RubyIOC 0.0.1 → 0.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- data/.gitignore +19 -19
- data/Gemfile +3 -3
- data/Rakefile +7 -7
- data/RubyIOC.gemspec +24 -24
- data/iocaware.iocterms +12 -0
- data/lib/RubyIOC.rb +38 -38
- data/lib/RubyIOC/iocitem/arp_entry_item.rb +86 -1
- data/lib/RubyIOC/iocitem/dns_entry_item.rb +47 -11
- data/lib/RubyIOC/iocitem/event_log_item.rb +49 -0
- data/lib/RubyIOC/iocitem/port_item.rb +117 -0
- data/lib/RubyIOC/iocitem/service_item.rb +100 -0
- data/lib/RubyIOC/iocitem/user_item.rb +1 -1
- data/lib/RubyIOC/iocitem/volume_item.rb +65 -0
- data/lib/RubyIOC/platform.rb +2 -2
- data/lib/RubyIOC/scanner.rb +15 -28
- data/lib/RubyIOC/version.rb +15 -15
- data/test/test_arp_entry_item.ioc +57 -0
- data/test/test_dns_entry_item.ioc +26 -5
- data/test/test_event_log_item.ioc +55 -0
- data/test/test_port_item.ioc +51 -0
- data/test/test_scan.rb +29 -4
- data/test/test_service_item.ioc +143 -0
- data/test/test_user_item.ioc +9 -8
- data/test/test_volume_item.ioc +63 -0
- metadata +16 -5
|
@@ -16,7 +16,107 @@ module RubyIOC
|
|
|
16
16
|
def get_type
|
|
17
17
|
"ServiceItem"
|
|
18
18
|
end
|
|
19
|
+
|
|
20
|
+
def scan(indicator)
|
|
21
|
+
if RubyIOC::Platform.windows?
|
|
22
|
+
return search_windows_services(indicator)
|
|
23
|
+
else
|
|
24
|
+
puts "Not implemented on this platform yet"
|
|
25
|
+
end
|
|
26
|
+
end
|
|
27
|
+
|
|
28
|
+
def search_windows_services(indicator)
|
|
29
|
+
wmi = WIN32OLE.connect("winmgmts:\\")
|
|
30
|
+
query = "Select * from Win32_Service where "
|
|
31
|
+
getLogicalDisk = false
|
|
32
|
+
|
|
33
|
+
servicemodetypes = Hash[
|
|
34
|
+
"SERVICE_AUTO_START" => "Auto",
|
|
35
|
+
"SERVICE_BOOT_START" => "Boot",
|
|
36
|
+
"SERVICE_DEMAND_START" => "Manual",
|
|
37
|
+
"SERVICE_DISABLED" => "Disabled",
|
|
38
|
+
"SERVICE_SYSTEM_START" => "System",
|
|
39
|
+
]
|
|
40
|
+
|
|
41
|
+
servicestatustypes = Hash[
|
|
42
|
+
"SERVICE_CONTINUE_PENDING" => "Continue Pending",
|
|
43
|
+
"SERVICE_PAUSE_PENDING" => "Pause Pending",
|
|
44
|
+
"SERVICE_PAUSED" => "Paused",
|
|
45
|
+
"SERVICE_RUNNING" => "Running",
|
|
46
|
+
"SERVICE_START_PENDING" => "Start Pending",
|
|
47
|
+
"SERVICE_STOP_PENDING" => "Stop Pending",
|
|
48
|
+
"SERVICE_STOPPED" => "Stopped",
|
|
49
|
+
#***#
|
|
50
|
+
"SERVICE_UNKNOWN" => "Unknown"
|
|
51
|
+
]
|
|
52
|
+
|
|
53
|
+
servicetypetypes = Hash[
|
|
54
|
+
"SERVICE_KERNEL_DRIVER" => "Kernel Driver",
|
|
55
|
+
"SERVICE_FILE_SYSTEM_DRIVER" => "File System Driver",
|
|
56
|
+
"SERVICE_WIN32_OWN_PROCESS" => "Own Process",
|
|
57
|
+
"SERVICE_WIN32_SHARE_PROCESS" => "Share Process",
|
|
58
|
+
#***#
|
|
59
|
+
"SERVICE_ADAPTER" => "Adapter",
|
|
60
|
+
"SERVICE_RECOGNIZER_DRIVER" => "Recognizer Driver",
|
|
61
|
+
"SERVICE_WIN32_INTERACTIVE_PROCESS" => "Interactive Process"
|
|
62
|
+
]
|
|
63
|
+
|
|
64
|
+
indicator.each { |i|
|
|
65
|
+
case i[:search]
|
|
66
|
+
when "ServiceItem/arguments"
|
|
67
|
+
when "ServiceItem/description"
|
|
68
|
+
query += "Description like '%#{i[:content]}%' "
|
|
69
|
+
when "ServiceItem/descriptiveName"
|
|
70
|
+
query += "DisplayName = '#{i[:content]}' "
|
|
71
|
+
when "ServiceItem/serviceDLL"
|
|
72
|
+
when "ServiceItem/serviceDLLCertificateIssuer"
|
|
73
|
+
when "ServiceItem/serviceDLLCertificateSubject"
|
|
74
|
+
when "ServiceItem/serviceDLLmd5sum"
|
|
75
|
+
when "ServiceItem/serviceDLLsha1sum"
|
|
76
|
+
when "ServiceItem/serviceDLLsha256sum"
|
|
77
|
+
when "ServiceItem/serviceDLLSignatureDescription"
|
|
78
|
+
when "ServiceItem/serviceDLLSignatureVerified"
|
|
79
|
+
when "ServiceItem/serviceDLLSignatureExists"
|
|
80
|
+
when "ServiceItem/mode"
|
|
81
|
+
query += "StartMode = '#{servicemodetypes[i[:content]]}' "
|
|
82
|
+
when "ServiceItem/name"
|
|
83
|
+
query += "Name = '#{i[:content]}' "
|
|
84
|
+
when "ServiceItem/path"
|
|
85
|
+
content = i[:content].gsub("\\", "\\\\\\\\")
|
|
86
|
+
query += "PathName like '%#{[content]}%' "
|
|
87
|
+
when "ServiceItem/pathCertificateIssuer"
|
|
88
|
+
when "ServiceItem/pathCertificateSubject"
|
|
89
|
+
when "ServiceItem/pathmd5sum"
|
|
90
|
+
when "ServiceItem/pathsha1sum"
|
|
91
|
+
when "ServiceItem/pathsha256sum"
|
|
92
|
+
when "ServiceItem/pathSignatureDescription"
|
|
93
|
+
when "ServiceItem/pathSignatureExists"
|
|
94
|
+
when "ServiceItem/pathSignatureVerified"
|
|
95
|
+
when "ServiceItem/pid"
|
|
96
|
+
query += "ProcessID = #{i[:content]} "
|
|
97
|
+
when "ServiceItem/startedAs"
|
|
98
|
+
query += "StartName = '#{i[:content]}' "
|
|
99
|
+
when "ServiceItem/status"
|
|
100
|
+
query += "State = '#{servicestatustypes[i[:content]]}' "
|
|
101
|
+
when "ServiceItem/type"
|
|
102
|
+
query += "ServiceType = '#{servicetypetypes[i[:content]]}' "
|
|
103
|
+
when "ServiceItem/serviceDLLMd54Ksum"
|
|
104
|
+
when "ServiceItem/serviceDLLSha512Sum"
|
|
105
|
+
when "ServiceItem/serviceDLLSsdeep"
|
|
106
|
+
when "ServiceItem/pathMd54ksum"
|
|
107
|
+
when "ServiceItem/pathSha512sum"
|
|
108
|
+
when "ServiceItem/pathSsdeep"
|
|
109
|
+
end
|
|
110
|
+
}
|
|
111
|
+
|
|
112
|
+
services = wmi.ExecQuery(query)
|
|
113
|
+
services.each { |s|
|
|
114
|
+
return true
|
|
115
|
+
}
|
|
116
|
+
return false
|
|
117
|
+
end
|
|
19
118
|
end
|
|
119
|
+
|
|
20
120
|
|
|
21
121
|
class ServiceItemFactory < RubyIOC::IOCItem::IOCItemFactory
|
|
22
122
|
def get_type
|
|
@@ -16,6 +16,71 @@ module RubyIOC
|
|
|
16
16
|
def get_type
|
|
17
17
|
"VolumeItem"
|
|
18
18
|
end
|
|
19
|
+
|
|
20
|
+
def scan(indicator)
|
|
21
|
+
if RubyIOC::Platform.windows?
|
|
22
|
+
return search_windows_volumes(indicator)
|
|
23
|
+
else
|
|
24
|
+
puts "Not implemented on this platform yet"
|
|
25
|
+
end
|
|
26
|
+
end
|
|
27
|
+
|
|
28
|
+
def search_windows_volumes(indicator)
|
|
29
|
+
wmi = WIN32OLE.connect("winmgmts:\\")
|
|
30
|
+
query = ""
|
|
31
|
+
getLogicalDisk = false
|
|
32
|
+
|
|
33
|
+
voltypes = Hash[
|
|
34
|
+
"DRIVE_UNKNOWN" => "0",
|
|
35
|
+
"DRIVE_NO_ROOT_DIR" => "1",
|
|
36
|
+
"DRIVE_REMOVABLE" => "2",
|
|
37
|
+
"DRIVE_FIXED" => "3",
|
|
38
|
+
"DRIVE_REMOTE" => "4",
|
|
39
|
+
"DRIVE_CDROM" => "5",
|
|
40
|
+
"DRIVE_RAMDISK" => "6"
|
|
41
|
+
]
|
|
42
|
+
|
|
43
|
+
indicator.each { |i|
|
|
44
|
+
case i[:search]
|
|
45
|
+
when "VolumeItem/ActualAvailableAllocationUnits"
|
|
46
|
+
query += "FreeSpace = #{i[:content]} "
|
|
47
|
+
when "VolumeItem/BytesPerSector"
|
|
48
|
+
query += "BlockSize = #{i[:content]} "
|
|
49
|
+
when "VolumeItem/CreationTime"
|
|
50
|
+
query += "InstallDate = '#{i[:content]}' "
|
|
51
|
+
when "VolumeItem/DevicePath"
|
|
52
|
+
when "VolumeItem/DriveLetter"
|
|
53
|
+
query += "DriveLetter = '#{i[:content]}' "
|
|
54
|
+
when "VolumeItem/FileSystemFlags"
|
|
55
|
+
when "VolumeItem/FileSystemName"
|
|
56
|
+
query += "FileSystem = '#{i[:content]}' "
|
|
57
|
+
getLogicalDisk = true
|
|
58
|
+
when "VolumeItem/IsMounted"
|
|
59
|
+
when "VolumeItem/Name"
|
|
60
|
+
query += "VolumeName = '#{i[:content]}' "
|
|
61
|
+
getLogicalDisk = true
|
|
62
|
+
when "VolumeItem/SectorsPerAllocationUnit"
|
|
63
|
+
when "VolumeItem/SerialNumber"
|
|
64
|
+
query += "SerialNumber = '#{i[:content]}' "
|
|
65
|
+
when "VolumeItem/TotalAllocationUnits"
|
|
66
|
+
query += "Capacity = #{i[:content]} "
|
|
67
|
+
when "VolumeItem/Type"
|
|
68
|
+
query += "DriveType = #{voltypes[i[:content]]} "
|
|
69
|
+
end
|
|
70
|
+
}
|
|
71
|
+
|
|
72
|
+
if getLogicalDisk then
|
|
73
|
+
query = "Select * from Win32_LogicalDisk where " + query
|
|
74
|
+
else
|
|
75
|
+
query = "Select * from Win32_Volume where " + query
|
|
76
|
+
end
|
|
77
|
+
|
|
78
|
+
volumes = wmi.ExecQuery(query)
|
|
79
|
+
volumes.each { |v|
|
|
80
|
+
return true
|
|
81
|
+
}
|
|
82
|
+
return false
|
|
83
|
+
end
|
|
19
84
|
end
|
|
20
85
|
|
|
21
86
|
class VolumeItemFactory < RubyIOC::IOCItem::IOCItemFactory
|
data/lib/RubyIOC/platform.rb
CHANGED
|
@@ -33,7 +33,7 @@ module RubyIOC
|
|
|
33
33
|
end
|
|
34
34
|
|
|
35
35
|
def mac?
|
|
36
|
-
RubyIOC::Platform.is? /mac
|
|
36
|
+
RubyIOC::Platform.is? /darwin|mac/
|
|
37
37
|
end
|
|
38
38
|
|
|
39
39
|
def bsd?
|
|
@@ -41,7 +41,7 @@ module RubyIOC
|
|
|
41
41
|
end
|
|
42
42
|
|
|
43
43
|
def windows?
|
|
44
|
-
RubyIOC::Platform.is? /mswin|
|
|
44
|
+
RubyIOC::Platform.is? /mswin|mingw/
|
|
45
45
|
end
|
|
46
46
|
|
|
47
47
|
def solaris?
|
data/lib/RubyIOC/scanner.rb
CHANGED
|
@@ -26,7 +26,7 @@ module RubyIOC
|
|
|
26
26
|
@ioc.indicators.each { |i|
|
|
27
27
|
results << process_indicators(i, results)
|
|
28
28
|
}
|
|
29
|
-
|
|
29
|
+
return results
|
|
30
30
|
end
|
|
31
31
|
|
|
32
32
|
def get_all_results(items, results)
|
|
@@ -68,42 +68,29 @@ module RubyIOC
|
|
|
68
68
|
|
|
69
69
|
def process_indicators(i, results)
|
|
70
70
|
res = {}
|
|
71
|
-
search_item = []
|
|
72
71
|
res[i.id] = {}
|
|
73
72
|
res[i.id]['items'] = []
|
|
74
73
|
res[i.id]['operator'] = i.operator
|
|
75
74
|
res[i.id]['indicators'] = []
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
else
|
|
90
|
-
i.indicator_item.each { | inditem |
|
|
91
|
-
tmp = {}
|
|
92
|
-
tmp[:document] = inditem.document
|
|
93
|
-
tmp[:search] = inditem.search
|
|
94
|
-
tmp[:condition] = inditem.condition
|
|
95
|
-
tmp[:content_type] = inditem.content_type
|
|
96
|
-
tmp[:content] = inditem.content
|
|
97
|
-
tmp[:context_type] = inditem.context_type
|
|
98
|
-
search_item << tmp
|
|
99
|
-
res[i.id]['indicators'] << RubyIOC::IOCItem::IOCItemFactory.item_for(inditem.document).scan(search_item)
|
|
100
|
-
}
|
|
101
|
-
end
|
|
75
|
+
i.indicator_item.each { | inditem |
|
|
76
|
+
search_item = []
|
|
77
|
+
tmp = {}
|
|
78
|
+
tmp[:document] = inditem.document
|
|
79
|
+
tmp[:search] = inditem.search
|
|
80
|
+
tmp[:condition] = inditem.condition
|
|
81
|
+
tmp[:content_type] = inditem.content_type
|
|
82
|
+
tmp[:content] = inditem.content
|
|
83
|
+
tmp[:context_type] = inditem.context_type
|
|
84
|
+
search_item << tmp
|
|
85
|
+
res[i.id]['indicators'] << RubyIOC::IOCItem::IOCItemFactory.item_for(inditem.document).scan(search_item)
|
|
86
|
+
}
|
|
87
|
+
|
|
102
88
|
i.indicators.each { |ii |
|
|
103
89
|
process_indicators(ii, res[i.id]['items'])
|
|
104
90
|
}
|
|
105
91
|
res[i.id]['result'] = get_result(i.operator, res[i.id])
|
|
106
92
|
results << res
|
|
93
|
+
return results
|
|
107
94
|
end
|
|
108
95
|
|
|
109
96
|
end
|
data/lib/RubyIOC/version.rb
CHANGED
|
@@ -1,15 +1,15 @@
|
|
|
1
|
-
# Copyright (c) 2013 Matt Jezorek
|
|
2
|
-
#
|
|
3
|
-
# Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"),
|
|
4
|
-
# to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense,
|
|
5
|
-
# and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
|
|
6
|
-
#
|
|
7
|
-
# The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
|
|
8
|
-
#
|
|
9
|
-
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
10
|
-
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
11
|
-
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
|
|
12
|
-
# IN THE SOFTWARE.
|
|
13
|
-
module RubyIOC
|
|
14
|
-
VERSION = "0.0.
|
|
15
|
-
end
|
|
1
|
+
# Copyright (c) 2013 Matt Jezorek
|
|
2
|
+
#
|
|
3
|
+
# Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"),
|
|
4
|
+
# to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense,
|
|
5
|
+
# and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
|
|
6
|
+
#
|
|
7
|
+
# The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
|
|
8
|
+
#
|
|
9
|
+
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
10
|
+
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
11
|
+
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
|
|
12
|
+
# IN THE SOFTWARE.
|
|
13
|
+
module RubyIOC
|
|
14
|
+
VERSION = "0.0.2"
|
|
15
|
+
end
|
|
@@ -0,0 +1,57 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="us-ascii"?>
|
|
2
|
+
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="868b1eaa-7d68-4634-9572-a0d442e71814" last-modified="2013-08-04T03:44:46" xmlns="http://schemas.mandiant.com/2010/ioc">
|
|
3
|
+
<short_description>*ARP Entry Test IOC*</short_description>
|
|
4
|
+
<authored_by>IOCAware</authored_by>
|
|
5
|
+
<authored_date>2013-06-17T18:00:55</authored_date>
|
|
6
|
+
<links />
|
|
7
|
+
<definition>
|
|
8
|
+
<Indicator operator="OR" id="063979a1-df60-48c8-b514-5d226f192322">
|
|
9
|
+
<Indicator operator="AND" id="ea7f3691-a790-4295-93ce-58ef7ccdcebb">
|
|
10
|
+
<IndicatorItem id="7cc9932d-64e5-478e-ae28-b676ce033fa1" condition="contains">
|
|
11
|
+
<Context document="ArpEntryItem" search="ArpEntryItem/IPv4Address" type="mir" />
|
|
12
|
+
<Content type="IP">192.168.1.1</Content>
|
|
13
|
+
</IndicatorItem>
|
|
14
|
+
<IndicatorItem id="8f2280f7-ad34-4718-8f7c-32ba28c71f5c" condition="contains">
|
|
15
|
+
<Context document="ArpEntryItem" search="ArpEntryItem/PhysicalAddress" type="mir" />
|
|
16
|
+
<Content type="string">f0:d1:a9:08:6a:60</Content>
|
|
17
|
+
</IndicatorItem>
|
|
18
|
+
<IndicatorItem id="17c2ad4f-3f8f-43fa-8aee-e19df4afbae9" condition="contains">
|
|
19
|
+
<Context document="ArpEntryItem" search="ArpEntryItem/Interface" type="mir" />
|
|
20
|
+
<Content type="IP">en1</Content>
|
|
21
|
+
</IndicatorItem>
|
|
22
|
+
</Indicator>
|
|
23
|
+
<Indicator operator="AND" id="8757b126-6b67-47f6-b77a-8158c0a71116">
|
|
24
|
+
<IndicatorItem id="ba09a245-63b0-4657-9402-f8ecb13693a6" condition="contains">
|
|
25
|
+
<Context document="ArpEntryItem" search="ArpEntryItem/Interface" type="mir" />
|
|
26
|
+
<Content type="IP">eth0</Content>
|
|
27
|
+
</IndicatorItem>
|
|
28
|
+
<IndicatorItem id="4269d1ab-0b04-4a67-8946-9ca23d6257e0" condition="contains">
|
|
29
|
+
<Context document="ArpEntryItem" search="ArpEntryItem/IPv4Address" type="mir" />
|
|
30
|
+
<Content type="IP">192.168.1.1</Content>
|
|
31
|
+
</IndicatorItem>
|
|
32
|
+
<IndicatorItem id="7c19b193-86be-455f-8be0-13075cb08b04" condition="contains">
|
|
33
|
+
<Context document="ArpEntryItem" search="ArpEntryItem/PhysicalAddress" type="mir" />
|
|
34
|
+
<Content type="string">f0:d1:a9:08:6a:60</Content>
|
|
35
|
+
</IndicatorItem>
|
|
36
|
+
</Indicator>
|
|
37
|
+
<Indicator operator="AND" id="c2a54d35-2c29-4526-8177-db9829985bb6">
|
|
38
|
+
<IndicatorItem id="6776d766-9ef9-445c-8e94-f1da9364a8f9" condition="contains">
|
|
39
|
+
<Context document="ArpEntryItem" search="ArpEntryItem/Interface" type="mir" />
|
|
40
|
+
<Content type="IP">0xc</Content>
|
|
41
|
+
</IndicatorItem>
|
|
42
|
+
<IndicatorItem id="656d1f71-8bde-4ed0-8a6f-7667d523aedb" condition="contains">
|
|
43
|
+
<Context document="ArpEntryItem" search="ArpEntryItem/CacheType" type="mir" />
|
|
44
|
+
<Content type="string">Dynamic</Content>
|
|
45
|
+
</IndicatorItem>
|
|
46
|
+
<IndicatorItem id="d4533bab-5a5d-4869-9a31-3da0b4a82e45" condition="contains">
|
|
47
|
+
<Context document="ArpEntryItem" search="ArpEntryItem/IPv4Address" type="mir" />
|
|
48
|
+
<Content type="IP">192.168.237.2</Content>
|
|
49
|
+
</IndicatorItem>
|
|
50
|
+
<IndicatorItem id="ab9d4e19-d472-4ec3-a63e-f1e9606daed3" condition="contains">
|
|
51
|
+
<Context document="ArpEntryItem" search="ArpEntryItem/PhysicalAddress" type="mir" />
|
|
52
|
+
<Content type="string">00:50:56:ff:ad:9a</Content>
|
|
53
|
+
</IndicatorItem>
|
|
54
|
+
</Indicator>
|
|
55
|
+
</Indicator>
|
|
56
|
+
</definition>
|
|
57
|
+
</ioc>
|
|
@@ -1,14 +1,35 @@
|
|
|
1
1
|
<?xml version="1.0" encoding="us-ascii"?>
|
|
2
|
-
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="efce87c7-f78f-4e32-8f3f-b470d1ec693f" last-modified="2013-
|
|
3
|
-
<short_description>*
|
|
2
|
+
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="efce87c7-f78f-4e32-8f3f-b470d1ec693f" last-modified="2013-08-04T03:43:19" xmlns="http://schemas.mandiant.com/2010/ioc">
|
|
3
|
+
<short_description>*DNS Entry Test IOC*</short_description>
|
|
4
|
+
<authored_by>IOCAware</authored_by>
|
|
4
5
|
<authored_date>2013-01-07T01:25:50</authored_date>
|
|
5
6
|
<links />
|
|
6
7
|
<definition>
|
|
7
8
|
<Indicator operator="OR" id="336a594b-3302-4ac8-9512-4f329d660515">
|
|
8
9
|
<IndicatorItem id="1d1ca6f3-6bf9-4c8a-812e-3e9879f5ad29" condition="contains">
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
10
|
+
<Context document="DnsEntryItem" search="DnsEntryItem/Host" type="mir" />
|
|
11
|
+
<Content type="string">www.yahoo.com</Content>
|
|
12
|
+
</IndicatorItem>
|
|
13
|
+
<IndicatorItem id="03ff5739-b4e8-47ba-9731-cc05399e3bb1" condition="is">
|
|
14
|
+
<Context document="DnsEntryItem" search="DnsEntryItem/DataLength" type="mir" />
|
|
15
|
+
<Content type="int">8</Content>
|
|
16
|
+
</IndicatorItem>
|
|
17
|
+
<IndicatorItem id="82b571d3-9432-4cf2-af87-f9d1926cebf5" condition="contains">
|
|
18
|
+
<Context document="DnsEntryItem" search="DnsEntryItem/RecordName" type="mir" />
|
|
19
|
+
<Content type="string">www.yahoo.com</Content>
|
|
20
|
+
</IndicatorItem>
|
|
21
|
+
<IndicatorItem id="5263a013-3877-4038-a441-e7fae573820f" condition="contains">
|
|
22
|
+
<Context document="DnsEntryItem" search="DnsEntryItem/RecordType" type="mir" />
|
|
23
|
+
<Content type="string">5</Content>
|
|
24
|
+
</IndicatorItem>
|
|
25
|
+
<IndicatorItem id="1d8e01c5-9840-4244-97d9-72c3ea50e61a" condition="contains">
|
|
26
|
+
<Context document="DnsEntryItem" search="DnsEntryItem/TimeToLive" type="mir" />
|
|
27
|
+
<Content type="string">2</Content>
|
|
28
|
+
</IndicatorItem>
|
|
29
|
+
<IndicatorItem id="cf3a83a1-aac3-4730-9efb-302e919f841f" condition="contains">
|
|
30
|
+
<Context document="DnsEntryItem" search="DnsEntryItem/RecordData/IPv4Address" type="mir" />
|
|
31
|
+
<Content type="IP">192.168.237.128</Content>
|
|
32
|
+
</IndicatorItem>
|
|
12
33
|
</Indicator>
|
|
13
34
|
</definition>
|
|
14
35
|
</ioc>
|
|
@@ -0,0 +1,55 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="us-ascii"?>
|
|
2
|
+
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="5a36460c-a57c-4cfd-9731-f3494af1fd19" last-modified="2013-08-04T03:43:19" xmlns="http://schemas.mandiant.com/2010/ioc">
|
|
3
|
+
<short_description>*EventLog Entry Test IOC*</short_description>
|
|
4
|
+
<authored_by>IOCAware</authored_by>
|
|
5
|
+
<authored_date>2013-08-01T15:25:30</authored_date>
|
|
6
|
+
<links />
|
|
7
|
+
<definition>
|
|
8
|
+
<Indicator operator="OR" id="8909fba8-d368-4dfb-80e9-3c5bc1414d18">
|
|
9
|
+
<IndicatorItem id="2011b44a-3ae5-4913-b3e5-9de81449cdcb" condition="contains">
|
|
10
|
+
<Context document="EventLogItem" search="EventLogItem/category" type="mir" />
|
|
11
|
+
<Content type="string">Startup of the UMDF reflector</Content>
|
|
12
|
+
</IndicatorItem>
|
|
13
|
+
<IndicatorItem id="a60acc9e-677f-4e3f-853c-fa4d3a55d800" condition="contains">
|
|
14
|
+
<Context document="EventLogItem" search="EventLogItem/categoryNum" type="mir" />
|
|
15
|
+
<Content type="string">101</Content>
|
|
16
|
+
</IndicatorItem>
|
|
17
|
+
<IndicatorItem id="23a5f59d-8aa0-4301-a4e0-f2dbcad956ab" condition="is">
|
|
18
|
+
<Context document="EventLogItem" search="EventLogItem/genTime" type="mir" />
|
|
19
|
+
<Content type="date">20121120204608.735041-000</Content>
|
|
20
|
+
</IndicatorItem>
|
|
21
|
+
<IndicatorItem id="38c618d6-8699-46d6-b9dc-c772911b21c8" condition="is">
|
|
22
|
+
<Context document="EventLogItem" search="EventLogItem/EID" type="mir" />
|
|
23
|
+
<Content type="int">5615</Content>
|
|
24
|
+
</IndicatorItem>
|
|
25
|
+
<IndicatorItem id="eb983742-4953-4c76-94fb-5b2c699acd94" condition="contains">
|
|
26
|
+
<Context document="EventLogItem" search="EventLogItem/log" type="mir" />
|
|
27
|
+
<Content type="string">System</Content>
|
|
28
|
+
</IndicatorItem>
|
|
29
|
+
<IndicatorItem id="a567613d-f99f-4030-b232-47dd49fd0c16" condition="contains">
|
|
30
|
+
<Context document="EventLogItem" search="EventLogItem/machine" type="mir" />
|
|
31
|
+
<Content type="string">Win8</Content>
|
|
32
|
+
</IndicatorItem>
|
|
33
|
+
<IndicatorItem id="3b5758ac-d356-4912-921f-99744e9a8716" condition="contains">
|
|
34
|
+
<Context document="EventLogItem" search="EventLogItem/message" type="mir" />
|
|
35
|
+
<Content type="string">P1: 7.8.9200.16465</Content>
|
|
36
|
+
</IndicatorItem>
|
|
37
|
+
<IndicatorItem id="89ba60af-ab43-47dd-aa22-46dbbe9c8c19" condition="contains">
|
|
38
|
+
<Context document="EventLogItem" search="EventLogItem/source" type="mir" />
|
|
39
|
+
<Content type="string">MsiInstaller</Content>
|
|
40
|
+
</IndicatorItem>
|
|
41
|
+
<IndicatorItem id="f4618c66-92f1-468e-bee9-288404469100" condition="contains">
|
|
42
|
+
<Context document="EventLogItem" search="EventLogItem/type" type="mir" />
|
|
43
|
+
<Content type="string">Error</Content>
|
|
44
|
+
</IndicatorItem>
|
|
45
|
+
<IndicatorItem id="77ae9c7e-c1cf-4ebd-8abc-c9156351249f" condition="contains">
|
|
46
|
+
<Context document="EventLogItem" search="EventLogItem/user" type="mir" />
|
|
47
|
+
<Content type="string">SYSTEM</Content>
|
|
48
|
+
</IndicatorItem>
|
|
49
|
+
<IndicatorItem id="55b298ba-7fa2-4faf-9853-c9ae4c2964fb" condition="is">
|
|
50
|
+
<Context document="EventLogItem" search="EventLogItem/writeTime" type="mir" />
|
|
51
|
+
<Content type="date">20121228232521.930418-000</Content>
|
|
52
|
+
</IndicatorItem>
|
|
53
|
+
</Indicator>
|
|
54
|
+
</definition>
|
|
55
|
+
</ioc>
|