Skip to content

Instantly share code, notes, and snippets.

@johnnykv

johnnykv/conpot_stix.xml

Last active December 31, 2015 01:29
Show Gist options
  • Save johnnykv/7914621 to your computer and use it in GitHub Desktop.
Save johnnykv/7914621 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
conpot_stix.xml
<?xml version="1.0" encoding="UTF-8"?>
<stix:STIX_Package xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:cybox="http://cybox.mitre.org/cybox-2"
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
xmlns:PortObj="http://cybox.mitre.org/objects#PortObject-2"
xmlns:SocketAddressObj="http://cybox.mitre.org/objects#SocketAddressObject-1"
xmlns:NetworkConnectionObj="http://cybox.mitre.org/objects#NetworkConnectionObject-2"
xmlns:stix="http://stix.mitre.org/stix-1"
xmlns:stixCommon="http://stix.mitre.org/common-1"
xmlns:CustomObj="http://cybox.mitre.org/objects#CustomObject-1"
xmlns:incident="http://stix.mitre.org/Incident-1"
xmlns:Identity="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1"
xmlns:ciq="urn:oasis:names:tc:ciq:xpil:3"
xmlns:n="urn:oasis:names:tc:ciq:xnl:3"
xmlns:ConPot="http://conpot.org/stix-1"
xsi:schemaLocation="
http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1 http://stix.mitre.org/XMLSchema/extensions/identity/ciq_identity_3.0/1.0.1/ciq_identity_3.0.xsd
http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.0.1/stix_core.xsd
http://stix.mitre.org/common-1 http://stix.mitre.org/XMLSchema/common/1.0.1/stix_common.xsd
http://stix.mitre.org/Incident-1 http://stix.mitre.org/XMLSchema/incident/1.0.1/incident.xsd
http://stix.mitre.org/extensions/Address#CIQAddress3.0-1 http://stix.mitre.org/XMLSchema/extensions/address/ciq_address_3.0/1.0.1/ciq_address_3.0.xsd
http://cybox.mitre.org/cybox-2 http://cybox.mitre.org/XMLSchema/core/2.0.1/cybox_core.xsd
http://cybox.mitre.org/common-2 http://cybox.mitre.org/XMLSchema/common/2.0.1/cybox_common.xsd
http://cybox.mitre.org/objects#AddressObject-2 http://cybox.mitre.org/XMLSchema/objects/Address/2.0.1/Address_Object.xsd
http://cybox.mitre.org/objects#PortObject-2 http://cybox.mitre.org/XMLSchema/objects/Port/2.0.1/Port_Object.xsd
http://cybox.mitre.org/objects#SocketAddressObject-1 http://cybox.mitre.org/XMLSchema/objects/Socket_Address/1.0.1/Socket_Address_Object.xsd
http://cybox.mitre.org/objects#ArtifactObject-2 http://cybox.mitre.org/XMLSchema/objects/Artifact/2.0.1/Artifact_Object.xsd
http://cybox.mitre.org/objects#CustomObject-1 http://cybox.mitre.org/XMLSchema/objects/Custom/1.0.1/Custom_Object.xsd
http://cybox.mitre.org/objects#NetworkConnectionObject-2 http://cybox.mitre.org/XMLSchema/objects/Network_Connection/2.0.1/Network_Connection_Object.xsd"
id="ConPot:STIXPackage-4012cb49-693a-4435-9b31-b51f92a3f8dd" version="1.0.1">
<stix:STIX_Header>
<stix:Title>Unauthorized traffic to honeypot</stix:Title>
<stix:Description>Describes one or more honeypot incidents</stix:Description>
<stix:Information_Source>
<stixCommon:Time>
<cyboxCommon:Produced_Time>2013-12-13T21:19:20.263433</cyboxCommon:Produced_Time>
</stixCommon:Time>
</stix:Information_Source>
</stix:STIX_Header>
<stix:Incidents>
<stix:Incident id="ConPot:Incident-36bf7290-98ef-4b03-8093-7d982b334b78" xsi:type='incident:IncidentType'>
<incident:Time>
<incident:First_Malicious_Action>2013-12-13T21:19:18.035442</incident:First_Malicious_Action>
</incident:Time>
<incident:Description>Traffic to ConPot honeypot</incident:Description>
<incident:Categories>
<incident:Category>Scans/Probes/Attempted Access</incident:Category>
</incident:Categories>
<incident:Reporter>
<stixCommon:Tools>
<cyboxCommon:Tool>
<cyboxCommon:Name>Conpot</cyboxCommon:Name>
<cyboxCommon:Type>Honeypot</cyboxCommon:Type>
<cyboxCommon:Description>Conpot is a low interactive server side Industrial Control Systems honeypot designed to be easy to deploy, modify and extend.</cyboxCommon:Description>
<cyboxCommon:References>
<cyboxCommon:Reference reference_type="Source">https://github.com/glastopf/conpot</cyboxCommon:Reference>
<cyboxCommon:Reference reference_type="Other">http://www.conpot.org</cyboxCommon:Reference>
</cyboxCommon:References>
<cyboxCommon:Version>0.2.2</cyboxCommon:Version>
</cyboxCommon:Tool>
</stixCommon:Tools>
</incident:Reporter>
<incident:Related_Observables>
<incident:Related_Observable>
<stixCommon:Observable id="ConPot:Observable-7a7f3923-00c6-401e-86c9-8c79a75b1fee">
<cybox:Object>
<cybox:Properties xsi:type="NetworkConnectionObj:NetworkConnectionObjectType">
<NetworkConnectionObj:Layer7_Protocol datatype="string">modbus</NetworkConnectionObj:Layer7_Protocol>
<NetworkConnectionObj:Source_Socket_Address>
<SocketAddressObj:IP_Address category="ipv4-addr" is_source="true">
<AddressObj:Address_Value>127.0.0.1</AddressObj:Address_Value>
</SocketAddressObj:IP_Address>
<SocketAddressObj:Port>
<PortObj:Port_Value>51949</PortObj:Port_Value>
</SocketAddressObj:Port>
</NetworkConnectionObj:Source_Socket_Address>
<NetworkConnectionObj:Destination_Socket_Address>
<SocketAddressObj:IP_Address category="ipv4-addr">
<AddressObj:Address_Value>111.222.111.222</AddressObj:Address_Value>
</SocketAddressObj:IP_Address>
<SocketAddressObj:Port>
<PortObj:Port_Value>502</PortObj:Port_Value>
</SocketAddressObj:Port>
</NetworkConnectionObj:Destination_Socket_Address>
</cybox:Properties>
</cybox:Object>
</stixCommon:Observable>
</incident:Related_Observable>
<incident:Related_Observable>
<stixCommon:Observable id="ConPot:Observable-f13e39b9-0852-450a-9ffa-1cda716103fc">
<cybox:Object>
<cybox:Properties xsi:type="CustomObj:CustomObjectType" custom_name="ConpotLog">
<cyboxCommon:Custom_Properties>
<cyboxCommon:Property name="rawlog">{"0": {"function_code": 43, "slave_id": 255, "request": "000000000005ff2b0e0100", "response": "2b0e010100000300075369656d656e73010753494d41544943020653372d323030"}}</cyboxCommon:Property>
</cyboxCommon:Custom_Properties>
<CustomObj:Description>Conpot log</CustomObj:Description>
</cybox:Properties>
</cybox:Object>
</stixCommon:Observable>
</incident:Related_Observable>
</incident:Related_Observables>
<incident:Contact>
<stixCommon:Identity xsi:type='Identity:CIQIdentity3.0InstanceType'>
<Identity:Specification>
<ciq:PartyName>
<n:NameLine>The Honeynet Project</n:NameLine>
</ciq:PartyName>
<ciq:ElectronicAddressIdentifiers>
<ciq:ElectronicAddressIdentifier ciq:Type='EMAIL'>[email protected]</ciq:ElectronicAddressIdentifier>
</ciq:ElectronicAddressIdentifiers>
</Identity:Specification>
</stixCommon:Identity>
</incident:Contact>
</stix:Incident>
</stix:Incidents>
</stix:STIX_Package>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment