Skip to content

Instantly share code, notes, and snippets.

@johnwunder
Last active August 29, 2015 14:05
Show Gist options
  • Save johnwunder/353e72a49ecde55744b1 to your computer and use it in GitHub Desktop.
Save johnwunder/353e72a49ecde55744b1 to your computer and use it in GitHub Desktop.
STIX 1.1.1, Multiple Reports, No Content
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<stix:STIX_Package
xmlns:stix="http://stix.mitre.org/stix-1"
xmlns:campaign="http://stix.mitre.org/Campaign-1"
xmlns:coa="http://stix.mitre.org/CourseOfAction-1"
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
xmlns:CodeObj="http://cybox.mitre.org/objects#CodeObject-2"
xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"
xmlns:MutexObj="http://cybox.mitre.org/objects#MutexObject-2"
xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1"
xmlns:cybox="http://cybox.mitre.org/cybox-2"
xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
xmlns:fireeye="http://www.fireeye.com"
xmlns:marking="http://data-marking.mitre.org/Marking-1"
xmlns:indicator="http://stix.mitre.org/Indicator-2"
xmlns:terms="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1"
xmlns:stixCiqIdentity="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1"
xmlns:stixCommon="http://stix.mitre.org/common-1"
xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
xmlns:ta="http://stix.mitre.org/ThreatActor-1"
xmlns:ttp="http://stix.mitre.org/TTP-1"
xmlns:xpil="urn:oasis:names:tc:ciq:xpil:3"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="
http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.1.1/stix_core.xsd
http://stix.mitre.org/default_vocabularies-1 http://stix.mitre.org/XMLSchema/default_vocabularies/1.1.1/stix_default_vocabularies.xsd
http://stix.mitre.org/Campaign-1 http://stix.mitre.org/XMLSchema/campaign/1.1.1/campaign.xsd
http://stix.mitre.org/ThreatActor-1 http://stix.mitre.org/XMLSchema/threat_actor/1.1.1/threat_actor.xsd
http://stix.mitre.org/TTP-1 http://stix.mitre.org/XMLSchema/ttp/1.1.1/ttp.xsd
http://stix.mitre.org/COA-1 http://stix.mitre.org/XMLSchema/course_of_action/1.1.1/course_of_action.xsd
http://data-marking.mitre.org/Marking-1 http://stix.mitre.org/XMLSchema/data_marking/1.1.1/data_marking.xsd
http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1 http://stix.mitre.org/XMLSchema/extensions/marking/terms_of_use/1.0.1/terms_of_use_marking.xsd
http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1 http://stix.mitre.org/XMLSchema/extensions/identity/ciq_3.0/1.1.1/ciq_3.0_identity.xsd
"
id="fireeye:stix-b7b16e67-4292-46a3-ba64-60c1a491723d"
timestamp="2014-05-08T09:00:00.000000Z"
version="1.1.1">
<stix:Related_Packages>
<stix:Related_Package>
<stix:Package id="fireeye:stix-b7b16e67-4292-46a3-ba64-60c1a491723b" timestamp="2014-05-08T09:00:00.000000Z">
<stix:STIX_Header>
<stix:Title>Poison Ivy: Assessing Damage and Extracting Intelligence</stix:Title>
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
<stix:Description>The reports talks about Poison Ivy!</stix:Description>
<stix:Information_Source>
<stixCommon:Identity>
<stixCommon:Name>MITRE</stixCommon:Name>
</stixCommon:Identity>
</stix:Information_Source>
</stix:STIX_Header>
<stix:TTPs>
<stix:TTP idref="fireeye:ttp-7323cc18-c4b2-4e25-8a5e-3caa4afa3081" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:TTP idref="fireeye:ttp-bf2bdcaf-61a0-4e90-bcce-ad0b0551a02e" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:TTP idref="fireeye:ttp-e51f43fe-37eb-4469-a666-a4c74708c9ed" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:TTP idref="fireeye:ttp-f9e0c47b-a923-4ea6-805e-bd7dcdefeb26" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:TTP idref="fireeye:ttp-59fae6a2-4a3b-418e-8ca7-06a845820666" timestamp="2014-05-08T09:00:00.000000Z"/>
</stix:TTPs>
<stix:Campaigns>
<stix:Campaign idref="fireeye:campaign-700c8b90-fd16-40e9-8b80-00b0c8bc84ee" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:Campaign idref="fireeye:campaign-752c225d-d6f6-4456-9130-d9580fd4007b" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:Campaign idref="fireeye:campaign-36082810-2226-4c00-88dc-d69f92efa60e" timestamp="2014-05-08T09:00:00.000000Z"/>
</stix:Campaigns>
<stix:Threat_Actors>
<stix:Threat_Actor idref="fireeye:threatactor-7b14e202-bd27-4885-b8d7-b908a9651a03" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:Threat_Actor idref="fireeye:threatactor-9b371afe-ddfd-4954-abaf-8abb357ac78e" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:Threat_Actor idref="fireeye:threatactor-12b54231-a99d-431e-9587-34b4cb447e98" timestamp="2014-05-08T09:00:00.000000Z"/>
</stix:Threat_Actors>
</stix:Package>
</stix:Related_Package>
<stix:Related_Package>
<stix:Package id="fireeye:stix-b7b16e67-4292-46a3-ba64-60c1a491723a" timestamp="2014-05-08T09:00:00.000000Z">
<stix:STIX_Header>
<stix:Title>Cryptolocker: Ransom is great!</stix:Title>
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
<stix:Description>The reports talks about Cryptolocker!</stix:Description>
<stix:Information_Source>
<stixCommon:Identity>
<stixCommon:Name>MITRE</stixCommon:Name>
</stixCommon:Identity>
</stix:Information_Source>
</stix:STIX_Header>
<stix:TTPs>
<stix:TTP idref="fireeye:ttp-7323cc18-c4b2-4e25-8a5e-3caa4afa3081" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:TTP idref="fireeye:ttp-bf2bdcaf-61a0-4e90-bcce-ad0b0551a02e" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:TTP idref="fireeye:ttp-e51f43fe-37eb-4469-a666-a4c74708c9ed" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:TTP idref="fireeye:ttp-f9e0c47b-a923-4ea6-805e-bd7dcdefeb26" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:TTP idref="fireeye:ttp-59fae6a2-4a3b-418e-8ca7-06a845820666" timestamp="2014-05-08T09:00:00.000000Z"/>
</stix:TTPs>
<stix:Campaigns>
<stix:Campaign idref="fireeye:campaign-700c8b90-fd16-40e9-8b80-00b0c8bc84ee" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:Campaign idref="fireeye:campaign-752c225d-d6f6-4456-9130-d9580fd4007b" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:Campaign idref="fireeye:campaign-36082810-2226-4c00-88dc-d69f92efa60e" timestamp="2014-05-08T09:00:00.000000Z"/>
</stix:Campaigns>
<stix:Threat_Actors>
<stix:Threat_Actor idref="fireeye:threatactor-7b14e202-bd27-4885-b8d7-b908a9651a03" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:Threat_Actor idref="fireeye:threatactor-9b371afe-ddfd-4954-abaf-8abb357ac78e" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:Threat_Actor idref="fireeye:threatactor-12b54231-a99d-431e-9587-34b4cb447e98" timestamp="2014-05-08T09:00:00.000000Z"/>
</stix:Threat_Actors>
</stix:Package>
</stix:Related_Package>
<stix:Related_Package>
<stix:Package id="fireeye:stix-b7b16e67-4292-46a3-ba64-60c1a491723c" timestamp="2014-05-08T09:00:00.000000Z">
<stix:STIX_Header>
<stix:Title>Mobile Banking Malware</stix:Title>
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
<stix:Description>The reports talks about some mobile banking malware!</stix:Description>
<stix:Information_Source>
<stixCommon:Identity>
<stixCommon:Name>MITRE</stixCommon:Name>
</stixCommon:Identity>
</stix:Information_Source>
</stix:STIX_Header>
<stix:TTPs>
<stix:TTP idref="fireeye:ttp-7323cc18-c4b2-4e25-8a5e-3caa4afa3081" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:TTP idref="fireeye:ttp-bf2bdcaf-61a0-4e90-bcce-ad0b0551a02e" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:TTP idref="fireeye:ttp-e51f43fe-37eb-4469-a666-a4c74708c9ed" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:TTP idref="fireeye:ttp-f9e0c47b-a923-4ea6-805e-bd7dcdefeb26" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:TTP idref="fireeye:ttp-59fae6a2-4a3b-418e-8ca7-06a845820666" timestamp="2014-05-08T09:00:00.000000Z"/>
</stix:TTPs>
<stix:Campaigns>
<stix:Campaign idref="fireeye:campaign-700c8b90-fd16-40e9-8b80-00b0c8bc84ee" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:Campaign idref="fireeye:campaign-752c225d-d6f6-4456-9130-d9580fd4007b" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:Campaign idref="fireeye:campaign-36082810-2226-4c00-88dc-d69f92efa60e" timestamp="2014-05-08T09:00:00.000000Z"/>
</stix:Campaigns>
<stix:Threat_Actors>
<stix:Threat_Actor idref="fireeye:threatactor-7b14e202-bd27-4885-b8d7-b908a9651a03" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:Threat_Actor idref="fireeye:threatactor-9b371afe-ddfd-4954-abaf-8abb357ac78e" timestamp="2014-05-08T09:00:00.000000Z"/>
<stix:Threat_Actor idref="fireeye:threatactor-12b54231-a99d-431e-9587-34b4cb447e98" timestamp="2014-05-08T09:00:00.000000Z"/>
</stix:Threat_Actors>
</stix:Package>
</stix:Related_Package>
</stix:Related_Packages>
</stix:STIX_Package>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment