Skip to content

Instantly share code, notes, and snippets.

@ikiril01
ikiril01 / example.json
Created April 4, 2016 19:54
Recursive Archive File Characterization - TLO
{
"type": "package",
"spec_version": "stix-2.0",
"objects": [
{
"id": "file-object--1",
"type": "file-object",
"hashes": {"md5": "C37D819D0C4C16865E9519478897D5D4"},
"extended-properties": {"archive": {"file_count": 1}}
},
@ikiril01
ikiril01 / example.json
Last active April 5, 2016 15:56
Network Connection w/ AS - TLO
{
"type": "package",
"spec_version": "stix-2.0",
"objects": [
{
"type": "network-connection",
"id": "network-connection--1",
"spec_version": "cybox-3.0"
},
{
@ikiril01
ikiril01 / example.json
Created April 5, 2016 16:46
Network Connection w/ AS (embedded) - TLO
{
"type": "package",
"spec_version": "stix-2.0",
"objects": [
{
"type": "network-connection",
"id": "network-connection--1",
"spec_version": "cybox-3.0",
"source_addr": {"type":"ipv4-addr-object",
"value": "4.3.2.1"},
@ikiril01
ikiril01 / example.json
Created April 5, 2016 16:49
Network Connection w/ AS (embedded) - Container
{
"type": "package",
"spec_version": "stix-2.0",
"observations": [{
"type": "observation",
"id": "observation--4",
"spec_version": "stix-2.0",
"created_at": "2016-03-21T01:01:01Z",
"observed_at": "2016-03-21T01:01:01Z",
"objects": [{
@ikiril01
ikiril01 / example.json
Last active April 5, 2016 16:54
Domain -> IP Address Resolution Characterization - TLO
{
"type": "package",
"spec_version": "stix-2.0",
"objects": [
{
"type": "domain-name-object",
"id": "domain-name--1",
"spec_version": "cybox-3.0",
"value":"http://foo.bar.com"
},
@ikiril01
ikiril01 / example.json
Created April 5, 2016 17:02
Domain -> IP Address Resolution Characterization (embedded) - Container
{
"type": "package",
"spec_version": "stix-2.0",
"observations": [{
"type": "observation",
"id": "observation--4",
"spec_version": "stix-2.0",
"created_at": "2016-03-21T01:01:01Z",
"observed_at": "2016-03-21T01:01:01Z",
"objects": [{
@ikiril01
ikiril01 / example.json
Created April 5, 2016 17:47
Recursive Archive File Characterization (embedded) - TLO
{
"type": "package",
"spec_version": "stix-2.0",
"objects": [{
"id": "file-object--1",
"type": "file-object",
"hashes": {"md5": "C37D819D0C4C16865E9519478897D5D4"},
"extended-properties": {"archive": {
"file_count": 1,
"contained_objects": [{
@ikiril01
ikiril01 / example.json
Created April 5, 2016 17:50
Recursive Archive File Characterization (embedded) - Container
{
"type": "package",
"spec_version": "stix-2.0",
"observations": [{
"type": "observation",
"id": "observation--4",
"spec_version": "stix-2.0",
"created_at": "2016-03-21T01:01:01Z",
"observed_at": "2016-03-21T01:01:01Z",
"objects": [{
@ikiril01
ikiril01 / example.json
Created April 5, 2016 16:57
Domain -> IP Address Resolution Characterization (embedded) - TLO
{
"type": "package",
"spec_version": "stix-2.0",
"objects": [
{
"type": "domain-name-object",
"id": "domain-name--1",
"spec_version": "cybox-3.0",
"value":"http://foo.bar.com",
"resolved_to":{"type":"ipv4-addr-object",
@ikiril01
ikiril01 / example.json
Last active April 15, 2016 15:41
Detailed Observation Example w/ Actions
{
"type": "package",
"spec_version": "stix-2.0",
"observations": [{
"type": "observation",
"id": "observation--1",
"spec_version": "stix-2.0",
"created_at": "2016-03-21T01:01:01Z",
"observed_at": "2016-03-20T12:33:22Z",
"cybox": {