Skip to content

Commit cd4e4c7

Browse files
infosec-alchemistinfosec-alchemist
authored
Release 0.3.3 (#619)
* removed indicators groupings from meta properties file #484 * #345 expose parse via REST * #345 * #443 nginx serves compiled aot prod ui * wip build fails sometimes w/ out of memory when building in docker * serves angular aot app * #346 mockup * fixup #346 * Added app.js to volume mapping for api #508 * updated to include stix patterns for the three indicators that MITRE posted in https://github.com/mitre/stix2patterns_translator Fixed #516 * removed pattern_lang from indicators * added HTTPS_PROXY_URL env variable to docker compose files #527 * added RUN_MODE env variables #524 * added unfetter open identity #528 * typo in unfetter open stix id #528 * added created_by_ref for unfetter stix fixes #532 * Delete Jenkinsfile * fixed HTTPS_PROXY_URL var in docker.compse.yml * added open vocab to config file #535 * testing jenkins * Release 0.3.2 (#561) * Updated the master compose file to reflect the new version of the images, and added the CTF * synced .aot yml with .dev yml for ctf-ingest * Release 0.3.2 canidate 2 (#566) * Revert "Added Jenkinsfile" * Not sure * Added Jenkinsfile * Delete Jenkinsfile * Update README.md * Update README.md * Release 0.3.2 (#559) * removed indicators groupings from meta properties file #484 * #345 expose parse via REST * #345 * #443 nginx serves compiled aot prod ui * wip build fails sometimes w/ out of memory when building in docker * serves angular aot app * #346 mockup * fixup #346 * Added app.js to volume mapping for api #508 * updated to include stix patterns for the three indicators that MITRE posted in https://github.com/mitre/stix2patterns_translator Fixed #516 * removed pattern_lang from indicators * added HTTPS_PROXY_URL env variable to docker compose files #527 * added RUN_MODE env variables #524 * added unfetter open identity #528 * typo in unfetter open stix id #528 * added created_by_ref for unfetter stix fixes #532 * Delete Jenkinsfile * fixed HTTPS_PROXY_URL var in docker.compse.yml * added open vocab to config file #535 * testing jenkins * Updated the master compose file to reflect the new version of the images, and added the CTF * synced .aot yml with .dev yml for ctf-ingest * renamed docker-compose.aot to docker-compose.deploy, synced ctf-ingest container with .development, made default RUN_MODE DEMO * added the unfetter-ctf * removed extra link * deleted .aot yml, upgraded .deploy yml to use new api deploy command #568 (#569) * added observed data mapping to config file #571 (#581) * example threat report * load sample translation configs (#601) * load sample report by url (#606) * load sample report by url * single item per config key * fix regex to handle path or no path urls * refactor common nginx configs, test whitelist certs (#611) * added volume mounting for processor * put uac mode in development file * multiple workproducts per report, many to many relationship (#617) * updated version numbers
1 parent 1623807 commit cd4e4c7

24 files changed

+3407
-2679
lines changed

‎config/examples/unfetter-db/config.json

+190-4
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,7 @@
1-
[
2-
{
1+
[{
32
"_id": "d9732cfc-166e-41a0-af79-d37e7abc69b2",
43
"configKey": "killChains",
5-
"configValue": [
6-
{
4+
"configValue": [{
75
"name": "mitre-attack",
86
"phase_names": [
97
"persistence",
@@ -232,5 +230,193 @@
232230
"configGroups": [
233231
"stixConfig"
234232
]
233+
234+
},
235+
{
236+
"_id": "98fba9e7-6ad8-4bac-a178-af9282f8b05c",
237+
"configKey": "observableDataTypes",
238+
"configValue": [{
239+
"name": "driver",
240+
"actions": [
241+
"load",
242+
"unload"
243+
],
244+
"properties": [
245+
"base_address",
246+
"fqdn",
247+
"hostname",
248+
"image_path",
249+
"md5_hash_,module_name",
250+
"sha1_hash",
251+
"sh256_hash",
252+
"signer"
253+
]
254+
},
255+
{
256+
"name": "file",
257+
"actions": [
258+
"create",
259+
"delete",
260+
"modify",
261+
"read",
262+
"timestomp",
263+
"write"
264+
],
265+
"properties": [
266+
"hashes",
267+
"size",
268+
"name",
269+
"name_enc",
270+
"magic_number_hex",
271+
"mime_type",
272+
"created",
273+
"modified",
274+
"accessed",
275+
"parent_directory",
276+
"is_encrypted",
277+
"encryption_algorithm",
278+
"decryption_key"
279+
]
280+
},
281+
{
282+
"name": "network-traffic",
283+
"actions": [
284+
"end",
285+
"message",
286+
"start"
287+
],
288+
"properties": [
289+
"start",
290+
"end",
291+
"is_active",
292+
"src_ref",
293+
"dst_ref",
294+
"src_port",
295+
"dst_port",
296+
"protocols",
297+
"src_byte_count",
298+
"dst_byte_count",
299+
"src_packets",
300+
"dst_packets",
301+
"ipfix",
302+
"src_payload_ref",
303+
"dst_payload_ref"
304+
]
305+
},
306+
{
307+
"name": "process",
308+
"actions": [
309+
"create",
310+
"terminate"
311+
],
312+
"properties": [
313+
"is_hidden",
314+
"pid",
315+
"name",
316+
"created",
317+
"cwd",
318+
"arguments",
319+
"command_line",
320+
"environment_variables",
321+
"opened_connection_refs",
322+
"creator_user_ref",
323+
"binary_ref",
324+
"parent_ref",
325+
"child_refs"
326+
]
327+
},
328+
{
329+
"name": "windows-registry-key",
330+
"actions": [
331+
"add",
332+
"edit",
333+
"remove"
334+
],
335+
"properties": [
336+
"key",
337+
"values",
338+
"modified",
339+
"creator_user_ref",
340+
"number_of_subkeys"
341+
]
342+
},
343+
{
344+
"name": "service",
345+
"actions": [
346+
"create",
347+
"delete",
348+
"pause",
349+
"start",
350+
"stop"
351+
],
352+
"properties": [
353+
"service_name",
354+
"descriptions",
355+
"display_name",
356+
"group_name",
357+
"start_type",
358+
"service_dll_refs",
359+
"service_type",
360+
"service_status"
361+
]
362+
},
363+
{
364+
"name": "thread",
365+
"actions": [
366+
"create",
367+
"remote_create",
368+
"suspend",
369+
"terminate"
370+
],
371+
"properties": [
372+
"hostname",
373+
"src_pid",
374+
"src_tid",
375+
"stack_base",
376+
"stack_limit",
377+
"start_address",
378+
"start_function",
379+
"start_module",
380+
"start_module_name",
381+
"subprocess_tag",
382+
"tgt_pid",
383+
"tgt_tid",
384+
"user",
385+
"user_stack_base",
386+
"user_stack_limit"
387+
]
388+
},
389+
{
390+
"name": "user-account",
391+
"actions": [
392+
"interactive",
393+
"local",
394+
"lock",
395+
"login",
396+
"logout",
397+
"rdp",
398+
"reconnect",
399+
"remote",
400+
"unlock"
401+
],
402+
"properties": [
403+
"user_id",
404+
"account_login",
405+
"account_type",
406+
"display_name",
407+
"is_service_account",
408+
"is_privileged",
409+
"can_escalate_privs",
410+
"is_disabled",
411+
"account_created",
412+
"account_expires",
413+
"password_last_changed",
414+
"account_first_login",
415+
"acount_last_login"
416+
]
417+
}
418+
]
419+
420+
235421
}
236422
]

‎config/examples/unfetter-db/stix-enhancements.json

+32
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,36 @@
11
[
2+
{
3+
"extendedProperties": {
4+
"x_unfetter_object_actions": [
5+
"The attacker used injected JavaScript on the compromised websites to redirect targets to an Internet Explorer exploit that dropped Stage 1 launcher/downloader mobile code. This downloader then retrieved and installed a PIVY RAT variant."
6+
]
7+
},
8+
"id": "report--44c023fa-dfcb-4334-9a44-ee9c096f96cf"
9+
},
10+
{
11+
"extendedProperties": {
12+
"x_unfetter_object_actions": [
13+
"The attacker used injected JavaScript on the compromised websites to redirect targets to an Internet Explorer exploit that dropped Stage 1 launcher/downloader mobile code. This downloader then retrieved and installed a PIVY RAT variant."
14+
]
15+
},
16+
"id": "report--3284a25f-114a-490c-af70-ccfc694f7f02"
17+
},
18+
{
19+
"extendedProperties": {
20+
"x_unfetter_object_actions": [
21+
"The attacker used injected JavaScript on the compromised websites to redirect targets to an Internet Explorer exploit that dropped Stage 1 launcher/downloader mobile code. This downloader then retrieved and installed a PIVY RAT variant."
22+
]
23+
},
24+
"id": "report--2a4fd840-1856-4776-af90-2eb67acee3ee"
25+
},
26+
{
27+
"extendedProperties": {
28+
"x_unfetter_object_actions": [
29+
"The attacker used injected JavaScript on the compromised websites to redirect targets to an Internet Explorer exploit that dropped Stage 1 launcher/downloader mobile code. This downloader then retrieved and installed a PIVY RAT variant."
30+
]
31+
},
32+
"id": "report--de00c562-6afe-4e5c-994d-1aff0762b783"
33+
},
234
{
335
"id": "attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22",
436
"extendedProperties": {

0 commit comments

Comments
 (0)