Skip to content

Commit 54d16af

Browse files
stevespringettstevespringett
committed
Added mockups
Signed-off-by: Steve Springett <steve@springett.us>
1 parent 27282d3 commit 54d16af

2 files changed

Lines changed: 228 additions & 0 deletions

File tree

‎tools/src/test/resources/2.0/prototypes/behavior-mockup-evidence.json‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
{
2+
"$schema": "https://cyclonedx.org/schema/2.0/cyclonedx-2.0.schema.json",
3+
"specFormat": "CycloneDX",
4+
"specVersion": "2.0",
5+
"serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
6+
"version": 1,
7+
"blueprints": [
8+
{
9+
"bom-ref": "blueprint-pth-payload",
10+
"name": "Pass-the-Hash Payload Behavioral Blueprint",
11+
"modelTypes": [
12+
{ "type": "behavioral" }
13+
],
14+
"methodologies": [
15+
{ "type": "MITRE-ATTACK" }
16+
],
17+
"behaviors": {
18+
"instances": [
19+
{
20+
"bom-ref": "b-startup-exec",
21+
"behavior": "system:persistence:registersForStartup",
22+
"trigger": "startup",
23+
"evidence": {
24+
"bom-ref": "evidence-1",
25+
"confidence": 0.95,
26+
"description": "Persistence registration via Run key write observed in unpacked binary.",
27+
"methods": [
28+
{
29+
"technique": "binary-analysis",
30+
"confidence": 0.95,
31+
"value": "Import of advapi32!RegSetValueExW resolving to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run at 0x00401a20.",
32+
"tools": [{ "ref": "karambit" }],
33+
"externalReferences": {
34+
"type": "formulation",
35+
"url": "urn:cdx:3e671687-395b-41f5-a30f-a58921a69b79/1#my-workflow"
36+
}
37+
}
38+
]
39+
}
40+
},
41+
{
42+
"bom-ref": "b-decode",
43+
"behavior": "evasion:obfuscation:obfuscatesStrings",
44+
"trigger": "startup",
45+
"evidence": {
46+
"confidence": 0.9,
47+
"description": "Stack-built XOR-decoded strings resolved at runtime.",
48+
"methods": [
49+
{
50+
"technique": "binary-analysis",
51+
"confidence": 0.9,
52+
"value": "XOR decode loop at 0x00403110 with key 0x5A resolving C2 hostnames and API names prior to use."
53+
}
54+
],
55+
"tools": [
56+
{ "ref": "karambit" }
57+
]
58+
}
59+
},
60+
{
61+
"bom-ref": "b-credential-collect",
62+
"behavior": "privacy:collection:collectsPersonalData",
63+
"trigger": "startup",
64+
"evidence": {
65+
"confidence": 0.92,
66+
"description": "LSASS memory access to harvest NTLM hashes.",
67+
"methods": [
68+
{
69+
"technique": "binary-analysis",
70+
"confidence": 0.92,
71+
"value": "OpenProcess on lsass.exe with PROCESS_VM_READ followed by MiniDumpWriteDump observed at 0x004044c0."
72+
}
73+
],
74+
"tools": [
75+
{ "ref": "karambit" }
76+
]
77+
}
78+
},
79+
{
80+
"bom-ref": "b-exfil",
81+
"behavior": "network:transmission:sendsData",
82+
"trigger": "startup",
83+
"evidence": {
84+
"confidence": 0.88,
85+
"description": "HTTPS POST of collected artifacts to external C2 endpoint.",
86+
"methods": [
87+
{
88+
"technique": "binary-analysis",
89+
"confidence": 0.88,
90+
"value": "WinHttpOpen/WinHttpConnect/WinHttpSendRequest chain at 0x00405e80 posting to 185.x.x.x/gate.php."
91+
}
92+
],
93+
"tools": [
94+
{ "ref": "karambit" }
95+
]
96+
}
97+
}
98+
],
99+
"flows": [
100+
{
101+
"bom-ref": "flow-pth-payload",
102+
"trigger": "startup",
103+
"acknowledgment": ["observed"],
104+
"evidence": {
105+
"ref": "urn:cdx:3e671687-395b-41f5-a30f-a58921a69b79/1#evidence-1"
106+
},
107+
"ordering": "unordered",
108+
"steps": [
109+
{ "ordinal": 1, "ref": "b-startup-exec" },
110+
{ "ordinal": 2, "ref": "b-decode" },
111+
{ "ordinal": 3, "ref": "b-credential-collect" },
112+
{ "ordinal": 4, "ref": "b-exfil" }
113+
]
114+
}
115+
]
116+
}
117+
}
118+
]
119+
}

‎tools/src/test/resources/2.0/prototypes/behavior-mockup.json‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
{
2+
"$schema": "https://cyclonedx.org/schema/2.0/cyclonedx-2.0.schema.json",
3+
"specFormat": "CycloneDX",
4+
"specVersion": "2.0",
5+
"serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
6+
"version": 1,
7+
"blueprints": [
8+
{
9+
"bom-ref": "blueprint-pth-payload",
10+
"name": "Pass-the-Hash Payload Behavioral Blueprint",
11+
"modelTypes": [
12+
{ "type": "behavioral" }
13+
],
14+
"methodologies": [
15+
{ "type": "MITRE-ATTACK" }
16+
],
17+
"behaviors": {
18+
"instances": [
19+
{
20+
"bom-ref": "b-startup-exec",
21+
"behavior": "system:persistence:registersForStartup",
22+
"acknowledgment": ["observed"],
23+
"trigger": "startup"
24+
},
25+
{
26+
"bom-ref": "b-decode",
27+
"behavior": "evasion:obfuscation:obfuscatesStrings",
28+
"acknowledgment": ["observed"],
29+
"trigger": "startup"
30+
},
31+
{
32+
"bom-ref": "b-credential-collect",
33+
"behavior": "privacy:collection:collectsPersonalData",
34+
"acknowledgment": ["observed"],
35+
"trigger": "startup"
36+
},
37+
{
38+
"bom-ref": "b-exfil",
39+
"behavior": "network:transmission:sendsData",
40+
"acknowledgment": ["observed"],
41+
"trigger": "startup"
42+
}
43+
],
44+
"flows": [
45+
{
46+
"bom-ref": "flow-pth-payload",
47+
"trigger": "startup",
48+
"acknowledgment": ["observed"],
49+
"ordering": "sequential",
50+
"steps": [
51+
{ "ordinal": 1, "ref": "b-startup-exec" },
52+
{ "ordinal": 2, "ref": "b-decode" },
53+
{ "ordinal": 3, "ref": "b-credential-collect" },
54+
{ "ordinal": 4, "ref": "b-exfil" }
55+
]
56+
}
57+
],
58+
59+
"workflows": [
60+
{
61+
"bom-ref": "workflow-pth-payload",
62+
"name": "Pass-the-Hash Payload Workflow",
63+
"trigger": {
64+
"type": "startup"
65+
},
66+
"tasks": [
67+
{
68+
"b-ref": "b-startup-exec",
69+
"timeStart": "2026-01-01T00:00:00Z"
70+
},
71+
{
72+
"b-ref": "b-decode",
73+
"timeStart": "2026-01-01T00:10:00Z"
74+
},
75+
{
76+
"b-ref": "b-credential-collect",
77+
"timeStart": "2026-01-01T00:12:00Z"
78+
},
79+
{
80+
"b-ref": "b-exfil",
81+
"timeStart": "2026-01-01T00:13:00Z"
82+
}
83+
],
84+
"taskDependencies": [
85+
{
86+
"ref": "b-startup-exec",
87+
"dependsOn": []
88+
},
89+
{
90+
"ref": "b-decode",
91+
"dependsOn": [ "b-startup-exec" ]
92+
},
93+
{
94+
"ref": "b-credential-collect",
95+
"dependsOn": [ "b-decode" ]
96+
},
97+
{
98+
"ref": "b-exfil",
99+
"dependsOn": [ "b-credential-collect" ]
100+
}
101+
]
102+
}
103+
]
104+
105+
106+
}
107+
}
108+
]
109+
}

0 commit comments

Comments
 (0)