threat-intelligence

威胁情报技能

收集、分析和传播网络威胁情报，包括 IOC 提取、威胁行为者画像和 MITRE ATT&CK 映射。

功能

• IOC 提取：从文本、日志和报告中提取指标
• IOC 管理：对指标进行去重、验证和丰富
• 威胁画像：记录威胁行为者和活动
• ATT&CK 映射：将威胁映射到 MITRE ATT&CK 框架
• 情报报告：生成威胁简报和评估
• 信息源处理：解析和规范化威胁信息源

快速开始

from cti_utils import IOCExtractor, ThreatActor, IntelReport

# Extract IOCs from text
extractor = IOCExtractor()
iocs = extractor.extract_from_text('''
Malware connects to 192.168.1.100 and evil.com.
Hash: d41d8cd98f00b204e9800998ecf8427e
''')
print(iocs)

# Document threat actor
actor = ThreatActor('APT29', aliases=['Cozy Bear', 'The Dukes'])
actor.add_ttp('T1566', 'Phishing')
actor.set_motivation('espionage')

# Generate intel report
report = IntelReport('Emerging Ransomware Campaign')
report.add_ioc('ip', '10.0.0.1', 'C2 server')
print(report.generate())

用法

IOC 提取

从各种文本来源中提取失陷指标。

示例：

from cti_utils import IOCExtractor

extractor = IOCExtractor()

# Extract from text
text = '''
The malware was downloaded from hxxp://malware[.]evil[.]com/payload.exe
It connects to C2 server at 192.168.100.50 on port 443.
The file hash is: a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4
Email originated from [email protected]
'''

iocs = extractor.extract_from_text(text)

print(f"IPs: {iocs['ip']}")
print(f"Domains: {iocs['domain']}")
print(f"URLs: {iocs['url']}")
print(f"Hashes: {iocs['hash']}")
print(f"Emails: {iocs['email']}")

# Defang/refang IOCs
defanged = extractor.defang('http://evil.com')  # hxxp://evil[.]com
refanged = extractor.refang('hxxp://evil[.]com')  # http://evil.com

# Validate IOCs
valid = extractor.validate_ioc('ip', '192.168.1.1')  # True
invalid = extractor.validate_ioc('ip', '999.999.999.999')  # False

IOC 管理

管理包含上下文信息的指标集合。

示例：

from cti_utils import IOCCollection

collection = IOCCollection('Campaign-2024-001')

# Add IOCs with context
collection.add_ioc(
    ioc_type='ip',
    value='192.168.1.100',
    context='C2 server',
    confidence='high',
    source='Sandbox analysis'
)

collection.add_ioc(
    ioc_type='domain',
    value='malware.evil.com',
    context='Payload delivery',
    confidence='medium',
    source='Network logs'
)

collection.add_ioc(
    ioc_type='hash',
    value='a1b2c3d4e5f6...',
    context='Ransomware executable',
    confidence='high',
    source='EDR'
)

# Deduplicate
collection.deduplicate()

# Export formats
print(collection.to_csv())
print(collection.to_json())
print(collection.to_stix())  # STIX 2.1 format

威胁行为者画像

记录威胁行为者及其特征。

示例：

from cti_utils import ThreatActor

actor = ThreatActor(
    name='APT29',
    aliases=['Cozy Bear', 'The Dukes', 'YTTRIUM']
)

# Set attributes
actor.set_motivation('espionage')
actor.set_sophistication('advanced')
actor.set_origin('Russia')

# Add TTPs (MITRE ATT&CK)
actor.add_ttp('T1566.001', 'Spearphishing Attachment')
actor.add_ttp('T1059.001', 'PowerShell')
actor.add_ttp('T1071.001', 'Web Protocols')
actor.add_ttp('T1486', 'Data Encrypted for Impact')

# Add targeting
actor.add_target_sector('Government')
actor.add_target_sector('Healthcare')
actor.add_target_region('North America')
actor.add_target_region('Europe')

# Add tools
actor.add_tool('Cobalt Strike')
actor.add_tool('Mimikatz')

# Add infrastructure
actor.add_infrastructure('ip', '192.168.1.100', 'C2 server')
actor.add_infrastructure('domain', 'actor-c2.com', 'Primary C2')

# Generate profile
print(actor.generate_profile())

活动追踪

持续追踪威胁活动。

示例：

from cti_utils import Campaign

campaign = Campaign(
    name='Operation DarkSide',
    first_seen='2024-01-01',
    threat_actor='APT29'
)

# Add campaign details
campaign.set_description('''
Targeted campaign against financial institutions using
spearphishing emails with malicious Excel attachments.
''')

campaign.set_objective('Financial theft and espionage')

# Add IOCs
campaign.add_ioc('domain', 'campaign-c2.evil.com')
campaign.add_ioc('hash', 'abc123...', 'Excel dropper')

# Add TTPs
campaign.add_ttp('T1566.001', 'Initial access via phishing')
campaign.add_ttp('T1059.005', 'VBA macro execution')

# Add targets
campaign.add_target('Financial Services', 'North America')

# Timeline events
campaign.add_event('2024-01-01', 'First phishing emails observed')
campaign.add_event('2024-01-05', 'New C2 infrastructure identified')
campaign.add_event('2024-01-10', 'Malware variant updated')

# Generate report
print(campaign.generate_report())

MITRE ATT&CK 映射

将威胁映射到 ATT&CK 框架。

示例：

from cti_utils import ATTACKMapper

mapper = ATTACKMapper()

# Map techniques
mapper.add_technique('T1566.001', 'Spearphishing used for initial access')
mapper.add_technique('T1059.001', 'PowerShell scripts executed')
mapper.add_technique('T1055', 'Process injection observed')
mapper.add_technique('T1486', 'Files encrypted with ransomware')

# Generate matrix view
print(mapper.generate_matrix())

# Get technique details
print(mapper.get_technique_info('T1566.001'))

# Export for ATT&CK Navigator
mapper.export_navigator('attack_layer.json')

情报报告

生成威胁情报报告。

示例：

from cti_utils import IntelReport

report = IntelReport(
    title='Emerging Ransomware Campaign Targeting Healthcare',
    classification='TLP:AMBER'
)

# Executive summary
report.set_summary('''
A new ransomware campaign has been identified targeting healthcare
organizations in North America. The campaign uses phishing emails
with malicious attachments to gain initial access.
''')

# Key findings
report.add_finding('New ransomware variant identified: "MedLocker"')
report.add_finding('Campaign active since January 2024')
report.add_finding('At least 5 healthcare organizations targeted')

# Add IOCs
report.add_ioc('hash', 'abc123...', 'Ransomware executable')
report.add_ioc('domain', 'medlocker-payment.onion', 'Payment portal')
report.add_ioc('ip', '192.168.1.100', 'C2 server')

# Add TTPs
report.add_ttp('T1566.001', 'Phishing with malicious attachments')
report.add_ttp('T1486', 'Data encryption')

# Recommendations
report.add_recommendation('Block IOCs at perimeter')
report.add_recommendation('Update endpoint detection signatures')
report.add_recommendation('Conduct phishing awareness training')

# Generate outputs
print(report.generate())
print(report.generate_executive_brief())

配置

环境变量

变量	描述	必填	默认值
CTI_FEED_API_KEY	威胁信息源的 API 密钥	否	None
CTI_OUTPUT_DIR	报告的输出目录	否	./output

支持的 IOC 类型

• ip - IPv4 和 IPv6 地址
• domain - 域名
• url - 完整 URL
• hash - MD5、SHA1、SHA256 哈希值
• email - 电子邮件地址
• cve - CVE 标识符

限制

• 无实时信息源：获取信息源内容需要手动配置
• 离线 ATT&CK：使用内置的技术数据
• 无丰富化 API：不包含外部丰富化功能

故障排除

无效的 IOC 格式

IOC 验证使用标准正则表达式模式：

# Valid
extractor.validate_ioc('ip', '192.168.1.1')  # True

# Invalid
extractor.validate_ioc('ip', '192.168.1.256')  # False

去标记化问题

使用一致的去标记化格式：

# Standard defanging
extractor.defang('http://evil.com')
# Returns: hxxp://evil[.]com

相关技能

• incident-response：在事件期间应用 CTI
• soc-operations：基于 CTI 的检测
• research：通用研究能力

参考资料

• 详细 API 参考
• MITRE ATT&CK
• STIX 2.1 规范