replace("-", ",")
                ipv4_ = Address.from_dict({
                    'address_value': nrange_values,
                    'category': Address.CAT_IPV4
                })
                ipv4_.address_value.condition = "InclusiveBetween"
                observable_ = Observable(ipv4_)

            else:
                continue

            mind = Indicator()
            mind.description = p_indicator["description"]
            mind.title = "%s from %spulse/%s" % (p_indicator["indicator"],
                                                 PULSE_SERVER_BASE,
                                                 str(self.pulse["id"]))
            observable_.title = "%s - %s" % (p_indicator["type"],
                                             p_indicator["indicator"])
            mind.add_observable(observable_)
            self.stix_package.add_indicator(mind)