From 5ffd987a93793123aebb37ef368615592ba1f740 Mon Sep 17 00:00:00 2001 From: Hannah Ward Date: Fri, 18 Nov 2016 13:51:01 +0000 Subject: [PATCH] Added tests and a travis build --- .travis.yml | 41 ++++++ setup.py | 2 +- tests/block-network-traffic.xml | 56 ++++++++ tests/campaign-v-actors.xml | 47 +++++++ tests/command-and-control-ip-list.xml | 61 +++++++++ tests/cve-in-exploit-target.xml | 25 ++++ tests/file-hash-reputation.xml | 44 ++++++ tests/identifying-a-threat-actor-group.xml | 56 ++++++++ tests/incident-malware.xml | 42 ++++++ tests/incident-with-affected-asset.xml | 39 ++++++ tests/incident-with-related-observables.xml | 64 +++++++++ tests/indicator-for-c2-ip-address.xml | 42 ++++++ tests/indicator-for-malicious-url.xml | 37 +++++ tests/kill-chain.xml | 45 ++++++ ...icious-email-indicator-with-attachment.xml | 104 ++++++++++++++ tests/malware-characterization-using-maec.xml | 44 ++++++ tests/malware-indicator-for-file-hash.xml | 62 +++++++++ tests/openioc-test-mechanism.xml | 128 ++++++++++++++++++ tests/sample.xml | 48 +++++++ tests/snort-test-mechanism.xml | 68 ++++++++++ tests/test.xml | 61 +++++++++ tests/test_upload.py | 22 +++ tests/yara-test-mechanism.xml | 57 ++++++++ 23 files changed, 1194 insertions(+), 1 deletion(-) create mode 100644 .travis.yml create mode 100644 tests/block-network-traffic.xml create mode 100644 tests/campaign-v-actors.xml create mode 100644 tests/command-and-control-ip-list.xml create mode 100644 tests/cve-in-exploit-target.xml create mode 100644 tests/file-hash-reputation.xml create mode 100644 tests/identifying-a-threat-actor-group.xml create mode 100644 tests/incident-malware.xml create mode 100644 tests/incident-with-affected-asset.xml create mode 100644 tests/incident-with-related-observables.xml create mode 100644 tests/indicator-for-c2-ip-address.xml create mode 100644 tests/indicator-for-malicious-url.xml create mode 100644 tests/kill-chain.xml create mode 100644 tests/malicious-email-indicator-with-attachment.xml create mode 100644 tests/malware-characterization-using-maec.xml create mode 100644 tests/malware-indicator-for-file-hash.xml create mode 100644 tests/openioc-test-mechanism.xml create mode 100644 tests/sample.xml create mode 100644 tests/snort-test-mechanism.xml create mode 100644 tests/test.xml create mode 100644 tests/test_upload.py create mode 100644 tests/yara-test-mechanism.xml diff --git a/.travis.yml b/.travis.yml new file mode 100644 index 0000000..3e2528d --- /dev/null +++ b/.travis.yml @@ -0,0 +1,41 @@ +language: python + +python: + - "2.7" + - "3.5" + - "nightly" + +cache: pip + +services: + - mysql + +env: + - OPENTAXII_CONFIG=$TRAVIS_BUILD_DIR/config.yaml + - URL="http://ec2-52-42-201-6.us-west-2.compute.amazonaws.com" + - APIKEY=Vjy0ra7wO6w6si7hbjxX52nARfVpaAO6Tm6lxeSm + +install: + # Set up the deps + - git submodule init + - git submodule update + # Install OpenTAXII + - cd OpenTAXII + - python setup.py install + - cd .. + # Create databases + - mysql -u root -e 'create database taxiiauth; create database taxiipersist;' + - mysql -u root -e "grant all on taxiiauth.* to 'taxii'@'%' identified by 'some_password';" + - mysql -u root -e "grant all on taxiipersist.* to 'taxii'@'%' identified by 'some_password';" + # Populate databases + - opentaxii-create-services -c services.yaml + - opentaxii-create-collections -c collections.yaml + - opentaxii-create-acccount -u travis -p travis + #Configure hooks + - misp_taxii_hooks/hooks.py + - python setup.py install + +script: + - cd tests + - nosetests . + - cd .. diff --git a/setup.py b/setup.py index 4ae4ab1..5f57965 100644 --- a/setup.py +++ b/setup.py @@ -12,6 +12,6 @@ setup( author="Hannah Ward", author_email="hannah.ward2@baesystems.com", packages=['misp_taxii_hooks'], - install_requires=["pymisp>=2.4.53", "pyaml>=3.11"], + install_requires=["pymisp>=2.4.53", "pyaml>=3.11", "cabby>=0.1", "nose>=1.3.7"], ) diff --git a/tests/block-network-traffic.xml b/tests/block-network-traffic.xml new file mode 100644 index 0000000..5e68235 --- /dev/null +++ b/tests/block-network-traffic.xml @@ -0,0 +1,56 @@ + + + + Block traffic to PIVY C2 Server (10.10.10.10) + Response + Perimeter Blocking + + Block communication between the PIVY agents and the C2 Server + + High + + + + + + + 10.10.10.10 + + + + + + Low + This IP address is not used for legitimate hosting so there should be no operational impact. + + + Low + + + High + + + + + diff --git a/tests/campaign-v-actors.xml b/tests/campaign-v-actors.xml new file mode 100644 index 0000000..56e8084 --- /dev/null +++ b/tests/campaign-v-actors.xml @@ -0,0 +1,47 @@ + + + + + Compromise of ATM Machines + + + + Victim Targeting: Customer PII and Financial Data + + Information Assets - Financial Data + + + + + + + + + + + + + People behind the intrusion + + + + + + + diff --git a/tests/command-and-control-ip-list.xml b/tests/command-and-control-ip-list.xml new file mode 100644 index 0000000..69dd326 --- /dev/null +++ b/tests/command-and-control-ip-list.xml @@ -0,0 +1,61 @@ + + + + + + + 198.51.100.2 + + + + + + + 198.51.100.17 + + + + + + + 203.0.113.19 + + + + + + + Malware C2 Channel + + + Malware C2 + + + + + + + + + + diff --git a/tests/cve-in-exploit-target.xml b/tests/cve-in-exploit-target.xml new file mode 100644 index 0000000..2d69cb0 --- /dev/null +++ b/tests/cve-in-exploit-target.xml @@ -0,0 +1,25 @@ + + + + + Javascript vulnerability in MSIE 6-11 + + CVE-2013-3893 + + + + + diff --git a/tests/file-hash-reputation.xml b/tests/file-hash-reputation.xml new file mode 100644 index 0000000..03ee29f --- /dev/null +++ b/tests/file-hash-reputation.xml @@ -0,0 +1,44 @@ + + + File Hash Reputation Service Results + Indicators - Malware Artifacts + + + + File Reputation for SHA256=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 + File Hash Watchlist + + + + + + SHA256 + e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 + + + + + + + + Malicious file + + + + 75 + + + + + diff --git a/tests/identifying-a-threat-actor-group.xml b/tests/identifying-a-threat-actor-group.xml new file mode 100644 index 0000000..19bf8f9 --- /dev/null +++ b/tests/identifying-a-threat-actor-group.xml @@ -0,0 +1,56 @@ + + + + + Disco Team Threat Actor Group + + + + + Disco Tean + + + Equipo del Discoteca + + + + + + United States + + + California + + + + + disco-team@stealthemail.com + facebook.com/thediscoteam + + + Spanish + + + + + + diff --git a/tests/incident-malware.xml b/tests/incident-malware.xml new file mode 100644 index 0000000..ef63875 --- /dev/null +++ b/tests/incident-malware.xml @@ -0,0 +1,42 @@ + + + + Poison Ivy + + + + Remote Access Trojan + Poison Ivy + + + + + + + + Detected Poison Ivy beaconing through perimeter firewalls + + + Uses Malware + + + + + + + diff --git a/tests/incident-with-affected-asset.xml b/tests/incident-with-affected-asset.xml new file mode 100644 index 0000000..701a584 --- /dev/null +++ b/tests/incident-with-affected-asset.xml @@ -0,0 +1,39 @@ + + + + + Exfiltration from hr-data1.example.com + + + Database + Database server at hr-data1.example.com + Hosts the database for example.com + Internally-Owned + Internally-Managed + Internally-Located + + + Confidentiality + Data was exfiltrated, has not been determined which data or how. + Yes + + + + + + + + diff --git a/tests/incident-with-related-observables.xml b/tests/incident-with-related-observables.xml new file mode 100644 index 0000000..e6499cb --- /dev/null +++ b/tests/incident-with-related-observables.xml @@ -0,0 +1,64 @@ + + + + Malicious files detected + + + Malicious Artifact Detected + + + + readme.doc.exe + 40891 + + + SHA256 + e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 + + + + + + + + Malicious Artifact Detected + + + + readme.doc.exe + 40891 + + + SHA256 + d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592 + + + + + + + + + + + diff --git a/tests/indicator-for-c2-ip-address.xml b/tests/indicator-for-c2-ip-address.xml new file mode 100644 index 0000000..35cc08c --- /dev/null +++ b/tests/indicator-for-c2-ip-address.xml @@ -0,0 +1,42 @@ + + + + IP Address for known C2 channel + IP Watchlist + + + + 10.0.0.0 + + + + + + + + + + + C2 Behavior + + + diff --git a/tests/indicator-for-malicious-url.xml b/tests/indicator-for-malicious-url.xml new file mode 100644 index 0000000..ad86e6d --- /dev/null +++ b/tests/indicator-for-malicious-url.xml @@ -0,0 +1,37 @@ + + + + Malicious site hosting downloader + URL Watchlist + + + + http://x4z9arb.cn/4712 + + + + + + + diff --git a/tests/kill-chain.xml b/tests/kill-chain.xml new file mode 100644 index 0000000..c884bfd --- /dev/null +++ b/tests/kill-chain.xml @@ -0,0 +1,45 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/tests/malicious-email-indicator-with-attachment.xml b/tests/malicious-email-indicator-with-attachment.xml new file mode 100644 index 0000000..d618336 --- /dev/null +++ b/tests/malicious-email-indicator-with-attachment.xml @@ -0,0 +1,104 @@ + + + + Malicious E-mail + Malicious E-mail + + + + + [IMPORTANT] Please Review Before + + + + + + + + + + + + High + + + + Malicious E-mail Subject Line + Malicious E-mail + + + + + [IMPORTANT] Please Review Before + + + + + + + + + Low + + + + Malicious E-mail Attachment + Malicious E-mail + + + + + + + + + + + Final Report + doc.exe + + Contains + + + + + + + + + Low + + + + + + Phishing + + + + diff --git a/tests/malware-characterization-using-maec.xml b/tests/malware-characterization-using-maec.xml new file mode 100644 index 0000000..53cb46d --- /dev/null +++ b/tests/malware-characterization-using-maec.xml @@ -0,0 +1,44 @@ + + + + + Poison Ivy Variant v4392-acc + + + + Remote Access Trojan + Poison Ivy Variant v4392-acc + + + + + + + + + + + + + + + diff --git a/tests/malware-indicator-for-file-hash.xml b/tests/malware-indicator-for-file-hash.xml new file mode 100644 index 0000000..165edb0 --- /dev/null +++ b/tests/malware-indicator-for-file-hash.xml @@ -0,0 +1,62 @@ + + + + File hash for Poison Ivy variant + File Hash Watchlist + + + + + + SHA256 + ef537f25c895bfa782526529a9b63d97aa631564d5d789c2b765448c8635fb6c + + + + + + + + + + + + + Poison Ivy + + + + Remote Access Trojan + Poison Ivy + + + + + + + diff --git a/tests/openioc-test-mechanism.xml b/tests/openioc-test-mechanism.xml new file mode 100644 index 0000000..2022788 --- /dev/null +++ b/tests/openioc-test-mechanism.xml @@ -0,0 +1,128 @@ + + + + Zeus + Finds Zeus variants, twexts, sdra64, ntos + + + + + + + + Mandiant + + + 2001-01-01T00:00:00 + + + http://openioc.org/iocs/6d2a1b03-b216-4cd8-9a9e-8827af6ebf93.ioc + + + + Zeus + Finds Zeus variants, twexts, sdra64, ntos + + Mandiant + 0001-01-01T00:00:00 + + + + + + + winlogon.exe + + + + File + + + + + system32\sdra64.exe + + + + system32\twain_32\user.ds + + + + \WINDOWS\system32\twext.exe + + + + system32\twain32\local.ds + + + + system32\twext.exe + + + + system32\lowsec\user.ds + + + + system32\lowsec\local.ds + + + + + + + Mutant + + + + + __SYSTEM__ + + + + _AVIRA_ + + + + + + + + + + + + + Zeus + + + + Zeus + twexts + sdra64 + ntos + + + + + + diff --git a/tests/sample.xml b/tests/sample.xml new file mode 100644 index 0000000..ab0a20b --- /dev/null +++ b/tests/sample.xml @@ -0,0 +1,48 @@ + + + + Breach of Cyber Tech Dynamics + + 2012-01-30T00:00:00 + 2012-05-10T00:00:00 + 2012-08-10T00:00:00 + 2012-12-10T00:00:00 + + Intrusion into enterprise network + + The person who reported it + + Sample Investigations, LLC + + + 2014-03-11T00:00:00 + + + + Cyber Tech Dynamics + + + + Financial Loss + + + + High + + + + + diff --git a/tests/snort-test-mechanism.xml b/tests/snort-test-mechanism.xml new file mode 100644 index 0000000..d3582b2 --- /dev/null +++ b/tests/snort-test-mechanism.xml @@ -0,0 +1,68 @@ + + + + Snort Signature for Heartbleed + + + + + + + Low + + + + FOX IT + + + http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/ + + + any any (msg:"FOX-SRT - Flowbit - TLS-SSL Client Hello"; flow:established; dsize:< 500; content:"|16 03|"; depth:2; byte_test:1, <=, 2, 3; byte_test:1, !=, 2, 1; content:"|01|"; offset:5; depth:1; content:"|03|"; offset:9; byte_test:1, <=, 3, 10; byte_test:1, !=, 2, 9; content:"|00 0f 00|"; flowbits:set,foxsslsession; flowbits:noalert; threshold:type limit, track by_src, count 1, seconds 60; reference:cve,2014-0160; classtype:bad-unknown; sid: 21001130; rev:9;)]]> + any any (msg:"FOX-SRT - Suspicious - TLS-SSL Large Heartbeat Response"; flow:established; flowbits:isset,foxsslsession; content:"|18 03|"; depth: 2; byte_test:1, <=, 3, 2; byte_test:1, !=, 2, 1; byte_test:2, >, 200, 3; threshold:type limit, track by_src, count 1, seconds 600; reference:cve,2014-0160; classtype:bad-unknown; sid: 21001131; rev:5;)]]> + + + + High + + + + + + Generic Heartbleed Exploits + + + + + + + + + + Heartbleed + + CVE-2013-3893 + + + + diff --git a/tests/test.xml b/tests/test.xml new file mode 100644 index 0000000..e9ec659 --- /dev/null +++ b/tests/test.xml @@ -0,0 +1,61 @@ + + + + + + + 198.51.100.2 + + + + + + + 198.51.100.17 + + + + + + + 203.0.113.19 + + + + + + + Malware C2 Channel + + + Malware C2 + + + + + + + + + + diff --git a/tests/test_upload.py b/tests/test_upload.py new file mode 100644 index 0000000..3e4f053 --- /dev/null +++ b/tests/test_upload.py @@ -0,0 +1,22 @@ +#!/usr/bin/env python + +import subprocess +import glob + +def test_push(): + for fname in glob.glob("*.xml"): + proc = subprocess.Popen([ + "taxii-push", + "--path", "http://localhost:9000/services/inbox", + "-f", fname, + "--dest", "collection", + "--username", "travis", + "--password", "travis" + ], + stdout=subprocess.PIPE, + stderr=subprocess.PIPE + ) + + out,err = proc.communicate() + print(out) + assert("Content block successfully pushed" in out.decode("utf-8")) diff --git a/tests/yara-test-mechanism.xml b/tests/yara-test-mechanism.xml new file mode 100644 index 0000000..40f36af --- /dev/null +++ b/tests/yara-test-mechanism.xml @@ -0,0 +1,57 @@ + + + + silent_banker + This is just an example. + + + + + Yara + + + http://plusvic.github.io/yara/ + + + + + + + + \ No newline at end of file