Initial commit - 611 cybersecurity skills across all subdomains

2026-09-17 05:15:22 +03:00 · 2026-02-25 10:47:44 +01:00
commit 22a7ab1462
1765 changed files with 280648 additions and 0 deletions
@@ -0,0 +1,81 @@
+# Standards and Frameworks Reference
+
+## IOC Types and Classification
+
+### File-Based IOCs
+| Type | Description | Example |
+|------|-------------|---------|
+| MD5 | 128-bit hash | d41d8cd98f00b204e9800998ecf8427e |
+| SHA-1 | 160-bit hash | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
+| SHA-256 | 256-bit hash | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
+| Imphash | Import hash | PE import table hash for family grouping |
+| SSDeep | Fuzzy hash | Context-triggered piecewise hash for similarity |
+| TLSH | Trend Micro LSH | Locality-sensitive hash for near-duplicate detection |
+
+### Network IOCs
+| Type | Description | Example |
+|------|-------------|---------|
+| IPv4 Address | C2 server IP | 192.0.2.1 |
+| Domain | C2 domain | malware-c2.example.com |
+| URL | Full URL path | https://evil.com/payload.exe |
+| JA3/JA3S | TLS fingerprint | Client/server TLS handshake hash |
+| JARM | TLS server fingerprint | Active TLS server scanning fingerprint |
+| User-Agent | HTTP User-Agent | Custom UA strings in beacons |
+
+### Host-Based IOCs
+| Type | Description | Example |
+|------|-------------|---------|
+| Mutex | Named mutex | Global\{GUID} |
+| Registry Key | Registry modification | HKLM\SOFTWARE\...\Run |
+| Scheduled Task | Persistence task | schtasks /create ... |
+| Service Name | Malicious service | Malicious service installation |
+| Named Pipe | IPC mechanism | \\.\pipe\name |
+| PDB Path | Debug path | C:\Users\dev\project.pdb |
+
+## STIX 2.1 Indicator Patterns
+
+### Pattern Syntax
+```
+[file:hashes.'SHA-256' = 'abc123...']
+[ipv4-addr:value = '1.2.3.4']
+[domain-name:value = 'evil.com']
+[url:value = 'https://evil.com/payload']
+[file:name = 'malware.exe']
+[email-addr:value = 'attacker@evil.com']
+[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_port = 443]
+```
+
+## YARA Rule Structure
+
+```
+rule RuleName {
+    meta:
+        author = "Analyst"
+        description = "Detection rule"
+        reference = "URL"
+        date = "YYYY-MM-DD"
+        hash = "SHA256"
+        tlp = "white"
+    strings:
+        $text = "string" ascii wide nocase
+        $hex = { 4D 5A 90 00 }
+        $regex = /pattern[0-9]+/
+    condition:
+        uint16(0) == 0x5A4D and filesize < 5MB and any of them
+}
+```
+
+## PE File Format
+- **DOS Header**: MZ signature (0x5A4D)
+- **PE Header**: PE signature, machine type, timestamp
+- **Optional Header**: Entry point, image base, subsystem
+- **Section Table**: .text, .data, .rdata, .rsrc, .reloc
+- **Import Table**: DLLs and functions used
+- **Export Table**: Functions exported (DLLs)
+- **Resource Table**: Embedded resources (icons, strings, configs)
+
+## References
+- [STIX 2.1 Patterning](https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_e8slinrhxcc9)
+- [YARA Documentation](https://yara.readthedocs.io/en/stable/)
+- [PE Format Specification](https://learn.microsoft.com/en-us/windows/win32/debug/pe-format)
+- [MalwareBazaar Database](https://bazaar.abuse.ch/)
@@ -0,0 +1,70 @@
+# Malware IOC Extraction Workflows
+
+## Workflow 1: Static Analysis Pipeline
+
+```
+[Malware Sample] --> [Hash Generation] --> [PE Parsing] --> [String Extraction] --> [IOC Filtering]
+                                                                                        |
+                                                                                        v
+                                                                               [YARA Scanning]
+                                                                                        |
+                                                                                        v
+                                                                               [STIX Bundle]
+```
+
+### Steps:
+1. **Sample Acquisition**: Obtain sample from MalwareBazaar, VirusTotal, or incident response
+2. **Hash Calculation**: Generate MD5, SHA-1, SHA-256, imphash, ssdeep hashes
+3. **PE Analysis**: Parse headers, sections, imports, exports, resources, timestamps
+4. **String Extraction**: Extract ASCII/Unicode strings, apply IOC regex patterns
+5. **IOC Filtering**: Remove false positives (private IPs, common DLLs, benign domains)
+6. **YARA Classification**: Scan with community and custom YARA rules
+7. **Output**: Generate STIX 2.1 bundle with extracted indicators
+
+## Workflow 2: Dynamic Analysis Pipeline
+
+```
+[Malware Sample] --> [Sandbox Submission] --> [Detonation] --> [Artifact Collection]
+                                                                       |
+                                                          +------------+------------+
+                                                          |            |            |
+                                                          v            v            v
+                                                    [Network]    [File Sys]   [Registry]
+                                                    [PCAPs]      [Changes]    [Changes]
+                                                          |            |            |
+                                                          +------------+------------+
+                                                                       |
+                                                                       v
+                                                              [IOC Consolidation]
+```
+
+### Steps:
+1. **Sandbox Setup**: Configure isolated VM with network monitoring
+2. **Sample Submission**: Submit to CAPE/Cuckoo sandbox with execution parameters
+3. **Execution Monitoring**: Monitor for 3-5 minutes of runtime behavior
+4. **Network Capture**: Extract DNS queries, HTTP/HTTPS traffic, raw connections
+5. **File System Analysis**: Identify created, modified, and deleted files
+6. **Registry Analysis**: Capture registry key changes for persistence indicators
+7. **Process Analysis**: Document spawned processes, injections, privilege escalation
+8. **Consolidation**: Merge static and dynamic IOCs into unified report
+
+## Workflow 3: Automated IOC Pipeline
+
+```
+[Feed/Alert] --> [Auto-Download] --> [Static Analysis] --> [Sandbox] --> [Enrichment] --> [Share]
+                                                                              |
+                                                                              v
+                                                                     [VirusTotal Check]
+                                                                              |
+                                                                              v
+                                                                     [MISP/OpenCTI Upload]
+```
+
+### Steps:
+1. **Trigger**: New sample from malware feed, email gateway, or EDR alert
+2. **Download**: Retrieve sample securely to analysis infrastructure
+3. **Static Scan**: Automated PE parsing, string extraction, YARA scanning
+4. **Dynamic Analysis**: Submit to sandbox for behavioral analysis
+5. **Enrichment**: Check hashes against VirusTotal, cross-reference with TI platforms
+6. **Deduplication**: Remove already-known IOCs from output
+7. **Sharing**: Upload new IOCs to MISP/OpenCTI for team consumption