Skip to content

Instantly share code, notes, and snippets.

View ikiril01's full-sized avatar

Ivan Kirillov ikiril01

55 followers · 2 following
View GitHub Profile
@ikiril01
ikiril01 / android_apk_test.xml
Created March 30, 2015 19:23
CybOX Android APK Test
<?xml version="1.0" encoding="UTF-8"?>
<AndroidAPKObj:Android_APK_File xmlns:X509CertificateObj="http://cybox.mitre.org/objects#X509CertificateObject-2"
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"
xmlns:ArchiveFileObj="http://cybox.mitre.org/objects#ArchiveFileObject-1"
xmlns:AndroidAPKObj="http://cybox.mitre.org/objects#AndroidAPKObject-1"
xmlns:AndroidManifestObj="http://cybox.mitre.org/objects#AndroidManifestObject-1"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://cybox.mitre.org/objects#AndroidAPKObject-1 file:/Users/ikirillov/Desktop/CybOX/Git/schemas/objects/Android_APK_Object.xsd">
<FileObj:File_Name>dummy_file.apk</FileObj:File_Name>
@ikiril01
ikiril01 / gist:db2faa28bbccf03928e8
Last active August 29, 2015 14:19
MAEC v5.0 example (notional)
<?xml version="1.0" encoding="UTF-8"?>
<!--
MAEC Capability/Objective Example
-Based on ThreatExpert report: http://www.threatexpert.com/report.aspx?md5=9d7006e30fdf15e9c8e03e62534b3a3e
-Demonstrates how Capabilities and Objectives may be captured
-Shows example of full linkage from Capability/Objective->Behavior->Action
Added February 2014 for MAEC v4.1 -->
<maecPackage:MAEC_Package
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
@ikiril01
ikiril01 / cybox_hierarchy.json
Last active January 20, 2016 16:09
CybOX Visualization Test
{
"name": "CybOX 3.0",
"children": [
{"name":"Core Components",
"children": [{"name":"CybOX Core", "size": 5234},
{"name":"CybOX Common", "size":3434},
{"name":"CybOX Vocabularies", "size":2343}]
},
{
"name": "Objects",
@ikiril01
ikiril01 / example.json
Created April 4, 2016 16:38
Network Connection w/ AS - Container
{
"type": "package",
"spec_version": "stix-2.0",
"observations": [{
"type": "observation",
"id": "observation--4",
"spec_version": "stix-2.0",
"created_at": "2016-03-21T01:01:01Z",
"observed_at": "2016-03-21T01:01:01Z",
"objects": [
@ikiril01
ikiril01 / example.json
Last active April 4, 2016 17:57
Malware Characterization w/ MAEC - Container
{
"type": "package",
"spec_version": "stix-2.0",
"ttps": [{
"id": "malware--1",
"type": "malware",
"maec": {
"spec_version": "maec-5.0",
"malware_subjects": [{
"id": "subject--1",
@ikiril01
ikiril01 / example.json
Last active April 4, 2016 17:58
Malware Characterization w/ MAEC - TLO
{
"type": "package",
"spec_version": "stix-2.0",
"objects": [
{
"id": "object--1",
"type": "file-object",
"hashes": {"md5": "C37D819D0C4C16865E9519478897D5D4"}
},
{
@ikiril01
ikiril01 / example.json
Created April 4, 2016 18:04
Malware Characterization w/ MAEC + Observations - TLO
{
"type": "package",
"spec_version": "stix-2.0",
"objects": [
{
"id": "object--1",
"type": "file-object",
"hashes": {"md5": "C37D819D0C4C16865E9519478897D5D4"}
},
{
@ikiril01
ikiril01 / example.json
Created April 4, 2016 18:09
Malware Characterization w/ MAEC + Observation - Container
{
"type": "package",
"spec_version": "stix-2.0",
"observations": [{
"type": "observation",
"id": "observation--1",
"spec_version": "stix-2.0",
"created_at": "2016-03-21T01:01:01Z",
"observed_at": "2016-03-21T01:01:01Z",
"objects": [{
@ikiril01
ikiril01 / example.json
Created April 4, 2016 18:53
Domain -> IP Address Resolution Characterization - Container
{
"type": "package",
"spec_version": "stix-2.0",
"observations": [{
"type": "observation",
"id": "observation--4",
"spec_version": "stix-2.0",
"created_at": "2016-03-21T01:01:01Z",
"observed_at": "2016-03-21T01:01:01Z",
"objects": [
@ikiril01
ikiril01 / example.json
Created April 4, 2016 19:43
Recursive Archive File Characterization - Container
{
"type": "package",
"spec_version": "stix-2.0",
"observations": [{
"type": "observation",
"id": "observation--4",
"spec_version": "stix-2.0",
"created_at": "2016-03-21T01:01:01Z",
"observed_at": "2016-03-21T01:01:01Z",
"objects": [