Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

data/ioc/spyware/citizen_lab/201803_BadTraffic/iocs.csv

@@ -0,0 +1,64 @@
+uuid,event_id,category,type,value,comment,to_ids,date
+5a9ebab6-193c-4062-8a28-630f8064ab0b,134,Network activity,domain,"updserv-east-cdn3.com","",1,20180306
+5a9ebab6-1cf8-44f7-9995-630f8064ab0b,134,Network activity,domain,"downloading.syriantelecom.co","",1,20180306
+5a9ebab6-1dc4-4139-92f9-630f8064ab0b,134,Network activity,domain,"computing.downloaders.today","",1,20180306
+5a9ebab6-389c-4de0-be65-630f8064ab0b,134,Network activity,domain,"ms-cdn-88.com","",1,20180306
+5a9ebab6-41d4-4b46-8c16-630f8064ab0b,134,Network activity,domain,"solitude.file-download.today","",1,20180306
+5a9ebab6-479c-4201-b823-630f8064ab0b,134,Network activity,domain,"window.processingdownloads.today","",1,20180306
+5a9ebab6-49a8-4bb1-81d7-630f8064ab0b,134,Network activity,domain,"redirection.bid","",1,20180306
+5a9ebab6-5b58-489e-90e2-630f8064ab0b,134,Network activity,domain,"download.downloading.shop","",1,20180306
+5a9ebab6-adc4-48ac-8d5d-630f8064ab0b,134,Network activity,domain,"epiphany.download-document.world","",1,20180306
+5a9ebab6-b230-4313-9195-630f8064ab0b,134,Network activity,domain,"cdn-upd-ms6.com","",1,20180306
+5a9ebab6-b9b8-412b-9929-630f8064ab0b,134,Network activity,domain,"epoch.wind-files.today","",1,20180306
+5a9ebab6-c2ac-45da-902c-630f8064ab0b,134,Network activity,domain,"system.documentations.live","",1,20180306
+5a9ebab6-caf4-41b4-8e69-630f8064ab0b,134,Network activity,domain,"internet.document-management.today","",1,20180306
+5a9ebab6-dd2c-446e-94a1-630f8064ab0b,134,Network activity,domain,"storage.computingdownloads.life","",1,20180306
+5a9ebab6-def0-4a56-9745-630f8064ab0b,134,Network activity,domain,"downloading.internetdownloading.co","",1,20180306
+5a9ebab6-e0ac-49ac-b6fa-630f8064ab0b,134,Network activity,domain,"download.syriantelecommunications.co","",1,20180306
+5a9ebab6-f734-4a44-a766-630f8064ab0b,134,Network activity,domain,"download.downloadering.co","",1,20180306
+5a9ebaec-0668-4191-b597-65188064ab0b,134,Artifacts dropped,md5,"6ce947913231bd968c86a2737bae7bba","",0,20180306
+5a9ebaec-0ba0-4c9f-91f1-65188064ab0b,134,Artifacts dropped,md5,"40383bee9846ecbd78581402e3379051","",0,20180306
+5a9ebaec-0d08-4751-b2a6-65188064ab0b,134,Artifacts dropped,md5,"43b39fd4ddc386092372da19f6278c25","",0,20180306
+5a9ebaec-0d40-42e6-8472-65188064ab0b,134,Artifacts dropped,md5,"32bc51088953377d601c6b27ca7484a9","",0,20180306
+5a9ebaec-1034-4a7d-8335-65188064ab0b,134,Artifacts dropped,md5,"08b8b4787f3ce90c6c1483cc127b1cdc","",0,20180306
+5a9ebaec-1c94-40ca-b487-65188064ab0b,134,Artifacts dropped,md5,"a070fd2cce434a6f0b0d0fa6d3278d22","",0,20180306
+5a9ebaec-1de8-45fc-8681-65188064ab0b,134,Artifacts dropped,md5,"8c8eb5cfc5642a773c5f2b5f59148aa3","",0,20180306
+5a9ebaec-1fdc-4320-a7d2-65188064ab0b,134,Artifacts dropped,md5,"56bc314bc0d4a0a230a4de2bf978b5ae","",0,20180306
+5a9ebaec-29e0-421c-9135-65188064ab0b,134,Artifacts dropped,md5,"4fe4094302c26e7ea2c58f5ca9f7f993","",0,20180306
+5a9ebaec-2ee4-46ad-9e1f-65188064ab0b,134,Artifacts dropped,md5,"9b0de56f7f862db73e223f41099fc74c","",0,20180306
+5a9ebaec-359c-4b66-afb6-65188064ab0b,134,Artifacts dropped,md5,"7ad8ad340c084f8185e2bb18cbfde891","",0,20180306
+5a9ebaec-43dc-4fd9-b2b3-65188064ab0b,134,Artifacts dropped,md5,"08d971f5f4707ae6ea56ed2f243c38b7","",0,20180306
+5a9ebaec-4b84-43af-a448-65188064ab0b,134,Artifacts dropped,md5,"205a5502ff0da4a471c4dad0e06c6c57","",0,20180306
+5a9ebaec-4cf0-4b40-9d1f-65188064ab0b,134,Artifacts dropped,md5,"461446151be0033a668782c2d7ba58cb","",0,20180306
+5a9ebaec-4d40-4614-a23e-65188064ab0b,134,Artifacts dropped,md5,"3729531c71163cddcded7e70c02a3004","",0,20180306
+5a9ebaec-5038-4cff-8b98-65188064ab0b,134,Artifacts dropped,md5,"449ba12127133ecd0440a558b083468c","",0,20180306
+5a9ebaec-50e4-4d9e-85c8-65188064ab0b,134,Artifacts dropped,md5,"3632fb080545d3518d57320466f96cb3","",0,20180306
+5a9ebaec-55f8-4be5-8e12-65188064ab0b,134,Artifacts dropped,md5,"90373539c60529153d0d6b0cc857e845","",0,20180306
+5a9ebaec-56e8-4a86-b564-65188064ab0b,134,Artifacts dropped,md5,"df0045bd4168893922480f7ccb29860a","",0,20180306
+5a9ebaec-5d38-493a-a73c-65188064ab0b,134,Artifacts dropped,md5,"7fd98d6bb1e9d6bcf2e1984e812c1e46","",0,20180306
+5a9ebaec-87ac-4368-b185-65188064ab0b,134,Artifacts dropped,md5,"e436e849d9496ef3f651c1904786c78f","",0,20180306
+5a9ebaec-887c-4c49-baa1-65188064ab0b,134,Artifacts dropped,md5,"8fea3de31a58415c3fec2e6dd4095575","",0,20180306
+5a9ebaec-9cb8-477d-a13f-65188064ab0b,134,Artifacts dropped,md5,"a5ae6e0d74052d4f889f2538fdd7cb9b","",0,20180306
+5a9ebaec-9dd4-42eb-aef1-65188064ab0b,134,Artifacts dropped,md5,"5c3f0dcf4aaa699b50154aa245923c86","",0,20180306
+5a9ebaec-a0c8-4282-8b2b-65188064ab0b,134,Artifacts dropped,md5,"6a442a610c047a7a306a12f423978bfb","",0,20180306
+5a9ebaec-af4c-40fc-8e98-65188064ab0b,134,Artifacts dropped,md5,"d7ec065cc3f563928504f80692578d2f","",0,20180306
+5a9ebaec-ba64-42f1-9505-65188064ab0b,134,Artifacts dropped,md5,"58239ea5747d3375278ce7c04db22c1b","",0,20180306
+5a9ebaec-bb18-4c5d-879d-65188064ab0b,134,Artifacts dropped,md5,"20755b98d7c094747b75b157413e3422","",0,20180306
+5a9ebaec-bb2c-495d-a460-65188064ab0b,134,Artifacts dropped,md5,"be6f2a03dfddbaf1166854730961d13c","",0,20180306
+5a9ebaec-bbec-446d-a785-65188064ab0b,134,Artifacts dropped,md5,"8bb2ba6f1cfa3bd99146688cd1e76bb0","",0,20180306
+5a9ebaec-c054-4a65-8ff3-65188064ab0b,134,Artifacts dropped,md5,"f344da38958dbc730ddebc10660cd451","",0,20180306
+5a9ebaec-c1f8-45f5-abd0-65188064ab0b,134,Artifacts dropped,md5,"001316808aa7108b467e8ecc06139c2e","",0,20180306
+5a9ebaec-d490-4f27-be9b-65188064ab0b,134,Artifacts dropped,md5,"e80d8a0c35133f7485d8e87ade903919","",0,20180306
+5a9ebaec-e354-4d5d-bafb-65188064ab0b,134,Artifacts dropped,md5,"fa90508007b94a4dbfeb8b48d5443ec8","",0,20180306
+5a9ebaec-e6dc-44c8-a030-65188064ab0b,134,Artifacts dropped,md5,"be8a344487bcfea66de8e0f0f14d869e","",0,20180306
+5a9ebaec-f230-436a-b587-65188064ab0b,134,Artifacts dropped,md5,"f36e67109ae368c9db109d0a41b5817c","",0,20180306
+5a9ebaec-f83c-46dd-9ceb-65188064ab0b,134,Artifacts dropped,md5,"89180820b47bb11ccf0c8505371e98d1","",0,20180306
+5a9ebaec-ff78-4858-a1e3-65188064ab0b,134,Artifacts dropped,md5,"6491df10c766be9c487fb9495d04df6e","",0,20180306
+5aa03a55-0118-4f2a-9ab5-67a48064ab0b,134,Network activity,domain,"internet.downloadingdocuments.com","",1,20180307
+5aa03a55-6920-413a-a285-67a48064ab0b,134,Network activity,domain,"epoch.englishdownloaders.today","",1,20180307
+5aa03a55-7f20-4130-9def-67a48064ab0b,134,Network activity,domain,"upd-ms3-app-state.com","",1,20180307
+5aa03a55-d3dc-4b53-a6e4-67a48064ab0b,134,Network activity,domain,"document.downloadingsystem.com","",1,20180307
+5aa03a55-e36c-4dc5-934d-67a48064ab0b,134,Network activity,domain,"system.filedownloaders.com","",1,20180307
+5aa03c02-0bd0-42ee-ade7-67a28064ab0b,134,Network activity,domain,"solitude.filedownloads.online","",1,20180307
+5aa03c02-8520-4c2c-8ae7-67a28064ab0b,134,Network activity,domain,"bombinate.winload.info","",1,20180307
+5aa03c02-e238-4288-9217-67a28064ab0b,134,Network activity,domain,"epoch.uploaders.online","",1,20180307

data/ioc/spyware/citizen_lab/201803_BadTraffic/openioc.ioc

@@ -0,0 +1,113 @@
+<?xml version="1.0" encoding="utf-8"?>
+<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="5a84a4bc-1498-4808-9cf1-6ce78e96ca05" last-modified="2018-02-14T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
+  <short_description>Event #134</short_description>
+  <description>Bad Traffic</description>
+  <keywords />
+  <authored_by>citizenlab</authored_by>
+  <authored_date>2018-02-14T00:00:00</authored_date>
+  <links />
+  <definition>
+    <Indicator operator="OR" id="5a84a4bc-1498-4808-9cf1-6ce78e96ca05">
+      <IndicatorItem id="document.downloadingsystem.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="epoch.englishdownloaders.today" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="internet.downloadingdocuments.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="system.filedownloaders.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="upd-ms3-app-state.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="bombinate.winload.info" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="epoch.uploaders.online" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="solitude.filedownloads.online" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="download.downloading.shop" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="downloading.syriantelecom.co" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="download.syriantelecommunications.co" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="redirection.bid" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="downloading.internetdownloading.co" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="download.downloadering.co" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="updserv-east-cdn3.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="computing.downloaders.today" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="storage.computingdownloads.life" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="window.processingdownloads.today" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="ms-cdn-88.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="solitude.file-download.today" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="system.documentations.live" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="epiphany.download-document.world" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="epoch.wind-files.today" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="internet.document-management.today" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="cdn-upd-ms6.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+    </Indicator>
+  </definition>
+</ioc>