ioc_writer

The source code in this package is made available under the terms of the Apache License , Version 2.0. See the "LICENSE " file for more information.

Status

Author

William Gibb william.gibb at fireeye dot com

Purpose

Provide a python library that allows for basic creation and editing of OpenIOC objects. It supports a basic CRUD (Create, Read, Update, Delete) for various items:

item	Create	Read	Update	Delete
IOC name	Yes	No	Yes	Yes
IOC description	Yes	No	Yes	Yes
created date	Yes	No	Yes	N/A
last modified date	Yes	No	Yes	N/A
published date	Yes	No	Yes	N/A
link metadata	Yes	No	Yes	Yes
IndicatorItem nodes	Yes	No	NotYet	Yes
Indicator nodes	Yes	No	NotYet	Yes
Parameters	Yes	No	Yes	Yes

Items do not have built in Read operations, since all items can be accesed with built in ElementTree syntax or the use of XPATH to select portions of the IOC.

No decision has been made about whether or not to support changing of existing Indicator/IndicatorItem nodes.

See the Docs located at https://pythonhosted.org/ioc_writer/ and the examples directory for examples of working with the library. The user code should avoid having to call functionality in ioc_writer.ioc_et.

Requirements

The python "lxml" library must be installed. This can be obtained from https://pypi.python.org/pypi/lxml

Installation

See the file named "INSTALL" for instructions on installing this library locally.

Examples

Example code lives in the examples folder of the repository.

examples/11_to_10_downgrade Script to downgrade OpenIOC 1.1 to OpenIOC 1.1.
examples/openioc_to_yara Scripts that support encapsulating YARA signatures in OpenIOC 1.1 format.
examples/simple_ioc_writer Script that consumes a csv of data to build an IOC. this csv contains the content, context, et cetera. An example CSV is provided.

Bug reports / questions / feedback / feature requests

william.gibb at fireeye dot com

xml openioc_to_yara parse error

Hello!

I have the following issue with some xml formats I am trying to parse with the openioc_to_yara.py.
First, I have the following xml:

<?xml version='1.0' encoding='UTF-8'?>
<!--
    TITLE:          0b879284-0c37-4bfa-9dd8-34505a9c5175.ioc
    VERSION:        1.0
    DESCRIPTION:    OpenIOC file
    LICENSE:        Copyright 2015 FireEye Corporation.  Licensed under the Apache 2.0 license.

    FireEye licenses this file to you under the Apache License, Version
    2.0 (the "License"); you may not use this file except in compliance with the
    License.  You may obtain a copy of the License at:

            http://www.apache.org/licenses/LICENSE-2.0

    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
    implied.  See the License for the specific language governing
    permissions and limitations under the License.
-->
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.mandiant.com/2010/ioc" id="0b879284-0c37-4bfa-9dd8-34505a9c5175" last-modified="2015-01-27T21:18:07Z">
  <short_description>PYTHON SHELLCODE (DOWNLOADER)</short_description>
  <description>The shellcode launcher is a simple launcher which recieves an encoded shellcode buffer from its C2 server, allocates memory for it and then executes the shellcode.  The launcher is written in python and packaged with PyInstaller.  You can read more about this downloader at https://www.fireeye.com/blog/threat-research/2015/02/behind_the_syrianco.htmlhttps://www.fireeye.com/blog/threat-research/2015/02/behind_the_syrianco.html </description>
  <keywords/>
  <authored_by>FireEye</authored_by>
  <authored_date>2015-01-27T19:56:21Z</authored_date>
  <links>
    <link rel="category">Downloader</link>
    <link rel="license">Apache 2.0</link>
  </links>
  <definition>
    <Indicator id="b5c921a1-56c5-45ab-9537-72581eb73e0e" operator="OR">
      <IndicatorItem id="a89dc9cb-15a5-42e6-9e49-7a7cc9ae1bf5" condition="is">
        <Context document="FileItem" search="FileItem/Md5sum" type="mir"/>
        <Content type="md5">64a17f5177157bb8c4199d38c46ec93b</Content>
      </IndicatorItem>
      <IndicatorItem id="452d566a-78fb-48cc-bb9e-47ae7234a1dd" condition="is">
        <Context document="FileItem" search="FileItem/FileName" type="mir"/>
        <Content type="string">Facebook-Account.exe</Content>
      </IndicatorItem>
      <IndicatorItem id="ece0648f-532e-42ec-8f67-095aafb53ca2" condition="contains">
        <Context document="PortItem" search="PortItem/remoteIP" type="mir"/>
        <Content type="IP">80.241.223.128</Content>
      </IndicatorItem>
    </Indicator>
  </definition>
</ioc>

and when I try to parse it I get an error saying it is not openioc but ioc. I tried to confront it using the
openioc_10_to_11. The resulted file accomplished parsing it successfully but the output file was empty. The upgraded file is the next one:

<?xml version='1.0' encoding='UTF-8'?>
<OpenIOC xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://openioc.org/schemas/OpenIOC_1.1" id="0b879284-0c37-4bfa-9dd8-34505a9c5175" last-modified="2015-01-27T21:18:07" published-date="0001-01-01T00:00:00">
  <metadata>
    <short_description>PYTHON SHELLCODE (DOWNLOADER)</short_description>
    <description>The shellcode launcher is a simple launcher which recieves an encoded shellcode buffer from its C2 server, allocates memory for it and then executes the shellcode.  The launcher is written in python and packaged with PyInstaller.  You can read more about this downloader at https://www.fireeye.com/blog/threat-research/2015/02/behind_the_syrianco.htmlhttps://www.fireeye.com/blog/threat-research/2015/02/behind_the_syrianco.html </description>
    <keywords/>
    <authored_by>FireEye</authored_by>
    <authored_date>2015-01-27T19:56:21</authored_date>
    <links>
      <link rel="category" href="Downloader"/>
      <link rel="license" href="Apache 2.0"/>
    </links>
  </metadata>
  <criteria>
    <Indicator id="eead8521-fbea-4ddb-8aad-05b09dc08468" operator="OR">
      <IndicatorItem id="a89dc9cb-15a5-42e6-9e49-7a7cc9ae1bf5" condition="is" preserve-case="false" negate="false">
        <Context document="FileItem" search="FileItem/Md5sum" type="mir"/>
        <Content type="md5">64a17f5177157bb8c4199d38c46ec93b</Content>
      </IndicatorItem>
      <IndicatorItem id="452d566a-78fb-48cc-bb9e-47ae7234a1dd" condition="is" preserve-case="false" negate="false">
        <Context document="FileItem" search="FileItem/FileName" type="mir"/>
        <Content type="string">Facebook-Account.exe</Content>
      </IndicatorItem>
      <IndicatorItem id="ece0648f-532e-42ec-8f67-095aafb53ca2" condition="contains" preserve-case="false" negate="false">
        <Context document="PortItem" search="PortItem/remoteIP" type="mir"/>
        <Content type="IP">80.241.223.128</Content>
      </IndicatorItem>
    </Indicator>
  </criteria>
  <parameters/>
</OpenIOC>

So, comparing the example ioc and mine I saw a difference in the document, search and type tags.
As I changed them from <Context document="FileItem" search="FileItem/Md5sum" type="mir"/> to <Context document="Yara" search="Yara/HexString" type="yara" /> and then
run the openioc_to_yara I finally got the yara rule! But this is a lot of effort...so my question is, is there an
error with the format of the input? Is there something wrong about the parser? I would like to get the yara rule instantly without doing all this job, especially when I have a ton of .ioc files

mandiant / ioc_writer Goto Github PK

ioc_writer's Introduction

ioc_writer

Status

Author

Purpose

Requirements

Installation

Examples

Bug reports / questions / feedback / feature requests

ioc_writer's People

Contributors

Stargazers

Watchers

Forkers

ioc_writer's Issues

Recommend Projects

Recommend Topics

Recommend Org