# STIX/TAXII & MISP Operations Reference
### STIX/TAXII Patterns

**STIX 2.1 object hierarchy:**
```
SDOs (Domain Objects):
  Indicator        — pattern matching IOC (STIX patterns or YARA/Snort)
  Malware          — malware family description, capabilities, aliases
  Threat Actor     — adversary profile, sophistication, goals
  Campaign         — coordinated adversary activity set with objective
  Attack Pattern   — CAPEC or ATT&CK technique description
  Course of Action — defensive recommendation
  Tool             — legitimate or dual-use tool
  Vulnerability    — CVE reference with description

SROs (Relationship Objects):
  Relationship     — typed directed edge: "uses", "targets", "indicates", "mitigates"
  Sighting         — observed SDO instance with count and time range

SCOs (Cyber Observables):
  ipv4-addr, domain-name, url, file, email-addr, network-traffic, process, etc.
```

**STIX 2.1 Indicator pattern syntax:**
```json
{
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--...",
  "created": "2024-01-15T10:00:00Z",
  "modified": "2024-01-15T10:00:00Z",
  "name": "APT28 C2 Domain",
  "pattern": "[domain-name:value = 'c2.evil.com']",
  "pattern_type": "stix",
  "valid_from": "2024-01-15T10:00:00Z",
  "valid_until": "2024-03-15T10:00:00Z",
  "labels": ["malicious-activity"],
  "indicator_types": ["malicious-activity"],
  "confidence": 85
}
```

**STIX bundle assembly:**
```python
import stix2

indicator = stix2.Indicator(
    name="C2 Domain",
    pattern="[domain-name:value = 'malicious.com']",
    pattern_type="stix",
    valid_from="2024-01-01T00:00:00Z"
)
actor = stix2.ThreatActor(name="APT28", aliases=["Fancy Bear", "Strontium"])
rel = stix2.Relationship(actor, "uses", indicator)
bundle = stix2.Bundle(objects=[indicator, actor, rel])
print(bundle.serialize(pretty=True))
```

**TAXII 2.1 operations:**
```bash
# List collections
curl -u user:pass -H "Accept: application/taxii+json;version=2.1" \
  https://taxii.server/api/v21/collections/

# Get objects from collection (paginate with next/more)
curl -u user:pass \
  "https://taxii.server/api/v21/collections/{id}/objects/?added_after=2024-01-01T00:00:00Z&limit=100"

# Push objects to collection
curl -X POST -u user:pass -H "Content-Type: application/stix+json;version=2.1" \
  https://taxii.server/api/v21/collections/{id}/objects/ -d @bundle.json
```

**Anti-pattern:** Using STIX without valid_until on indicators — indicators without expiry persist indefinitely. A domain IOC from a 2019 campaign blocking traffic in 2024 is a false positive generator. Always set valid_until at ingest time.

### Analytical Frameworks Applied

**Diamond Model:**
Four features with bidirectional relationships:
```
         Adversary
        /          \
   Capability — — — Infrastructure
        \          /
         Victim
```
- **Adversary:** Who is conducting the operation (actor profile, motivation, intent)
- **Capability:** What tools/TTPs they use (malware, exploits, social engineering)
- **Infrastructure:** How they operate (C2, staging, bulletproof hosting, domains)
- **Victim:** Who they target (sector, technology, geography, persona)

**Diamond Model meta-features:** Timestamp (campaign phase), Phase (Kill Chain step), Result (success/fail/unknown), Direction (attacker→victim vs. victim→attacker), Methodology (attack type), Resources (operator level)

**Pivoting with Diamond Model:** New infrastructure IOC → pivot to related victims (who else used this IP?) → pivot to capabilities (what malware called home here?) → pivot to adversary (who operates this infrastructure cluster?)

**Lockheed Martin Cyber Kill Chain (7 stages):**
```
1. Recon         — Passive/active intel gathering. Defender opportunity: monitor external exposure
2. Weaponization — Exploit + payload creation. Defender: no visibility; rely on threat intel feeds
3. Delivery      — Phishing, watering hole, USB. Defender: email gateway, web proxy, awareness
4. Exploitation  — Code execution on target. Defender: patch, exploit prevention (EMET/DEP/CFG)
5. Installation  — Persistence mechanism. Defender: endpoint telemetry, baseline monitoring
6. C2            — Outbound comms. Defender: DNS/proxy monitoring, JA3/JARM, beaconing detection
7. Actions on Objectives — Exfil, destruction, lateral move. Defender: DLP, honeypots, segmentation
```

**Kill Chain limitation:** Linear model; real attacks loop back, skip stages, and have parallel tracks. Use ATT&CK for technique-level analysis; Kill Chain for campaign phase communication to non-technical stakeholders.

**ACH in practice (attribution example):**
```
Hypotheses: H1=APT28, H2=APT29, H3=FIN7, H4=False flag
Evidence E1: X-Agent variant found     → H1+, H2I, H3I, H4?
Evidence E2: GRU-linked registrar      → H1+, H2I, H3I, H4+
Evidence E3: Financial targeting       → H1I, H2I, H3+, H4?
Evidence E4: No financial exfil        → H1~, H2~, H3I, H4~
Matrix cell values: + (consistent), I (inconsistent), ~ (not diagnostic)
Result: H1 has fewest inconsistencies — assess APT28 with MODERATE confidence
```

### Intelligence Production

**Product types and audiences:**

**Strategic intelligence** (CISO, board, executives):
- Business impact language, no jargon, no TLAs without definition
- Threat landscape briefing format: sector trends, top threat actors, risk recommendations
- Cadence: monthly/quarterly or event-driven
- Length: 1-2 pages maximum

**Operational intelligence** (security architects, IR team leads):
- TTP focus: how adversary operates, what defensive gaps they exploit
- Actionable: specific configuration changes, detection investments, hunting priorities
- Include ATT&CK heatmap showing gaps vs. actor profile

**Tactical intelligence** (SOC analysts, detection engineers):
- IOC lists with context (malware family, campaign, confidence, expiry)
- Detection rules (Sigma, Snort, YARA) ready to deploy
- Pivot queries for SIEM

**Technical intelligence** (reverse engineers, forensics):
- Malware analysis report: capabilities, C2 protocol, persistence, decryption keys
- C2 infrastructure map: IPs, domains, ASNs, hosting patterns, historical pivots
- Configuration extraction, DGA seed/algorithm analysis

**Finished product structure (standard):**
```
[CLASSIFICATION] [HANDLING CAVEAT]
Title: [Actor] [Activity Type] Targeting [Sector/Geography]
TLP: WHITE/GREEN/AMBER/RED
Date: YYYY-MM-DD  |  Confidence: HIGH/MODERATE/LOW

EXECUTIVE SUMMARY (3 sentences max)

KEY JUDGMENTS
  1. [Assessment] [Confidence level]
  2. ...

BACKGROUND (context on actor, prior campaign history)

TECHNICAL DETAILS (TTPs, IOCs, kill chain mapping)

DEFENSIVE RECOMMENDATIONS

APPENDIX: IOC TABLE
  Type | Value | Context | Confidence | Expiry
```

**TLP (Traffic Light Protocol) definitions:**
- **WHITE:** Unlimited distribution, public
- **GREEN:** Community sharing, no public posting
- **AMBER:** Organization + need-to-know basis
- **AMBER+STRICT:** Recipients only, no further distribution
- **RED:** Named recipients only, conversation-level

### MISP Operations

Platform setup and event management:
```bash
# Create MISP event via API
curl -X POST https://misp/events \
  -H "Authorization: YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{
    "Event": {
      "distribution": "1",
      "info": "APT28 Phishing Campaign 2024-Q1",
      "date": "2024-01-15",
      "threat_level_id": "2",
      "analysis": "1"
    }
  }'

# Add attribute (IOC) to event
curl -X POST https://misp/attributes/add/{event_id} \
  -H "Authorization: KEY" \
  -d '{"type":"domain","category":"Network activity","value":"evil.com","comment":"C2 domain","to_ids":true}'

# Search attributes across all events
curl -X POST https://misp/attributes/restSearch \
  -H "Authorization: KEY" \
  -d '{"returnFormat":"json","type":"domain","value":"evil.com","to_ids":1}'

# Export event as STIX 2.1
curl https://misp/events/restSearch/returnFormat:stix2/type:Event/eventid:123
```

**MISP taxonomies for TI tagging:** `tlp:amber`, `misp-galaxy:threat-actor="APT28"`, `misp-attack-pattern:T1566.001`, `confidence:80`

**MISP feeds configuration:** Pull threat intel feeds from trusted sources:
```python
# misp-feed schema for custom feed
[
  {"url": "https://your-feed/manifest.json", "name": "Custom TI", "provider": "Internal",
   "enabled": True, "rules": "", "distribution": 3, "sharing_group_id": None, "tag_id": None,
   "default_distribution": 3, "source_format": "misp", "fixed_event": False, "delta_merge": True}
]
```

**Anti-pattern:** Setting `to_ids=true` on all IOCs — `to_ids` means "use for automated detection/blocking." Low-confidence or contextual IOCs with `to_ids=true` generate alert noise. Reserve `to_ids=true` for high-confidence, high-specificity IOCs (specific hashes, targeted C2 domains) — not for generic IPs or broad domains.

### IOC-to-Detection Integration

Translating threat intelligence into detection rules:

**Hash IOC → SIEM/EDR rule:**
```yaml
# Sigma rule from hash IOC
title: Malware Hash - APT28 Sofacy Loader
status: stable
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Hashes|contains:
      - 'SHA256=a1b2c3d4e5f6...'
      - 'MD5=deadbeefdeadbeef'
  condition: selection
falsepositives: none
level: critical
tags:
  - attack.execution
  - attack.t1059
```

**Domain IOC → DNS detection:**
```yaml
title: C2 Domain - APT28 Campaign
logsource:
  category: dns
detection:
  selection:
    dns.question.name:
      - 'evil-c2.com'
      - '*.evil-c2.com'
  condition: selection
level: high
```

**Behavioral TTP → Sigma (no specific IOC needed):**
```yaml
title: Suspicious LSASS Memory Access (T1003.001)
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 10
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1410'
      - '0x1010'
  filter_legitimate:
    SourceImage|contains:
      - '\Windows\System32\'
      - '\Program Files\Windows Defender\'
  condition: selection and not filter_legitimate
level: high
tags: [attack.credential_access, attack.t1003.001]
```

**JARM-based C2 detection (TLS fingerprinting):**
```bash
# Generate JARM for known C2 server
python3 jarm.py malicious-c2.com
# Output: 2ad2ad0002ad2ad00042d42d000000ad9bf51cc3f5a1e29eecb81d0c7b06eb

