From 479e66cc9b574de1c7fc8a44b4819f674a11943c Mon Sep 17 00:00:00 2001 From: chrisr3d Date: Mon, 11 Jun 2018 17:03:23 +0200 Subject: [PATCH] fix: Removed STIX related libraries, files, documentation, etc. --- README.md | 1 - setup.py | 2 - tests/stix.xml | 331 ------------------------------------------------- tests/test.py | 15 --- 4 files changed, 349 deletions(-) delete mode 100644 tests/stix.xml diff --git a/README.md b/README.md index 590fbac..8b96814 100644 --- a/README.md +++ b/README.md @@ -60,7 +60,6 @@ For more information: [Extending MISP with Python modules](https://www.circl.lu/ * [GoAML import](misp_modules/modules/import_mod/) Module to import [GoAML](http://goaml.unodc.org/goaml/en/index.html) XML format. * [OCR](misp_modules/modules/import_mod/ocr.py) Optical Character Recognition (OCR) module for MISP to import attributes from images, scan or faxes. * [OpenIOC](misp_modules/modules/import_mod/openiocimport.py) OpenIOC import based on PyMISP library. -* [stiximport](misp_modules/modules/import_mod/stiximport.py) - An import module to process STIX xml/json. * [ThreatAnalyzer](misp_modules/modules/import_mod/threatanalyzer_import.py) - An import module to process ThreatAnalyzer archive.zip/analysis.json sandbox exports. * [VMRay](misp_modules/modules/import_mod/vmray_import.py) - An import module to process VMRay export. diff --git a/setup.py b/setup.py index 3bdc180..f6c3a64 100644 --- a/setup.py +++ b/setup.py @@ -33,8 +33,6 @@ setup( 'pyeupi', 'ipasn-redis', 'asnhistory', - 'stix', - 'cybox', 'pillow', 'pytesseract', 'shodan', diff --git a/tests/stix.xml b/tests/stix.xml deleted file mode 100644 index a4a60d8..0000000 --- a/tests/stix.xml +++ /dev/null @@ -1,331 +0,0 @@ - - - - CNC Server 1 - - - 82.146.166.56 - - - - - CNC Server 2 - - - 209.239.79.47 - - - - - CNC Server 3 - - - 41.213.121.180 - - - - - Watering Hole Wordpress - - - eu-society.com - - - - - Watering Hole Wordpress - - - aromatravel.org - - - - - Watering Hole Wordpress - - - bss.servebbs.com - - - - - - - Watering Hole Detected - URL Watchlist - - - - C2 List - - - C2 List - - - C2 List - - - - - - CnC Beaconing Detected - C2 - - - - - - - - - - - - - - - Malware CnC Channels - - Advantage - - - - Hosting - - - - - - - - - - - - - Fingerprinting and whitelisting during watering-hole operations - - Theft - Credential Theft - - - - Domain Registration - - - C2 List - - - C2 List - - - C2 List - - - - - - - - - - Spear-phishing in tandem with 0-day exploits - - Unauthorized Access - - - - - - - Infiltration of organisations via third party supplier/partner - - Unauthorized Access - - - - - - - Custom recon tool to compromise and identify credentials of the network - - Theft - Credential Theft - - - - - - - Multiple means of C2 communications given the diversity of the attacker toolset - - Advantage - - - - - - - rootkit communicates during the same time as network activity, encoded with an XOR key - - Advantage - - - - - - - Kernel-centric rootkit waits for network trigger before launching - - Advantage - - - - - - - Kernel centric exfiltration over TCP/UDP/DNS/ICMP/HTTP - - Theft - - - - - - - Exfiltration over HTTP/HTTPS - - Theft - - - - - - - Use of previously undocumented functions in their Kernel centric attacks - - Advantage - - - - - - - - - - - - - - - - - Privilage Escalation Vulnerability - - CVE-2013-5065 - - - - - - The Epic Turla Campaign - The Epic Turla Campaign - - Advantage - Political - - - - - - - - - - SNAKE Campaign - The SNAKE Campaign - - Advantage - Political - - - - - - - - - - - - SNAKE - -The group behind the SNAKE campaign are a top tier nation-state threat. Their capabilities extend from subtle watering-hole attacks to sophisticated server rootkits – virtually undetectable by conventional security products. -This threat actor group has been operating continuously for over a decade, infiltrating governments and strategic private sector networks in that time. The most notorious of their early campaigns led to a breach of classified US military systems, an extensive clean-up called ‘Operation Buckshot Yankee’, and led to the creation of the US Cyber Command. -Whilst the sophisticated rootkit is used for persistent access to networks, the group also leverage more straight-forward capabilities for gaining an initial toe-hold on targets. This includes the use of watering-hole attacks and basic remote access tools. - - -The group behind the SNAKE campaign are a top tier nation-state threat. Their capabilities extend from subtle watering-hole attacks to sophisticated server rootkits – virtually undetectable by conventional security products. - - - - - - SNAKE - - - Turla - - - WRAITH - - - - - - Russia - - - Moscow - - - - - snake@gmail.com - twitter.com/snake - - - Russian - - - - - Political - - - Expert - - - Advantage - Political - - - Theft - Intellectual Property - - - - diff --git a/tests/test.py b/tests/test.py index 5a56f5a..d32bd00 100644 --- a/tests/test.py +++ b/tests/test.py @@ -57,21 +57,6 @@ class TestModules(unittest.TestCase): assert("mrxcls.sys" in values) assert("mdmcpq3.PNF" in values) - def test_stix(self): - with open("tests/stix.xml", "rb") as f: - content = base64.b64encode(f.read()) - data = json.dumps({"module": "stiximport", - "data": content.decode('utf-8'), - }) - response = requests.post(self.url + "query", data=data).json() - - print("STIX :: {}".format(response)) - values = [x["values"][0] for x in response["results"]] - - assert("209.239.79.47" in values) - assert("41.213.121.180" in values) - assert("eu-society.com" in values) - def test_email_headers(self): query = {"module": "email_import"} query["config"] = {"unzip_attachments": None,