From be512a064e41d91a4c2b9852715c2da0ac1f81fe Mon Sep 17 00:00:00 2001 From: Frank Xu Date: Sun, 14 Feb 2021 21:42:40 -0500 Subject: [PATCH] add investigation tools to evidence --- STIX_for_digital_forensics/CFO_intro.svg | 626 ++++++++++++++--------- STIX_for_digital_forensics/readme.md | 80 +-- 2 files changed, 419 insertions(+), 287 deletions(-) diff --git a/STIX_for_digital_forensics/CFO_intro.svg b/STIX_for_digital_forensics/CFO_intro.svg index acc3ec2..f98cda1 100644 --- a/STIX_for_digital_forensics/CFO_intro.svg +++ b/STIX_for_digital_forensics/CFO_intro.svg @@ -3,7 +3,7 @@ + xml:space="preserve" color-interpolation-filters="sRGB" class="st13"> @@ -18,12 +18,13 @@ .st4 {fill:#004b74;font-family:Franklin Gothic Demi;font-size:1.00001em} .st5 {fill:#ffffff;stroke:#00bc74;stroke-linecap:round;stroke-linejoin:round;stroke-width:1} .st6 {fill:#00653e;font-family:Franklin Gothic Demi;font-size:1.00001em} - .st7 {marker-end:url(#mrkr4-42);stroke:#008cd8;stroke-linecap:round;stroke-linejoin:round;stroke-width:0.75} - .st8 {fill:#008cd8;fill-opacity:1;stroke:#008cd8;stroke-opacity:1;stroke-width:0.22935779816514} - .st9 {fill:#ffffff;stroke:none;stroke-linecap:butt;stroke-width:7.2} - .st10 {fill:#002f49;font-family:Franklin Gothic Demi;font-size:0.666664em} - .st11 {font-size:1em} - .st12 {fill:none;fill-rule:evenodd;font-size:12px;overflow:visible;stroke-linecap:square;stroke-miterlimit:3} + .st7 {font-size:1em} + .st8 {marker-end:url(#mrkr4-45);stroke:#008cd8;stroke-linecap:round;stroke-linejoin:round;stroke-width:0.75} + .st9 {fill:#008cd8;fill-opacity:1;stroke:#008cd8;stroke-opacity:1;stroke-width:0.22935779816514} + .st10 {fill:#ffffff;stroke:none;stroke-linecap:butt;stroke-width:7.2} + .st11 {fill:#002f49;font-family:Franklin Gothic Demi;font-size:0.666664em} + .st12 {fill:#ffffff;stroke:none;stroke-linecap:butt} + .st13 {fill:none;fill-rule:evenodd;font-size:12px;overflow:visible;stroke-linecap:square;stroke-miterlimit:3} ]]> @@ -31,7 +32,7 @@ - @@ -43,7 +44,7 @@ Page-1 - + Rectangle x-disk-partition--1 @@ -65,14 +66,14 @@ x-secondary-storage--1 Rectangle.5 - x-disk-image--1 + x-image--1 - x-disk-image--1 + x-image--1 Rectangle.1000 x-action--1 @@ -155,23 +156,24 @@ x-action--2 Rectangle.1009 - x-memory- image—1 + x-image—2 - x-memory- image—1 - + x-image—2 + Dynamic connector.1011 - evidence_of + evidence-of - - - - evidence_of - + + + + evidence-of + Rectangle.1012 user-account --1 @@ -181,89 +183,90 @@ user-account --1 - + Dynamic connector.1013 exploits - - - exploits - + + + exploits + Dynamic connector.1014 action_refs - - - action_refs - + + + action_refs + Dynamic connector.1017 Indicated-by - - - Indicated-by - + + + Indicated-by + Dynamic connector.1018 based-on - - - based-on - + + + based-on + Dynamic connector.1019 object_refs - - - object_refs - + + + object_refs + Dynamic connector.1021 image-of - - - image-of - + + + image-of + Dynamic connector.1024 evidence-of - - - evidence-of - + + + evidence-of + Dynamic connector.1025 action_refs - - - action_refs - + + + action_refs + Dynamic connector.1026 has - - - has - + + + has + Dynamic connector.1027 reconstructed_from - - - reconstructed_from - + + + reconstructed_from + Rectangle.1028 file--2 @@ -273,16 +276,16 @@ file--2 - + class="st7" v:langID="1033">2 + Dynamic connector.1029 source_ref - - - - source_ref - + + + + source_ref + Rectangle.1030 software--2 @@ -292,70 +295,70 @@ software--2 - + Dynamic connector.1031 browser_ref - - - browser_ref - + + + browser_ref + Sheet.1032 directory-1 directory-1 - + Dynamic connector.1033 parent_directory_ref - - - parent_directory_ref - + + + parent_directory_ref + Dynamic connector.1034 contains-refs - - - - contains-refs - + + + + contains-refs + Sheet.1035 threat-actor--1 threat-actor--1 - + Sheet.1036 Identity--1 Identity--1 - + Dynamic connector.1037 attributed-to - - - attributed-to - + + + attributed-to + Dynamic connector.1038 related-to - - - related-to - + + + related-to + Rectangle.1039 identity--2 @@ -364,27 +367,27 @@ - identity--identity--2 - + Dynamic connector.1040 reconstructed_by - - - r + + reconstructed_by - + Dynamic connector.1041 secondary_storage_refs - - - secondary_storage_refs - + + + secondary_storage_refs + Rectangle.1042 indicator--3 @@ -394,7 +397,7 @@ indicator--3 - + Rectangle.1043 observed-data--3 @@ -404,7 +407,7 @@ observed-data--3 - + Rectangle.1044 x-pnp-evt--1 @@ -414,24 +417,24 @@ x-pnp-evt--1 - + Dynamic connector.1045 based-on - - - based-on - + + + based-on + Dynamic connector.1046 object_refs - - - object_refs - + + + object_refs + Rectangle.1047 file--4 @@ -441,39 +444,39 @@ file--4 - + class="st7" v:langID="1033">4 + Dynamic connector.1048 source_ref - - - - source_ref - + + + + source_ref + Sheet.1049 directory-3 directory-3 - + Dynamic connector.1050 parent_directory_ref - - - parent_directory_ref - + + + parent_directory_ref + Dynamic connector.1051 indicated-by - - - indicated-by - + + + indicated-by + Rectangle.1052 indicator—2 @@ -483,7 +486,7 @@ indicator—2 - + Rectangle.1053 observed-data—2 @@ -493,7 +496,7 @@ observed-data—2 - + Rectangle.1054 x-windows-evt-2 @@ -503,24 +506,24 @@ x-windows-evt-2 - + Dynamic connector.1055 based-on - - - based-on - + + + based-on + Dynamic connector.1056 object_refs - - - object_refs - + + + object_refs + Rectangle.1057 file--3 @@ -530,76 +533,76 @@ file--3 - + class="st7" v:langID="1033">3 + Dynamic connector.1058 source_ref - - - - source_ref - + + + + source_ref + Sheet.1059 directory-2 directory-2 - + Dynamic connector.1060 parent_directory_ref - - - parent_directory_ref - + + + parent_directory_ref + Dynamic connector.1061 indicated-by - - - indicated-by - + + + indicated-by + Dynamic connector.1062 contains-refs - - - - contains-refs - + + + + contains-refs + Dynamic connector.1063 contains-refs - - - - contains-refs - + + + + contains-refs + Dynamic connector.1065 part-of - - - - part-of - + + + + part-of + Dynamic connector.1066 used-in - - - used-in - + + + used-in + Rectangle.1067 Identify--3 @@ -609,8 +612,8 @@ Identify--3 - + class="st7" v:langID="1033">3 + Rectangle.1069 x-investigation-tool--1 @@ -620,15 +623,15 @@ x-investigation-tool--1 - + Dynamic connector.1070 acquired_using_tool_ref - - - acquired_using_tool_ref - + + + acquired_using_tool_ref + Rectangle.1071 software--1 @@ -638,15 +641,15 @@ software--1 - + Dynamic connector.1072 software_ref - - - software_ref - + + + software_ref + Rectangle.1073 x-file-visit--1 @@ -656,16 +659,16 @@ x-file-visit--1 - + class="st7" v:langID="2057">--1 + Dynamic connector.1074 object_refs - - - object_refs - + + + object_refs + Rectangle.1075 file--1 @@ -675,33 +678,33 @@ file--1 - + Dynamic connector.1076 source-ref - - - source-ref - + + + source-ref + Dynamic connector.1077 contains-refs - - - - contains-refs - + + + + contains-refs + Dynamic connector.1078 object-refs - - - object-refs - + + + object-refs + Rectangle.1079 Cyber Forensic Domain Object @@ -711,8 +714,8 @@ Cyber Forensic Domain Object - + x="25.91" dy="1.2em" class="st7">Domain Object + Rectangle.1080 Cyber Forensic Domain Object @@ -722,8 +725,8 @@ Cyber Forensic Domain Object - + x="48.15" dy="1.2em" class="st7">Object + Rectangle.1081 STIX Object @@ -733,47 +736,47 @@ STIX Object - + Dynamic connector.1082 assigned-to - - - assigned-to - + + + assigned-to + Dynamic connector.1083 invovles - - - invovles - + + + invovles + Dynamic connector.1084 acquired_by_ref - - - acquired_by_ref - + + + acquired_by_ref + Dynamic connector.1085 exploits - - - exploits - + + + exploits + Dynamic connector.1086 exploits - - - exploits - + + + exploits + Rectangle.1087 url @@ -783,22 +786,133 @@ url - + Dynamic connector.1088 url_ref - - - url_ref - + + + url_ref + Dynamic connector.1089 object_refs - - - object_refs + + + object_refs + + Rectangle.1090 + x-ram + + + + + + + x-ram + + Dynamic connector.1091 + ram_refs + + + + + ram_refs + + Dynamic connector.1092 + image-of + + + + + image-of + + Sheet.1093 + mac-addr--1 + + + + mac-addr--1 + + Sheet.1094 + ipv4-addr--1 + + + + ipv4-addr--1 + + Dynamic connector.1096 + communicates-use + + + + + communicates-use + + Dynamic connector.1097 + has + + + + + has + + Rectangle.1098 + x-investigation-tool--2 + + + + + + + x-investigation-tool--2 + + Dynamic connector.1099 + processed-by + + + + + processed-by + + Rectangle.1100 + x-investigation-tool--3 + + + + + + + x-investigation-tool--3 + + Rectangle.1101 + x-investigation-tool--4 + + + + + + + x-investigation-tool--4 + + Dynamic connector.1102 + processed-by + + + + + processed-by + + Dynamic connector.1103 + processed-by + + + + + processed-by diff --git a/STIX_for_digital_forensics/readme.md b/STIX_for_digital_forensics/readme.md index 8fbc0ff..e5f1ffd 100644 --- a/STIX_for_digital_forensics/readme.md +++ b/STIX_for_digital_forensics/readme.md @@ -168,15 +168,15 @@ Investigation Tools are software that can be used by cyber investigators to perf ### Investigation Tool Specific Properties -| Property Name | Type | Description | -| --------------- | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | -| type (required) | string | The value of this property MUST be x-investigation-tool. | -| last_modified | timestamps | The last modified date of the investigation tool. | -| description | string | A description that provides more details and context about the investigation tool. | -| used_for | list of type open-vocab | Specifies a list of activities that tool is used to perform. Each activity SHOULD come from the x-activity-name-ov open vocabulary. | -| aliases | list of type string | Alternative names used to identify this investigation tool. | -| version | string | The version identifier associated with the investigation tool. | -| software_ref | identifier | Specifies the software product (if CPE or SWID is known) used as the investigation tool. | +| Property Name | Type | Description | +| --------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| type (required) | string | The value of this property MUST be x-investigation-tool. | +| last_modified | timestamps | The last modified date of the investigation tool. | +| description | string | A description that provides more details and context about the investigation tool. | +| functions | list of type open-vocab | Specifies a list of functions of an Investigation Tool. Each function is summarized in one activity, which SHOULD come from the x-activity-name-ov open vocabulary. | +| aliases | list of type string | Alternative names used to identify this investigation tool. | +| version | string | The version identifier associated with the investigation tool. | +| software_ref | identifier | Specifies the software product (if CPE or SWID is known) used as the investigation tool. | ### Activity Name Vocabulary @@ -524,18 +524,19 @@ A Crime Case object represents a background description of a potential cybercrim | type | string | Specifies the type of a computer. The value of this property MUST come from [Types](https://en.wikipedia.org/wiki/Computer). | | model | string | Specifies the model of a computer. | | cpu | StringS | Specifies the CUP of a computer. It MUST follow CUP naming conventions. | -| memory | list of x-memory | Specifies the memory of a computer. | +| ram_refs | list of type x-ram | Specifies a list of RAM memory device of a computer. | | input_devices | list of type string | Specifies a list of input devices. | | output_device | list of type string | Specifies a list of output devices. | | secondary_storage_refs | list of x-secondary-storage | Specifies a list of x-secondary-storage. | ### Relationships -| Source | Relationship Type | Target | Description | -| ---------- | ----------------- | ------------------------- | -------------------------------------------------------------------------------------- | -| x-computer | has | ipv4-addr | The relationship specifies that a computer communicates with other PCs with ipv4-addr. | -| x-computer | has | list of type user-account | The relationship specifies that a computer has a list of user-account. | -| x-computer | used-in | x-crime-case | The relationship specifies that a computer is used in a x-crime-case. | +| Source | Relationship Type | Target | Description | +| ---------- | ----------------- | ------------------------- | ----------------------------------------------------------------------------------------- | +| x-computer | communicates-use | ipv4-addr, ipv6-addr | The relationship specifies that a computer communicates with other PCs with IPv4/v6 Addr. | +| x-computer | has | mac-addr | The relationship specifies that a computer has a a Mac Address. | +| x-computer | has | list of type user-account | The relationship specifies that a computer has a list of User Account. | +| x-computer | used-in | x-crime-case | The relationship specifies that a computer is used in a Crime Case. | ### Example @@ -664,7 +665,7 @@ Specify a partition with NTFS "id": "relationship--6598bf44-1c10-4218-af9f-75b5b71c23a7", "created": "2021-05-15T09:12:16.432Z", "modified": "2021-05-15T09:12:16.432Z", - "relationship_type": "part-of", + "relationship_type": "contains-refs", "source_ref": "x-disk-partition--ac6e29f1-aa84-4066-961b-9e1f42acab8f", "target_ref": [ "file--4de6823e-ee2e-4244-9915-7b3dc0489c84", @@ -678,7 +679,7 @@ Specify a partition with NTFS **Type Name:** x-ram -Memory object represent a primary storage that is used to store information for immediate use in a computer or related computer hardware device. We only include RAM. +RAM object represent a random access memory, a primary storage, that is used to store information for immediate use in a computer or related computer hardware device. ### Memory Specific Properties @@ -787,8 +788,8 @@ A Windows Event object represents properties of an event, which is recorded by W | event_generator | string | Specifies the name of the software (or the name of a sub-component of the software if the software is large) that generates the event. | | event_id | integer | The value is specific to the event source for the event, and is used with the source name to locate a description string in the message file for the event source. | | event_id_string | integer | Specified the description string of event_id. | -| event_type | string | It MUST be one EventType defined in [Windows Doc](https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-eventlogrecord) | -| source_ref(required) | identifier | Specifies object type that event object belongs to. It MUST be a type of file or artifact | +| event_type | string | It MUST be one of EventTypes defined in [Windows Doc](https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-eventlogrecord) | +| source_ref(required) | identifier | Specifies object type that event object belongs to. It MUST be a type of File or Artifact | Notes: @@ -797,9 +798,10 @@ Notes: ### Relationships -| Source | Relationship Type | Target | Description | -| ------------- | ----------------- | ------------ | ------------------------------------------------------------------------- | -| x-windows-evt | exploits | user-account | This Relationship describes that a Windows Event exploits a User Account. | +| Source | Relationship Type | Target | Description | +| ------------- | ----------------- | --------------------------------- | ------------------------------------------------------------------------------------------------------ | +| x-windows-evt | exploits | user-account | This Relationship describes that a Windows Event exploits a User Account. | +| x-windows-evt | processed-by | list of type x-investigation-tool | This Relationship describes that a Windows Event is processed/viewed by a list of Investigation Tools. | ### Example 1: describes a "logon" event recorded in the security event file. @@ -854,6 +856,19 @@ Notes: "relationship_type": "exploits", "source_ref": "x-windows-evt--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f", "target_ref": "user-account--0d5b424b-93b8-5cd8-ac36-306e1789d63c" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--014841f8-eb38-4673-9904-70f67c92dd8b", + "created": "2020-01-16T18:52:24.277Z", + "modified": "2020-01-16T18:52:24.277Z", + "relationship_type": "processed-by", + "source_ref": "x-windows-evt--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f", + "target_ref": [ + "x-investigation-tool-b0c1231e-996f-455d-9884-a4c52b7910a5", + "x-investigation-tool-eab56266-e855-4737-a48a-e6d10d7e96c2" + ] } ] ``` @@ -898,9 +913,10 @@ A Webpage Visit object represents a visit to a webpage. ### Relationships -| Source | Relationship Type | Target | Description | -| --------------- | ----------------- | ------------ | ------------------------------------------------------------------------- | -| x-webpage-visit | exploits | user-account | This Relationship describes that a Webpage Visit exploits a User Account. | +| Source | Relationship Type | Target | Description | +| --------------- | ----------------- | --------------------------------- | ------------------------------------------------------------------------------------------------------ | +| x-webpage-visit | exploits | user-account | This Relationship describes that a Webpage Visit exploits a User Account. | +| x-webpage-visit | processed-by | list of type x-investigation-tool | This Relationship describes that a Webpage Visit is processed/viewed by a list of Investigation Tools. | ### Examples @@ -981,9 +997,10 @@ Vocabulary Name: x-pnp-message-type-enum ### Relationships -| Source | Relationship Type | Target | Description | -| --------- | ----------------- | ------------ | --------------------------------------------------------------------- | -| x-pnp-evt | exploits | user-account | This Relationship describes that a pnp Event exploits a user-account. | +| Source | Relationship Type | Target | Description | +| --------- | ----------------- | --------------------------------- | -------------------------------------------------------------------------------------------------- | +| x-pnp-evt | exploits | user-account | This Relationship describes that a pnp Event exploits a user-account. | +| x-pnp-evt | processed-by | list of type x-investigation-tool | This Relationship describes that a pnp Event is processed/viewed by a list of Investigation Tools. | ### Examples @@ -1071,9 +1088,10 @@ A File Visit object represents properties that are associated with a file/direct ### Relationships -| Source | Relationship Type | Target | Description | -| ------------ | ----------------- | ------------ | ---------------------------------------------------------------------- | -| x-file-visit | exploits | user-account | This Relationship describes that a File Visit exploits a User Account. | +| Source | Relationship Type | Target | Description | +| ------------ | ----------------- | --------------------------------- | --------------------------------------------------------------------------------------------------- | +| x-file-visit | exploits | user-account | This Relationship describes that a File Visit exploits a User Account. | +| x-file-visit | processed-by | list of type x-investigation-tool | This Relationship describes that a File Visit is processed/viewed by a list of Investigation Tools. | ### RecentFileCache