From bb05a75705811b327ed77b1d27aae9b53e46454c Mon Sep 17 00:00:00 2001 From: Ben Date: Tue, 2 Jun 2015 15:01:08 +0000 Subject: [PATCH] add usage example for deception --- .../idioms/deception-usage/decep_consumer.py | 26 ++++++ .../idioms/deception-usage/decep_producer.py | 42 +++++++++ documentation/idioms/deception-usage/index.md | 85 +++++++++++++++++++ .../idioms/deception-usage/sample.xml | 28 ++++++ 4 files changed, 181 insertions(+) create mode 100644 documentation/idioms/deception-usage/decep_consumer.py create mode 100644 documentation/idioms/deception-usage/decep_producer.py create mode 100644 documentation/idioms/deception-usage/index.md create mode 100644 documentation/idioms/deception-usage/sample.xml diff --git a/documentation/idioms/deception-usage/decep_consumer.py b/documentation/idioms/deception-usage/decep_consumer.py new file mode 100644 index 00000000..982b22b6 --- /dev/null +++ b/documentation/idioms/deception-usage/decep_consumer.py @@ -0,0 +1,26 @@ +#!/usr/bin/env python +# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +import sys +from stix.core import STIXPackage, STIXHeader + +def parse_stix( pkg ): + print "== INCIDENT ==" + for inc in pkg.incidents: + for coa in inc.coa_requested: + requested = coa.course_of_action + print "COA: " + str(requested.title) + print "Stage: "+ str(requested.stage) + print "Type: "+ str(requested.type_) + print "Objective: "+ str(requested.objective.description) + + return + +if __name__ == '__main__': + try: fname = sys.argv[1] + except: exit(1) + fd = open(fname) + stix_pkg = STIXPackage.from_xml(fd) + + parse_stix(stix_pkg) diff --git a/documentation/idioms/deception-usage/decep_producer.py b/documentation/idioms/deception-usage/decep_producer.py new file mode 100644 index 00000000..8fca0aef --- /dev/null +++ b/documentation/idioms/deception-usage/decep_producer.py @@ -0,0 +1,42 @@ +#!/usr/bin/env python +# Copyright (c) 2014, The MITRE Corporation. All rights reserved. +# See LICENSE.txt for complete terms. + +''' +The following code requires python-stix v1.1.0.4 or greater installed. +For installation instructions, please refer to https://github.com/STIXProject/python-stix. +''' + +def main(): + from stix.coa import CourseOfAction, Objective + from stix.common import Confidence + from stix.core import STIXPackage + from stix.incident import Incident + from cybox.core import Observables + from cybox.objects.address_object import Address + + from stix.common.vocabs import VocabString + + pkg = STIXPackage() + + incident = Incident(title="Breach of Cyber Tech Dynamics") + + coa = CourseOfAction() + coa.title = "Monitor activity related to known compromised accounts" + coa.stage = VocabString("Monitor") + coa.stage.xsi_type = "stixVocabs:DeceptionVocab-1.0" + coa.type_ = "Redirection (Honey Pot)" + + obj = Objective() + obj.description = "This will further our investigation into the intruders who are re-using compromised accounts." + + coa.objective = obj + + incident.add_coa_requested(coa) + + pkg.add_incident(incident) + + print pkg.to_xml() + +if __name__ == '__main__': + main() \ No newline at end of file diff --git a/documentation/idioms/deception-usage/index.md b/documentation/idioms/deception-usage/index.md new file mode 100644 index 00000000..95b4db69 --- /dev/null +++ b/documentation/idioms/deception-usage/index.md @@ -0,0 +1,85 @@ +--- +layout: flat +title: Deception for Defense +constructs: + - Incident + - Course of Action +summary: Leverage deception to build shared awareness of threats +--- + +## Scenario +Network defense teams can leverage deception to mitigate fraud and intrusions, while sharing lessons learned and effective strategies. + +One method of referencing these actions is the "Deception Kill Chain" [described by MITRE ](http://deceptionbook.com) + +An organization might send an Incident report describing their strategy : + +- The Purpose of their deception: prevent intruders from unauthorized access to customer accounts +- Their Collected Intelligence on intruders +- Creation of a Cover Story with false identity and associated accounts +- Their Plan and Preparations to link that identity to the company +- Monitoring of attempts to interact with the false identity + +## Data model +To describe deception techniques, an [Incident can reference ](https://stixproject.github.io/data-model/{{site.current_version}}/indicator/IndicatorType/) one or more [Courses of Action that describe mitigation techniques](https://stixproject.github.io/data-model/{{site.current_version}}/coa/CourseOfActionType/) + +## Implementation + +{% include start_tabs.html tabs="XML|Python Producer|Python Consumer" name="indicator-w-kill-chain" %}{% highlight xml linenos %} + + + + Breach of Cyber Tech Dynamics + + + Monitor activity related to known compromised accounts + Monitor + Redirection (Honey Pot) + + Further investigation into intruders re-using compromised accounts + + + + + + + +{% endhighlight %}{% include tab_separator.html %}{% highlight python linenos %} +pkg = STIXPackage() +incident = Incident(title="Breach of Cyber Tech Dynamics") + +coa = CourseOfAction() +coa.title = "Monitor activity related to known compromised accounts" +coa.stage = VocabString("Monitor") +coa.stage.xsi_type = "stixVocabs:DeceptionVocab-1.0" +coa.type_ = "Redirection (Honey Pot)" + +obj = Objective() +obj.description = "Further investigation into intruders re-using compromised accounts" + +coa.objective = obj + +incident.add_coa_requested(coa) + +pkg.add_incident(incident) + +print pkg.to_xml() + +{% endhighlight %}{% include tab_separator.html %}{% highlight python linenos %} + +print "== INCIDENT ==" +for inc in pkg.incidents: + for coa in inc.coa_requested: + requested = coa.course_of_action + print "COA: " + str(requested.title) + print "Stage: "+ str(requested.stage) + print "Type: "+ str(requested.type_) + print "Objective: "+ str(requested.objective.description) + + +{% endhighlight %}{% include end_tabs.html %} + +[Full XML](sample.xml) | [Python Producer](indicator-w-kill-chain_producer.py) | [Python Consumer](indicator-w-kill-chain_consumer.py) +## Further Reading + +* [Kill Chain Definition](/data-model/{{site.current_version}}/stixCommon/KillChainType/) diff --git a/documentation/idioms/deception-usage/sample.xml b/documentation/idioms/deception-usage/sample.xml new file mode 100644 index 00000000..c7ec1e33 --- /dev/null +++ b/documentation/idioms/deception-usage/sample.xml @@ -0,0 +1,28 @@ + + + + Breach of Cyber Tech Dynamics + + + Monitor activity related to known compromised accounts + Monitor + Redirection (Honey Pot) + + Further investigation into intruders re-using compromised accounts + + + + + + +