txt2stix 1.1.7__py3-none-any.whl → 1.1.9__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (34) hide show
  1. txt2stix/ai_extractor/utils.py +4 -1
  2. txt2stix/includes/extractions/ai/config.yaml +20 -0
  3. txt2stix/includes/extractions/lookup/config.yaml +33 -15
  4. txt2stix/includes/lookups/_generate_lookups.py +39 -30
  5. txt2stix/includes/lookups/{disarm_id_v1_5.txt → disarm_id_v1_6.txt} +95 -32
  6. txt2stix/includes/lookups/{disarm_name_v1_5.txt → disarm_name_v1_6.txt} +380 -317
  7. txt2stix/includes/lookups/{mitre_atlas_id_v4_5_2.txt → mitre_atlas_id_v4_9_0.txt} +41 -1
  8. txt2stix/includes/lookups/mitre_atlas_name_v4_9_0.txt +157 -0
  9. txt2stix/includes/lookups/{mitre_attack_enterprise_aliases_v16_0.txt → mitre_attack_enterprise_aliases_v18_0.txt} +679 -531
  10. txt2stix/includes/lookups/mitre_attack_enterprise_id_v18_0.txt +4293 -0
  11. txt2stix/includes/lookups/mitre_attack_enterprise_name_v18_0.txt +4295 -0
  12. txt2stix/includes/lookups/{mitre_attack_ics_aliases_v16_0.txt → mitre_attack_ics_aliases_v18_0.txt} +7 -3
  13. txt2stix/includes/lookups/mitre_attack_ics_id_v18_0.txt +410 -0
  14. txt2stix/includes/lookups/{mitre_attack_ics_name_v16_0.txt → mitre_attack_ics_name_v18_0.txt} +172 -53
  15. txt2stix/includes/lookups/{mitre_attack_mobile_aliases_v16_0.txt → mitre_attack_mobile_aliases_v18_0.txt} +33 -0
  16. txt2stix/includes/lookups/mitre_attack_mobile_id_v18_0.txt +643 -0
  17. txt2stix/includes/lookups/mitre_attack_mobile_name_v18_0.txt +645 -0
  18. txt2stix/includes/lookups/mitre_capec_name_v3_9.txt +522 -522
  19. txt2stix/includes/lookups/{mitre_cwe_id_v4_15.txt → mitre_cwe_id_v4_18.txt} +5 -0
  20. txt2stix/includes/lookups/{mitre_cwe_name_v4_15.txt → mitre_cwe_name_v4_18.txt} +889 -884
  21. txt2stix/includes/lookups/sector_aliases_v1_0.txt +751 -0
  22. txt2stix/includes/tests/test_cases.yaml +8 -0
  23. txt2stix/retriever.py +6 -0
  24. {txt2stix-1.1.7.dist-info → txt2stix-1.1.9.dist-info}/METADATA +2 -1
  25. {txt2stix-1.1.7.dist-info → txt2stix-1.1.9.dist-info}/RECORD +28 -27
  26. txt2stix/includes/lookups/mitre_atlas_name_v4_5_2.txt +0 -117
  27. txt2stix/includes/lookups/mitre_attack_enterprise_id_v16_0.txt +0 -1656
  28. txt2stix/includes/lookups/mitre_attack_enterprise_name_v16_0.txt +0 -1765
  29. txt2stix/includes/lookups/mitre_attack_ics_id_v16_0.txt +0 -254
  30. txt2stix/includes/lookups/mitre_attack_mobile_id_v16_0.txt +0 -277
  31. txt2stix/includes/lookups/mitre_attack_mobile_name_v16_0.txt +0 -296
  32. {txt2stix-1.1.7.dist-info → txt2stix-1.1.9.dist-info}/WHEEL +0 -0
  33. {txt2stix-1.1.7.dist-info → txt2stix-1.1.9.dist-info}/entry_points.txt +0 -0
  34. {txt2stix-1.1.7.dist-info → txt2stix-1.1.9.dist-info}/licenses/LICENSE +0 -0
txt2stix/includes/lookups/{mitre_attack_ics_aliases_v16_0.txt → mitre_attack_ics_aliases_v18_0.txt} RENAMED
@@ -1,3 +1,4 @@
1
+ FrostyGoop Incident
1
2
  Triton Safety Instrumented System Attack
2
3
  2015 Ukraine Electric Power Attack
3
4
  Maroochy Water Breach
@@ -55,6 +56,9 @@ Evasive Serpens
55
56
  Hazel Sandstorm
56
57
  EUROPIUM
57
58
  ITG13
59
+ Earth Simnavaz
60
+ Crambus
61
+ TA452
58
62
  TEMP.Veles
59
63
  XENOTIME
60
64
  CyberAv3ngers
@@ -123,6 +127,8 @@ ACAD/Medre.A
123
127
  REvil
124
128
  Sodin
125
129
  Sodinokibi
130
+ FrostyGoop
131
+ BUSTLEBERM
126
132
  INCONTROLLER
127
133
  PIPEDREAM
128
134
  KillDisk
@@ -136,6 +142,4 @@ CRASHOVERRIDE
136
142
  Win32/Industroyer
137
143
  Flame
138
144
  Flamer
139
- sKyWIper
140
- Leafminer
141
- Raspite
145
+ sKyWIper
txt2stix/includes/lookups/mitre_attack_ics_id_v18_0.txt ADDED
@@ -0,0 +1,410 @@
1
+ A0001
2
+ A0002
3
+ A0003
4
+ A0004
5
+ A0005
6
+ A0006
7
+ A0007
8
+ A0008
9
+ A0009
10
+ A0010
11
+ A0011
12
+ A0012
13
+ A0013
14
+ A0014
15
+ A0015
16
+ A0016
17
+ A0017
18
+ A0018
19
+ AN1855
20
+ AN1856
21
+ AN1857
22
+ AN1858
23
+ AN1859
24
+ AN1860
25
+ AN1861
26
+ AN1862
27
+ AN1863
28
+ AN1864
29
+ AN1865
30
+ AN1866
31
+ AN1867
32
+ AN1868
33
+ AN1869
34
+ AN1870
35
+ AN1871
36
+ AN1872
37
+ AN1873
38
+ AN1874
39
+ AN1875
40
+ AN1876
41
+ AN1877
42
+ AN1878
43
+ AN1879
44
+ AN1880
45
+ AN1881
46
+ AN1882
47
+ AN1883
48
+ AN1884
49
+ AN1885
50
+ AN1886
51
+ AN1887
52
+ AN1888
53
+ AN1889
54
+ AN1890
55
+ AN1891
56
+ AN1892
57
+ AN1893
58
+ AN1894
59
+ AN1895
60
+ AN1896
61
+ AN1897
62
+ AN1898
63
+ AN1899
64
+ AN1900
65
+ AN1901
66
+ AN1902
67
+ AN1903
68
+ AN1904
69
+ AN1905
70
+ AN1906
71
+ AN1907
72
+ AN1908
73
+ AN1909
74
+ AN1910
75
+ AN1911
76
+ AN1912
77
+ AN1913
78
+ AN1914
79
+ AN1915
80
+ AN1916
81
+ AN1917
82
+ AN1918
83
+ AN1919
84
+ AN1920
85
+ AN1921
86
+ AN1922
87
+ AN1923
88
+ AN1924
89
+ AN1925
90
+ AN1926
91
+ AN1927
92
+ AN1928
93
+ AN1929
94
+ AN1930
95
+ AN1931
96
+ AN1932
97
+ AN1933
98
+ AN1934
99
+ AN1935
100
+ AN1936
101
+ C0020
102
+ C0025
103
+ C0028
104
+ C0030
105
+ C0031
106
+ C0034
107
+ C0041
108
+ DC0001
109
+ DC0002
110
+ DC0004
111
+ DC0005
112
+ DC0012
113
+ DC0016
114
+ DC0021
115
+ DC0029
116
+ DC0032
117
+ DC0033
118
+ DC0034
119
+ DC0038
120
+ DC0039
121
+ DC0040
122
+ DC0041
123
+ DC0042
124
+ DC0045
125
+ DC0046
126
+ DC0055
127
+ DC0059
128
+ DC0060
129
+ DC0061
130
+ DC0063
131
+ DC0064
132
+ DC0065
133
+ DC0067
134
+ DC0078
135
+ DC0082
136
+ DC0085
137
+ DC0088
138
+ DC0102
139
+ DC0107
140
+ DC0108
141
+ DC0109
142
+ DC0110
143
+ DC0111
144
+ DET0722
145
+ DET0723
146
+ DET0724
147
+ DET0725
148
+ DET0726
149
+ DET0727
150
+ DET0728
151
+ DET0729
152
+ DET0730
153
+ DET0731
154
+ DET0732
155
+ DET0733
156
+ DET0734
157
+ DET0735
158
+ DET0736
159
+ DET0737
160
+ DET0738
161
+ DET0739
162
+ DET0740
163
+ DET0741
164
+ DET0742
165
+ DET0743
166
+ DET0744
167
+ DET0745
168
+ DET0746
169
+ DET0747
170
+ DET0748
171
+ DET0749
172
+ DET0750
173
+ DET0751
174
+ DET0752
175
+ DET0753
176
+ DET0754
177
+ DET0755
178
+ DET0756
179
+ DET0757
180
+ DET0758
181
+ DET0759
182
+ DET0760
183
+ DET0761
184
+ DET0762
185
+ DET0763
186
+ DET0764
187
+ DET0765
188
+ DET0766
189
+ DET0767
190
+ DET0768
191
+ DET0769
192
+ DET0770
193
+ DET0771
194
+ DET0772
195
+ DET0773
196
+ DET0774
197
+ DET0775
198
+ DET0776
199
+ DET0777
200
+ DET0778
201
+ DET0779
202
+ DET0780
203
+ DET0781
204
+ DET0782
205
+ DET0783
206
+ DET0784
207
+ DET0785
208
+ DET0786
209
+ DET0787
210
+ DET0788
211
+ DET0789
212
+ DET0790
213
+ DET0791
214
+ DET0792
215
+ DET0793
216
+ DET0794
217
+ DET0795
218
+ DET0796
219
+ DET0797
220
+ DET0798
221
+ DET0799
222
+ DET0800
223
+ DET0801
224
+ DET0802
225
+ DET0803
226
+ DET0804
227
+ G0032
228
+ G0034
229
+ G0035
230
+ G0037
231
+ G0046
232
+ G0049
233
+ G0064
234
+ G0082
235
+ G0088
236
+ G0102
237
+ G0115
238
+ G1000
239
+ G1001
240
+ G1027
241
+ M0800
242
+ M0801
243
+ M0802
244
+ M0803
245
+ M0804
246
+ M0805
247
+ M0806
248
+ M0807
249
+ M0808
250
+ M0809
251
+ M0810
252
+ M0811
253
+ M0812
254
+ M0813
255
+ M0814
256
+ M0815
257
+ M0816
258
+ M0817
259
+ M0818
260
+ M0913
261
+ M0915
262
+ M0916
263
+ M0917
264
+ M0918
265
+ M0919
266
+ M0920
267
+ M0921
268
+ M0922
269
+ M0924
270
+ M0926
271
+ M0927
272
+ M0928
273
+ M0930
274
+ M0931
275
+ M0932
276
+ M0934
277
+ M0935
278
+ M0936
279
+ M0937
280
+ M0938
281
+ M0941
282
+ M0942
283
+ M0944
284
+ M0945
285
+ M0946
286
+ M0947
287
+ M0948
288
+ M0949
289
+ M0950
290
+ M0951
291
+ M0953
292
+ M0954
293
+ S0038
294
+ S0089
295
+ S0093
296
+ S0143
297
+ S0366
298
+ S0368
299
+ S0372
300
+ S0446
301
+ S0496
302
+ S0603
303
+ S0604
304
+ S0605
305
+ S0606
306
+ S0607
307
+ S0608
308
+ S1000
309
+ S1006
310
+ S1009
311
+ S1010
312
+ S1045
313
+ S1072
314
+ S1157
315
+ S1165
316
+ T0800
317
+ T0801
318
+ T0802
319
+ T0803
320
+ T0804
321
+ T0805
322
+ T0806
323
+ T0807
324
+ T0809
325
+ T0811
326
+ T0812
327
+ T0813
328
+ T0814
329
+ T0815
330
+ T0816
331
+ T0817
332
+ T0819
333
+ T0820
334
+ T0821
335
+ T0822
336
+ T0823
337
+ T0826
338
+ T0827
339
+ T0828
340
+ T0829
341
+ T0830
342
+ T0831
343
+ T0832
344
+ T0834
345
+ T0835
346
+ T0836
347
+ T0837
348
+ T0838
349
+ T0839
350
+ T0840
351
+ T0842
352
+ T0843
353
+ T0845
354
+ T0846
355
+ T0847
356
+ T0848
357
+ T0849
358
+ T0851
359
+ T0852
360
+ T0853
361
+ T0855
362
+ T0856
363
+ T0857
364
+ T0858
365
+ T0859
366
+ T0860
367
+ T0861
368
+ T0862
369
+ T0863
370
+ T0864
371
+ T0865
372
+ T0866
373
+ T0867
374
+ T0868
375
+ T0869
376
+ T0871
377
+ T0872
378
+ T0873
379
+ T0874
380
+ T0877
381
+ T0878
382
+ T0879
383
+ T0880
384
+ T0881
385
+ T0882
386
+ T0883
387
+ T0884
388
+ T0885
389
+ T0886
390
+ T0887
391
+ T0888
392
+ T0889
393
+ T0890
394
+ T0891
395
+ T0892
396
+ T0893
397
+ T0894
398
+ T0895
399
+ TA0100
400
+ TA0101
401
+ TA0102
402
+ TA0103
403
+ TA0104
404
+ TA0105
405
+ TA0106
406
+ TA0107
407
+ TA0108
408
+ TA0109
409
+ TA0110
410
+ TA0111
txt2stix/includes/lookups/{mitre_attack_ics_name_v16_0.txt → mitre_attack_ics_name_v18_0.txt} RENAMED
@@ -1,4 +1,3 @@
1
- ICS ATT&CK
2
1
  Block Command Message
3
2
  Service Stop
4
3
  Modify Parameter
@@ -82,6 +81,7 @@ Internet Accessible Device
82
81
  Data from Local System
83
82
  Change Credential
84
83
  Modify Program
84
+ FrostyGoop Incident
85
85
  Triton Safety Instrumented System Attack
86
86
  2015 Ukraine Electric Power Attack
87
87
  Maroochy Water Breach
@@ -173,21 +173,108 @@ Fuxnet
173
173
  Ryuk
174
174
  ACAD/Medre.A
175
175
  REvil
176
+ FrostyGoop
176
177
  INCONTROLLER
177
178
  KillDisk
178
179
  Industroyer
179
180
  Flame
180
181
  None
182
+ Analytic 1881
183
+ Analytic 1936
184
+ Analytic 1855
185
+ Analytic 1916
186
+ Analytic 1886
187
+ Analytic 1860
188
+ Analytic 1895
189
+ Analytic 1874
190
+ Analytic 1859
191
+ Analytic 1925
192
+ Analytic 1926
193
+ Analytic 1932
194
+ Analytic 1907
195
+ Analytic 1868
196
+ Analytic 1872
197
+ Analytic 1879
198
+ Analytic 1914
199
+ Analytic 1909
200
+ Analytic 1929
201
+ Analytic 1924
202
+ Analytic 1880
203
+ Analytic 1921
204
+ Analytic 1893
205
+ Analytic 1899
206
+ Analytic 1864
207
+ Analytic 1920
208
+ Analytic 1908
209
+ Analytic 1882
210
+ Analytic 1913
211
+ Analytic 1894
212
+ Analytic 1883
213
+ Analytic 1901
214
+ Analytic 1897
215
+ Analytic 1898
216
+ Analytic 1892
217
+ Analytic 1870
218
+ Analytic 1905
219
+ Analytic 1887
220
+ Analytic 1858
221
+ Analytic 1902
222
+ Analytic 1918
223
+ Analytic 1862
224
+ Analytic 1928
225
+ Analytic 1922
226
+ Analytic 1915
227
+ Analytic 1863
228
+ Analytic 1900
229
+ Analytic 1889
230
+ Analytic 1911
231
+ Analytic 1935
232
+ Analytic 1877
233
+ Analytic 1878
234
+ Analytic 1934
235
+ Analytic 1869
236
+ Analytic 1866
237
+ Analytic 1885
238
+ Analytic 1896
239
+ Analytic 1930
240
+ Analytic 1871
241
+ Analytic 1884
242
+ Analytic 1876
243
+ Analytic 1906
244
+ Analytic 1910
245
+ Analytic 1865
246
+ Analytic 1856
247
+ Analytic 1931
248
+ Analytic 1903
249
+ Analytic 1917
250
+ Analytic 1923
251
+ Analytic 1904
252
+ Analytic 1873
253
+ Analytic 1857
254
+ Analytic 1867
255
+ Analytic 1875
256
+ Analytic 1912
257
+ Analytic 1891
258
+ Analytic 1861
259
+ Analytic 1919
260
+ Analytic 1888
261
+ Analytic 1890
262
+ Analytic 1927
263
+ Analytic 1933
181
264
  Virtual Private Network (VPN) Server
182
265
  Jump Host
183
266
  Remote Terminal Unit (RTU)
184
267
  Field I/O
185
268
  Human-Machine Interface (HMI)
269
+ Programmable Automation Controller (PAC)
186
270
  Data Gateway
187
271
  Safety Controller
188
272
  Intelligent Electronic Device (IED)
273
+ Distributed Control System (DCS) Controller
189
274
  Application Server
190
275
  Programmable Logic Controller (PLC)
276
+ Firewall
277
+ Switch
191
278
  Routers
192
279
  Data Historian
193
280
  Control Server
@@ -228,23 +315,89 @@ Process Metadata
228
315
  Scheduled Job Creation
229
316
  Network Share Access
230
317
  Scheduled Job Modification
231
- User Account
232
- Windows Registry
233
- Script
234
- Operational Databases
235
- Application Log
236
- Logon Session
237
- File
238
- Drive
239
- Command
240
- Asset
241
- Network Share
242
- Network Traffic
243
- Scheduled Job
244
- Firmware
245
- Service
246
- Process
247
- Module
318
+ Detection of Rootkit
319
+ Detection of Block Reporting Message
320
+ Detection of Masquerading
321
+ Detection of Denial of Service
322
+ Detection of Project File Infection
323
+ Detection of System Firmware
324
+ Detection of Exploitation for Privilege Escalation
325
+ Detection of Alarm Suppression
326
+ Detection of Denial of View
327
+ Detection of Device Restart/Shutdown
328
+ Detection of Denial of Control
329
+ Detection of Theft of Operational Information
330
+ Detection of Block Command Message
331
+ Detection of Change Credential
332
+ Detection of Commonly Used Port
333
+ Detection of Loss of Control
334
+ Detection of Data from Local System
335
+ Detection of Screen Capture
336
+ Detection of Brute Force I/O
337
+ Detection of Network Connection Enumeration
338
+ Detection of Automated Collection
339
+ Detection of Modify Parameter
340
+ Detection of Manipulation of View
341
+ Detection of Block Serial COM
342
+ Detection of System Binary Proxy Execution
343
+ Detection of Point & Tag Identification
344
+ Detection of Supply Chain Compromise
345
+ Detection of Native API
346
+ Detection of Monitor Process State
347
+ Detection of Lateral Tool Transfer
348
+ Detection of Remote System Information Discovery
349
+ Detection of Exploitation of Remote Services
350
+ Detection of Activate Firmware Update Mode
351
+ Detection of Program Upload
352
+ Detection of Program Download
353
+ Detection of Standard Application Layer Protocol
354
+ Detection of Remote Services
355
+ Detection of Wireless Compromise
356
+ Detection of Modify Program
357
+ Detection of Modify Alarm Settings
358
+ Detection of Graphical User Interface
359
+ Detection of Connection Proxy
360
+ Detection of Drive-by Compromise
361
+ Detection of Transient Cyber Asset
362
+ Detection of Autorun Image
363
+ Detection of Exploitation for Evasion
364
+ Detection of Rogue Master
365
+ Detection of Hooking
366
+ Detection of Data from Information Repositories
367
+ Detection of Loss of View
368
+ Detection of Exploit Public-Facing Application
369
+ Detection of Manipulate I/O Image
370
+ Detection of Manipulation of Control
371
+ Detection of Default Credentials
372
+ Detection of Service Stop
373
+ Detection of Adversary-in-the-Middle
374
+ Detection of Spearphishing Attachment
375
+ Detection of Wireless Sniffing
376
+ Detection of Command-Line Interface
377
+ Detection of Spoof Reporting Message
378
+ Detection of Loss of Protection
379
+ Detection of Loss of Productivity and Revenue
380
+ Detection of Internet Accessible Device
381
+ Detection of I/O Image
382
+ Detection of Replication Through Removable Media
383
+ Detection of Unauthorized Command Message
384
+ Detection of Loss of Availability
385
+ Detection of Hardcoded Credentials
386
+ Detection of Module Firmware
387
+ Detection of Detect Operating Mode
388
+ Detection of Indicator Removal on Host
389
+ Detection of External Remote Services
390
+ Detection of User Execution
391
+ Detection of Remote System Discovery
392
+ Detection of Data Destruction
393
+ Detection of Execution through API
394
+ Detection of Network Sniffing
395
+ Detection of Damage to Property
396
+ Detection of Scripting
397
+ Detection of Loss of Safety
398
+ Detection of Change Operating Mode
399
+ Detection of Modify Controller Tasking
400
+ Detection of Valid Accounts
248
401
  Inhibit Response Function
249
402
  Privilege Escalation
250
403
  Lateral Movement
@@ -256,38 +409,4 @@ Execution
256
409
  Command and Control
257
410
  Collection
258
411
  Evasion
259
- Impair Process Control
260
- Network Intrusion Prevention
261
- Vulnerability Scanning
262
- Limit Access to Resource Over Network
263
- Filter Network Traffic
264
- Restrict Web-Based Content
265
- Application Developer Guidance
266
- Limit Hardware Installation
267
- User Training
268
- Operating System Configuration
269
- Data Backup
270
- Execution Prevention
271
- Code Signing
272
- SSL/TLS Inspection
273
- Boot Integrity
274
- Network Segmentation
275
- Threat Intelligence Program
276
- Password Policies
277
- User Account Management
278
- Restrict File and Directory Permissions
279
- Privileged Account Management
280
- Restrict Registry Permissions
281
- Antivirus/Antimalware
282
- Multi-factor Authentication
283
- Software Configuration
284
- Application Isolation and Sandboxing
285
- Audit
286
- Exploit Protection
287
- Active Directory Configuration
288
- Update Software
289
- Restrict Library Loading
290
- Disable or Remove Feature or Program
291
- Account Use Policies
292
- Encrypt Sensitive Information
293
- Leafminer
412
+ Impair Process Control