pymisp 2.5.3__py3-none-any.whl → 2.5.7__py3-none-any.whl

tests/mispevent_testfiles/overwrite_file/definition.json

@@ -0,0 +1,457 @@
+{
+  "requiredOneOf": [
+    "filename",
+    "size-in-bytes",
+    "authentihash",
+    "ssdeep",
+    "md5",
+    "sha1",
+    "sha224",
+    "sha256",
+    "sha384",
+    "sha512",
+    "sha512/224",
+    "sha512/256",
+    "tlsh",
+    "pattern-in-file",
+    "certificate",
+    "malware-sample",
+    "attachment",
+    "path",
+    "fullpath"
+  ],
+  "required": [
+    "test_overwrite"
+  ],
+  "attributes": {
+    "test_overwrite": {
+      "description": "Test attribute",
+      "misp-attribute": "text"
+    },
+    "md5": {
+      "description": "[Insecure] MD5 hash (128 bits)",
+      "ui-priority": 1,
+      "misp-attribute": "md5",
+      "recommended": false
+    },
+    "sha1": {
+      "description": "[Insecure] Secure Hash Algorithm 1 (160 bits)",
+      "ui-priority": 1,
+      "misp-attribute": "sha1",
+      "recommended": false
+    },
+    "sha224": {
+      "description": "Secure Hash Algorithm 2 (224 bits)",
+      "ui-priority": 0,
+      "misp-attribute": "sha224",
+      "recommended": false
+    },
+    "sha256": {
+      "description": "Secure Hash Algorithm 2 (256 bits)",
+      "ui-priority": 1,
+      "misp-attribute": "sha256"
+    },
+    "sha384": {
+      "description": "Secure Hash Algorithm 2 (384 bits)",
+      "ui-priority": 0,
+      "misp-attribute": "sha384",
+      "recommended": false
+    },
+    "sha512": {
+      "description": "Secure Hash Algorithm 2 (512 bits)",
+      "ui-priority": 1,
+      "misp-attribute": "sha512"
+    },
+    "sha512/224": {
+      "description": "Secure Hash Algorithm 2 (224 bits)",
+      "ui-priority": 0,
+      "misp-attribute": "sha512/224",
+      "recommended": false
+    },
+    "sha512/256": {
+      "description": "Secure Hash Algorithm 2 (256 bits)",
+      "ui-priority": 0,
+      "misp-attribute": "sha512/256",
+      "recommended": false
+    },
+    "ssdeep": {
+      "description": "Fuzzy hash using context triggered piecewise hashes (CTPH)",
+      "ui-priority": 0,
+      "misp-attribute": "ssdeep"
+    },
+    "authentihash": {
+      "description": "Authenticode executable signature hash",
+      "ui-priority": 0,
+      "misp-attribute": "authentihash",
+      "recommended": false
+    },
+    "size-in-bytes": {
+      "description": "Size of the file, in bytes",
+      "disable_correlation": true,
+      "ui-priority": 0,
+      "misp-attribute": "size-in-bytes"
+    },
+    "entropy": {
+      "description": "Entropy of the whole file",
+      "disable_correlation": true,
+      "ui-priority": 1,
+      "misp-attribute": "float"
+    },
+    "pattern-in-file": {
+      "description": "Pattern that can be found in the file",
+      "categories": [
+        "Artifacts dropped",
+        "Payload installation",
+        "External analysis"
+      ],
+      "ui-priority": 1,
+      "misp-attribute": "pattern-in-file",
+      "multiple": true
+    },
+    "text": {
+      "description": "Free text value to attach to the file",
+      "disable_correlation": true,
+      "ui-priority": 1,
+      "misp-attribute": "text",
+      "recommended": false
+    },
+    "malware-sample": {
+      "description": "The file itself (binary)",
+      "ui-priority": 1,
+      "misp-attribute": "malware-sample"
+    },
+    "attachment": {
+      "description": "A non-malicious file.",
+      "ui-priority": 1,
+      "misp-attribute": "attachment"
+    },
+    "filename": {
+      "description": "Filename on disk",
+      "disable_correlation": true,
+      "multiple": true,
+      "categories": [
+        "Payload delivery",
+        "Artifacts dropped",
+        "Payload installation",
+        "External analysis"
+      ],
+      "ui-priority": 1,
+      "misp-attribute": "filename"
+    },
+    "path": {
+      "description": "Path of the filename complete or partial",
+      "disable_correlation": true,
+      "multiple": true,
+      "ui-priority": 0,
+      "misp-attribute": "text"
+    },
+    "fullpath": {
+      "description": "Complete path of the filename including the filename",
+      "multiple": true,
+      "ui-priority": 0,
+      "misp-attribute": "text"
+    },
+    "tlsh": {
+      "description": "Fuzzy hash by Trend Micro: Locality Sensitive Hash",
+      "ui-priority": 0,
+      "misp-attribute": "tlsh"
+    },
+    "certificate": {
+      "description": "Certificate value if the binary is signed with another authentication scheme than authenticode",
+      "ui-priority": 0,
+      "misp-attribute": "x509-fingerprint-sha1"
+    },
+    "mimetype": {
+      "description": "Mime type",
+      "disable_correlation": true,
+      "ui-priority": 0,
+      "misp-attribute": "mime-type"
+    },
+    "state": {
+      "misp-attribute": "text",
+      "ui-priority": 0,
+      "description": "State of the file",
+      "multiple": true,
+      "disable_correlation": true,
+      "values_list": [
+        "Malicious",
+        "Harmless",
+        "Signed",
+        "Revoked",
+        "Expired",
+        "Trusted"
+      ]
+    },
+    "file-encoding": {
+      "misp-attribute": "text",
+      "ui-priority": 0,
+      "description": "Encoding format of the file",
+      "disable_correlation": true,
+      "sane_default": [
+        "Adobe-Standard-Encoding",
+        "Adobe-Symbol-Encoding",
+        "Amiga-1251",
+        "ANSI_X3.110-1983",
+        "ASMO_449",
+        "Big5",
+        "Big5-HKSCS",
+        "BOCU-1",
+        "BRF",
+        "BS_4730",
+        "BS_viewdata",
+        "CESU-8",
+        "CP50220",
+        "CP51932",
+        "CSA_Z243.4-1985-1",
+        "CSA_Z243.4-1985-2",
+        "CSA_Z243.4-1985-gr",
+        "CSN_369103",
+        "DEC-MCS",
+        "DIN_66003",
+        "dk-us",
+        "DS_2089",
+        "EBCDIC-AT-DE",
+        "EBCDIC-AT-DE-A",
+        "EBCDIC-CA-FR",
+        "EBCDIC-DK-NO",
+        "EBCDIC-DK-NO-A",
+        "EBCDIC-ES",
+        "EBCDIC-ES-A",
+        "EBCDIC-ES-S",
+        "EBCDIC-FI-SE",
+        "EBCDIC-FI-SE-A",
+        "EBCDIC-FR",
+        "EBCDIC-IT",
+        "EBCDIC-PT",
+        "EBCDIC-UK",
+        "EBCDIC-US",
+        "ECMA-cyrillic",
+        "ES",
+        "ES2",
+        "EUC-KR",
+        "Extended_UNIX_Code_Fixed_Width_for_Japanese",
+        "Extended_UNIX_Code_Packed_Format_for_Japanese",
+        "GB18030",
+        "GB_1988-80",
+        "GB2312",
+        "GB_2312-80",
+        "GBK",
+        "GOST_19768-74",
+        "greek7",
+        "greek7-old",
+        "greek-ccitt",
+        "HP-DeskTop",
+        "HP-Legal",
+        "HP-Math8",
+        "HP-Pi-font",
+        "hp-roman8",
+        "HZ-GB-2312",
+        "IBM00858",
+        "IBM00924",
+        "IBM01140",
+        "IBM01141",
+        "IBM01142",
+        "IBM01143",
+        "IBM01144",
+        "IBM01145",
+        "IBM01146",
+        "IBM01147",
+        "IBM01148",
+        "IBM01149",
+        "IBM037",
+        "IBM038",
+        "IBM1026",
+        "IBM1047",
+        "IBM273",
+        "IBM274",
+        "IBM275",
+        "IBM277",
+        "IBM278",
+        "IBM280",
+        "IBM281",
+        "IBM284",
+        "IBM285",
+        "IBM290",
+        "IBM297",
+        "IBM420",
+        "IBM423",
+        "IBM424",
+        "IBM437",
+        "IBM500",
+        "IBM775",
+        "IBM850",
+        "IBM851",
+        "IBM852",
+        "IBM855",
+        "IBM857",
+        "IBM860",
+        "IBM861",
+        "IBM862",
+        "IBM863",
+        "IBM864",
+        "IBM865",
+        "IBM866",
+        "IBM868",
+        "IBM869",
+        "IBM870",
+        "IBM871",
+        "IBM880",
+        "IBM891",
+        "IBM903",
+        "IBM904",
+        "IBM905",
+        "IBM918",
+        "IBM-Symbols",
+        "IBM-Thai",
+        "IEC_P27-1",
+        "INIS",
+        "INIS-8",
+        "INIS-cyrillic",
+        "INVARIANT",
+        "ISO_10367-box",
+        "ISO-10646-J-1",
+        "ISO-10646-UCS-2",
+        "ISO-10646-UCS-4",
+        "ISO-10646-UCS-Basic",
+        "ISO-10646-Unicode-Latin1",
+        "ISO-10646-UTF-1",
+        "ISO-11548-1",
+        "ISO-2022-CN",
+        "ISO-2022-CN-EXT",
+        "ISO-2022-JP",
+        "ISO-2022-JP-2",
+        "ISO-2022-KR",
+        "ISO_2033-1983",
+        "ISO_5427",
+        "ISO_5427:1981",
+        "ISO_5428:1980",
+        "ISO_646.basic:1983",
+        "ISO_646.irv:1983",
+        "ISO_6937-2-25",
+        "ISO_6937-2-add",
+        "ISO-8859-10",
+        "ISO_8859-1:1987",
+        "ISO-8859-13",
+        "ISO-8859-14",
+        "ISO-8859-15",
+        "ISO-8859-16",
+        "ISO-8859-1-Windows-3.0-Latin-1",
+        "ISO-8859-1-Windows-3.1-Latin-1",
+        "ISO_8859-2:1987",
+        "ISO-8859-2-Windows-Latin-2",
+        "ISO_8859-3:1988",
+        "ISO_8859-4:1988",
+        "ISO_8859-5:1988",
+        "ISO_8859-6:1987",
+        "ISO_8859-6-E",
+        "ISO_8859-6-I",
+        "ISO_8859-7:1987",
+        "ISO_8859-8:1988",
+        "ISO_8859-8-E",
+        "ISO_8859-8-I",
+        "ISO_8859-9:1989",
+        "ISO-8859-9-Windows-Latin-5",
+        "ISO_8859-supp",
+        "iso-ir-90",
+        "ISO-Unicode-IBM-1261",
+        "ISO-Unicode-IBM-1264",
+        "ISO-Unicode-IBM-1265",
+        "ISO-Unicode-IBM-1268",
+        "ISO-Unicode-IBM-1276",
+        "IT",
+        "JIS_C6220-1969-jp",
+        "JIS_C6220-1969-ro",
+        "JIS_C6226-1978",
+        "JIS_C6226-1983",
+        "JIS_C6229-1984-a",
+        "JIS_C6229-1984-b",
+        "JIS_C6229-1984-b-add",
+        "JIS_C6229-1984-hand",
+        "JIS_C6229-1984-hand-add",
+        "JIS_C6229-1984-kana",
+        "JIS_Encoding",
+        "JIS_X0201",
+        "JIS_X0212-1990",
+        "JUS_I.B1.002",
+        "JUS_I.B1.003-mac",
+        "JUS_I.B1.003-serb",
+        "KOI7-switched",
+        "KOI8-R",
+        "KOI8-U",
+        "KS_C_5601-1987",
+        "KSC5636",
+        "KZ-1048",
+        "latin-greek",
+        "Latin-greek-1",
+        "latin-lap",
+        "macintosh",
+        "Microsoft-Publishing",
+        "MNEM",
+        "MNEMONIC",
+        "MSZ_7795.3",
+        "Name",
+        "NATS-DANO",
+        "NATS-DANO-ADD",
+        "NATS-SEFI",
+        "NATS-SEFI-ADD",
+        "NC_NC00-10:81",
+        "NF_Z_62-010",
+        "NF_Z_62-010_(1973)",
+        "NS_4551-1",
+        "NS_4551-2",
+        "OSD_EBCDIC_DF03_IRV",
+        "OSD_EBCDIC_DF04_1",
+        "OSD_EBCDIC_DF04_15",
+        "PC8-Danish-Norwegian",
+        "PC8-Turkish",
+        "PT",
+        "PT2",
+        "PTCP154",
+        "SCSU",
+        "SEN_850200_B",
+        "SEN_850200_C",
+        "Shift_JIS",
+        "T.101-G2",
+        "T.61-7bit",
+        "T.61-8bit",
+        "TIS-620",
+        "TSCII",
+        "UNICODE-1-1",
+        "UNICODE-1-1-UTF-7",
+        "UNKNOWN-8BIT",
+        "US-ASCII",
+        "us-dk",
+        "UTF-16",
+        "UTF-16BE",
+        "UTF-16LE",
+        "UTF-32",
+        "UTF-32BE",
+        "UTF-32LE",
+        "UTF-7",
+        "UTF-8",
+        "Ventura-International",
+        "Ventura-Math",
+        "Ventura-US",
+        "videotex-suppl",
+        "VIQR",
+        "VISCII",
+        "windows-1250",
+        "windows-1251",
+        "windows-1252",
+        "windows-1253",
+        "windows-1254",
+        "windows-1255",
+        "windows-1256",
+        "windows-1257",
+        "windows-1258",
+        "Windows-31J",
+        "windows-874"
+      ]
+    }
+  },
+  "version": 1,
+  "description": "File object describing a file with meta-information",
+  "meta-category": "file",
+  "uuid": "688c46fb-5edb-40a3-8273-1af7923e0000",
+  "name": "overwrite_file"
+}

tests/mispevent_testfiles/proposals.json

@@ -0,0 +1,35 @@
+{
+  "Attribute": [
+    {
+      "ShadowAttribute": [
+        {
+          "category": "Payload delivery",
+          "disable_correlation": false,
+          "to_ids": true,
+          "type": "filename",
+          "value": "bar.pdf"
+        }
+      ],
+      "category": "Payload delivery",
+      "disable_correlation": false,
+      "to_ids": true,
+      "type": "filename",
+      "value": "bar.exe"
+    }
+  ],
+  "ShadowAttribute": [
+    {
+      "category": "Payload delivery",
+      "disable_correlation": false,
+      "to_ids": true,
+      "type": "filename",
+      "value": "baz.jpg"
+    }
+  ],
+  "analysis": "1",
+  "date": "2017-12-31",
+  "distribution": "1",
+  "info": "This is a test",
+  "threat_level_id": "1"
+}
+

tests/mispevent_testfiles/shadow.json

@@ -0,0 +1,148 @@
+{
+  "Attribute": [
+    {
+      "ShadowAttribute": [
+        {
+          "Org": {
+            "id": "1",
+            "name": "CIRCL",
+            "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
+          },
+          "category": "Artifacts dropped",
+          "comment": "",
+          "disable_correlation": false,
+          "event_id": "6676",
+          "event_uuid": "5a4cb19a-f550-437f-bd29-48ed950d210f",
+          "id": "3770",
+          "old_id": "811578",
+          "org_id": "1",
+          "proposal_to_delete": false,
+          "timestamp": "1514975846",
+          "to_ids": true,
+          "type": "filename",
+          "uuid": "5a4cb1c7-fa84-45fa-8d27-4822950d210f",
+          "value": "blah.exe.jpg"
+        }
+      ],
+      "category": "Artifacts dropped",
+      "comment": "",
+      "deleted": false,
+      "disable_correlation": false,
+      "distribution": "5",
+      "event_id": "6676",
+      "id": "811578",
+      "object_id": "0",
+      "sharing_group_id": "0",
+      "timestamp": "1514975687",
+      "to_ids": false,
+      "type": "filename",
+      "uuid": "5a4cb1c7-fa84-45fa-8d27-4822950d210f",
+      "value": "blah.exe"
+    }
+  ],
+  "Object": [
+    {
+      "Attribute": [
+        {
+          "ShadowAttribute": [
+            {
+              "Org": {
+                "id": "1",
+                "name": "CIRCL",
+                "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
+              },
+              "category": "Payload delivery",
+              "comment": "",
+              "disable_correlation": false,
+              "event_id": "6676",
+              "event_uuid": "5a4cb19a-f550-437f-bd29-48ed950d210f",
+              "id": "3771",
+              "old_id": "811579",
+              "org_id": "1",
+              "proposal_to_delete": false,
+              "timestamp": "1514976196",
+              "to_ids": true,
+              "type": "filename",
+              "uuid": "5a4cb2b8-4748-4c72-96e6-4588950d210f",
+              "value": "baz.png.exe"
+            }
+          ],
+          "category": "Payload delivery",
+          "comment": "",
+          "deleted": false,
+          "disable_correlation": false,
+          "distribution": "5",
+          "event_id": "6676",
+          "id": "811579",
+          "object_id": "2278",
+          "object_relation": "filename",
+          "sharing_group_id": "0",
+          "timestamp": "1514975928",
+          "to_ids": true,
+          "type": "filename",
+          "uuid": "5a4cb2b8-4748-4c72-96e6-4588950d210f",
+          "value": "baz.png"
+        },
+        {
+          "category": "Other",
+          "comment": "",
+          "deleted": false,
+          "disable_correlation": true,
+          "distribution": "5",
+          "event_id": "6676",
+          "id": "811580",
+          "object_id": "2278",
+          "object_relation": "state",
+          "sharing_group_id": "0",
+          "timestamp": "1514975928",
+          "to_ids": false,
+          "type": "text",
+          "uuid": "5a4cb2b9-92b4-4d3a-82df-4e86950d210f",
+          "value": "Malicious"
+        }
+      ],
+      "comment": "",
+      "deleted": false,
+      "description": "File object describing a file with meta-information",
+      "distribution": "5",
+      "event_id": "6676",
+      "id": "2278",
+      "meta-category": "file",
+      "name": "file",
+      "sharing_group_id": "0",
+      "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
+      "template_version": "8",
+      "timestamp": "1514975928",
+      "uuid": "5a4cb2b8-7958-4323-852c-4d2a950d210f"
+    }
+  ],
+  "Org": {
+    "id": "1",
+    "name": "CIRCL",
+    "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
+  },
+  "Orgc": {
+    "id": "1",
+    "name": "CIRCL",
+    "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
+  },
+  "analysis": "2",
+  "attribute_count": "3",
+  "date": "2018-01-03",
+  "disable_correlation": false,
+  "distribution": "0",
+  "event_creator_email": "raphael.vinot@circl.lu",
+  "id": "6676",
+  "info": "Test proposals / ShadowAttributes",
+  "locked": false,
+  "org_id": "1",
+  "orgc_id": "1",
+  "proposal_email_lock": true,
+  "publish_timestamp": "0",
+  "published": false,
+  "sharing_group_id": "0",
+  "threat_level_id": "1",
+  "timestamp": "1514975929",
+  "uuid": "5a4cb19a-f550-437f-bd29-48ed950d210f"
+}
+

tests/mispevent_testfiles/sighting.json

@@ -0,0 +1,5 @@
+{
+  "timestamp": "11111111",
+  "type": "bar",
+  "value": "1"
+}

tests/mispevent_testfiles/simple.json

@@ -0,0 +1,2 @@
+{
+}

tests/mispevent_testfiles/test_object_template/definition.json

@@ -0,0 +1,29 @@
+{
+  "requiredOneOf": [
+    "member1",
+    "member2"
+  ],
+  "required": [
+      "member3"
+  ],
+  "attributes": {
+    "member1": {
+      "description": "FirstMember",
+      "misp-attribute": "text"
+    },
+    "member2": {
+      "description": "SecondMember",
+      "misp-attribute": "text",
+      "multiple": true
+    },
+    "member3": {
+      "description": "Thirdmember",
+      "misp-attribute": "text"
+    }
+  },
+  "version": "1",
+  "description": "TestTemplate.",
+  "meta-category": "file",
+  "uuid": "4ec55cc6-9e49-4c64-b794-03c25c1a6589",
+  "name": "test_object_template"
+}