digital-forensics-labs/Ubalt
1
0
Fork 0
mirror of https://github.com/frankwxu/Ubalt.git synced 2026-04-10 12:33:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

add Poison IVY state machine

Browse Source
This commit is contained in:
Frank Xu
2020-05-04 19:46:21 -04:00
parent 09c2f3f1dd
commit 4eea5e267e
30 changed files with 503 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
Research/APT_FSM/MyStateMachine.scxml Normal file
View File

@@ -0,0 +1,36 @@
<?xml version="1.0" encoding="UTF-8"?>
<scxml initial="Secure" version="1.0"
xmlns="http://www.w3.org/2005/07/scxml" xmlns:sqrl="http://squirrelframework.org/squirrel">
<sqrl:fsm context-insensitive="true" context-type="java.lang.Void"
event-type="PivyFSM$PivyEvent" fsm-type="PivyFSM"
id="wYDJTbm8m0" state-type="PivyFSM$PivyState"/>
<state id="Exfiltrated">
<transition
cond="instance#org.squirrelframework.foundation.fsm.Conditions$Always"
event="changeSrcIPFound" sqrl:priority="1"
sqrl:type="EXTERNAL" target="Explored">
<sqrl:action content="method#transitFromExfiltratedToExploredOnchangeSrcIPFound:-10"/>
</transition>
</state>
<state id="Secure">
<transition
cond="instance#org.squirrelframework.foundation.fsm.Conditions$Always"
event="pivyNameFound" sqrl:priority="1" sqrl:type="EXTERNAL" target="Penetrated">
<sqrl:action content="method#transitFromSecureToPenetratedOnpivyNameFound:-10"/>
</transition>
</state>
<state id="Explored"/>
<state id="Penetrated">
<transition
cond="instance#org.squirrelframework.foundation.fsm.Conditions$Always"
event="trafficFound" sqrl:priority="1" sqrl:type="EXTERNAL" target="Exfiltrated">
<sqrl:action content="method#transitFromPenetratedToExfiltratedOntrafficFound:-10"/>
</transition>
<transition
cond="instance#org.squirrelframework.foundation.fsm.Conditions$Always"
event="changeSrcIPFound" sqrl:priority="1"
sqrl:type="EXTERNAL" target="Explored">
<sqrl:action content="method#transitFromPenetratedToExploredOnchangeSrcIPFound:-10"/>
</transition>
</state>
</scxml>