idaholab / cape2stix Goto Github PK

• Evaluate approaches for clustering or otherwise grouping malware based on a subset of files that it modified, reads, or deletes. Also think of this from the perspective of grouping files that occur in the same runs. The goal is to be able to identity similar malware, which similarity will likely derive from file type, interpreter used, or file access patterns.

https://github.com/idaholab/cape2stix/blob/main/cape2stix/core/extension_data.py

• Bandit test passes (fix or evaluate and ignore each error)
• Flake8 test passes (fix or evaluate and ignore each error)

• Summary - Answering this question would tell us if this binary is considered ransomware.
• Query -
• Picture of Graph -
• Picture of Table -

Might need to remove this as it's nothing more difficult than a single query match, but file hashes are a common observable that is used in threat intelligence. I do not believe there is a way to compare file hashes for similarity within Neo4J. In fact I believe similarity comparison for file hashes they would have to be of a certain type (not MD5). @RCooley might be able to give insight.Summary - Answering this question would tell us if this binary is considered ransomware.

  Query -

    
  Picture of Graph -

    
  Picture of Table -

Might need to remove this as it's nothing more difficult than a single query match, but file hashes are a common observable that is used in threat intelligence. I do not believe there is a way to compare file hashes for similarity within Neo4J. In fact I believe similarity comparison for file hashes they would have to be of a certain type (not MD5). @Rcooley might be able to give insight.

MITRE deprecated some Techniques, so they no longer exist in the STIX we're pulling from, however CAPEv2 still recongnizes them, we may need to auto-adjust those T####'s to a valid replacement.

See https://attack.mitre.org/techniques/T1320/

If tlsh hash is not in cape report, tlsh key needs to be removed from the dictionary of hashes

[ ] - Files dropped by malware should be in a different category than reads/writes/deletes.
[ ] - System calls aren't terribly important. We would want to encapsulate them inside a dictionary. However, if we get dictionaries that are megs big, we wouldn't want them

• Add HTTPS
• Add SSH
• Add FTP
• Add Telnet
• Add SMB/SAMBA
• Add fake socket (nc, socat) for ports 20000/TCP and 502/TCP

• Functional Linux VM Analysis
• STAP
• File Collection
• Syscalls?
• Processes

ERROR:root:'target'
Traceback (most recent call last):
cape2stix/cape2stix/scripts/convert.py", line 188, in convert
if self.content["target"]["category"] == "file": # NOTE: i don't have enough reports to test if this will ever not be true;this is for safety -wb

KeyError: 'target'                                                                                                      
CRITICAL:root:File failed to convert: 

MATCH (m:malware) -[n]-> (r:windows-registry-key WHERE r.key =~ '.CurrentVersion\\Run\\.' OR r.key =~ '.CurrentVersion\\RunOnce\\.') RETURN m,r

• when converting in convert.py, failed conversions need the file path logged.
• catch and log failures with [target][category]
• catch and log attack pattern/extension fails

• Executed Commands
• • Win 10
• • Win 7
• Word/Excel Macros
• • Win 10
• • Win 7
• Process Capture
• • Win 7

Add the following

• Information about obtaining the base qcow files
• How to export json reports
• Fix Neo4j documentation - a lot is missing