Something with file hashes about cape2stix

[Fhree99]

MATCH (f:file WHERE f.hashes =~ '.[0-9,a-z,A-Z]{64}.' OR f.hashes =~ '.[0-9,a-z,A-Z]{32}.') RETURN f

[Fhree99]

We might need to verify that our file objects (or indicators) are actually getting hash values (sha, etc)

[Fhree99]

While looking at cape2stix code

SHA256 MD5 IF TLSH, SSDeep Any Internal tags (implies) - perhaps throw it in a note object

Take Hashes in STIX bundles

Signatures Sys Calls Double Check Processes Take a look at the difference between the hashes of the main file and hashes of the dropped files.