SCF Advanced Search



Members
  • Total Members: 14197
  • Latest: Levine
Stats
  • Total Posts: 43457
  • Total Topics: 16546
  • Online today: 2925
  • Online ever: 51419
  • (01. January 2010., 10:27:49)
Users Online
Users: 3
Guests: 2785
Total: 2788









Author Topic: Operation Troy: OpenIOC Release  (Read 3376 times)

0 Members and 1 Guest are viewing this topic.

Pez

  • SCF VIP Member
  • *****
  • Posts: 776
  • KARMA: 117
  • Gender: Male
  • Pez
Operation Troy: OpenIOC Release
« on: 15. July 2013., 09:48:43 »
Operation Troy: OpenIOC Release

In conjunction with our investigation into Operation Troy, we will be releasing IOC data in the open and highly flexible OpenIOC Framework format.

The McAfee Operation Troy IOC can be downloaded here.


In addition to various open/free tools, OpenIOC data can be consumed by:

•            McAfee Network Security Platform

•            McAfee HIPS

•            McAfee GTI Proxy

•            McAfee Web Gateway


For more information around the OpenIOC Framework, please visit:
http://www.openioc.org/


YouTube clip related to this article:
http://youtu.be/2b2ZA-TerS0


Original article: Friday, July 12, 2013 at 1:54pm by Jim Walter
Their is two easy way to configure a system!
Every thing open and every thing closed.
Every thing else is more or less complex.

Start Turfing ! http://scforum.info/index.php/topic,8405.msg21475.html#msg21475

Samker's Computer Forum - SCforum.info

Operation Troy: OpenIOC Release
« on: 15. July 2013., 09:48:43 »

Pez

  • SCF VIP Member
  • *****
  • Posts: 776
  • KARMA: 117
  • Gender: Male
  • Pez
Re: Operation Troy: OpenIOC Release
« Reply #1 on: 15. July 2013., 09:58:17 »
OpenIOC


Overview
 
In the current threat environment, rapid communication of pertinent threat information is the key to quickly detecting, responding and containing targeted attacks. OpenIOC is designed to fill a void that currently exists for organizations that want to share threat information both internally and externally in a machine-digestible format. OpenIOC is an extensible XML schema that enables you to describe the technical characteristics that identify a known threat, an attacker’s methodology, or other evidence of compromise.

OpenIOC was originally designed to enable MANDIANT’s products to codify intelligence in order to rapidly search for potential security breaches. Now, in response to requests from across the user community, MANDIANT has standardized and open sourced the OpenIOC schema and is releasing tools and utilities to allow communication of threat information at machine speed.


Why OpenIOC?

Sophisticated Indicators

Traditional methods of identifying security breaches no longer work. Simple signatures are too easy for an intruder to circumvent. Organizations need to be able to communicate how to find attackers on their networks and hosts using a machine digestible format that removes human delay from intelligence sharing.


Advanced Threat Detection

By using the OpenIOC framework, you will have the most advanced threat detection capability available. By joining the OpenIOC community, your organization can benefit from the network effect of threat intelligence from organizations within your industry, as well as global Fortune 1000 companies.


Extendable & Customizable

By allowing for extensions and customization, OpenIOC offers your organization the option of using MANDIANT’s field tested Indicators of Compromise, as well as creating your own custom sets of indicators, and any combination thereof that you need to complete your mission.


The Framework Schema

It's Really Simple

The base OpenIOC schema is a simple framework that is written in XML to document and categorize forensic artifacts of an intrusion that can be identified on a host or network. You can easily extend the base schema to include additional indicators from a variety of sources.


Mandiant Indicators

OpenIOC ships with a base set of indicators provided by MANDIANT. These indicators describe over 500 facets of environments that can be used to track down advanced attackers, which have been vetted through years of MANDIANT’s experience responding to some of the world’s largest and most sophisticated computer attacks.


Extendable

Every environment is different, and you may find custom needs that your environment, market sector, or industry has that are not included in the base set of IOC terms. You are free to create and add your own sets of indicators and extend OpenIOC as you see fit.


Get The Tools

IOC Editor

Following MANDIANT’s long tradition of providing free tools, MANDIANT has created the IOC Editor, which allows users to create, edit and compare Indicators of Compromise in XML format.


IOC Finder

IOC Finder, another free tool, allows users to search for Indicators of Compromise on a single host, allowing for everything from testing new IOCs to finding evil on hosts during the course of an investigation

Frequently Asked Questions:
http://www.openioc.org/
Their is two easy way to configure a system!
Every thing open and every thing closed.
Every thing else is more or less complex.

Start Turfing ! http://scforum.info/index.php/topic,8405.msg21475.html#msg21475

Samker

  • SCF Administrator
  • *****
  • Posts: 7529
  • KARMA: 322
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum
Re: Operation Troy: OpenIOC Release
« Reply #2 on: 20. July 2013., 09:12:20 »
I need more time to find out all the possibilities with this tool...

Samker's Computer Forum - SCforum.info

Re: Operation Troy: OpenIOC Release
« Reply #2 on: 20. July 2013., 09:12:20 »

 

With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Verification:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters):www.codekids.ba:

Enter your email address to receive daily email with 'SCforum.info - Samker's Computer Forum' newest content:

Kursevi programiranja za ucenike u Sarajevu

Terms of Use | Privacy Policy | Advertising
TinyPortal 2.3.1 © 2005-2023