diff --git a/STIX_for_digital_forensics/CFO_intro.svg b/STIX_for_digital_forensics/CFO_intro.svg index f007adb..6f81043 100644 --- a/STIX_for_digital_forensics/CFO_intro.svg +++ b/STIX_for_digital_forensics/CFO_intro.svg @@ -3,7 +3,7 @@ + xml:space="preserve" color-interpolation-filters="sRGB" class="st17"> @@ -14,20 +14,21 @@ .st1 {fill:#ffffff;stroke:#e3d0f1;stroke-dasharray:3,3;stroke-linecap:round;stroke-linejoin:round;stroke-width:1} .st2 {fill:#004c75;font-family:Franklin Gothic Demi;font-size:1.00001em;font-stretch:semi-expanded} - .st3 {fill:#ffffff;stroke:#f37b49;stroke-linecap:round;stroke-linejoin:round;stroke-width:1} - .st4 {fill:#a0360a;font-family:Franklin Gothic Demi;font-size:1.00001em} - .st5 {fill:#ffffff;stroke:#008cd8;stroke-linecap:round;stroke-linejoin:round;stroke-width:1} - .st6 {fill:#004b74;font-family:Franklin Gothic Demi;font-size:1.00001em} - .st7 {fill:#ffffff;stroke:#00bc74;stroke-linecap:round;stroke-linejoin:round;stroke-width:1} - .st8 {fill:#00653e;font-family:Franklin Gothic Demi;font-size:1.00001em} - .st9 {font-size:1em} - .st10 {marker-end:url(#mrkr4-61);stroke:#008cd8;stroke-linecap:round;stroke-linejoin:round;stroke-width:0.75} - .st11 {fill:#008cd8;fill-opacity:1;stroke:#008cd8;stroke-opacity:1;stroke-width:0.22935779816514} - .st12 {fill:#ffffff;stroke:none;stroke-linecap:butt} - .st13 {fill:#002f49;font-family:Franklin Gothic Demi;font-size:0.666664em} - .st14 {fill:#ffffff;stroke:none;stroke-linecap:butt;stroke-width:7.2} - .st15 {fill:#a0370b;font-family:Franklin Gothic Demi;font-size:1.00001em} - .st16 {fill:none;fill-rule:evenodd;font-size:12px;overflow:visible;stroke-linecap:square;stroke-miterlimit:3} + .st3 {fill:#ffffff;stroke:#00bc74;stroke-linecap:round;stroke-linejoin:round;stroke-width:1} + .st4 {fill:#00663f;font-family:Franklin Gothic Demi;font-size:1.00001em} + .st5 {fill:#ffffff;stroke:#f37b49;stroke-linecap:round;stroke-linejoin:round;stroke-width:1} + .st6 {fill:#a0360a;font-family:Franklin Gothic Demi;font-size:1.00001em} + .st7 {fill:#ffffff;stroke:#008cd8;stroke-linecap:round;stroke-linejoin:round;stroke-width:1} + .st8 {fill:#004b74;font-family:Franklin Gothic Demi;font-size:1.00001em} + .st9 {fill:#00653e;font-family:Franklin Gothic Demi;font-size:1.00001em} + .st10 {font-size:1em} + .st11 {marker-end:url(#mrkr4-61);stroke:#008cd8;stroke-linecap:round;stroke-linejoin:round;stroke-width:0.75} + .st12 {fill:#008cd8;fill-opacity:1;stroke:#008cd8;stroke-opacity:1;stroke-width:0.22935779816514} + .st13 {fill:#ffffff;stroke:none;stroke-linecap:butt} + .st14 {fill:#002f49;font-family:Franklin Gothic Demi;font-size:0.666664em} + .st15 {fill:#ffffff;stroke:none;stroke-linecap:butt;stroke-width:7.2} + .st16 {fill:#a0370b;font-family:Franklin Gothic Demi;font-size:1.00001em} + .st17 {fill:none;fill-rule:evenodd;font-size:12px;overflow:visible;stroke-linecap:square;stroke-miterlimit:3} @@ -46,7 +47,7 @@ - @@ -225,7 +226,7 @@ - x-disk-partition--1 + x-disk-partition--1 Rectangle.4 x-secondary-storage--1 @@ -235,7 +236,7 @@ - x-secondary-storage--1 + x-secondary-storage--1 Rectangle.5 x-image--1 @@ -244,8 +245,8 @@ - - x-image--1 + + x-image--1 Rectangle.1000 x-action--1 @@ -254,8 +255,8 @@ - - x-action--1 + + x-action--1 Rectangle.1001 indicator--1 @@ -264,8 +265,8 @@ - - indicator--1 + + indicator--1 Rectangle.1002 observed-data--1 @@ -274,8 +275,8 @@ - - observed-data--1 + + observed-data--1 Rectangle.1003 x-webpage-visit--1 @@ -284,8 +285,8 @@ - - x-webpage-visit--1 + + x-webpage-visit--1 Rectangle.1004 x-computer--1 @@ -295,7 +296,7 @@ - x-computer--1 + x-computer--1 Rectangle.1005 x-crime-case--1 @@ -304,8 +305,8 @@ - - x-crime-case--1 + + x-crime-case--1 Rectangle.1006 x-timeline--1 @@ -314,8 +315,8 @@ - - x-timeline--1 + + x-timeline--1 Rectangle.1008 x-action--2 @@ -324,8 +325,8 @@ - - x-action--2 + + x-action--2 Rectangle.1009 x-image—2 @@ -334,17 +335,18 @@ - - x-image—2 + + x-image—2 Dynamic connector.1011 evidence-of - - - evidence-of + + + evidence-of Rectangle.1012 user-account --1 @@ -353,91 +355,91 @@ - - user-account --1 + + user-account --1 Dynamic connector.1013 exploits - - - exploits + + + exploits Dynamic connector.1014 action_refs - - - action_refs + + + action_refs Dynamic connector.1017 Indicated-by - - - Indicated-by + + + Indicated-by Dynamic connector.1018 based-on - - - based-on + + + based-on Dynamic connector.1019 object_refs - - - object_refs + + + object_refs Dynamic connector.1021 image-of - - - image-of + + + image-of Dynamic connector.1024 evidence-of - - - evidence-of + + + evidence-of Dynamic connector.1025 action_refs - - - action_refs + + + action_refs Dynamic connector.1026 has - - has + class="st11"/> + + has Dynamic connector.1027 reconstructed_from - - - reconstructed_from + + + reconstructed_from Rectangle.1028 file--2 @@ -446,17 +448,17 @@ - - file--2 + + file--2 Dynamic connector.1029 sved-to - - - sved-to + + + sved-to Rectangle.1030 software--2 @@ -465,71 +467,71 @@ - - software--2 + + software--2 Dynamic connector.1031 browser_ref - - - browser_ref + + + browser_ref Sheet.1032 directory-1 - - directory-1 + + directory-1 Dynamic connector.1033 parent_directory_ref - - - parent_directory_ref + + + parent_directory_ref Dynamic connector.1034 contains-refs - - - contains-refs + + + contains-refs Sheet.1035 threat-actor--1 - - threat-actor--1 + + threat-actor--1 Sheet.1036 Identity--1 - - Identity--1 + + Identity--1 Dynamic connector.1037 attributed-to - - - attributed-to + + + attributed-to Dynamic connector.1038 related-to - - - related-to + + + related-to Rectangle.1039 x-investigator--2 @@ -538,26 +540,26 @@ - - x-investigator--2 + + x-investigator--2 Dynamic connector.1040 reconstructed_by - - - r + + reconstructed_by Dynamic connector.1041 secondary_storage_refs - - - secondary_storage_refs + + + secondary_storage_refs Rectangle.1042 indicator--3 @@ -566,8 +568,8 @@ - - indicator--3 + + indicator--3 Rectangle.1043 observed-data--3 @@ -576,8 +578,8 @@ - - observed-data--3 + + observed-data--3 Rectangle.1044 x-pnp-evt--1 @@ -586,25 +588,25 @@ - - x-pnp-evt--1 + + x-pnp-evt--1 Dynamic connector.1045 based-on - - - based-on + + + based-on Dynamic connector.1046 object_refs - - - object_refs + + + object_refs Rectangle.1047 file--4 @@ -613,40 +615,40 @@ - - file--4 + + file--4 Dynamic connector.1048 sved-to - - - sved-to + + + sved-to Sheet.1049 directory-3 - - directory-3 + + directory-3 Dynamic connector.1050 parent_directory_ref - - - parent_directory_ref + + + parent_directory_ref Dynamic connector.1051 indicated-by - - - indicated-by + + + indicated-by Rectangle.1052 indicator—2 @@ -655,8 +657,8 @@ - - indicator—2 + + indicator—2 Rectangle.1053 observed-data—2 @@ -665,8 +667,8 @@ - - observed-data—2 + + observed-data—2 Rectangle.1054 x-windows-evt-2 @@ -675,25 +677,25 @@ - - x-windows-evt-2 + + x-windows-evt-2 Dynamic connector.1055 based-on - - - based-on + + + based-on Dynamic connector.1056 object_refs - - - object_refs + + + object_refs Rectangle.1057 file--3 @@ -702,77 +704,77 @@ - - file--3 + + file--3 Dynamic connector.1058 sved-to - - - sved-to + + + sved-to Sheet.1059 directory-2 - - directory-2 + + directory-2 Dynamic connector.1060 parent_directory_ref - - - parent_directory_ref + + + parent_directory_ref Dynamic connector.1061 indicated-by - - - indicated-by + + + indicated-by Dynamic connector.1062 contains-refs - - contains-refs + L157.31 2305.23 A3 3 0 0 1 163.31 2305.23 L257.62 2305.23 L257.62 2376.7 L283.15 2376.7" class="st11"/> + + contains-refs Dynamic connector.1063 contains-refs - - - contains-refs + + + contains-refs Dynamic connector.1065 part-of - - - part-of + + + part-of Dynamic connector.1066 used-in - - - used-in + + + used-in Rectangle.1067 x-investigator--1 @@ -781,8 +783,8 @@ - - x-investigator--1 + + x-investigator--1 Rectangle.1069 x-investigation-tool--1 @@ -791,16 +793,16 @@ - - x-investigation-tool--1 + + x-investigation-tool--1 Dynamic connector.1070 acquired_using_ref - - - acquired_using_ref + + + acquired_using_ref Rectangle.1071 software--1 @@ -809,16 +811,16 @@ - - software--1 + + software--1 Dynamic connector.1072 software_ref - - - software_ref + + + software_ref Rectangle.1073 x-file-visit--1 @@ -827,17 +829,17 @@ - - x-file-visit--1 + + x-file-visit--1 Dynamic connector.1074 object_refs - - - object_refs + + + object_refs Rectangle.1075 file--1 @@ -846,34 +848,34 @@ - - file--1 + + file--1 Dynamic connector.1076 saved-to - - - saved-to + + + saved-to Dynamic connector.1077 contains-refs - - - contains-refs + + + contains-refs Dynamic connector.1078 object-refs - - - object-refs + + + object-refs Rectangle.1079 Cyber Forensic Domain Object @@ -882,20 +884,20 @@ - - Cyber Forensic Domain Object + + Cyber Forensic Domain Object Rectangle.1080 - Cyber Forensic Domain Object + Cyber Forensic Observable Object - - Cyber Forensic Domain Object + + Cyber Forensic Observable Object Rectangle.1081 STIX Object @@ -904,48 +906,48 @@ - - STIX Object + + STIX Object Dynamic connector.1082 assigned-to - - - assigned-to + + + assigned-to Dynamic connector.1083 invovles - - - invovles + + + invovles Dynamic connector.1084 acquired_by_ref - - - acquired_by_ref + + + acquired_by_ref Dynamic connector.1085 exploits - - - exploits + + + exploits Dynamic connector.1086 exploits - - - exploits + + + exploits Rectangle.1087 url @@ -954,25 +956,25 @@ - - url + + url Dynamic connector.1088 url_ref - - - url_ref + + + url_ref Dynamic connector.1089 object_refs - - - object_refs + + + object_refs Rectangle.1090 x-ram @@ -988,40 +990,40 @@ ram_refs - - - ram_refs + + + ram_refs Dynamic connector.1092 image-of - - - image-of + + + image-of Sheet.1093 mac-addr--1 - - mac-addr--1 + + mac-addr--1 Sheet.1094 ipv4-addr--1 - - ipv4-addr--1 + + ipv4-addr--1 Dynamic connector.1096 communicates-use - - - communicates-use + + + communicates-use Rectangle.1098 x-investigation-tool--2 @@ -1030,8 +1032,8 @@ - - x-investigation-tool--2 + + x-investigation-tool--2 Rectangle.1100 x-investigation-tool--3 @@ -1040,8 +1042,8 @@ - - x-investigation-tool--3 + + x-investigation-tool--3 Rectangle.1101 x-investigation-tool--4 @@ -1050,32 +1052,32 @@ - - x-investigation-tool--4 + + x-investigation-tool--4 Dynamic connector.1102 processed-by - - - processed-by + + + processed-by Dynamic connector.1103 processed-by - - - processed-by + + + processed-by Dynamic connector.1104 has - - - has + + + has Rectangle.1105 x-cloud-storage--1 @@ -1085,35 +1087,34 @@ - x-cloud-storage--1 - + x-cloud-storage--1 + Sheet.1106 directory-4 - - directory-4 - + + directory-4 + Dynamic connector.1107 local_directory_ref - - - local_directory_ref - + + + local_directory_ref + Dynamic connector.1108 contains-refs - - - contains-refs - + + + contains-refs + Rectangle.1130 user-account --2 @@ -1121,40 +1122,56 @@ - - user-account --2 - + + user-account --2 + Dynamic connector.1131 requires - - - requires - + + + requires + Dynamic connector investigates - - - investigates - + + + investigates + Dynamic connector.1135 inputs_ref - - - inputs_ref - + + + inputs_ref + Dynamic connector.1136 outputs_refs - - - outputs_refs + + + outputs_refs + + Dynamic connector.1137 + target + + + + + target + + Dynamic connector.1139 + target + + + + + target diff --git a/STIX_for_digital_forensics/CFO_intro.vsdx b/STIX_for_digital_forensics/CFO_intro.vsdx index 1ead416..4a3babf 100644 Binary files a/STIX_for_digital_forensics/CFO_intro.vsdx and b/STIX_for_digital_forensics/CFO_intro.vsdx differ diff --git a/STIX_for_digital_forensics/readme.md b/STIX_for_digital_forensics/readme.md index e02380a..827d060 100644 --- a/STIX_for_digital_forensics/readme.md +++ b/STIX_for_digital_forensics/readme.md @@ -193,6 +193,7 @@ The Activity Name vocabulary is shared by both attackers and investigators. | Vocabulary Value | Description | | ---------------- | ------------------------------------------------------------------- | | steganalysis | | +| break | | | browse | Browse webpages, directories, etc. | | carve | | | config | | @@ -271,14 +272,14 @@ An action is one cyber criminal activity performed under a user account. It is a ## Action Specific Properties -| Property Name | Type | Description | -| --------------- | ---------- | --------------------------------------------------------------------------------------------- | -| type (required) | string | The value of this property MUST be x-action. | -| name | open-vocab | Specifies the name of an action. It MUST come from x-activity-name-ov. | -| target | identifier | Specifies the object that receives the direct action of the verb. It is an observable object. | -| description | string | A description that provides more details and context about the Action. | -| start_time | timestamp | Specifies the the time that an action is started. | -| end_time | timestamp | Specifies the the time that an action is ended. | +| Property Name | Type | Description | +| --------------- | ---------- | ------------------------------------------------------------------------------ | +| type (required) | string | The value of this property MUST be x-action. | +| verb | open-vocab | Specifies the name of an action. It MUST come from x-activity-name-ov. | +| target | identifier | Specifies an observed data object that receives the direct action of the verb. | +| description | string | A description that provides more details and context about the Action. | +| start_time | timestamp | Specifies the the time that an action is started. | +| end_time | timestamp | Specifies the the time that an action is ended. | ### Relationships @@ -295,8 +296,8 @@ An action is one cyber criminal activity performed under a user account. It is a "type": "x-action", "spec_version": "2.1", "id": "x-action--87a3e4ee-102c-4cc9-9017-96089a0e0680", - "name": "Search", - "target": "anti-forensic tools", + "verb": "Search", + "target": ["observed-data--2c562ec3-d3bd-4e9b-9d79-cc791c86692d"], "description": "Search a 'anti-forensic tools' keyword online using bing search engine.", "start_time": "2015-25-25T14:46:44:44Z", "created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",