From 70873df7e5bbe121574809b02c8e88c58fd0a203 Mon Sep 17 00:00:00 2001 From: Frank Xu Date: Sun, 14 Feb 2021 10:57:53 -0500 Subject: [PATCH] add a graph --- STIX_for_digital_forensics/CFO_intro.svg | 805 +++++++++++++++++++++++ STIX_for_digital_forensics/readme.md | 50 +- 2 files changed, 829 insertions(+), 26 deletions(-) create mode 100644 STIX_for_digital_forensics/CFO_intro.svg diff --git a/STIX_for_digital_forensics/CFO_intro.svg b/STIX_for_digital_forensics/CFO_intro.svg new file mode 100644 index 0000000..1ba1613 --- /dev/null +++ b/STIX_for_digital_forensics/CFO_intro.svg @@ -0,0 +1,805 @@ + + + + + + + + + + + + + + + + + + + + + + + + + Page-1 + + + + Rectangle + x-disk-partition--1 + + + + + + + x-disk-partition--1 + + Rectangle.4 + x-secondary-storage--1 + + + + + + + x-secondary-storage--1 + + Rectangle.5 + x-disk-image--1 + + + + + + + x-disk-image--1 + + Rectangle.1000 + x-action--1 + + + + + + + x-action--1 + + Rectangle.1001 + indicator--1 + + + + + + + indicator--1 + + Rectangle.1002 + observed-data--1 + + + + + + + observed-data--1 + + Rectangle.1003 + x-webpage-visit--1 + + + + + + + x-webpage-visit--1 + + Rectangle.1004 + x-computer--1 + + + + + + + x-computer--1 + + Rectangle.1005 + x-crime-case--1 + + + + + + + x-crime-case--1 + + Rectangle.1006 + x-timeline--1 + + + + + + + x-timeline--1 + + Rectangle.1008 + x-action--2 + + + + + + + x-action--2 + + Rectangle.1009 + x-memory- image—1 + + + + + + + x-memory- image—1 + + Dynamic connector.1011 + evidence_of + + + + + evidence_of + + Rectangle.1012 + user-account --1 + + + + + + + user-account --1 + + Dynamic connector.1013 + exploits + + + + + exploits + + Dynamic connector.1014 + action_refs + + + + + action_refs + + Dynamic connector.1017 + Indicated-by + + + + + Indicated-by + + Dynamic connector.1018 + based-on + + + + + based-on + + Dynamic connector.1019 + object_refs + + + + + object_refs + + Dynamic connector.1021 + image-of + + + + + image-of + + Dynamic connector.1024 + evidence-of + + + + + evidence-of + + Dynamic connector.1025 + action_refs + + + + + action_refs + + Dynamic connector.1026 + has + + + + + has + + Dynamic connector.1027 + reconstructed_from + + + + + reconstructed_from + + Rectangle.1028 + file--2 + + + + + + + file--2 + + Dynamic connector.1029 + source_ref + + + + + source_ref + + Rectangle.1030 + software--2 + + + + + + + software--2 + + Dynamic connector.1031 + browser_ref + + + + + browser_ref + + Sheet.1032 + directory-1 + + + + directory-1 + + Dynamic connector.1033 + parent_directory_ref + + + + + parent_directory_ref + + Dynamic connector.1034 + contains-refs + + + + + contains-refs + + Sheet.1035 + threat-actor--1 + + + + threat-actor--1 + + Sheet.1036 + Identity--1 + + + + Identity--1 + + Dynamic connector.1037 + attributed-to + + + + + attributed-to + + Dynamic connector.1038 + related-to + + + + + related-to + + Rectangle.1039 + identity--2 + + + + + + + identity--2 + + Dynamic connector.1040 + reconstructed_by + + + + + reconstructed_by + + Dynamic connector.1041 + secondary_storage_refs + + + + + secondary_storage_refs + + Rectangle.1042 + indicator--3 + + + + + + + indicator--3 + + Rectangle.1043 + observed-data--3 + + + + + + + observed-data--3 + + Rectangle.1044 + x-pnp-evt--1 + + + + + + + x-pnp-evt--1 + + Dynamic connector.1045 + based-on + + + + + based-on + + Dynamic connector.1046 + object_refs + + + + + object_refs + + Rectangle.1047 + file--4 + + + + + + + file--4 + + Dynamic connector.1048 + source_ref + + + + + source_ref + + Sheet.1049 + directory-3 + + + + directory-3 + + Dynamic connector.1050 + parent_directory_ref + + + + + parent_directory_ref + + Dynamic connector.1051 + indicated-by + + + + + indicated-by + + Rectangle.1052 + indicator—2 + + + + + + + indicator—2 + + Rectangle.1053 + observed-data—2 + + + + + + + observed-data—2 + + Rectangle.1054 + x-windows-evt-2 + + + + + + + x-windows-evt-2 + + Dynamic connector.1055 + based-on + + + + + based-on + + Dynamic connector.1056 + object_refs + + + + + object_refs + + Rectangle.1057 + file--3 + + + + + + + file--3 + + Dynamic connector.1058 + source_ref + + + + + source_ref + + Sheet.1059 + directory-2 + + + + directory-2 + + Dynamic connector.1060 + parent_directory_ref + + + + + parent_directory_ref + + Dynamic connector.1061 + indicated-by + + + + + indicated-by + + Dynamic connector.1062 + contains-refs + + + + + contains-refs + + Dynamic connector.1063 + contains-refs + + + + + contains-refs + + Dynamic connector.1065 + part-of + + + + + part-of + + Dynamic connector.1066 + used-in + + + + + used-in + + Rectangle.1067 + Identify--3 + + + + + + + Identify--3 + + Rectangle.1069 + x-investigation-tool--1 + + + + + + + x-investigation-tool--1 + + Dynamic connector.1070 + acquired_using_tool_ref + + + + + acquired_using_tool_ref + + Rectangle.1071 + software--1 + + + + + + + software--1 + + Dynamic connector.1072 + software_ref + + + + + software_ref + + Rectangle.1073 + x-file-visit--1 + + + + + + + x-file-visit--1 + + Dynamic connector.1074 + object_refs + + + + + object_refs + + Rectangle.1075 + file--1 + + + + + + + file--1 + + Dynamic connector.1076 + source-ref + + + + + source-ref + + Dynamic connector.1077 + contains-refs + + + + + contains-refs + + Dynamic connector.1078 + object-refs + + + + + object-refs + + Rectangle.1079 + Cyber Forensic Domain Object + + + + + + + Cyber Forensic Domain Object + + Rectangle.1080 + Cyber Forensic Domain Object + + + + + + + Cyber Forensic Domain Object + + Rectangle.1081 + STIX Object + + + + + + + STIX Object + + Dynamic connector.1082 + assigned-to + + + + + assigned-to + + Dynamic connector.1083 + invovles + + + + + invovles + + Dynamic connector.1084 + acquired_by_ref + + + + + acquired_by_ref + + Dynamic connector.1085 + exploits + + + + + exploits + + Dynamic connector.1086 + exploits + + + + + exploits + + Rectangle.1087 + url + + + + + + + url + + Dynamic connector.1088 + url_ref + + + + + url_ref + + Dynamic connector.1089 + object_refs + + + + + object_refs + + diff --git a/STIX_for_digital_forensics/readme.md b/STIX_for_digital_forensics/readme.md index 1ba3ff2..1c18711 100644 --- a/STIX_for_digital_forensics/readme.md +++ b/STIX_for_digital_forensics/readme.md @@ -16,6 +16,8 @@ The xSTIX includes a set of Cyber Forensic Objects (CFOs), customized properties - **Open Vocabulary extension:** Add vocabulary in the field of cyber forensic investigations. +![CFO graph](CFO_intro.svg) + ## Extension Format - **CFOs:** We follow the STIX specification for [customizing objects](https://docs.oasis-open.org/cti/stix/v2.1/cs01/stix-v2.1-cs01.html#_p2sz1mp7z524). The most important rule to create a new object type is that the value of the type property in a Custom Object SHOULD start with “x-” followed by a source unique identifier (like a domain name with dots replaced by hyphens), a hyphen and then the name. For example, x-example-com-customobject. @@ -333,10 +335,10 @@ An action is one cyber criminal activity performed under a user account. It is a ### Relationships -| Source | Relationship Type | Target | Description | -| -------- | ----------------- | ------------ | -------------------------------------------------------------------------- | -| x-action | traced-back-to | user-account | This Relationship describes that an action is traced-back-to user-account. | -| x-action | indicated-by | indicator | This Relationship describes that an action is indicated-by of indicator. | +| Source | Relationship Type | Target | Description | +| -------- | ----------------- | ------------ | ----------------------------------------------------------------------- | +| x-action | exploits | user-account | This Relationship describes that a Action exploits a User Account. | +| x-action | indicated-by | indicator | This Relationship describes that a Action is indicated-by of Indicator. | ## Example: An action that search for anti-forensics tools @@ -387,7 +389,7 @@ An action is one cyber criminal activity performed under a user account. It is a "id": "relationship--014841f8-eb38-4673-9904-70f67c92dd8b", "created": "2020-01-16T18:52:24.277Z", "modified": "2020-01-16T18:52:24.277Z", - "relationship_type": "traced-back-to", + "relationship_type": "exploits", "source_ref": "x-action--87a3e4ee-102c-4cc9-9017-96089a0e0680", "target_ref": "user-account--68f0b7d5-f7ab-47d2-8773-739ceb1c11bb" }, @@ -470,12 +472,12 @@ A Timeline object describes a specific cybercrime case that is represented by a | description | string | A description that provides more details and context about a timeline. | | reconstructed_from | identifier | Specifies timeline is reconstructed from a crime case. | | reconstructed_by | identifier | Specifies timeline is reconstructed by an identity. | -| exploits | identifier | Specifies timeline exploits a User Account. | ### Relationships -| Source | Relationship Type | Target | Description | -| ------ | ----------------- | ------ | ----------- | +| Source | Relationship Type | Target | Description | +| ---------- | ----------------- | ------------ | -------------------------------------------------------------------- | +| x-timeline | exploits | user-account | This Relationship describes that a Timeline exploits a User Account. | ## Example: data leakage using a UBS @@ -819,10 +821,9 @@ Notes: ### Relationships -| Source | Relationship Type | Target | Description | -| ------------- | ----------------- | ---------------- | ------------------------------------------------------------------------------------ | -| x-windows-evt | traced-back-to | user-account | This Relationship describes that x-windows-evt can be traced back to a user-account. | -| x-windows-evt | extracted-from | x-disk-partition | This Relationship describes that x-windows-evt is extracted from x-disk-partition. | +| Source | Relationship Type | Target | Description | +| ------------- | ----------------- | ------------ | ------------------------------------------------------------------------- | +| x-windows-evt | exploits | user-account | This Relationship describes that a Windows Event exploits a User Account. | ### Example 1: describes a "logon" event recorded in the security event file. @@ -874,7 +875,7 @@ Notes: "id": "relationship--014841f8-eb38-4673-9904-70f67c92dd8b", "created": "2020-01-16T18:52:24.277Z", "modified": "2020-01-16T18:52:24.277Z", - "relationship_type": "traced-back-to", + "relationship_type": "exploits", "source_ref": "x-windows-evt--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f", "target_ref": "user-account--0d5b424b-93b8-5cd8-ac36-306e1789d63c" } @@ -921,10 +922,9 @@ A Webpage Visit object represents a visit to a webpage. ### Relationships -| Source | Relationship Type | Target | Description | -| --------------- | ----------------- | ---------------- | ------------------------------------------------------------------------------------------------- | -| x-webpage-visit | traced-back-to | user-account | This Relationship describes that x-webpage-visit can be traced back to a user-account. | -| x-webpage-visit | extracted-from | x-disk-partition | This Relationship describes that a piece of x-webpage-visit is extracted from a x-disk-partition. | +| Source | Relationship Type | Target | Description | +| --------------- | ----------------- | ------------ | ------------------------------------------------------------------------- | +| x-webpage-visit | exploits | user-account | This Relationship describes that a Webpage Visit exploits a User Account. | ### Examples @@ -962,7 +962,7 @@ A Webpage Visit object represents a visit to a webpage. "id": "relationship--014841f8-eb38-4673-9904-70f67c92dd8b", "created": "2020-01-16T18:52:24.277Z", "modified": "2020-01-16T18:52:24.277Z", - "relationship_type": "traced-back-to", + "relationship_type": "exploits", "source_ref": "x-webpage-visit-evidence--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f", "target_ref": "user-account--68f0b7d5-f7ab-47d2-8773-739ceb1c11bb" } @@ -1005,10 +1005,9 @@ Vocabulary Name: x-pnp-message-type-enum ### Relationships -| Source | Relationship Type | Target | Description | -| --------- | ----------------- | ---------------- | ---------------------------------------------------------------------------------- | -| x-pnp-evt | traced-back-to | user-account | This Relationship describes that a x-pnp-evt can be traced back to a user-account. | -| x-pnp-evt | extracted-from | x-disk-partition | This Relationship describes that a x-pnp-evt is extracted from a x-disk-partition. | +| Source | Relationship Type | Target | Description | +| --------- | ----------------- | ------------ | --------------------------------------------------------------------- | +| x-pnp-evt | exploits | user-account | This Relationship describes that a pnp Event exploits a user-account. | ### Examples @@ -1096,10 +1095,9 @@ A File Visit object represents properties that are associated with a file/direct ### Relationships -| Source | Relationship Type | Target | Description | -| ------------ | ----------------- | ---------------- | ------------------------------------------------------------------------------------- | -| x-file-visit | traced-back-to | user-account | This Relationship describes that a x-file-visit can be traced back to a user-account. | -| x-file-visit | extracted-from | x-disk-partition | This Relationship describes that a x-file-visit is extracted from a x-disk-partition. | +| Source | Relationship Type | Target | Description | +| ------------ | ----------------- | ------------ | ---------------------------------------------------------------------- | +| x-file-visit | exploits | user-account | This Relationship describes that a File Visit exploits a User Account. | ### RecentFileCache