STIXv2 Support in SPARK

by Florian RothNov 12, 2018

SPARK Version 1.17.0 adds extensive STIXv2 support.

This allows you to easily extend SPARK’s signature bases with IOCs from any sandbox, analysis or threat intel platforms that support STIXv2 export by placing the exported [cci]*.json[/cci] files in the [cci]./custom-signatures[/cci] folder.

For now, the supported observable object types are:

file:name with = != LIKE and MATCHES
file:parent_directory_ref.path with = != LIKE and MATCHES
file:hashes.sha-256 / file:hashes.sha256 with = and !=
file:hashes.sha-1 / file:hashes.sha1 with = and !=
file:hashes.md-5 / file:hashes.md5 with = and !=
file:size with < <= > >= = !=
file:created with < <= > >= = !=
file:modified with < <= > >= = !=
file:accessed with < <= > >= = !=
win-registry-key:key with = != LIKE and MATCHES
win-registry-key:values.name with = != LIKE and MATCHES
win-registry-key:values.data with = != LIKE and MATCHES
win-registry-key:values.modified_time with < <= > >= = !=

These types are applied in different modules:

FileScan: file:*
Registry: win-registry-key:* and file:name (applied to data field)

You can find a list of products that support the STIX data exchange format here.

About the author:

Florian Roth

Florian Roth serves as the Head of Research and Development at Nextron Systems. With a background in IT security since 2000, he has delved deep into nation-state cyber attacks since 2012. Florian has developed the THOR Scanner and actively engages with the community via his Twitter handle @cyb3rops. He has contributed to open-source projects, including 'Sigma', a generic SIEM rule format, and 'LOKI', an open-source scanner. Additionally, he has shared valuable resources like a mapping of APT groups and operations and an Antivirus Event Analysis Cheat Sheet.