Cyber Standards User Council CTI-TC STIX Subcommittee Update www.oasis-open.org Cyber Standards User Council CTI-TC STIX Subcommittee Update Co-Chairs: John Wunder and Sarah Kelley 4 December 2017

Agenda STIX 2.0 - Lessons Learned STIX 2.0 - Objects www.oasis-open.org Agenda STIX 2.0 - Lessons Learned STIX 2.0 - Objects STIX 2.1 - New Objects and Features STIX 2.1 - What’s in progress STIX 2 modeling example

Lessons Learned from STIX 1.x JSON, not XML: Preferred by developers, easier to understand Simplicity and Clarity: Less flexibility, more standardization Pragmatism: Fewer, but better-understood objects and properties One Standard: Merge CybOX into STIX Relationships as first-class objects: Easier for the community to contribute

STIX 2.0 Domain Objects I

STIX 2.0 Domain Objects II

STIX 2.0 Status As of Oct 2017, STIX 2.0 has been published as an Oasis Committee Specification!

STIX 2.1 - New Objects Location Malware (expanded) Note Opinion Lat/Long and Address information Malware (expanded) Much more full featured, can capture sandbox output, etc. Note For add-on intelligence related to an object Opinion third party opinion, allows for feedback from others Grouping for sets of related information

STIX 2.1 - New Features Confidence Internationalization Contains a number scale and a mapping to other scales Internationalization Allows for multi-language content Time- bound relationships Specify when a relationship is/was considered valid

STIX 2.1 - In Progress Infrastructure Categorizations Course of Action Focus on malicious/adversary infrastructure Categorizations risk scoring, etc Course of Action Patterning Changes

When will STIX 2.1 be done? We’re estimating spring 2018 for STIX 2.1.

Modeling a cyber Threat Intelligence Report in STIX 2 The IMDDOS Report: https://www.coresecurity.com/publication/imddos-botnet-discovery-and-analysis

IMDDOS: The Big Picture* * Created directly from the JSON via the STIX Viewer: https://oasis-open.github.io/cti-stix-visualization/

Bundle & Marking Definition { "type": "bundle", "id": "bundle--9f0725cb-4bc3-47c3-aba6-99cb97ba4f52", "spec_version": "2.0", "objects": [ "type": "marking-definition", "id": "marking-definition--dc1b5371-1918-4e57-93f2-25d1d78d983f", "created": "2017-07-18T22:00:30.404Z", "definition_type": "statement", "definition": { "statement": "Copyright 2010, Damballa, Inc All Rights Reserved" } }, ...

Report "type": "report", … "name": "IMDDOS Botnet", "labels": [ "threat-report" ], "description": "The newly-uncovered IMDDOS Botnet is a commercial DDOS service hosted in China.", "published": "2010-09-13T00:00:00.000Z", "object_refs": [ "malware--efd5ac80-79ba-45cc-9293-01460ad85303", "threat-actor--e234c322-0981-4aa4-ae03-f4037e6be83f", "indicator--691d06b5-aa1d-46ec-97d6-e59ef9411b8a", ... ], "object_marking_refs": [ "marking-definition--dc1b5371-1918-4e57-93f2-25d1d78d983f" "external_references": [ { "source_name": "Damballa, Inc.", "url": "https://www.coresecurity.com/system/files/publications/2017/03/Damballa_Report_IMDDOS.pdf", "hashes": { "SHA-1": "4e0f4197d6d61f52f80a5560d78af599a37277c0" }

Threat Actor & Location { "type": "threat-actor", "id": "threat-actor--e234c322-0981-4aa4-ae03-f4037e6be83f", "created": "2017-07-18T22:00:30.405Z", "modified": "2017-07-18T22:00:30.405Z", "name": "(Unnamed) IMDDOS Threat Actor", "labels": [ "criminal" ] }, "type": "location", "id": "location--07608992-927e-434c-9cbd-bf45274290a0", "country": "China"

Indicator: TLHD { "type": "indicator", "id": "indicator--691d06b5-aa1d-46ec-97d6-e59ef9411b8a", "created": "2017-07-18T22:00:30.406Z", "modified": "2017-07-18T22:00:30.406Z", "name": "IMDDOS THLD", "labels": [ "malicious-activity" ], "description": "References to this domain are indicative of the presence of the IMDDOS malware in the environment", "valid_from": "2010-04-01T00:00:00.000Z", "kill_chain_phases": [ "kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploit" } "pattern": "[ domain-name:value = 'imddos.my03.com' ]" },

Indicator: TLHD Traffic { "type": "indicator", "id": "indicator--b2ab314f-3a97-44d4-bfca-6a9857a6fe17", "created": "2017-07-18T22:00:30.406Z", "modified": "2017-07-18T22:00:30.406Z", "name": "IMDDOS THLD Traffic", "labels": [ "malicious-activity" ], "description": "Traffic to this domain indicates the source host is infected with IMDDOS malware", "valid_from": "2010-04-01T00:00:00.000Z", "kill_chain_phases": [ "kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploit" } "pattern": "[ network-traffic:dst_ref.type = 'domain-name' AND network- traffic:dst_ref.value = 'imddos.my03.com' AND network-traffic:dst_port = 9090 ]" },

Indicator: IMDDOS Infected Host { "type": "indicator", "id": "indicator--ca26195e-e3c0-4139-8e21-0af90c89bd27", "created": "2017-07-18T22:00:30.407Z", "modified": "2017-07-18T22:00:30.407Z", "name": "IMDDOS Infected Host", "labels": [ "malicious-activity" ], "description": "Presence of this registry key on a host indicates it is infected with the IMDDOS malware", "valid_from": "2010-04-01T00:00:00.000Z", "kill_chain_phases": [ "kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploit" } "pattern": "[windows-registry-key:key LIKE 'HKEY_LOCAL_MACHINE\\\\System\\\\CurrentControlSet\\\\Services\\\\SafePrec%' ]" },

Indicator: IMDDOS C2 Traffic { "type": "indicator", "id": "indicator--644bc5dc-1627-4c3a-b9d8-bb2a9fa30567", "created": "2017-07-18T22:00:30.407Z", "modified": "2017-07-18T22:00:30.407Z", "name": "IMDDOS C2 Traffic", "labels": [ "malicious-activity" ], "description": "Traffic to these domains indicates that the source host is under the control of the IMDDOS malware", "valid_from": "2010-04-01T00:00:00.000Z", "kill_chain_phases": [ "kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "control" } "pattern": "[ network-traffic:dst_ref.type = 'domain-name' AND network- traffic:dst_ref.value IN ('dns.ddos.im', 'win2003ddos.3322.org', 'woshindi.3322.org', 'pk518.3322.org', 'huanjue6369029.3322.org', 'qq603535.3322.org', 'qq188588.3322.org', 'hjff.3322.org', '198600.3322.org', 'ankankan.3322.org', 'yinn.3322.org') ]" },

External Relationships { "type": "relationship", ... "relationship_type": "indicates", "source_ref": "indicator--691d06b5-aa1d-46ec-97d6-e59ef9411b8a", "target_ref": "malware--efd5ac80-79ba-45cc-9293-01460ad85303" }, <other indicates Relationships omitted for clarity> … "relationship_type": "located-at", "source_ref": "threat-actor--e234c322-0981-4aa4-ae03-f4037e6be83f", "target_ref": "location--07608992-927e-434c-9cbd-bf45274290a0" "relationship_type": "uses", }

Cyber Threat Intelligence Q & A Cyber Threat Intelligence Technical Committee