58 lines
3.0 KiB
XML
58 lines
3.0 KiB
XML
<stix:STIX_Package
|
|
xmlns:example="http://example.com"
|
|
xmlns:et="http://stix.mitre.org/ExploitTarget-1"
|
|
xmlns:incident="http://stix.mitre.org/Incident-1"
|
|
xmlns:indicator="http://stix.mitre.org/Indicator-2"
|
|
xmlns:ttp="http://stix.mitre.org/TTP-1"
|
|
xmlns:stixCommon="http://stix.mitre.org/common-1"
|
|
xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
|
|
xmlns:yaraTM="http://stix.mitre.org/extensions/TestMechanism#YARA-1"
|
|
xmlns:stix="http://stix.mitre.org/stix-1"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xsi:schemaLocation="
|
|
http://stix.mitre.org/ExploitTarget-1 http://stix.mitre.org/XMLSchema/exploit_target/1.2/exploit_target.xsd
|
|
http://stix.mitre.org/Incident-1 http://stix.mitre.org/XMLSchema/incident/1.2/incident.xsd
|
|
http://stix.mitre.org/Indicator-2 http://stix.mitre.org/XMLSchema/indicator/2.2/indicator.xsd
|
|
http://stix.mitre.org/TTP-1 http://stix.mitre.org/XMLSchema/ttp/1.2/ttp.xsd
|
|
http://stix.mitre.org/common-1 http://stix.mitre.org/XMLSchema/common/1.2/stix_common.xsd
|
|
http://stix.mitre.org/default_vocabularies-1 http://stix.mitre.org/XMLSchema/default_vocabularies/1.2.0/stix_default_vocabularies.xsd
|
|
http://stix.mitre.org/extensions/TestMechanism#YARA-1 http://stix.mitre.org/XMLSchema/extensions/test_mechanism/yara/1.1.1/yara_test_mechanism.xsd
|
|
|
|
http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.2/stix_core.xsd" id="example:Package-ea99d4d4-1ae7-4120-9ebe-67ed4783fb36" version="1.2">
|
|
<stix:Indicators>
|
|
<stix:Indicator id="example:indicator-567b201c-4fd5-4bde-a5db-42abc340807a" timestamp="2014-06-20T15:16:56.987616+00:00" xsi:type='indicator:IndicatorType' negate="false" version="2.1.1">
|
|
<indicator:Title>silent_banker</indicator:Title>
|
|
<indicator:Description>This is just an example.</indicator:Description>
|
|
<indicator:Test_Mechanisms>
|
|
<indicator:Test_Mechanism id="example:testmechanism-a1475567-50f7-4dae-b0d0-47c7ea8e79e1" xsi:type='yaraTM:YaraTestMechanismType'>
|
|
<indicator:Producer>
|
|
<stixCommon:Identity id="example:Identity-a0740d84-9fcd-44af-9033-94e76a53201e">
|
|
<stixCommon:Name>Yara</stixCommon:Name>
|
|
</stixCommon:Identity>
|
|
<stixCommon:References>
|
|
<stixCommon:Reference>http://plusvic.github.io/yara/</stixCommon:Reference>
|
|
</stixCommon:References>
|
|
</indicator:Producer>
|
|
<yaraTM:Rule><![CDATA[
|
|
rule silent_banker : banker
|
|
{
|
|
meta:
|
|
description = "This is just an example"
|
|
thread_level = 3
|
|
in_the_wild = true
|
|
|
|
strings:
|
|
$a = {6A 40 68 00 30 00 00 6A 14 8D 91}
|
|
$b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}
|
|
$c = "UVODFRYSIHLNWPEJXQZAKCBGMT"
|
|
|
|
condition:
|
|
$a or $b or $c
|
|
}
|
|
]]></yaraTM:Rule>
|
|
</indicator:Test_Mechanism>
|
|
</indicator:Test_Mechanisms>
|
|
</stix:Indicator>
|
|
</stix:Indicators>
|
|
</stix:STIX_Package>
|