RubyIOC 0.0.1 → 0.0.2
Sign up to get free protection for your applications and to get access to all the features.
- data/.gitignore +19 -19
- data/Gemfile +3 -3
- data/Rakefile +7 -7
- data/RubyIOC.gemspec +24 -24
- data/iocaware.iocterms +12 -0
- data/lib/RubyIOC.rb +38 -38
- data/lib/RubyIOC/iocitem/arp_entry_item.rb +86 -1
- data/lib/RubyIOC/iocitem/dns_entry_item.rb +47 -11
- data/lib/RubyIOC/iocitem/event_log_item.rb +49 -0
- data/lib/RubyIOC/iocitem/port_item.rb +117 -0
- data/lib/RubyIOC/iocitem/service_item.rb +100 -0
- data/lib/RubyIOC/iocitem/user_item.rb +1 -1
- data/lib/RubyIOC/iocitem/volume_item.rb +65 -0
- data/lib/RubyIOC/platform.rb +2 -2
- data/lib/RubyIOC/scanner.rb +15 -28
- data/lib/RubyIOC/version.rb +15 -15
- data/test/test_arp_entry_item.ioc +57 -0
- data/test/test_dns_entry_item.ioc +26 -5
- data/test/test_event_log_item.ioc +55 -0
- data/test/test_port_item.ioc +51 -0
- data/test/test_scan.rb +29 -4
- data/test/test_service_item.ioc +143 -0
- data/test/test_user_item.ioc +9 -8
- data/test/test_volume_item.ioc +63 -0
- metadata +16 -5
|
@@ -16,7 +16,107 @@ module RubyIOC
|
|
|
16
16
|
def get_type
|
|
17
17
|
"ServiceItem"
|
|
18
18
|
end
|
|
19
|
+
|
|
20
|
+
def scan(indicator)
|
|
21
|
+
if RubyIOC::Platform.windows?
|
|
22
|
+
return search_windows_services(indicator)
|
|
23
|
+
else
|
|
24
|
+
puts "Not implemented on this platform yet"
|
|
25
|
+
end
|
|
26
|
+
end
|
|
27
|
+
|
|
28
|
+
def search_windows_services(indicator)
|
|
29
|
+
wmi = WIN32OLE.connect("winmgmts:\\")
|
|
30
|
+
query = "Select * from Win32_Service where "
|
|
31
|
+
getLogicalDisk = false
|
|
32
|
+
|
|
33
|
+
servicemodetypes = Hash[
|
|
34
|
+
"SERVICE_AUTO_START" => "Auto",
|
|
35
|
+
"SERVICE_BOOT_START" => "Boot",
|
|
36
|
+
"SERVICE_DEMAND_START" => "Manual",
|
|
37
|
+
"SERVICE_DISABLED" => "Disabled",
|
|
38
|
+
"SERVICE_SYSTEM_START" => "System",
|
|
39
|
+
]
|
|
40
|
+
|
|
41
|
+
servicestatustypes = Hash[
|
|
42
|
+
"SERVICE_CONTINUE_PENDING" => "Continue Pending",
|
|
43
|
+
"SERVICE_PAUSE_PENDING" => "Pause Pending",
|
|
44
|
+
"SERVICE_PAUSED" => "Paused",
|
|
45
|
+
"SERVICE_RUNNING" => "Running",
|
|
46
|
+
"SERVICE_START_PENDING" => "Start Pending",
|
|
47
|
+
"SERVICE_STOP_PENDING" => "Stop Pending",
|
|
48
|
+
"SERVICE_STOPPED" => "Stopped",
|
|
49
|
+
#***#
|
|
50
|
+
"SERVICE_UNKNOWN" => "Unknown"
|
|
51
|
+
]
|
|
52
|
+
|
|
53
|
+
servicetypetypes = Hash[
|
|
54
|
+
"SERVICE_KERNEL_DRIVER" => "Kernel Driver",
|
|
55
|
+
"SERVICE_FILE_SYSTEM_DRIVER" => "File System Driver",
|
|
56
|
+
"SERVICE_WIN32_OWN_PROCESS" => "Own Process",
|
|
57
|
+
"SERVICE_WIN32_SHARE_PROCESS" => "Share Process",
|
|
58
|
+
#***#
|
|
59
|
+
"SERVICE_ADAPTER" => "Adapter",
|
|
60
|
+
"SERVICE_RECOGNIZER_DRIVER" => "Recognizer Driver",
|
|
61
|
+
"SERVICE_WIN32_INTERACTIVE_PROCESS" => "Interactive Process"
|
|
62
|
+
]
|
|
63
|
+
|
|
64
|
+
indicator.each { |i|
|
|
65
|
+
case i[:search]
|
|
66
|
+
when "ServiceItem/arguments"
|
|
67
|
+
when "ServiceItem/description"
|
|
68
|
+
query += "Description like '%#{i[:content]}%' "
|
|
69
|
+
when "ServiceItem/descriptiveName"
|
|
70
|
+
query += "DisplayName = '#{i[:content]}' "
|
|
71
|
+
when "ServiceItem/serviceDLL"
|
|
72
|
+
when "ServiceItem/serviceDLLCertificateIssuer"
|
|
73
|
+
when "ServiceItem/serviceDLLCertificateSubject"
|
|
74
|
+
when "ServiceItem/serviceDLLmd5sum"
|
|
75
|
+
when "ServiceItem/serviceDLLsha1sum"
|
|
76
|
+
when "ServiceItem/serviceDLLsha256sum"
|
|
77
|
+
when "ServiceItem/serviceDLLSignatureDescription"
|
|
78
|
+
when "ServiceItem/serviceDLLSignatureVerified"
|
|
79
|
+
when "ServiceItem/serviceDLLSignatureExists"
|
|
80
|
+
when "ServiceItem/mode"
|
|
81
|
+
query += "StartMode = '#{servicemodetypes[i[:content]]}' "
|
|
82
|
+
when "ServiceItem/name"
|
|
83
|
+
query += "Name = '#{i[:content]}' "
|
|
84
|
+
when "ServiceItem/path"
|
|
85
|
+
content = i[:content].gsub("\\", "\\\\\\\\")
|
|
86
|
+
query += "PathName like '%#{[content]}%' "
|
|
87
|
+
when "ServiceItem/pathCertificateIssuer"
|
|
88
|
+
when "ServiceItem/pathCertificateSubject"
|
|
89
|
+
when "ServiceItem/pathmd5sum"
|
|
90
|
+
when "ServiceItem/pathsha1sum"
|
|
91
|
+
when "ServiceItem/pathsha256sum"
|
|
92
|
+
when "ServiceItem/pathSignatureDescription"
|
|
93
|
+
when "ServiceItem/pathSignatureExists"
|
|
94
|
+
when "ServiceItem/pathSignatureVerified"
|
|
95
|
+
when "ServiceItem/pid"
|
|
96
|
+
query += "ProcessID = #{i[:content]} "
|
|
97
|
+
when "ServiceItem/startedAs"
|
|
98
|
+
query += "StartName = '#{i[:content]}' "
|
|
99
|
+
when "ServiceItem/status"
|
|
100
|
+
query += "State = '#{servicestatustypes[i[:content]]}' "
|
|
101
|
+
when "ServiceItem/type"
|
|
102
|
+
query += "ServiceType = '#{servicetypetypes[i[:content]]}' "
|
|
103
|
+
when "ServiceItem/serviceDLLMd54Ksum"
|
|
104
|
+
when "ServiceItem/serviceDLLSha512Sum"
|
|
105
|
+
when "ServiceItem/serviceDLLSsdeep"
|
|
106
|
+
when "ServiceItem/pathMd54ksum"
|
|
107
|
+
when "ServiceItem/pathSha512sum"
|
|
108
|
+
when "ServiceItem/pathSsdeep"
|
|
109
|
+
end
|
|
110
|
+
}
|
|
111
|
+
|
|
112
|
+
services = wmi.ExecQuery(query)
|
|
113
|
+
services.each { |s|
|
|
114
|
+
return true
|
|
115
|
+
}
|
|
116
|
+
return false
|
|
117
|
+
end
|
|
19
118
|
end
|
|
119
|
+
|
|
20
120
|
|
|
21
121
|
class ServiceItemFactory < RubyIOC::IOCItem::IOCItemFactory
|
|
22
122
|
def get_type
|
|
@@ -16,6 +16,71 @@ module RubyIOC
|
|
|
16
16
|
def get_type
|
|
17
17
|
"VolumeItem"
|
|
18
18
|
end
|
|
19
|
+
|
|
20
|
+
def scan(indicator)
|
|
21
|
+
if RubyIOC::Platform.windows?
|
|
22
|
+
return search_windows_volumes(indicator)
|
|
23
|
+
else
|
|
24
|
+
puts "Not implemented on this platform yet"
|
|
25
|
+
end
|
|
26
|
+
end
|
|
27
|
+
|
|
28
|
+
def search_windows_volumes(indicator)
|
|
29
|
+
wmi = WIN32OLE.connect("winmgmts:\\")
|
|
30
|
+
query = ""
|
|
31
|
+
getLogicalDisk = false
|
|
32
|
+
|
|
33
|
+
voltypes = Hash[
|
|
34
|
+
"DRIVE_UNKNOWN" => "0",
|
|
35
|
+
"DRIVE_NO_ROOT_DIR" => "1",
|
|
36
|
+
"DRIVE_REMOVABLE" => "2",
|
|
37
|
+
"DRIVE_FIXED" => "3",
|
|
38
|
+
"DRIVE_REMOTE" => "4",
|
|
39
|
+
"DRIVE_CDROM" => "5",
|
|
40
|
+
"DRIVE_RAMDISK" => "6"
|
|
41
|
+
]
|
|
42
|
+
|
|
43
|
+
indicator.each { |i|
|
|
44
|
+
case i[:search]
|
|
45
|
+
when "VolumeItem/ActualAvailableAllocationUnits"
|
|
46
|
+
query += "FreeSpace = #{i[:content]} "
|
|
47
|
+
when "VolumeItem/BytesPerSector"
|
|
48
|
+
query += "BlockSize = #{i[:content]} "
|
|
49
|
+
when "VolumeItem/CreationTime"
|
|
50
|
+
query += "InstallDate = '#{i[:content]}' "
|
|
51
|
+
when "VolumeItem/DevicePath"
|
|
52
|
+
when "VolumeItem/DriveLetter"
|
|
53
|
+
query += "DriveLetter = '#{i[:content]}' "
|
|
54
|
+
when "VolumeItem/FileSystemFlags"
|
|
55
|
+
when "VolumeItem/FileSystemName"
|
|
56
|
+
query += "FileSystem = '#{i[:content]}' "
|
|
57
|
+
getLogicalDisk = true
|
|
58
|
+
when "VolumeItem/IsMounted"
|
|
59
|
+
when "VolumeItem/Name"
|
|
60
|
+
query += "VolumeName = '#{i[:content]}' "
|
|
61
|
+
getLogicalDisk = true
|
|
62
|
+
when "VolumeItem/SectorsPerAllocationUnit"
|
|
63
|
+
when "VolumeItem/SerialNumber"
|
|
64
|
+
query += "SerialNumber = '#{i[:content]}' "
|
|
65
|
+
when "VolumeItem/TotalAllocationUnits"
|
|
66
|
+
query += "Capacity = #{i[:content]} "
|
|
67
|
+
when "VolumeItem/Type"
|
|
68
|
+
query += "DriveType = #{voltypes[i[:content]]} "
|
|
69
|
+
end
|
|
70
|
+
}
|
|
71
|
+
|
|
72
|
+
if getLogicalDisk then
|
|
73
|
+
query = "Select * from Win32_LogicalDisk where " + query
|
|
74
|
+
else
|
|
75
|
+
query = "Select * from Win32_Volume where " + query
|
|
76
|
+
end
|
|
77
|
+
|
|
78
|
+
volumes = wmi.ExecQuery(query)
|
|
79
|
+
volumes.each { |v|
|
|
80
|
+
return true
|
|
81
|
+
}
|
|
82
|
+
return false
|
|
83
|
+
end
|
|
19
84
|
end
|
|
20
85
|
|
|
21
86
|
class VolumeItemFactory < RubyIOC::IOCItem::IOCItemFactory
|
data/lib/RubyIOC/platform.rb
CHANGED
|
@@ -33,7 +33,7 @@ module RubyIOC
|
|
|
33
33
|
end
|
|
34
34
|
|
|
35
35
|
def mac?
|
|
36
|
-
RubyIOC::Platform.is? /mac
|
|
36
|
+
RubyIOC::Platform.is? /darwin|mac/
|
|
37
37
|
end
|
|
38
38
|
|
|
39
39
|
def bsd?
|
|
@@ -41,7 +41,7 @@ module RubyIOC
|
|
|
41
41
|
end
|
|
42
42
|
|
|
43
43
|
def windows?
|
|
44
|
-
RubyIOC::Platform.is? /mswin|
|
|
44
|
+
RubyIOC::Platform.is? /mswin|mingw/
|
|
45
45
|
end
|
|
46
46
|
|
|
47
47
|
def solaris?
|
data/lib/RubyIOC/scanner.rb
CHANGED
|
@@ -26,7 +26,7 @@ module RubyIOC
|
|
|
26
26
|
@ioc.indicators.each { |i|
|
|
27
27
|
results << process_indicators(i, results)
|
|
28
28
|
}
|
|
29
|
-
|
|
29
|
+
return results
|
|
30
30
|
end
|
|
31
31
|
|
|
32
32
|
def get_all_results(items, results)
|
|
@@ -68,42 +68,29 @@ module RubyIOC
|
|
|
68
68
|
|
|
69
69
|
def process_indicators(i, results)
|
|
70
70
|
res = {}
|
|
71
|
-
search_item = []
|
|
72
71
|
res[i.id] = {}
|
|
73
72
|
res[i.id]['items'] = []
|
|
74
73
|
res[i.id]['operator'] = i.operator
|
|
75
74
|
res[i.id]['indicators'] = []
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
else
|
|
90
|
-
i.indicator_item.each { | inditem |
|
|
91
|
-
tmp = {}
|
|
92
|
-
tmp[:document] = inditem.document
|
|
93
|
-
tmp[:search] = inditem.search
|
|
94
|
-
tmp[:condition] = inditem.condition
|
|
95
|
-
tmp[:content_type] = inditem.content_type
|
|
96
|
-
tmp[:content] = inditem.content
|
|
97
|
-
tmp[:context_type] = inditem.context_type
|
|
98
|
-
search_item << tmp
|
|
99
|
-
res[i.id]['indicators'] << RubyIOC::IOCItem::IOCItemFactory.item_for(inditem.document).scan(search_item)
|
|
100
|
-
}
|
|
101
|
-
end
|
|
75
|
+
i.indicator_item.each { | inditem |
|
|
76
|
+
search_item = []
|
|
77
|
+
tmp = {}
|
|
78
|
+
tmp[:document] = inditem.document
|
|
79
|
+
tmp[:search] = inditem.search
|
|
80
|
+
tmp[:condition] = inditem.condition
|
|
81
|
+
tmp[:content_type] = inditem.content_type
|
|
82
|
+
tmp[:content] = inditem.content
|
|
83
|
+
tmp[:context_type] = inditem.context_type
|
|
84
|
+
search_item << tmp
|
|
85
|
+
res[i.id]['indicators'] << RubyIOC::IOCItem::IOCItemFactory.item_for(inditem.document).scan(search_item)
|
|
86
|
+
}
|
|
87
|
+
|
|
102
88
|
i.indicators.each { |ii |
|
|
103
89
|
process_indicators(ii, res[i.id]['items'])
|
|
104
90
|
}
|
|
105
91
|
res[i.id]['result'] = get_result(i.operator, res[i.id])
|
|
106
92
|
results << res
|
|
93
|
+
return results
|
|
107
94
|
end
|
|
108
95
|
|
|
109
96
|
end
|
data/lib/RubyIOC/version.rb
CHANGED
|
@@ -1,15 +1,15 @@
|
|
|
1
|
-
# Copyright (c) 2013 Matt Jezorek
|
|
2
|
-
#
|
|
3
|
-
# Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"),
|
|
4
|
-
# to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense,
|
|
5
|
-
# and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
|
|
6
|
-
#
|
|
7
|
-
# The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
|
|
8
|
-
#
|
|
9
|
-
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
10
|
-
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
11
|
-
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
|
|
12
|
-
# IN THE SOFTWARE.
|
|
13
|
-
module RubyIOC
|
|
14
|
-
VERSION = "0.0.
|
|
15
|
-
end
|
|
1
|
+
# Copyright (c) 2013 Matt Jezorek
|
|
2
|
+
#
|
|
3
|
+
# Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"),
|
|
4
|
+
# to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense,
|
|
5
|
+
# and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
|
|
6
|
+
#
|
|
7
|
+
# The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
|
|
8
|
+
#
|
|
9
|
+
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
10
|
+
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
11
|
+
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
|
|
12
|
+
# IN THE SOFTWARE.
|
|
13
|
+
module RubyIOC
|
|
14
|
+
VERSION = "0.0.2"
|
|
15
|
+
end
|
|
@@ -0,0 +1,57 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="us-ascii"?>
|
|
2
|
+
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="868b1eaa-7d68-4634-9572-a0d442e71814" last-modified="2013-08-04T03:44:46" xmlns="http://schemas.mandiant.com/2010/ioc">
|
|
3
|
+
<short_description>*ARP Entry Test IOC*</short_description>
|
|
4
|
+
<authored_by>IOCAware</authored_by>
|
|
5
|
+
<authored_date>2013-06-17T18:00:55</authored_date>
|
|
6
|
+
<links />
|
|
7
|
+
<definition>
|
|
8
|
+
<Indicator operator="OR" id="063979a1-df60-48c8-b514-5d226f192322">
|
|
9
|
+
<Indicator operator="AND" id="ea7f3691-a790-4295-93ce-58ef7ccdcebb">
|
|
10
|
+
<IndicatorItem id="7cc9932d-64e5-478e-ae28-b676ce033fa1" condition="contains">
|
|
11
|
+
<Context document="ArpEntryItem" search="ArpEntryItem/IPv4Address" type="mir" />
|
|
12
|
+
<Content type="IP">192.168.1.1</Content>
|
|
13
|
+
</IndicatorItem>
|
|
14
|
+
<IndicatorItem id="8f2280f7-ad34-4718-8f7c-32ba28c71f5c" condition="contains">
|
|
15
|
+
<Context document="ArpEntryItem" search="ArpEntryItem/PhysicalAddress" type="mir" />
|
|
16
|
+
<Content type="string">f0:d1:a9:08:6a:60</Content>
|
|
17
|
+
</IndicatorItem>
|
|
18
|
+
<IndicatorItem id="17c2ad4f-3f8f-43fa-8aee-e19df4afbae9" condition="contains">
|
|
19
|
+
<Context document="ArpEntryItem" search="ArpEntryItem/Interface" type="mir" />
|
|
20
|
+
<Content type="IP">en1</Content>
|
|
21
|
+
</IndicatorItem>
|
|
22
|
+
</Indicator>
|
|
23
|
+
<Indicator operator="AND" id="8757b126-6b67-47f6-b77a-8158c0a71116">
|
|
24
|
+
<IndicatorItem id="ba09a245-63b0-4657-9402-f8ecb13693a6" condition="contains">
|
|
25
|
+
<Context document="ArpEntryItem" search="ArpEntryItem/Interface" type="mir" />
|
|
26
|
+
<Content type="IP">eth0</Content>
|
|
27
|
+
</IndicatorItem>
|
|
28
|
+
<IndicatorItem id="4269d1ab-0b04-4a67-8946-9ca23d6257e0" condition="contains">
|
|
29
|
+
<Context document="ArpEntryItem" search="ArpEntryItem/IPv4Address" type="mir" />
|
|
30
|
+
<Content type="IP">192.168.1.1</Content>
|
|
31
|
+
</IndicatorItem>
|
|
32
|
+
<IndicatorItem id="7c19b193-86be-455f-8be0-13075cb08b04" condition="contains">
|
|
33
|
+
<Context document="ArpEntryItem" search="ArpEntryItem/PhysicalAddress" type="mir" />
|
|
34
|
+
<Content type="string">f0:d1:a9:08:6a:60</Content>
|
|
35
|
+
</IndicatorItem>
|
|
36
|
+
</Indicator>
|
|
37
|
+
<Indicator operator="AND" id="c2a54d35-2c29-4526-8177-db9829985bb6">
|
|
38
|
+
<IndicatorItem id="6776d766-9ef9-445c-8e94-f1da9364a8f9" condition="contains">
|
|
39
|
+
<Context document="ArpEntryItem" search="ArpEntryItem/Interface" type="mir" />
|
|
40
|
+
<Content type="IP">0xc</Content>
|
|
41
|
+
</IndicatorItem>
|
|
42
|
+
<IndicatorItem id="656d1f71-8bde-4ed0-8a6f-7667d523aedb" condition="contains">
|
|
43
|
+
<Context document="ArpEntryItem" search="ArpEntryItem/CacheType" type="mir" />
|
|
44
|
+
<Content type="string">Dynamic</Content>
|
|
45
|
+
</IndicatorItem>
|
|
46
|
+
<IndicatorItem id="d4533bab-5a5d-4869-9a31-3da0b4a82e45" condition="contains">
|
|
47
|
+
<Context document="ArpEntryItem" search="ArpEntryItem/IPv4Address" type="mir" />
|
|
48
|
+
<Content type="IP">192.168.237.2</Content>
|
|
49
|
+
</IndicatorItem>
|
|
50
|
+
<IndicatorItem id="ab9d4e19-d472-4ec3-a63e-f1e9606daed3" condition="contains">
|
|
51
|
+
<Context document="ArpEntryItem" search="ArpEntryItem/PhysicalAddress" type="mir" />
|
|
52
|
+
<Content type="string">00:50:56:ff:ad:9a</Content>
|
|
53
|
+
</IndicatorItem>
|
|
54
|
+
</Indicator>
|
|
55
|
+
</Indicator>
|
|
56
|
+
</definition>
|
|
57
|
+
</ioc>
|
|
@@ -1,14 +1,35 @@
|
|
|
1
1
|
<?xml version="1.0" encoding="us-ascii"?>
|
|
2
|
-
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="efce87c7-f78f-4e32-8f3f-b470d1ec693f" last-modified="2013-
|
|
3
|
-
<short_description>*
|
|
2
|
+
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="efce87c7-f78f-4e32-8f3f-b470d1ec693f" last-modified="2013-08-04T03:43:19" xmlns="http://schemas.mandiant.com/2010/ioc">
|
|
3
|
+
<short_description>*DNS Entry Test IOC*</short_description>
|
|
4
|
+
<authored_by>IOCAware</authored_by>
|
|
4
5
|
<authored_date>2013-01-07T01:25:50</authored_date>
|
|
5
6
|
<links />
|
|
6
7
|
<definition>
|
|
7
8
|
<Indicator operator="OR" id="336a594b-3302-4ac8-9512-4f329d660515">
|
|
8
9
|
<IndicatorItem id="1d1ca6f3-6bf9-4c8a-812e-3e9879f5ad29" condition="contains">
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
10
|
+
<Context document="DnsEntryItem" search="DnsEntryItem/Host" type="mir" />
|
|
11
|
+
<Content type="string">www.yahoo.com</Content>
|
|
12
|
+
</IndicatorItem>
|
|
13
|
+
<IndicatorItem id="03ff5739-b4e8-47ba-9731-cc05399e3bb1" condition="is">
|
|
14
|
+
<Context document="DnsEntryItem" search="DnsEntryItem/DataLength" type="mir" />
|
|
15
|
+
<Content type="int">8</Content>
|
|
16
|
+
</IndicatorItem>
|
|
17
|
+
<IndicatorItem id="82b571d3-9432-4cf2-af87-f9d1926cebf5" condition="contains">
|
|
18
|
+
<Context document="DnsEntryItem" search="DnsEntryItem/RecordName" type="mir" />
|
|
19
|
+
<Content type="string">www.yahoo.com</Content>
|
|
20
|
+
</IndicatorItem>
|
|
21
|
+
<IndicatorItem id="5263a013-3877-4038-a441-e7fae573820f" condition="contains">
|
|
22
|
+
<Context document="DnsEntryItem" search="DnsEntryItem/RecordType" type="mir" />
|
|
23
|
+
<Content type="string">5</Content>
|
|
24
|
+
</IndicatorItem>
|
|
25
|
+
<IndicatorItem id="1d8e01c5-9840-4244-97d9-72c3ea50e61a" condition="contains">
|
|
26
|
+
<Context document="DnsEntryItem" search="DnsEntryItem/TimeToLive" type="mir" />
|
|
27
|
+
<Content type="string">2</Content>
|
|
28
|
+
</IndicatorItem>
|
|
29
|
+
<IndicatorItem id="cf3a83a1-aac3-4730-9efb-302e919f841f" condition="contains">
|
|
30
|
+
<Context document="DnsEntryItem" search="DnsEntryItem/RecordData/IPv4Address" type="mir" />
|
|
31
|
+
<Content type="IP">192.168.237.128</Content>
|
|
32
|
+
</IndicatorItem>
|
|
12
33
|
</Indicator>
|
|
13
34
|
</definition>
|
|
14
35
|
</ioc>
|
|
@@ -0,0 +1,55 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="us-ascii"?>
|
|
2
|
+
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="5a36460c-a57c-4cfd-9731-f3494af1fd19" last-modified="2013-08-04T03:43:19" xmlns="http://schemas.mandiant.com/2010/ioc">
|
|
3
|
+
<short_description>*EventLog Entry Test IOC*</short_description>
|
|
4
|
+
<authored_by>IOCAware</authored_by>
|
|
5
|
+
<authored_date>2013-08-01T15:25:30</authored_date>
|
|
6
|
+
<links />
|
|
7
|
+
<definition>
|
|
8
|
+
<Indicator operator="OR" id="8909fba8-d368-4dfb-80e9-3c5bc1414d18">
|
|
9
|
+
<IndicatorItem id="2011b44a-3ae5-4913-b3e5-9de81449cdcb" condition="contains">
|
|
10
|
+
<Context document="EventLogItem" search="EventLogItem/category" type="mir" />
|
|
11
|
+
<Content type="string">Startup of the UMDF reflector</Content>
|
|
12
|
+
</IndicatorItem>
|
|
13
|
+
<IndicatorItem id="a60acc9e-677f-4e3f-853c-fa4d3a55d800" condition="contains">
|
|
14
|
+
<Context document="EventLogItem" search="EventLogItem/categoryNum" type="mir" />
|
|
15
|
+
<Content type="string">101</Content>
|
|
16
|
+
</IndicatorItem>
|
|
17
|
+
<IndicatorItem id="23a5f59d-8aa0-4301-a4e0-f2dbcad956ab" condition="is">
|
|
18
|
+
<Context document="EventLogItem" search="EventLogItem/genTime" type="mir" />
|
|
19
|
+
<Content type="date">20121120204608.735041-000</Content>
|
|
20
|
+
</IndicatorItem>
|
|
21
|
+
<IndicatorItem id="38c618d6-8699-46d6-b9dc-c772911b21c8" condition="is">
|
|
22
|
+
<Context document="EventLogItem" search="EventLogItem/EID" type="mir" />
|
|
23
|
+
<Content type="int">5615</Content>
|
|
24
|
+
</IndicatorItem>
|
|
25
|
+
<IndicatorItem id="eb983742-4953-4c76-94fb-5b2c699acd94" condition="contains">
|
|
26
|
+
<Context document="EventLogItem" search="EventLogItem/log" type="mir" />
|
|
27
|
+
<Content type="string">System</Content>
|
|
28
|
+
</IndicatorItem>
|
|
29
|
+
<IndicatorItem id="a567613d-f99f-4030-b232-47dd49fd0c16" condition="contains">
|
|
30
|
+
<Context document="EventLogItem" search="EventLogItem/machine" type="mir" />
|
|
31
|
+
<Content type="string">Win8</Content>
|
|
32
|
+
</IndicatorItem>
|
|
33
|
+
<IndicatorItem id="3b5758ac-d356-4912-921f-99744e9a8716" condition="contains">
|
|
34
|
+
<Context document="EventLogItem" search="EventLogItem/message" type="mir" />
|
|
35
|
+
<Content type="string">P1: 7.8.9200.16465</Content>
|
|
36
|
+
</IndicatorItem>
|
|
37
|
+
<IndicatorItem id="89ba60af-ab43-47dd-aa22-46dbbe9c8c19" condition="contains">
|
|
38
|
+
<Context document="EventLogItem" search="EventLogItem/source" type="mir" />
|
|
39
|
+
<Content type="string">MsiInstaller</Content>
|
|
40
|
+
</IndicatorItem>
|
|
41
|
+
<IndicatorItem id="f4618c66-92f1-468e-bee9-288404469100" condition="contains">
|
|
42
|
+
<Context document="EventLogItem" search="EventLogItem/type" type="mir" />
|
|
43
|
+
<Content type="string">Error</Content>
|
|
44
|
+
</IndicatorItem>
|
|
45
|
+
<IndicatorItem id="77ae9c7e-c1cf-4ebd-8abc-c9156351249f" condition="contains">
|
|
46
|
+
<Context document="EventLogItem" search="EventLogItem/user" type="mir" />
|
|
47
|
+
<Content type="string">SYSTEM</Content>
|
|
48
|
+
</IndicatorItem>
|
|
49
|
+
<IndicatorItem id="55b298ba-7fa2-4faf-9853-c9ae4c2964fb" condition="is">
|
|
50
|
+
<Context document="EventLogItem" search="EventLogItem/writeTime" type="mir" />
|
|
51
|
+
<Content type="date">20121228232521.930418-000</Content>
|
|
52
|
+
</IndicatorItem>
|
|
53
|
+
</Indicator>
|
|
54
|
+
</definition>
|
|
55
|
+
</ioc>
|