Initial commit - 611 cybersecurity skills across all subdomains

skills/performing-malware-ioc-extraction/references/standards.md

@@ -0,0 +1,81 @@
+# Standards and Frameworks Reference
+
+## IOC Types and Classification
+
+### File-Based IOCs
+| Type | Description | Example |
+|------|-------------|---------|
+| MD5 | 128-bit hash | d41d8cd98f00b204e9800998ecf8427e |
+| SHA-1 | 160-bit hash | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
+| SHA-256 | 256-bit hash | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
+| Imphash | Import hash | PE import table hash for family grouping |
+| SSDeep | Fuzzy hash | Context-triggered piecewise hash for similarity |
+| TLSH | Trend Micro LSH | Locality-sensitive hash for near-duplicate detection |
+
+### Network IOCs
+| Type | Description | Example |
+|------|-------------|---------|
+| IPv4 Address | C2 server IP | 192.0.2.1 |
+| Domain | C2 domain | malware-c2.example.com |
+| URL | Full URL path | https://evil.com/payload.exe |
+| JA3/JA3S | TLS fingerprint | Client/server TLS handshake hash |
+| JARM | TLS server fingerprint | Active TLS server scanning fingerprint |
+| User-Agent | HTTP User-Agent | Custom UA strings in beacons |
+
+### Host-Based IOCs
+| Type | Description | Example |
+|------|-------------|---------|
+| Mutex | Named mutex | Global\{GUID} |
+| Registry Key | Registry modification | HKLM\SOFTWARE\...\Run |
+| Scheduled Task | Persistence task | schtasks /create ... |
+| Service Name | Malicious service | Malicious service installation |
+| Named Pipe | IPC mechanism | \\.\pipe\name |
+| PDB Path | Debug path | C:\Users\dev\project.pdb |
+
+## STIX 2.1 Indicator Patterns
+
+### Pattern Syntax
+```
+[file:hashes.'SHA-256' = 'abc123...']
+[ipv4-addr:value = '1.2.3.4']
+[domain-name:value = 'evil.com']
+[url:value = 'https://evil.com/payload']
+[file:name = 'malware.exe']
+[email-addr:value = 'attacker@evil.com']
+[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_port = 443]
+```
+
+## YARA Rule Structure
+
+```
+rule RuleName {
+    meta:
+        author = "Analyst"
+        description = "Detection rule"
+        reference = "URL"
+        date = "YYYY-MM-DD"
+        hash = "SHA256"
+        tlp = "white"
+    strings:
+        $text = "string" ascii wide nocase
+        $hex = { 4D 5A 90 00 }
+        $regex = /pattern[0-9]+/
+    condition:
+        uint16(0) == 0x5A4D and filesize < 5MB and any of them
+}
+```
+
+## PE File Format
+- **DOS Header**: MZ signature (0x5A4D)
+- **PE Header**: PE signature, machine type, timestamp
+- **Optional Header**: Entry point, image base, subsystem
+- **Section Table**: .text, .data, .rdata, .rsrc, .reloc
+- **Import Table**: DLLs and functions used
+- **Export Table**: Functions exported (DLLs)
+- **Resource Table**: Embedded resources (icons, strings, configs)
+
+## References
+- [STIX 2.1 Patterning](https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_e8slinrhxcc9)
+- [YARA Documentation](https://yara.readthedocs.io/en/stable/)
+- [PE Format Specification](https://learn.microsoft.com/en-us/windows/win32/debug/pe-format)
+- [MalwareBazaar Database](https://bazaar.abuse.ch/)