reverse-skills-max: initial public release (restored, redacted, hardened)
This commit is contained in:
baradok609hecl1pq6qi
@@ -0,0 +1,48 @@
|
||||
# API Reference — Performing Malware IOC Extraction
|
||||
|
||||
## Libraries Used
|
||||
- **re**: Regex patterns for 16 IOC types including defanged indicators
|
||||
- **hashlib**: MD5, SHA1, SHA256 file hashing
|
||||
- **pathlib**: File reading (text and binary)
|
||||
|
||||
## CLI Interface
|
||||
```
|
||||
python agent.py text --file threat_report.txt
|
||||
python agent.py hash --file malware.exe
|
||||
python agent.py strings --file malware.exe [--min-length 6]
|
||||
python agent.py report --file malware.exe [--output iocs.json]
|
||||
```
|
||||
|
||||
## Core Functions
|
||||
|
||||
### `extract_iocs_from_text(text)` — Extract IOCs with defanging support
|
||||
Handles defanged indicators: `[.]` -> `.`, `hxxp` -> `http`. Filters private IPs.
|
||||
|
||||
### `extract_from_file(file_path)` — Extract IOCs from text/report files
|
||||
### `hash_file(file_path)` — Calculate MD5/SHA1/SHA256 hashes
|
||||
### `extract_strings(file_path, min_length)` — Binary string extraction
|
||||
Extracts ASCII and wide (UTF-16LE) strings. Identifies suspicious API calls and keywords.
|
||||
|
||||
### `generate_ioc_report(file_path, output)` — Full analysis report
|
||||
|
||||
## IOC Pattern Types (16)
|
||||
| Type | Example |
|
||||
|------|---------|
|
||||
| ipv4 | 192.168.1.1 (private filtered) |
|
||||
| domain | evil.example.com |
|
||||
| url | https://malware.example.com/payload |
|
||||
| md5/sha1/sha256 | File hashes |
|
||||
| cve | CVE-2024-12345 |
|
||||
| registry_key | HKLM\Software\... |
|
||||
| file_path_windows | C:\Windows\Temp\mal.exe |
|
||||
| mutex | Global\MutexName |
|
||||
| mitre_technique | T1059.001 |
|
||||
| bitcoin_addr | Bitcoin wallet address |
|
||||
| user_agent | Mozilla/5.0 strings |
|
||||
|
||||
## Suspicious String Keywords
|
||||
CreateRemoteThread, VirtualAlloc, WriteProcessMemory, LoadLibrary,
|
||||
GetProcAddress, WinExec, ShellExecute, powershell, cmd.exe
|
||||
|
||||
## Dependencies
|
||||
No external packages — Python standard library only.
|
||||
@@ -0,0 +1,81 @@
|
||||
# Standards and Frameworks Reference
|
||||
|
||||
## IOC Types and Classification
|
||||
|
||||
### File-Based IOCs
|
||||
| Type | Description | Example |
|
||||
|------|-------------|---------|
|
||||
| MD5 | 128-bit hash | d41d8cd98f00b204e9800998ecf8427e |
|
||||
| SHA-1 | 160-bit hash | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
|
||||
| SHA-256 | 256-bit hash | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
|
||||
| Imphash | Import hash | PE import table hash for family grouping |
|
||||
| SSDeep | Fuzzy hash | Context-triggered piecewise hash for similarity |
|
||||
| TLSH | Trend Micro LSH | Locality-sensitive hash for near-duplicate detection |
|
||||
|
||||
### Network IOCs
|
||||
| Type | Description | Example |
|
||||
|------|-------------|---------|
|
||||
| IPv4 Address | C2 server IP | 192.0.2.1 |
|
||||
| Domain | C2 domain | malware-c2.example.com |
|
||||
| URL | Full URL path | https://evil.com/payload.exe |
|
||||
| JA3/JA3S | TLS fingerprint | Client/server TLS handshake hash |
|
||||
| JARM | TLS server fingerprint | Active TLS server scanning fingerprint |
|
||||
| User-Agent | HTTP User-Agent | Custom UA strings in beacons |
|
||||
|
||||
### Host-Based IOCs
|
||||
| Type | Description | Example |
|
||||
|------|-------------|---------|
|
||||
| Mutex | Named mutex | Global\{GUID} |
|
||||
| Registry Key | Registry modification | HKLM\SOFTWARE\...\Run |
|
||||
| Scheduled Task | Persistence task | schtasks /create ... |
|
||||
| Service Name | Malicious service | Malicious service installation |
|
||||
| Named Pipe | IPC mechanism | \\.\pipe\name |
|
||||
| PDB Path | Debug path | C:\Users\dev\project.pdb |
|
||||
|
||||
## STIX 2.1 Indicator Patterns
|
||||
|
||||
### Pattern Syntax
|
||||
```
|
||||
[file:hashes.'SHA-256' = 'abc123...']
|
||||
[ipv4-addr:value = '1.2.3.4']
|
||||
[domain-name:value = 'evil.com']
|
||||
[url:value = 'https://evil.com/payload']
|
||||
[file:name = 'malware.exe']
|
||||
[email-addr:value = 'attacker@evil.com']
|
||||
[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_port = 443]
|
||||
```
|
||||
|
||||
## YARA Rule Structure
|
||||
|
||||
```
|
||||
rule RuleName {
|
||||
meta:
|
||||
author = "Analyst"
|
||||
description = "Detection rule"
|
||||
reference = "URL"
|
||||
date = "YYYY-MM-DD"
|
||||
hash = "SHA256"
|
||||
tlp = "white"
|
||||
strings:
|
||||
$text = "string" ascii wide nocase
|
||||
$hex = { 4D 5A 90 00 }
|
||||
$regex = /pattern[0-9]+/
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and filesize < 5MB and any of them
|
||||
}
|
||||
```
|
||||
|
||||
## PE File Format
|
||||
- **DOS Header**: MZ signature (0x5A4D)
|
||||
- **PE Header**: PE signature, machine type, timestamp
|
||||
- **Optional Header**: Entry point, image base, subsystem
|
||||
- **Section Table**: .text, .data, .rdata, .rsrc, .reloc
|
||||
- **Import Table**: DLLs and functions used
|
||||
- **Export Table**: Functions exported (DLLs)
|
||||
- **Resource Table**: Embedded resources (icons, strings, configs)
|
||||
|
||||
## References
|
||||
- [STIX 2.1 Patterning](https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_e8slinrhxcc9)
|
||||
- [YARA Documentation](https://yara.readthedocs.io/en/stable/)
|
||||
- [PE Format Specification](https://learn.microsoft.com/en-us/windows/win32/debug/pe-format)
|
||||
- [MalwareBazaar Database](https://bazaar.abuse.ch/)
|
||||
@@ -0,0 +1,70 @@
|
||||
# Malware IOC Extraction Workflows
|
||||
|
||||
## Workflow 1: Static Analysis Pipeline
|
||||
|
||||
```
|
||||
[Malware Sample] --> [Hash Generation] --> [PE Parsing] --> [String Extraction] --> [IOC Filtering]
|
||||
|
|
||||
v
|
||||
[YARA Scanning]
|
||||
|
|
||||
v
|
||||
[STIX Bundle]
|
||||
```
|
||||
|
||||
### Steps:
|
||||
1. **Sample Acquisition**: Obtain sample from MalwareBazaar, VirusTotal, or incident response
|
||||
2. **Hash Calculation**: Generate MD5, SHA-1, SHA-256, imphash, ssdeep hashes
|
||||
3. **PE Analysis**: Parse headers, sections, imports, exports, resources, timestamps
|
||||
4. **String Extraction**: Extract ASCII/Unicode strings, apply IOC regex patterns
|
||||
5. **IOC Filtering**: Remove false positives (private IPs, common DLLs, benign domains)
|
||||
6. **YARA Classification**: Scan with community and custom YARA rules
|
||||
7. **Output**: Generate STIX 2.1 bundle with extracted indicators
|
||||
|
||||
## Workflow 2: Dynamic Analysis Pipeline
|
||||
|
||||
```
|
||||
[Malware Sample] --> [Sandbox Submission] --> [Detonation] --> [Artifact Collection]
|
||||
|
|
||||
+------------+------------+
|
||||
| | |
|
||||
v v v
|
||||
[Network] [File Sys] [Registry]
|
||||
[PCAPs] [Changes] [Changes]
|
||||
| | |
|
||||
+------------+------------+
|
||||
|
|
||||
v
|
||||
[IOC Consolidation]
|
||||
```
|
||||
|
||||
### Steps:
|
||||
1. **Sandbox Setup**: Configure isolated VM with network monitoring
|
||||
2. **Sample Submission**: Submit to CAPE/Cuckoo sandbox with execution parameters
|
||||
3. **Execution Monitoring**: Monitor for 3-5 minutes of runtime behavior
|
||||
4. **Network Capture**: Extract DNS queries, HTTP/HTTPS traffic, raw connections
|
||||
5. **File System Analysis**: Identify created, modified, and deleted files
|
||||
6. **Registry Analysis**: Capture registry key changes for persistence indicators
|
||||
7. **Process Analysis**: Document spawned processes, injections, privilege escalation
|
||||
8. **Consolidation**: Merge static and dynamic IOCs into unified report
|
||||
|
||||
## Workflow 3: Automated IOC Pipeline
|
||||
|
||||
```
|
||||
[Feed/Alert] --> [Auto-Download] --> [Static Analysis] --> [Sandbox] --> [Enrichment] --> [Share]
|
||||
|
|
||||
v
|
||||
[VirusTotal Check]
|
||||
|
|
||||
v
|
||||
[MISP/OpenCTI Upload]
|
||||
```
|
||||
|
||||
### Steps:
|
||||
1. **Trigger**: New sample from malware feed, email gateway, or EDR alert
|
||||
2. **Download**: Retrieve sample securely to analysis infrastructure
|
||||
3. **Static Scan**: Automated PE parsing, string extraction, YARA scanning
|
||||
4. **Dynamic Analysis**: Submit to sandbox for behavioral analysis
|
||||
5. **Enrichment**: Check hashes against VirusTotal, cross-reference with TI platforms
|
||||
6. **Deduplication**: Remove already-known IOCs from output
|
||||
7. **Sharing**: Upload new IOCs to MISP/OpenCTI for team consumption
|
||||
Reference in New Issue
Block a user