Lately I've been playing around with Cyber Observable eXpression,
CybOX, and created a plugin to help check for threat indicators in memory samples.
In case you don't know, CybOX provides a vendor neutral format for expressing indicator information. As of late, it has been gaining a lot of momentum among security/forensics vendors and government agencies. It has
python
bindings and an extensive schema that supports various disk, network and memory artifacts. There are also scripts available for
converting OpenIOC indicators to CybOX format. The project has a lot of potential and the developers are very responsive. As a result, it has the potential to provide a powerful capability to the Volatility community. The initial release of the Volatility plugin currently supports the following observable artifacts:
- Process names
- IP addresses/domains
- Mutexes
- Open(ed) files
- Services
- Registry Keys/Values
These artifacts will be expanded as the need arises.
Obtaining Python-CybOX
Make sure to
install the dependencies before downloading CybOX. If you are on Mac OSX, you
can find newer versions of lxml in macport:
$ port search lxml
[snip]
py-lxml @2.3.2 (python, devel)
Powerful and Pythonic XML processing library
py24-lxml @2.3.2 (python, devel)
Powerful and Pythonic XML processing library
py25-lxml @2.3.2 (python, devel)
Powerful and Pythonic XML processing library
py26-lxml @2.3.2 (python, devel)
Powerful and Pythonic XML processing library
py27-lxml @2.3.2 (python, devel)
Powerful and Pythonic XML processing library
Since I'm running Python 2.6, I chose py26-lxml. After getting all the dependencies installed, you can now install CybOX:
$ git clone https://github.com/CybOXProject/python-cybox.git
$ cd python-cybox
$ python setup.py build
$ sudo python setup.py install
If all goes well you shouldn't see any errors and can now use CybOX. You can try to import it to be sure it installed OK:
$ python
Python 2.6.1 (r261:67515, Jun 24 2010, 21:47:49)
[GCC 4.2.1 (Apple Inc. build 5646)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import cybox.bindings.cybox_core as core_binding
>>> from cybox.core import Observables
>>>
Obtaining IOCs
Currently, there are not a lot publicly available indicator examples in CybOX format. Granted with support currently being added to both commercial and open source tools and with government agencies looking to distribute their indicators in CybOX format, we expect that to be changing soon. In the meantime and for the sake of testing, let's demonstrate how a vendor specific format like OpenIOC can be converted to CybOX. There are a few places that one can find IOCs in the OpenIOC format, such as:
Not all of these will be useful from a memory forensics point of view, however, since they mostly cover disk artifacts. After an OpenIOC file is obtained, you
can convert them into CybOX format. The conversion script can be found in the
CybOX/Tools repository, which is
obtainable through github:
$ git clone https://github.com/CybOXProject/Tools.git
$ cd Tools/scripts/openioc_to_cybox/
$ python openioc_to_cybox.py -i [IOC file to convert] -o [output file]
So let's say that we want to convert
this OpenIOC file to CybOX format. We'd use the
openioc_to_cybox.py script like so:
$ python openioc_to_cybox.py -i 6d2a1b03-b216-4cd8-9a9e-8827af6ebf93.ioc -o 6d2a1b03-b216-4cd8-9a9e-8827af6ebf93.ioc.xml
We can now use the output file
6d2a1b03-b216-4cd8-9a9e-8827af6ebf93.ioc.xml with CybOX
CybOXer: A New Volatility Plugin
We have created a plugin, called cyboxer, that allows users to use CybOX IOCs with Volatility. This plugin has the following options:
-v, --verbose Verbose information
-c CYBOX, --cybox=CYBOX
CybOX output file (xml)
-D DIRECTORY, --directory=DIRECTORY
Directory of CybOX xml files
The plugin must have either
-c or
-D as an option. The
-v (verbose) flag prints out more information, including what files/handles/etc were responsive
to the CybOX rule. The CybOX files are first parsed in order to obtain all observables and then the plugin enumerates the appropriate memory objects and compares them to
the observable values. After this, the plugin parses out the CybOX compositions which contain the logic describing how these observables relate to each other. Supported logic is
as follows:
- Equals
- Contains
- DoesNotContain
- DoesNotEqual
- StartsWith
- EndsWith
- GreaterThan
- GreaterThanOrEqual
- LessThan
- LessThanOrEqual
Other logic will be added at a later date as needed.
Example Usage
For this example, we'll use a CybOX file that was converted from
this OpenIOC file
against
this memory sample:
$ python vol.py -f zeus.vmem cyboxer -c TEST/6d2a1b03-b216-4cd8-9a9e-8827af6ebf93.ioc.xml
Volatile Systems Volatility Framework 2.3_beta
Getting processes...
Getting handles...
Found the following IOC: Finds Zeus variants, twexts, sdra64, ntos
Items found:
Type: WindowsHandleObjectType, Value: _AVIRA_, Condition: Contains
Type: ProcessObjectType, Value: winlogon.exe, Condition: Contains
Type: WindowsHandleObjectType, Value: system32\lowsec\user.ds, Condition: Contains
Type: WindowsHandleObjectType, Value: system32\sdra64.exe, Condition: Contains
Type: WindowsHandleObjectType, Value: system32\lowsec\local.ds, Condition: Contains
The "Value" is the value that was given in the CybOX observable. We also see the "Type" of the observable object and the "Condition" (logic) that was used to find the value in memory. If we want to see more information about what was responsive we can use the verbose flag. Additional information includes the Observable ID, if it is a type (File, Mutex etc), a flag indicating whether or not it was found in memory (should be True) and the value of the item that was found in memory that matches the Composition criteria:
$ python vol.py -f zeus.vmem cyboxer -c TEST/6d2a1b03-b216-4cd8-9a9e-8827af6ebf93.ioc.xml -v
Volatile Systems Volatility Framework 2.3_beta
Getting processes...
Getting handles...
Found the following IOC: Finds Zeus variants, twexts, sdra64, ntos
Items found:
Type: WindowsHandleObjectType, Value: _AVIRA_, Condition: Contains, ID: openioc:indicator-item-e033b865-95ba-44ab-baa5-3b1e8e5f348c, IsType: False, IsFound: True
Responsive item: \Device\NamedPipe\_AVIRA_2109
Responsive item: _AVIRA_2109
Type: ProcessObjectType, Value: winlogon.exe, Condition: Contains, ID: openioc:indicator-item-50455b63-35bf-4efa-9f06-aeba2980f80a, IsType: False, IsFound: True
Responsive item: winlogon.exe
Type: WindowsHandleObjectType, Value: system32\lowsec\user.ds, Condition: Contains, ID: openioc:indicator-item-1c3f8902-d4e2-443a-a407-15be3951bef9, IsType: False, IsFound: True
Responsive item: \Device\HarddiskVolume1\WINDOWS\system32\lowsec\user.ds
Type: WindowsHandleObjectType, Value: system32\sdra64.exe, Condition: Contains, ID: openioc:indicator-item-c5ae706f-c032-4da7-8acd-4523f1dae9f6, IsType: False, IsFound: True
Responsive item: \Device\HarddiskVolume1\WINDOWS\system32\sdra64.exe
Type: WindowsHandleObjectType, Value: system32\lowsec\local.ds, Condition: Contains, ID: openioc:indicator-item-7fab12d1-67ed-4149-b46a-ec50fc622bee, IsType: False, IsFound: True
Responsive item: \Device\HarddiskVolume1\WINDOWS\system32\lowsec\local.ds
Below we can see an example of
cyboxer running against a directory of CybOX xml files
$ python vol.py -f zeus.vmem cyboxer -D TEST
Volatile Systems Volatility Framework 2.3_beta
Getting processes...
Getting opened files...
Getting handles...
Getting services...
Getting connections...
Getting registry keys...
Found the following IOC: This is a sample IOC that will hit on a number different artifacts present on a Windows computer. This IOC is used to test or illustrate the use of an IOC.
Items found:
Type: FileObjectType, Value: win.ini, Condition: Equals
Type: WindowsServiceObjectType, Value: ('TrkWks', None, None), Condition: Equals
Type: FileObjectTypeExt, Value: evt, Condition: Contains
Type: FileObjectType, Value: sens.dll, Condition: Equals
Found the following IOC: Finds Zeus variants, twexts, sdra64, ntos
Items found:
Type: WindowsHandleObjectType, Value: _AVIRA_, Condition: Contains
Type: ProcessObjectType, Value: winlogon.exe, Condition: Contains
Type: WindowsHandleObjectType, Value: system32\lowsec\user.ds, Condition: Contains
Type: WindowsHandleObjectType, Value: system32\sdra64.exe, Condition: Contains
Type: WindowsHandleObjectType, Value: system32\lowsec\local.ds, Condition: Contains
Below is an example of
cyboxer running against a flame hibernation file:
$ python vol.py -f hiberfil.sys cyboxer -c TEST/af2e8c80-13db-4a57-99ac-460ccd192333.ioc.xml -v
Volatile Systems Volatility Framework 2.3_beta
Getting processes...
Getting opened files...
Getting handles...
Getting registry keys...
Found the following IOC: IOCs to detect the presence of the Flamer framework
Items found:
Type: FileObjectType, Value: rccache.dat, Condition: Equals, ID: openioc:indicator-item-a82530a3-2351-4625-a578-fecf9979f735, IsType: False, IsFound: True
Responsive item: \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\MSSecurityMgr\rccache.dat
Type: WindowsHandleObjectType, Value: microsoft shared_mssecuritymgr_ssitable, Condition: Contains, ID: openioc:indicator-item-c2b094ad-e353-4433-90cb-4048c62f0ff2, IsType: False, IsFound: True
Responsive item: c__program files_common files_microsoft shared_mssecuritymgr_ssitable
Responsive item: c__program files_common files_microsoft shared_mssecuritymgr_ssitable_SHR
Type: WindowsHandleObjectType, Value: microsoft shared_mssecuritymgr_mscrypt.dat, Condition: Contains, ID: openioc:indicator-item-3be23f29-dc73-4baa-8ad3-4b0cd1c2b6dd, IsType: False, IsFound: True
Responsive item: c__program files_common files_microsoft shared_mssecuritymgr_mscrypt.dat
Responsive item: c__program files_common files_microsoft shared_mssecuritymgr_mscrypt.dat_SHR
Responsive item: c__program files_common files_microsoft shared_mssecuritymgr_mscrypt.datShared
Type: WindowsHandleObjectType, Value: TH_POOL_SHD_PQOISNG, Condition: Contains, ID: openioc:indicator-item-209070e1-50d7-489d-af11-e0f2b3df23d5, IsType: False, IsFound: True
Responsive item: TH_POOL_SHD_PQOISNG_912SYNCMTX
Responsive item: TH_POOL_SHD_PQOISNG_1244SYNCMTX
Responsive item: TH_POOL_SHD_PQOISNG_1604SYNCMTX
Notes
Only the aforementioned items are supported at this time, however there are plans to expand the plugin sometime in the future. Unsupported items are currently ignored and have no affect on the composition logic. Only items that are found are printed out. Items that have "DoesNotEqual" and "DoesNotContain" are not printed, since they are often used in combination with other observable values (this may change sometime in the future, however). Also file objects are always evaluated as "Contains" when "Equals" has been given as a condition. This is because in memory these file objects have the entire kernel path (
\Device\HarddiskVolume1\...) which will never match something like "rccache.dat" alone.
Conclusion
This plugin is still under development, but we hope that you will find this plugin useful in your investigations. I would like to thank Ivan Kirillov, Greg Back and the rest of the CybOX team for maintaining this project and for their help and support. If you are interested in testing this plugin, please drop me a line at jamie.levy {at} gmail {dot} com.