Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

data/ioc/spyware/mvt/2023-04-11_quadream/README.md

@@ -0,0 +1,3 @@
+# Quadream KingSpawn indicators
+
+Quadream indicators from [Citizen Lab](https://citizenlab.ca/2023/04/spyware-vendor-quadream-exploits-victims-customers/) and [Microsoft](https://www.microsoft.com/en-us/security/blog/2023/04/11/dev-0196-quadreams-kingspawn-malware-used-to-target-civil-society-in-europe-north-america-the-middle-east-and-southeast-asia/) reports.

data/ioc/spyware/mvt/2023-04-11_quadream/domains.txt

@@ -0,0 +1,164 @@
+addictmetui.com
+adeptary.com
+agronomsdoc.com
+allplaces.online
+aniarchit.com
+aqualizas.com
+bcarental.com
+beendos.com
+bestteamlife.com
+betterstime.com
+bgnews-bg.com
+bikersrental.com
+biznomex.com
+brushyourteeth.online
+careerhub4u.com
+careers4ad.com
+choccoline.com
+classiccolor.live
+cleanitgo.info
+climatestews.com
+codinerom.com
+codingstudies.com
+comeandpet.me
+countshops.com
+ctbgameson.com
+datacentertime.com
+deliverystorz.com
+designaroo.org
+designspacing.org
+digital-mar.com
+dressuse.com
+dsudro.com
+earthyouwantiis.com
+eccocredit.com
+ecologitics.com
+eedloversra.online
+e-gaming.online
+elektrozi.com
+elvacream.com
+enrollering.com
+foodyplates.com
+forestaaa.com
+fosterunch.com
+foundurycolletive.com
+fullaniimal.com
+fullmoongreyparty.org
+fullstorelife.com
+furiamoc.com
+gameboysess.com
+gameizes.com
+gamezess.com
+gamingcolonys.com
+gardenearthis.com
+garilc.com
+globepayinfo.com
+goodsforuw.com
+goshopeerz.com
+gosport24.com
+greenrunners.org
+healthcovid19.com
+hinterfy.com
+homeigardens.com
+homelosite.com
+hopsite.online
+hotalsextra.com
+hoteliqo.com
+hoteluxurysm.com
+incollegely.org
+inneture.com
+i-reality.online
+iwoodstor.xyz
+job4uhunt.com
+jungelfruitime.com
+jyfa.xyz
+kidsfunland.org
+kidzalnd.org
+kidzlande.com
+kikocruize.com
+koraliowe.com
+lateparties.com
+linestrip.online
+localtallk.store
+londonistory.com
+luxario.org
+meehealth.org
+mikontravels.com
+monvesting.com
+motorgamings.com
+mwww.ro
+naturemeter.org
+navadatime.com
+newsandlocalupdates.com
+newsbuiltin.online
+newslocalupdates.com
+newz-globe.com
+noraplant.com
+nordmanetime.com
+novinite.biz
+nutureheus.com
+pachadesert.com
+pennywines.com
+planetosgame.com
+planningly.org
+playozas.com
+powercodings.com
+projectoid.org
+razzodev.com
+recover-your-body.xyz
+recovery-plan.org
+redanddred.com
+reloadyourbrowser.info
+rentalproct.com
+retailmark.net
+runningandbeyond.org
+setclass.live
+sevensdfe.com
+shoeszise.xyz
+shoplifys.com
+shoppingeos.com
+sidelot.org
+skyphotogreen.com
+space-moon.com
+sseamb.com
+stayle.co
+stockstiming.org
+studiesutshifts.com
+studyreaserch.com
+study-search.com
+studyshifts.com
+studysliii.com
+styleanature.com
+stylelifees.com
+subcloud.online
+sunclub.site
+sunnyweek.site
+sunsandlights.com
+takebreak.io
+takestox.com
+teachlearning.org
+techpowerlight.com
+thegreenlight.xyz
+thenewsfill.com
+thepila.com
+thetimespress.com
+timeeforsports.com
+tokenberries.com
+topuprr.com
+transformaition.com
+treerroots.com
+unitedyears.com
+vinoneros.com
+wellnessjane.org
+whiteandpiink.com
+white-rhino.online
+wikipedoptions.com
+wilddog.site
+wildhour.store
+wombatcash.com
+womnbling.com
+youristores.com
+zebra-arts.com
+zedforme.com
+zeebefg.com
+zooloow.com

data/ioc/spyware/mvt/2023-04-11_quadream/file_paths.txt

@@ -0,0 +1,2 @@
+/private/var/db/com.apple.xpc.roleaccountd.staging/subridged
+/private/var/db/com.apple.xpc.roleaccountd.staging/PlugIns/fud.appex/

data/ioc/spyware/mvt/2023-04-11_quadream/generate_stix.py

@@ -0,0 +1,40 @@
+import sys
+import os
+from stix2.v21 import (Indicator, Malware, Relationship, Bundle, DomainName)
+
+
+if __name__ == "__main__":
+    if os.path.isfile("kingspawn.stix2"):
+        os.remove("kingspawn.stix2")
+
+    with open("domains.txt") as f:
+        domains = list(set([a.strip() for a in f.read().split()]))
+
+    with open("file_paths.txt") as f:
+        filepaths = list(set([a.strip() for a in f.read().split()]))
+
+    with open("processes.txt") as f:
+        processes = list(set([a.strip() for a in f.read().split()]))
+
+    res = []
+    malware = Malware(name="KingSpawn", is_family=False, description="IOCs related to Quadream KingsPawn or Reign spyware")
+    res.append(malware)
+    for d in domains:
+        i = Indicator(indicator_types=["malicious-activity"], pattern="[domain-name:value='{}']".format(d), pattern_type="stix")
+        res.append(i)
+        res.append(Relationship(i, 'indicates', malware))
+
+    for f in filepaths:
+        i = Indicator(indicator_types=["malicious-activity"], pattern="[file:path='{}']".format(f), pattern_type="stix")
+        res.append(i)
+        res.append(Relationship(i, 'indicates', malware))
+
+    for p in processes:
+        i = Indicator(indicator_types=["malicious-activity"], pattern="[process:name='{}']".format(p), pattern_type="stix")
+        res.append(i)
+        res.append(Relationship(i, 'indicates', malware))
+
+    bundle = Bundle(objects=res)
+    with open("kingspawn.stix2", "w+") as f:
+        f.write(bundle.serialize(indent=4))
+    print("kingspawn.stix2 file created")

data/ioc/spyware/mvt/2023-04-11_quadream/processes.txt

@@ -0,0 +1 @@
+com.apple.avcapture