CalvinBackup/mvt
1
0
Fork 0
mirror of https://github.com/mvt-project/mvt.git synced 2026-08-12 22:20:26 +02:00
Code Issues Packages Projects Releases Wiki Activity

First test structure

Browse Source
This commit is contained in:
tek
2022-01-07 16:41:19 +01:00
committed by Donncha Ó Cearbhaill
parent 28d57e7178
commit 513e2cc704
16 changed files with 318 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/artifacts/0d/0d609c54856a9bb2d56729df1d68f2958a88426b
BIN
View File
Binary file not shown.
tests/artifacts/64/64d0019cb3d46bfc8cce545a8ba54b93e7ea9347
BIN
View File
Binary file not shown.
tests/artifacts/Info.plist
BIN
View File
Binary file not shown.
tests/artifacts/Manifest.db
BIN
View File
Binary file not shown.
tests/artifacts/generate_stix.py
+41
View File
@@ -0,0 +1,41 @@
import sys
import os
from stix2.v21 import (Indicator, Malware, Relationship, Bundle, DomainName)
if __name__ == "__main__":
if os.path.isfile("test.stix2"):
os.remove("test.stix2")
domains = ["example.org"]
processes = ["Launch"]
emails = ["foobar@example.org"]
filenames = ["/var/foobar/txt"]
res = []
malware = Malware(name="TestMalware", is_family=False, description="")
res.append(malware)
for d in domains:
i = Indicator(indicator_types=["malicious-activity"], pattern="[domain-name:value='{}']".format(d), pattern_type="stix")
res.append(i)
res.append(Relationship(i, 'indicates', malware))
for p in processes:
i = Indicator(indicator_types=["malicious-activity"], pattern="[process:name='{}']".format(p), pattern_type="stix")
res.append(i)
res.append(Relationship(i, 'indicates', malware))
for f in filenames:
i = Indicator(indicator_types=["malicious-activity"], pattern="[file:name='{}']".format(f), pattern_type="stix")
res.append(i)
res.append(Relationship(i, 'indicates', malware))
for e in emails:
i = Indicator(indicator_types=["malicious-activity"], pattern="[email-addr:value='{}']".format(e), pattern_type="stix")
res.append(i)
res.append(Relationship(i, 'indicates', malware))
bundle = Bundle(objects=res)
with open("test.stix2", "w+") as f:
f.write(bundle.serialize(pretty=True))
print("test.stix2 file created")
tests/artifacts/test.stix2
+112
View File
@@ -0,0 +1,112 @@
{
"type": "bundle",
"id": "bundle--25fa4351-8a0a-4fea-bb4c-88ecbd0dfbf2",
"objects": [
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--b4581613-1fe9-441a-a7a5-56df36664e54",
"created": "2021-12-16T11:49:29.897487Z",
"modified": "2021-12-16T11:49:29.897487Z",
"name": "TestMalware",
"description": "",
"is_family": false
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--8614e326-7863-4d79-902c-89a0b769f290",
"created": "2021-12-16T11:49:29.897624Z",
"modified": "2021-12-16T11:49:29.897624Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[domain-name:value='example.org']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-12-16T11:49:29.897624Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6e02e776-1aa7-4436-8df0-d6cb6227f098",
"created": "2021-12-16T11:49:29.903846Z",
"modified": "2021-12-16T11:49:29.903846Z",
"relationship_type": "indicates",
"source_ref": "indicator--8614e326-7863-4d79-902c-89a0b769f290",
"target_ref": "malware--b4581613-1fe9-441a-a7a5-56df36664e54"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--1917e54e-d91d-4d11-811c-79e861c31661",
"created": "2021-12-16T11:49:29.903984Z",
"modified": "2021-12-16T11:49:29.903984Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[process:name='Launch']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-12-16T11:49:29.903984Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e6561236-ef2e-45ed-984b-d1c4832119ca",
"created": "2021-12-16T11:49:29.905442Z",
"modified": "2021-12-16T11:49:29.905442Z",
"relationship_type": "indicates",
"source_ref": "indicator--1917e54e-d91d-4d11-811c-79e861c31661",
"target_ref": "malware--b4581613-1fe9-441a-a7a5-56df36664e54"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--bd3961ab-e13a-42f5-b677-a797ced82adf",
"created": "2021-12-16T11:49:29.905565Z",
"modified": "2021-12-16T11:49:29.905565Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[file:name='/var/foobar/txt']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-12-16T11:49:29.905565Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9f4b5ee9-45d1-4b55-877c-082104baedab",
"created": "2021-12-16T11:49:29.906687Z",
"modified": "2021-12-16T11:49:29.906687Z",
"relationship_type": "indicates",
"source_ref": "indicator--bd3961ab-e13a-42f5-b677-a797ced82adf",
"target_ref": "malware--b4581613-1fe9-441a-a7a5-56df36664e54"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--0a798fe3-2293-4e60-8d45-d8d5cbd3f22f",
"created": "2021-12-16T11:49:29.906826Z",
"modified": "2021-12-16T11:49:29.906826Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[email-addr:value='foobar@example.org']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-12-16T11:49:29.906826Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--40f7462d-173b-43b5-b9e3-056f28c01ff7",
"created": "2021-12-16T11:49:29.907909Z",
"modified": "2021-12-16T11:49:29.907909Z",
"relationship_type": "indicates",
"source_ref": "indicator--0a798fe3-2293-4e60-8d45-d8d5cbd3f22f",
"target_ref": "malware--b4581613-1fe9-441a-a7a5-56df36664e54"
}
]
}