Subject: [mile] Example: Command and Control server

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 22 Jul 2015 15:48:28 -0400

Hi,

This one is just an example, the same older version of the schema was used
that shows up in the IODEF Guidance draft:

below is an example of a Command and Control incident represented in IODEF:

<?xml version="1.0" encoding="UTF-8"?>

<IODEF-Document version="1.00" lang="en”

    xmlns="urn:ietf:params:xml:ns:iodef-1.0”
xmlns:iodef="urn:ietf:params:xml:ns:iodef-1.0”

    xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance>

<iodef:Incident purpose="reporting”>

<iodef:ReportTime>2012-12-05T12:20:00+00:00</iodef:ReportTime>

      <iodef:description>Malware and related indicators</iodef:description>

          <iodef:Assessment occurrance="potential”>

              <iodef:Impact severity=medium" type="info-leak”>Malware with
C&C </iodef:Impact>

           </iodef:Assessment>

            <iodef:EventData>

            <iodef:Flow>

<iodef:System category="source”>

                  <iodef:Node>

                    <iodef:Address indicator_uid="xxxxx"
category="ipv4-addr">192.168.2.200</iodef:Address>

                    <iodef:Address indicator_uid="xxxxx" category="url”>

http://zeus.556677889900.com/log-bin/lunch_install.php?aff_id=1&lunch_id=1&maddr=&action=install
</iodef:Address>

                    <iodef:NodeRole category="c2-server"/>

                 </iodef:Node>

              </iodef:System>

            </iodef:Flow>

        </iodef:EventData>

    </iodef:Incident>

</IODEF-Document>

-- 

Best regards,
Kathleen

---

From: "Harrington, Christopher" <[email-masked]>
Date: Wed, 22 Jul 2015 16:05:57 -0400

Not sure that is matters in this example but that indicator URL is Delivery not C2.

On Jul 22, 2015, at 3:48 PM, Kathleen Moriarty <[email-masked]<mailto:[email-masked]>> wrote:

Hi,

This one is just an example, the same older version of the schema was used that shows up in the IODEF Guidance draft:

below is an example of a Command and Control incident represented in IODEF:
<?xml version="1.0" encoding="UTF-8"?>
<IODEF-Document version="1.00" lang="en”
    xmlns="urn:ietf:params:xml:ns:iodef-1.0”    xmlns:iodef="urn:ietf:params:xml:ns:iodef-1.0”
    xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance>
<iodef:Incident purpose="reporting”>
<iodef:ReportTime>2012-12-05T12:20:00+00:00</iodef:ReportTime>
      <iodef:description>Malware and related indicators</iodef:description>
          <iodef:Assessment occurrance="potential”>
              <iodef:Impact severity=medium" type="info-leak”>Malware with C&C </iodef:Impact>
           </iodef:Assessment>
            <iodef:EventData>
            <iodef:Flow>
<iodef:System category="source”>
                  <iodef:Node>
                    <iodef:Address indicator_uid="xxxxx" category="ipv4-addr">192.168.2.200</iodef:Address>
                    <iodef:Address indicator_uid="xxxxx" category="url”>
                      http://zeus.556677889900.com/log-bin/lunch_install.php?aff_id=1&lunch_id=1&maddr=&action=install</iodef:Address>
                    <iodef:NodeRole category="c2-server"/>
                 </iodef:Node>
              </iodef:System>
            </iodef:Flow>
        </iodef:EventData>
    </iodef:Incident>
</IODEF-Document>

--

Best regards,
Kathleen
_______________________________________________
mile mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/mile