One document matched: draft-ietf-mile-iodef-guidance-05.xml


<?xml version="1.0" encoding="UTF-8"?>
<!-- To cancel 00 submission 
     https://datatracker.ietf.org/submit/status/50229/1d1534134b1ea9c41563646b8d044937/  
-->

<!DOCTYPE rfc SYSTEM "rfc2629.dtd" [
    <!ENTITY rfc2119 PUBLIC '' 
      'http://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.2119.xml'> 
]>

<rfc category="info" ipr="trust200902" docName="draft-ietf-mile-iodef-guidance-05">

<?xml-stylesheet type='text/xsl' href='rfc2629.xslt' ?>

<?rfc toc="yes"?>         <!-- generate a table of contents -->
<?rfc symrefs="yes"?>     <!-- use anchors instead of numbers for references -->
<?rfc sortrefs="yes" ?>   <!-- alphabetize the references -->
<?rfc compact="yes" ?>    <!-- conserve vertical whitespace -->
<?rfc subcompact="no" ?>  <!-- but keep a blank line between list items -->

    <front>
        <title abbrev='IODEF Guidance'>IODEF Usage Guidance</title>
        <author initials='M.' surname="Suzuki" fullname='Mio Suzuki'>
            <organization>NICT</organization> 
            <address>
                <postal>
                    <street>4-2-1, Nukui-Kitamachi</street>
                    <city>Koganei</city> <region>Tokyo</region>
                    <code>184-8795</code>
                    <country>JP</country>
                </postal>
            <email>mio@nict.go.jp</email>
            </address>
        </author>
        <author initials='P' surname="Kampanakis" fullname='Panos Kampanakis'>
            <organization>Cisco Systems</organization> 
            <address>
                <postal>
                    <street>170 West Tasman Dr.</street>
                    <city>San Jose</city> <region>CA</region>
                    <code>95134</code>
                    <country>US</country>
                </postal>
            <email>pkampana@cisco.com</email>
            </address>
        </author>
        <date day="4" month="April" year="2016" />
        <workgroup>MILE Working Group</workgroup>

        <abstract>
        <t>The Incident Object Description Exchange Format <xref target="RFC5070"/> defines 
        a data representation that provides a framework for sharing information commonly exchanged 
        by Computer Security Incident Response Teams (CSIRTs) about computer security incidents. 
        Since the IODEF model includes a wealth of available options that can be used to describe 
        a security incident or issue, it can be challenging for implementers to develop tools that can 
        Leverage IODEF for incident sharing. This document provides guidelines for IODEF implementers. 
        It will also address how common security indicators can be represented in IODEF and use-cases 
        of how IODEF is being used so far. The goal of this document is to make IODEF's adoption by
        vendors easier and encourage faster and wider adoption of the model by Computer Security 
        Incident Response Teams (CSIRTs) around the world.</t>
        </abstract>
    </front>

    <middle>

        <section anchor="intro" title="Introduction">
            <t>The Incident Object Description Exchange Format in <xref target="RFC5070"/> defines a
            data representation that provides a framework for sharing information commonly exchanged 
            by Computer Security Incident Response Teams (CSIRTs) about computer security incidents. 
            The IODEF data model consists of multiple classes and data types that are used in the 
            IODEF XML schema.</t>
            <t>The IODEF schema was designed to be able to describe all the possible fields that would 
            be needed in a security incident exchange. Thus, IODEF contains plenty data constructs 
            that could potentially make it harder for IODEF implementers to decide which 
            are the most important ones. Additionally, in the IODEF schema, there exist multiple 
            fields and classes which do not necessarily need to be used in every possible data 
            exchange. Moreover, there are fields that are useful only in data exchanges of 
            non-traditional security events. This document tries to address the issues above. It will 
            also address how common security indicators can be represented in IODEF. It will point out 
            the most important IODEF classes for an implementer and describe other ones that are not 
            as important. Also, it addresses some common challenges for IODEF implementers and how 
            they should be addressed. The end goal of this document is to make IODEF's adoption by 
            vendors easier and encourage faster and wider adoption of the model by Computer Security 
            Incident Response Teams (CSIRTs) around the world.</t>
            <t><xref target="strategy"/> discusses the recommended classes and how an IODEF implementer 
            should chose the classes to implement. <xref target="considerations"/> presents common 
             considerations and implementer will come across and how to address them. <xref 
            target="in_action"/> goes over some basic security concepts and how they can be 
            expressed in IODEF.
            </t>
        </section>

        <section anchor="terminology" title="Terminology">
                <t>The terminology used in this document follows the one defined in 
                <xref target="RFC5070"/> and <xref target="RFC7203"/>.</t>
        
                <t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
                "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
                document are to be interpreted as described in RFC 2119 <xref target="RFC2119"/>.</t>
        </section>

<!-- TODO: MUST and SHOULD language -->

        <section anchor="strategy" title="Implementation Strategy">
            <t>It is important for IODEF implementers to be able to distinguish how the IODEF 
            classes will be used for incident information exchanges. It is critical for an 
            implementer to follow a strategy according to which of the various
            IODEF classes he will choose to implement. It is also important to know the most common classes that will
            be used to describe common security incident or indicators. Thus, this section will 
            describe the most important classes and factors an IODEF implementer should take into 
            consideration before designing the implementation or tool.</t>
            <section title="Minimal IODEF document">
                <t>This section describes the minimal IODEF document that only equips
                    mandatory-to-implement classes.
                <!-- 05 update by mio -->
                An IODEF document must have an IODEF-Document class, which needs to have at
                least one Incident class. Here is the structure of the minimal-style Incident class.
                </t>
                <figure title="Minimal-style Incident class"><artwork><![CDATA[
    +-------------------------+
    | Incident                |
    +-------------------------+
    | ENUM purpose            |<>----------[ IncidentID      ]
    |                         |<>----------[ GenerationTime  ]
    |                         |<>--{1..*}--[ Contact         ]
    +-------------------------+
                ]]></artwork></figure>

                <t>This minimal Incident class needs to have the purpose attribute and the
                IncidentID, GenerationTime, and Contact elements.
                Contact class requires type and role attributes, but no elements are
                required by this specification.
                Nevertheless, at least one of the elements, such as Email class, need to be
                implemented so that the IODEF document can be workable.</t>

                <t>Please see Section 7.1 of <xref target="I-D.ietf-mile-rfc5070-bis"/>
                    for example XMLs. </t>
                <!-- 05 update ends by mio -->

            </section>
            <section title="Decide what IODEF will be used for">
                <!-- 05 update by mio -->
                <t>This section describes that there is no need to implement all 
                fields of IODEF, the ones that are necessary for your use-cases. The 
                implementer should look into the schema and decide classes to implement (or not).
                Here shows some use cases and nessesary classes.</t>

                <t>
                If the implementer tackles against DDoS, Flow class and its included information are the most important ones.
                The Flow class contains information of related the attacker hosts and victim hosts.
                These information may help automated filtering or sink-hole operations. </t>

                <t>
                Another case is filtering malware c2 traffic.
                If modern malware infect some device, it commonly connect to
                c2 (command and control) server, and receive command from attackers.
                In such a case, filtering traffic to c2 server is important to interupt malware's activity.
                Both the Flow class and the URL class of IODEF can indicate the URL of c2 server.
                </t>
                <t>
                Also other external schema can be used to describe
                incidents or indicators, as noted in the next section.</t>

                <!-- 05 update ends by mio -->
            </section>

        </section>


        <section anchor="considerations" title="IODEF considerations and how to address them">
            <t> </t>
            <section title="External References">
                <!-- 04 update by mio -->
                <t>The IODEF format has the Reference class that refers to external information
                such as a vulnerability, Intrusion Detection System (IDS) alert, malware sample, advisory, 
                or attack technique. However, due to insufficiency of the capability of the Reference class itself
                    to describe external enumeration specifications, the Enumeretion Reference Format needs
                    to be used with.
                The Enumeration Reference Format<xref target="RFC7495"/>
                specifies a format to include enumeration values
                from external data representations into IODEF,
                and manages references to external representations
                using IANA registry.</t>
                <!-- 04 update ends by mio -->
            </section>
            <section title="Extensions">
                <!-- 04 update -->
                <t>The IODEF data model (<xref target="RFC5070"/>) is extensible. Many class 
                attributes and their values can be extended using using the "ext-*" prefix. 
                Additional classed can also be defined by using the AdditionalData and RecordItem 
                classes. An extension to the AdditionalData class for reporting Phishing emails 
                is defined in <xref target="RFC5901"/>.</t>

                <t>Additionally, IODEF can import existing schemata by using an extension framework 
                defined in <xref target="RFC7203"/>. The framework enables IODEF users to embed 
                XML data inside an IODEF document using external schemata or structures defined by external 
                specifications. Examples include CVE, CVRF and OVAL. Thus, <xref target="RFC7203"/> 
                enhances the IODEF capabilities without further extending the data model.</t>

                <t>IODEF implementers should consider using their own IODEF extensions only for data 
                that cannot be described using existing standards or importing them in and IODEF 
                document using <xref target="RFC7203"/> is not a suitable option.</t>
                <!-- 04 update ends -->
            </section>

                   <section title="Predicate logic">
                <!-- 03 update --> 
                <t>IODEF <xref target="I-D.ietf-mile-rfc5070-bis"/> allows 
                for nesting of incident information. For example, 
                a EventData Class could include multiple Flows or Records. 
                In turn, a Flow could consist of many Nodes and a Record 
                of many RecordData classes. To ensure consistency, IODEF 
                presumes certain predicate logic. </t>

                <t> An EventData class that contains multiple EventData classes
                depicts an Event that consists of smaller events. For the parent 
                event to take place, all the children EventData events SHOULD
                take place.<!-- TODO: Are we sure what nested EventData does? -->
                An EventData class with multiple
                Flows means that all the information defined in the
                flows need to exist for the event described to take place.</t>

                <t>
                For Records, the Records in an event just add more context to the event, 
                they do not all need to be present for the event to take place. 
                A Record in an EventData class with three RecordData in it, means that 
                either of these RecordData classes needs to be present for the event 
                described to take place. </t>

                <t>In <xref target="RFC5070"/>, if a Flow Class  
                contained two System classes  
                that have "source" and "target" 
                as the category attributes, both Systems SHOULD  
                be present in order for the Flow to be true and thus 
                marked as an event. There SHOULD NOT be more than 
                one "source" or "watchlist-source" and one "target" 
                or "watchlist-target" Systems per Flow.</t>

                 <t>In Node class, Node information grouped together under a System 
                class depicts different representations of the same System. For 
                example, if a System consists of different Nodes with an IPv4 address, 
                a domain-name and an IPv6 address, they all represent the same system. 
                Of course, different representations could also be grouped under 
                the same Node class. </t>

                <t><xref target="I-D.ietf-mile-rfc5070-bis"/> defined the 
                HashData Class that describes a file's hash information as also 
                described in <xref target="RFC5901"/>. Similar to the Node, 
                if a HashData class consists of many 
                digital signatures, the signatures represent alternative hash 
                algorithms for the same signature. For example, if the HashData 
                type is file-hash, then the signatures represent MD5, SHA1, SHA2 
                etc hashes.</t>

                <t> For grouped Key classes the logic changes. Multiple Key 
                classes in a WindowsRegistryKeysModified class represent 
                necessary Windows Registry Keys that constitute an indicator. 
                All SHOULD  be present in order for the indicator to be present.
                Multiple WindowsRegistryKeysModified classes grouped under the same 
                RecordData class represent alternatives for the same indicator.
                For example, if a RecordData class included two WindowsRegistryKeysModified
                classes, if either of the classes was true the RecordData 
                class would be true.</t>
                   </section>

                   <section title="Predicate Logic for watchlist of indicators">
                <t>Multiple indicators occasionally need to be combined in 
                an IODEF document. For example, a botnet might have multiple 
                command and control servers. A consistent predicate logic for 
                indicators SHOULD be followed in order to present such 
                relationships in IODEF. </t>

                <t><xref target="I-D.ietf-mile-rfc5070-bis"/> defines two new 
                category attributes in the System Class that can enhance the IODEF
                predicate logic functionality. These are watchlist-source 
                and watchlist-target and they serve for watchlist indicator 
                groupings. <!-- 02 update -->
                A watchlist of Systems means that the information is ORed with 
                the information in the Flow section. In other words, 
                if a Flow Class consists of multiple Systems with 
                watchlist-source or watchlist-target attributes 
                the Systems of the same watchlist type are ORed in the Flow Class.
                Multiple Flows in the EventData Class follow AND logic as explained in Section 4.3.
                There SHOULD NOT be more than one "watchlist-source" 
                and one "watchlist-target" Systems per Flow.
                <!-- 02 update end --> 
                <!-- An example is http://taxii.mitre.org/about/documents/TAXII_Introduction_briefing_November_2012.pdf (slide 19) --> 
                In the following example the EventData class will 
                evaluates as a Flow of one System with source address 
                being (10.10.10.104 OR 10.10.10.106) AND target address 10.1.1.1
                <figure><artwork><![CDATA[
<!-- ...XML code omitted... -->
<iodef:EventData>
   <iodef:Flow>
      <iodef:System category="watchlist-source" spoofed="no">
         <iodef:Node>
            <iodef:Address category="ipv4-addr">
               10.10.10.104
            </iodef:Address>
         </iodef:Node>
         <iodef:Node>
            <iodef:Address category="ipv4-addr">
               10.10.10.106
            </iodef:Address>
         </iodef:Node>
      </iodef:System>
      <iodef:System category="target">
         <iodef:Node>
            <iodef:Address category="ipv4-addr">
               10.1.1.1
            </iodef:Address>
         </iodef:Node>
      </iodef:System>
   </iodef:Flow>   
</iodef:EventData>
<!-- ...XML code omitted... -->
                ]]></artwork></figure>
                </t>

                <t>Similarly, the HashData Class 
                includes a type attribute that introduces watchlist groupings 
                (i.e. PKI_email_ds_watchlist, PGP_email_ds_watchlist, file_hash_watchlist, 
                email_hash_watchlist). Two HashData classes that contain a watchlist 
                type attribute follow OR logic in a RecordData class. In the 
                following example the RecordData class consists of either of the two 
                files with two different hashes.
                <figure><artwork><![CDATA[
<!-- ...XML code omitted... -->
<iodef:RecordData>
   <iodef:HashData type="file-hash-watchlist">
      <iodef:FileName>dummy.txt</iodef:FileName>
      <ds:Reference>
         <ds:DigestMethod Algorithm=
           "http://www.w3.org/2001/04/xmlenc#sha256"/>
         <ds:DigestValue>
           141accec23e7e5157de60853cb1e01bc38042d
           08f9086040815300b7fe75c184
         </ds:DigestValue>
      </ds:Reference>
   </iodef:HashData>
   <iodef:HashData type="file-hash-watchlist">
      <iodef:FileName>dummy2.txt</iodef:FileName>
      <ds:Reference>
         <ds:DigestMethod Algorithm=
          "http://www.w3.org/2001/04/xmlenc#sha256"/>
         <ds:DigestValue>
           141accec23e7e5157de60853cb1e01bc38042d
           08f9086040815300b7fe75c184
         </ds:DigestValue>
      </ds:Reference>
   </iodef:HashData>
</iodef:RecordData>
<!-- ...XML code omitted... -->
                ]]></artwork></figure>
                </t><!-- 03 update end --> 
                
                <t>Similarly, <xref target="I-D.ietf-mile-rfc5070-bis"/> introduces 
                the WindowsRegistryKeyModified Class which consists of Key Classes. 
                Key has an optional type attribute which has 
                watchlist as an option in order to include the ability to group 
                Keys. Multiple Keys of the same watchlist of indicators 
                SHOULD be grouped in the same WindowsRegistryKeysModified Class. 
                These Keys follow OR logic. </t>
            </section>
            <section title="Indicator identifiers">
                <!-- 03 update --> 
                <t><xref target="I-D.ietf-mile-rfc5070-bis"/> defines attrbutes indicator-set-id and 
                indicator-uid. These are data elements that are commonly used as indicators. 
                They are used in mutliple IODEF classes. Their purpose is to be able to 
                define indicator relationships and reference respectively. The indicator-uid 
                is used as a unique indicator identifier. Practitioners MAY use them to 
                establish that a class represents an indicator that is different than other 
                IODEF contextual information. </t>

                <t>On the other hand, an IODEF report could 
                contain multiple indicators that are part of the same or different 
                indicator group. For example, an IP source address, a target address, 
                that consitute a Flow and a RecordData class respectively could be representing 
                indicators of a virus and the traffic it generates. In such a situation,
                the indicator-set-id for all the classes (Address, RecordData) MUST be  
                the same. Unrelated indicators MUST contain different indicator-set-id attributes
                or no indicator-set-id attributes. </t>
                <!-- <t>Similarly,
                </t> -->
                <!-- 03 update end --> 
            </section>         
                <section title="Disclosure level of IODEF">
                <!-- <t>This section describes how Restriction can pose challenges -->
                <!--are not enough, so they use a new 
                schema for data marking to have more restrictions (as explained in 
                http://repoman.apwg.org/research/wiki/dataMarking ) -->
                <!-- </t> -->
                <!-- 05 update starts by mio -->
                <t>This section describes how to control the disclosure level of IODEF
                       docuemnts.</t>

                <t>The information conveyed in IODEF documents should be treated carefully
               since the content may be confidential.
               There are two types of restrictions on the use of IODEF: disclosure level
               indicator provided by IODEF and the one provided by external measures.</t>

               <t>IODEF has a common attribute, called "restriction", which indicates the
               disclosure guideline to which the sender expects the recipient to adhere for
               the information represented in the class and its children.
               In this way, the sender can express the level of disclosure for each
               components of an IODEF document.
               Assorted external measures could be implemented. Among them is RID, which
               provides policy guidelines for handling IODEF documents by preparing
               RIDPolicy class.</t>

               <t>Note that the enforcement of above disclosure guidelines is another issue.
               The recipient of the IODEF document needs to follow the guidelines, but
               these disclosure guidelines themselves do not provide any enforcement
               measures.
               Some appropriate measures, be it either technical or operational, need to be
               considered for that.</t>
                <!-- 05 update ends by mio -->
            </section>
        </section>

        <section anchor="in_action" title="Current uses of IODEF">
            <t>IODEF is currently used by various organizations in order to
            represent security incidents and share incident and threat information
            between security operations organizations.</t>

                   <!-- 02 update -->
                   <section title="Inter-vendor and Service Provider Exercise">
                <t> Various vendors organized and executed an exercise where multiple 
                threat indicators were exchanged using IODEF. The transport protocol used
                was RID. The threat information shared included incidents like DDoS attacks. 
                Malware and Spear-Phishing. As this was a proof-of-concept (PoC) exercise  
                only example information (no real threats) were shared as part of the 
                exchanges.</t>
                <t>
                <figure title="PoC peering topology"><artwork><![CDATA[
      ____________                             ____________
      | Vendor X  |                            | Vendor Y  |
      | RID Agent |_______-------------________| RID Agent |
      |___________|       | Internet  |        |___________|
                          -------------

                   ---- RID Report message --->
                   -- carrying IODEF example ->
                   --------- over TLS -------->

                   <----- RID Ack message -----
                   <--- in case of failure ----
                ]]></artwork></figure>
                The figure above shows how RID interactions took place during the
                PoC. Participating organizations were running RID Agent software on-
                premises. The RID Agents formed peering relationships with other
                participating organizations. When Entity X had a new incident to
                exchange it would package it in IODEF and send it to Entity Y over
                TLS in a RID Report message. In case there was an issue with the
                message, Entity Y would send an RID Acknowledgement message back to
                Entity X which included an application level message to describe 
                the issue. Interoperability between RID agents and the standards, 
                <xref target="RFC6545"/> and <xref target="RFC6546"/>, was also 
                proven in this exercise. <xref target="appendix"/> includes some 
                of the incident IODEF example information that was exchanged by 
                the organizations' RID Agents as part of this proof-of-concept. </t>
                   <!-- 02 update end -->
                   <!-- 03 update -->
<!-- TODO: (optionally): Explain that predicate logic is in each example and that these are explained in the appendix -->
                <t> The first use-case included sharing of Malware Data Related to 
                an Incident between CSIRTs. After Entity X detected an incident, she 
                would put data about malware found during the incident in a backend system. 
                Entity X then decided to share the incident information with 
                Entity Y about the malware discovered. This could be a human 
                decision or part of an automated process. </t>

                <t> Below are the steps followed for the malware information exchange 
                that was taking place: 
                <list style="format (%d)">
                    <t>Entity X has a sharing agreement with Entity Y, and has 
                    already been configured with the IP address of Entity Y’s RID 
                    Agent</t>
                    <t>Entity X’s RID Agent connects to Entity Y’s RID Agent, and 
                    mutual authentication occurs using PKI certificates.</t>
                    <t>Entity X pushes out a RID Report message which contains 
                    information about N pieces of discovered malware. IODEF is used 
                    in RID to discribe the 
                        <list style="format (%c)">
                            <t>Hash of malware files</t>
                            <t>Registry settings changed by the malware</t>
                            <t>C&C Information for the malware</t>
                        </list>
                    </t>
                    <t>Entity Y receives RID Report message, sends RID Acknowledgement 
                    message</t>
                    <t>Entity Y stores the data in a format that makes it possible for 
                    the back end to know which source the data came from.</t>
                </list> </t>

                <t> Another use-case was sharing Distributed Denial of Service (DDoS) 
                as presented below information:  
                Entity X, a Critical Infrastructure and Key Resource (CIKR) company 
                detects that their internet connection is saturated with an abnormal 
                amount of traffic. Further investigation determines that this is an 
                actual DDoS attack. Entity X's computer incident response team (CIRT) 
                contacts their ISP and shares information with them about the attack 
                traffic characteristics. In addition, Entity X has an information sharing 
                relationship with Entity Y. It shares information with Entity Y on 
                characteristics of the attack to watch for. Entitty X's ISP is being 
                overwhelmed by the amount of traffic, so it shares attack signatures 
                and IP addresses of the most prolific hosts with its adjacent ISPs.</t>

                <t> Below are the steps followed for a DDoS information exchange: 
                <list style="format (%d)">
                    <t>Entity X has a sharing agreement with Entity Y, and has 
                    already been configured with the IP address of Entity Y’s RID 
                    Agent</t>
                    <t>Entity X’s RID Agent connects to Entity Y’s RID Agent, and 
                    mutual authentication occurs using PKI certificates.</t>
                    <t>Entity X pushes out a RID Report message which contains 
                    information about the DDoS attack. IODEF is used in RID to 
                        discribe the 
                        <list style="format (%c)">
                            <t>Start and Detect dates and times</t>
                            <t>IP Addresses of nodes sending DDoS Traffic</t>
                            <t>Sharing and Use Restrictions</t>
                                        <t>Traffic characteristics (protocols and ports)</t>
                                        <t>HTTP User-Agents used</t>
                                        <t>IP Addresses of C&C for a botnet</t>
                        </list>
                    </t>
                    <t>Entity Y receives RID Report message, sends RID Acknowledgement 
                    message</t>
                    <t>Entity Y stores the data in a format that makes it possible for 
                    the back end to know which source the data came from.</t>
                </list> </t>

                <t> One more use-case was sharing spear-phishing email information 
                as explained in the following scenario: The board members of several 
                defense contractors receive an email inviting them to attend a conference 
                in San Francisco. The board members are asked to provide their 
                personally identifiable information such as their home address, 
                phone number, corporate email, etc in an attached document which 
                came with the email.  The board members were also asked to click 
                on a URL which would allow them to reach the sign up page for the 
                conference. One of the recipients believes the email to be a phishing 
                attempt and forwards the email to their corporate CSIRT for analysis. 
                The CSIRT identifies the email as an attempted spear phishing incident 
                and distributes the indicators to their sharing partners. </t>
                <t> Below are the steps followed for a spear-phishing information exchange 
                between CSIRTs that was part of this PoC. 
                <list style="format (%d)">
                    <t>Entity X has a sharing agreement with Entity Y, and has 
                    already been configured with the IP address of Entity Y’s RID 
                    Agent</t>
                    <t>Entity X’s RID Agent connects to Entity Y’s RID Agent, and 
                    mutual authentication occurs using PKI certificates.</t>
                    <t>Entity X pushes out a RID Report message which contains 
                    information about the spear-phishing email. IODEF is used 
                    in RID to discribe the 
                        <list style="format (%c)">
                            <t>Attachment details (file Name, hash, size, malware family</t>
                            <t>Target description  (IP, domain, NSLookup)</t>
                                        <t>Email information (From, Subject, header information, 
                                        date/time, digital signature)</t>
                            <t>Confidence Score</t>
                        </list>
                    </t>
                    <t>Entity Y receives RID Report message, sends RID Acknowledgement 
                    message</t>
                    <t>Entity Y stores the data in a format that makes it possible for 
                    the back end to know which source the data came from.</t>
                </list> </t>
                   <!-- 03 update end -->
            </section>

                   <!-- 05 update -->
            <!--    Here we had two sections that included CIF and APWG. Currently there 
                is a whole new draft
               <section title="Collective Intelligence Framework">
                <t> The Collective Intelligence Framework <xref target="CIF"/> is a cyber 
                threat intelligence management system that uses IODEF to combine known 
                malicious threat information from multiple sources and use that it to identify, 
                detect and mitigate. The threat intelligence can be IP addresses, domains and 
                URLs that are involved in malicious activity. IODEF records can be consumed 
                by a CIF standalone client or CIF browser plugins that a user can use to 
                make informed decisions about threat information.</t>
                   <section title="Anti-Phishing Working Group">
                <t> The Anti-Phishing Working Group (<xref target="APWG"/>) is using 
                <xref target="RFC5070"/> to represent email phishing information. 
                <xref target="APWG"/> also uses IODEF to aggregate and share 
                Bot and Infected System Alerting and Notification System (BISANS) and 
                Cyber Bullying IODEF records. Special IODEF extensions are used in order 
                to mark the sensitivity of the exchanged information. Shared infected 
                system or email phishing records can then be used by interested parties 
                in order to provide mitigations. <xref target="APWG"/> leverages tools of 
                its eCRISP-X toolkit in order to share and report e-Crime IODEF records.</t>
            </section>  -->
            <section title="Implementations">
                <!-- 05 update by mio -->
                <t>In order to use IODEF, some tools that copes with IODEF documents, such as
                    the parsers of IODEF documents, are needed.
                    Though arbitrary implementations can be done, some guidelines are provided
                    in <xref target="I-D.ietf-mile-implementreport"/>.
                    IODEF does not specify any MTI, but provides this guideline document.
                    The document provides a list of implementations the authors have surveyed at
                    the time of its publication as well as some tips on the implementations.
                    Readers are requested to read the draft.</t>
            </section>
                   <!-- 05 update end -->

                   <section title="Other">
                <t> IODEF is also used in various projects and products to consume and 
                share security information. Various vendor incident reporting products 
                have the ability to consume and export in IODEF format 
                <!-- 03 update --><xref target="implementations"/><!-- 03 update end -->. 
                Perl <!-- 03 update -->
                and Python modules (XML::IODEF, Iodef::Pb, iodeflib) <!-- 03 update end -->
                exist in order to parse IODEF documents and their extensions. 
                Additionally, some worldwide CERT organizations are already able to 
                use receive incident information in IODEF.
                </t>
                   <!-- 03 update -->
                <t>Future use-cases of IODEF could be: 
                        <list style="format (%d)">
                                <t>ISP notifying a national CERT or organization when it identifies and acts upon an incident and CERTs notifying ISPs when they are aware of incidents.</t>
                                <t>Suspected phishing emails could be shared amongst organizations and national agencies. Automation could validate web content that the suspicious emails are pointing to. Identified malicious content linked in a phishing email could then be shared using IODEF. Phishing campaigns could thus be subverted much faster by automating information sharing using IODEF.</t>
                                <t>When finding a certificate that should be revoked, a thrid-party would forward an automated IODEF message to the CA with the full context of the certificate and the CA could act accordingly after checking its validity. Alternatively, in the event of a compromise of the private key of a certificate, a third-party could alert the certificate owner about the compromise using IODEF.</t>
                        </list>
                </t>
                   <!-- 03 update end -->
            </section>
        </section>


        <section title="Updates">
        <t>version -05 updates:
            <list style="format (%d)">
                <t>Changed section title from "Restrictions in IODEF" to "Disclosure level of IODEF" and added some description</t>
                <t>Mixed "Recommended classes to implement" section with "Unnecessary Fields" section into "Minimal IODEF document" section</t>
                <t>Added description to "Decide what IODEF will be used for" section, "Implementations" section, and "Security Considerations" section</t>
            </list>
        </t>
        <t>version -04 updates:
                <list style="format (%d)">
                        <t>Expanded on the Extensions section using Take's suggestion.</t>
                        <t>Moved Future use-cases under the Other section.</t>
                        <t>CIF and APWG were consolidated in one "Implementation" section</t>
                        <t>Added abstract of RFC7495 to the "External References" section</t>
                        <t>Added Kathleen's example of malware delivery URL to "Appendix"</t>
                        <t>Added a little description to "Recommended classes to implement" section</t>
                </list>
        </t>
        <t>version -03 updates:
                <list style="format (%d)">
                        <t>Added "Updates" section.</t> 
                        <t>Added details about the flow of information exchanges in 
                        "Inter-vendor and Service Provider Exercise" section. Also updated
                        the usecases with more background information.</t> 
                        <t>Added future use-cases in the "Collective Intelligence Framework" 
                        section</t> 
                        <t>Updated Perl and Python references with the actual module names. 
                        Added IODEF implementation reference "implementations".</t> 
                        <t>Added Predicate logic section</t> 
                        <t>Updated Logic of watchlist of indicators section to simplify the logic and include examples.</t> 
                        <t>Renamed Externally defined indicators section to Indicator reference and elaborated on the use of indicator-uid and indicator-set-uid attribute use.</t>
                </list>
        </t>
        <t>version -02 updates:
                <list style="format (%d)">
                        <t>Updated the "Logic for watchlist of indications" section to 
                        clarify the logic based on community feedback.</t> 
                        <t>Added "Inter-vendor and Service Provider Exercise" section.</t> 
                        <t>Added Appendix to include actual use-case IODEF examples.</t>
                </list>
        </t>
        </section>

        <section title="Acknowledgements">
        <t> </t>
        </section>

        <section title="Security Considerations">
        <t>This document does not incur any new security issues, since it only talks
            about the usage of IODEF, which is defined in RFC 5070 <xref target="RFC5070"/>.
            Nevertheless, readers of this document SHOULD refer to the security
            consideration section of RFC 5070. </t>
        </section>

    </middle>

    <back>
        <references title='Normative References'>
        &rfc2119;
        <?rfc include="http://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.5070"?>
        <?rfc include="http://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.5901"?>
        <?rfc include="http://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.6545"?>
        <?rfc include="http://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.6546"?>
        <?rfc include="http://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.7203"?>
        <?rfc include="http://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.7495"?>
        </references>
        <references title='Informative References'>
        <?rfc include="http://xml2rfc.ietf.org/public/rfc/bibxml3/reference.I-D.draft-ietf-mile-rfc5070-bis-18.xml"?>
        <?rfc include="http://xml2rfc.ietf.org/public/rfc/bibxml3/reference.I-D.draft-ietf-mile-implementreport-06.xml"?>
        <reference anchor="APWG" target="http://apwg.org/">
            <front>
                <title>APWG</title>
                <author initials="" surname="" fullname="">
                    <organization />
                </author>
                <date year="" />
            </front>
        </reference>
        <reference anchor="CIF" target="http://csirtgadgets.org/collective-intelligence-framework/">
            <front>
                <title>CIF</title>
                <author initials="" surname="" fullname="">
                    <organization />
                </author>
                <date year="" />
            </front>
        </reference>
        <!-- 03 update --> 
        <reference anchor="implementations" target="http://siis.realmv6.org/implementations/">
            <front>
                <title>Implementations on IODEF</title>
                <author initials="" surname="" fullname="">
                    <organization />
                </author>
                <date year="" />
            </front>
        </reference>
        <!-- 03 update end --> 
        </references>


        <!-- 02 update --> 
        <section anchor="appendix" title="Inter-vendor and Service Provider Exercise Examples">
            <t>Below some of the incident IODEF example information that was exchanged by 
            the vendors as part of this proof-of-concept Inter-vendor and Service Provider 
            Exercise.</t>
            <section title="Malware">
                <t>In this test, malware information was exchanged using RID and IODEF. 
                The information included file hashes, registry setting changes and the 
                C&C servers the malware uses.
                <figure><artwork><![CDATA[
       <?xml version="1.0" encoding="UTF-8"?>
                  <iodef:IODEF-Document xmlns:ds="
                      http://www.w3.org/2000/09/xmldsig#" 
                      xmlns:iodef="urn:ietf:params:xml:ns:iodef-1.41">
            <iodef:Incident purpose="reporting">
              <iodef:ReportID name="EXAMPLE CSIRT">
                 189234
              </iodef:ReportID>
              <iodef:ReportTime>
                 2013-03-07T16:14:56.757+05:30
              </iodef:ReportTime>
              <iodef:Description>
                 Malware and related indicators identified
              </iodef:Description>
              <iodef:Assessment occurrence="potential">
                <iodef:Impact severity="medium" type="info-leak">
                   Malware with Command and Control Server 
                   and System Changes
                </iodef:Impact>
              </iodef:Assessment>
              <iodef:Contact role="creator" type="organization">
                <iodef:ContactName>EXAMPLE CSIRT</iodef:ContactName>
                <iodef:Email>emccirt@emc.com</iodef:Email>
              </iodef:Contact>
              <iodef:EventData>
                <iodef:Method>
                  <iodef:Reference>
                    <iodef:ReferenceName>Zeus</iodef:ReferenceName>
                    <iodef:URL>
                        http://www.threatexpert.com/report.aspx?
                        md5=e2710ceb088dacdcb03678db250742b7
                    </iodef:URL>
                  </iodef:Reference>
                </iodef:Method>
                <iodef:Flow>
                  <iodef:System category="watchlist-source">
                    <iodef:Node>
                      <iodef:Address category="ipv4-addr">
                         192.168.2.200
                      </iodef:Address>
                      <iodef:Address category="site-uri">
                         http://zeus.556677889900.com/log-bin/
                         lunch_install.php?aff_id=1&amp;
                         lunch_id=1&amp;maddr=&amp;
                         action=install
                      </iodef:Address>
                      <iodef:NodeRole attacktype="c2-server"/>
                    </iodef:Node>
                  </iodef:System>
                </iodef:Flow>
                <iodef:Record>
                  <iodef:RecordData>
                    <iodef:HashData>
                      <ds:Reference>
                        <ds:DigestMethod Algorithm="
                           http://www.w3.org/2001/04/xmlenc#sha1"/>
                        <ds:DigestValue>
                             MHg2NzUxQTI1MzQ4M0E2N0Q4NkUwRjg0NzYwRj
                             YxRjEwQkJDQzJFREZG</ds:DigestValue>
                      </ds:Reference>
                    </iodef:HashData>
                    <iodef:HashData>
                      <ds:Reference>
                        <ds:DigestMethod Algorithm="
                            http://www.w3.org/2001/04/xmlenc#md5"/>
                        <ds:DigestValue>
                            MHgyRTg4ODA5ODBENjI0NDdFOTc5MEFGQTg5NTE
                            zRjBBNA==
                        </ds:DigestValue>
                      </ds:Reference>
                    </iodef:HashData>
                    <iodef:WindowsRegistryKeysModified>
                      <iodef:Key registryaction="add_value">
                        <iodef:KeyName>
                            HKLM\Software\Microsoft\Windows\
                            CurrentVersion\Run\tamg
                        </iodef:KeyName>
                        <iodef:Value>
                           ?\?\?%System%\wins\mc.exe\?\??
                        </iodef:Value>
                      </iodef:Key>
                      <iodef:Key registryaction="modify_value">
                        <iodef:KeyName>HKLM\Software\Microsoft\
                           Windows\CurrentVersion\Run\dqo
                        </iodef:KeyName>
                        <iodef:Value>"\"\"%Windir%\Resources\
                            Themes\Luna\km.exe\?\?"
                        </iodef:Value>
                      </iodef:Key>
                    </iodef:WindowsRegistryKeysModified>
                  </iodef:RecordData>
                </iodef:Record>
              </iodef:EventData>
              <iodef:EventData>
                <iodef:Method>
                  <iodef:Reference>
                    <iodef:ReferenceName>Cridex</iodef:ReferenceName>
                    <iodef:URL>
                        http://www.threatexpert.com/report.aspx?
                        md5=c3c528c939f9b176c883ae0ce5df0001
                    </iodef:URL>
                  </iodef:Reference>
                </iodef:Method>
                <iodef:Flow>
                  <iodef:System category="watchlist-source">
                    <iodef:Node>
                      <iodef:Address category="ipv4-addr">
                         10.10.199.100
                      </iodef:Address>
                      <iodef:NodeRole attacktype="c2-server"/>
                    </iodef:Node>
                    <iodef:Service ip_protocol="6">
                      <iodef:Port>8080</iodef:Port>
                    </iodef:Service>
                  </iodef:System>
                </iodef:Flow>
                <iodef:Record>
                  <iodef:RecordData>
                    <iodef:HashData>
                      <ds:Reference>
                        <ds:DigestMethod Algorithm="
                           http://www.w3.org/2001/04/xmlenc#sha1"/>
                        <ds:DigestValue>
                           MHg3MjYzRkUwRDNBMDk1RDU5QzhFMEM4OTVBOUM
                           1ODVFMzQzRTcxNDFD
                        </ds:DigestValue>
                      </ds:Reference>
                      <ds:Reference>
                        <ds:DigestMethod Algorithm="
                           http://www.w3.org/2001/04/xmlenc#md5"/>
                        <ds:DigestValue>MHg0M0NEODUwRkNEQURFNDMzMEE1
                           QkVBNkYxNkVFOTcxQw==</ds:DigestValue>
                      </ds:Reference>
                    </iodef:HashData>
                    <iodef:HashData>
                      <ds:Reference>
                        <ds:DigestMethod Algorithm="
                            http://www.w3.org/2001/04/xmlenc#md5"/>
                        <ds:DigestValue>MHg0M0NEODUwRkNEQURFNDMzMEE
                            1QkVBNkYxNkVFOTcxQw==</ds:DigestValue>
                      </ds:Reference>
                      <ds:Reference>
                        <ds:DigestMethod Algorithm="http://www.w3.org/
                            2001/04/xmlenc#sha1"/>
                        <ds:DigestValue>MHg3MjYzRkUwRDNBMDk1RDU5QzhFME
                            M4OTVBOUM1ODVFMzQzRTcxNDFD</ds:DigestValue>
                      </ds:Reference>
                    </iodef:HashData>
                    <iodef:WindowsRegistryKeysModified>
                      <iodef:Key registryaction="add_value">
                        <iodef:KeyName>
                           HKLM\Software\Microsoft\Windows\
                           CurrentVersion\Run\KB00121600.exe
                        </iodef:KeyName>
                        <iodef:Value>
                           \?\?%AppData%\KB00121600.exe\?\?
                        </iodef:Value>
                      </iodef:Key>
                    </iodef:WindowsRegistryKeysModified>
                  </iodef:RecordData>
                </iodef:Record>
              </iodef:EventData>
              <iodef:EventData>
                <iodef:Expectation action="other"/>
                  <iodef:Flow>
                    <iodef:System category="source" 
                          indicator-set-id="91011">
                      <iodef:Node>
                          <iodef:Address category="url" 
                             indicator-uid="qrst">
                                http://foo.com:12345/evil/cc.php
                          </iodef:Address>
                      <iodef:NodeName indicator-uid="rstu">
                          evil.com
                      </iodef:NodeName>
                          <iodef:Address category="ipv4-addr" 
                             indicator-uid="stuv">
                                1.2.3.4</iodef:Address>
                          <iodef:Address category="ipv4-addr" 
                             indicator-uid="tuvw">
                                5.6.7.8 </iodef:Address>
                          <iodef:Address category="ipv6-addr" 
                             indicator-uid="uvwx">
                                 2001:dead:beef::</iodef:Address>
                     <iodef:NodeRole category="c2-server"/>
                     </iodef:Node>
                  </iodef:System>
                </iodef:Flow>            
                <iodef:Record>
                  <iodef:RecordData indicator-set-id="91011">
                    <iodef:HashData>
                       <ds:Reference>
                          <ds:DigestMethod Algorithm=
                              "http://www.w3.org/2001/04/xmlenc
                               #sha256"/>
                           <ds:DigestValue>
                            141accec23e7e5157de60853cb1e01bc3804
                            2d08f9086040815300b7fe75c184
                           </ds:DigestValue>
                       </ds:Reference>
                      </iodef:HashData>
                    <iodef:WindowsRegistryKeysModified 
                      indicator-set-id="91011">
                      <iodef:Key registryaction="add_key" 
                      indicator-uid="vwxy">
                        <iodef:KeyName>
                            HKLM\SYSTEM\CurrentControlSet\
                            Services\.Net CLR
                        </iodef:KeyName>
                      </iodef:Key>
                      <iodef:Key registryaction="add_key" 
                        indicator-uid="wxyz">
                        <iodef:KeyName>
                            HKLM\SYSTEM\CurrentControlSet\
                            Services\.Net CLR\Parameters
                        </iodef:KeyName>
                        <iodef:Value>
                            \”\”%AppData%\KB00121600.exe\”\”
                        </iodef:Value>
                      </iodef:Key>
                      <iodef:Key registryaction="add_value" 
                        indicator-uid="xyza">
                        <iodef:KeyName>
                           HKLM\SYSTEM\CurrentControlSet\Services\
                           .Net CLR\Parameters\ServiceDll
                        </iodef:KeyName>
                        <iodef:Value>C:\bad.exe</iodef:Value>
                      </iodef:Key>
                      <iodef:Key registryaction="modify_value" 
                        indicator-uid="zabc">
                        <iodef:KeyName>
                            HKLM\SYSTEM\CurrentControlSet\
                            Services\.Net CLR\Parameters\Bar
                        </iodef:KeyName>
                        <iodef:Value>Baz</iodef:Value>
                      </iodef:Key>
                    </iodef:WindowsRegistryKeysModified>
                  </iodef:RecordData>
                </iodef:Record>  
              </iodef:EventData>
            </iodef:Incident>
          </iodef:IODEF-Document>
              ]]></artwork></figure></t>
            </section>
            <!-- 04 update by mio --> 
            <section title="Malware Delivery URL">
                <t>This example indicates malware and related URL for file delivery.
                <figure><artwork><![CDATA[
<?xml version="1.0" encoding="UTF-8"?>
<IODEF-Document version="2.00"
	xmlns="urn:ietf:params:xml:ns:iodef-2.0"
	xmlns:iodef="urn:ietf:params:xml:ns:iodef-2.0"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<iodef:Incident purpose="reporting">
      <iodef:IncidentID name="csirt.example.com">
          189801
      </iodef:IncidentID>
      <iodef:RelatedActivity>
          <iodef:URL>http://zeus.556677889900.example.com/log-bin/lunch_install.php?aff_id=1&lunch_id=1&maddr=&action=install
          </iodef:URL>
      </iodef:RelatedActivity>
      <iodef:ReportTime>2012-12-05T12:20:00+00:00</iodef:ReportTime>
      <iodef:GenerationTime>2012-12-05T12:20:00+00:00</iodef:GenerationTime>
      <iodef:Description>Malware and related indicators</iodef:Description>
          <iodef:Assessment occurrence="potential">
              <iodef:SystemImpact severity="medium" type="breach-privacy">Malware with C&C </iodef:SystemImpact>
           </iodef:Assessment>
		   <iodef:Contact role="creator" type="organization">
                <iodef:ContactName>example.com CSIRT
                </iodef:ContactName>
                <iodef:Email>contact@csirt.example.com</iodef:Email>
            </iodef:Contact>
            <iodef:EventData>
            <iodef:Flow>
<iodef:System category="source">
                  <iodef:Node>
                    <iodef:Address category="ipv4-addr">192.0.2.200</iodef:Address>
                    <iodef:NodeRole category="www"/>
                 </iodef:Node>
              </iodef:System>
            </iodef:Flow>
        </iodef:EventData>
    </iodef:Incident>
</IODEF-Document>
              ]]></artwork></figure></t>
            </section>
            <!-- 04 update end by mio --> 
            <section title="DDoS">
                  <t>The DDoS test exchanged information that described a DDoS including 
                protocols and ports, bad IP addresses and HTTP User-Agent fields. The 
                IODEF version used for the data representation was based on 
                <xref target="I-D.ietf-mile-rfc5070-bis"/>
                <figure><artwork><![CDATA[
<?xml version="1.0" encoding="UTF-8"?>
<IODEF-Document version="1.00" lang="en"
    xmlns="urn:ietf:params:xml:ns:iodef-1.41"
    xmlns:iodef="urn:ietf:params:xml:ns:iodef-1.41"
    xmlns:iodef-sci="urn:ietf:params:xml:ns:iodef-sci-1.0"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
     <iodef:Incident purpose="reporting" restriction="default">
         <iodef:IncidentID name="csirt.example.com">
             189701
         </iodef:IncidentID>
         <iodef:StartTime>2013-02-05T00:34:45+00:00</iodef:StartTime>
         <iodef:DetectTime>2013-02-05T01:15:45+00:00</iodef:DetectTime>
         <iodef:ReportTime>2013-02-05T01:34:45+00:00</iodef:ReportTime>
         <iodef:description>DDoS Traffic Seen</iodef:description>
            <iodef:Assessment occurrence="actual">
                <iodef:Impact severity="medium" type="dos">
                DDoS Traffic</iodef:Impact>
                <iodef:Confidence rating="numeric">90
                </iodef:Confidence>
            </iodef:Assessment>
            <iodef:Contact role="creator" type="organization">
                <iodef:ContactName>Dummy Test</iodef:ContactName>
                <iodef:Email>contact@dummytest.com</iodef:Email>
            </iodef:Contact>
            <iodef:EventData>
               <iodef:Description>
                   Dummy Test sharing with ISP1
               </iodef:Description>
            <iodef:Expectation action="other"/>
            <iodef:Method>
               <iodef:Reference>
                  <iodef:ReferenceName>
                      Low Orbit Ion Cannon User Agent
                  </iodef:ReferenceName>
                  <iodef:URL>
                     http://blog.spiderlabs.com/2011/01/loic-ddos-
                     analysis-and-detection.html
                  </iodef:URL>
                  <iodef:URL>
                     http://en.wikipedia.org/wiki/Low_Orbit_Ion_Cannon
                  </iodef:URL>
               </iodef:Reference>
            </iodef:Method>
            <iodef:Flow>
               <iodef:System category="watchlist-source" spoofed="no">
                  <iodef:Node>
                    <iodef:Address category="ipv4-addr">
                       10.10.10.104</iodef:Address>
                  </iodef:Node>
                  <iodef:Node>
                    <iodef:Address category="ipv4-addr">
                       10.10.10.106</iodef:Address>
                                   </iodef:Node>
                  <iodef:Node>
                    <iodef:Address category="ipv4-net">
                     172.16.66.0/24</iodef:Address>
                     </iodef:Node>
                  <iodef:Node>
                    <iodef:Address category="ipv6-addr">
                     2001:db8:dead:beef::</iodef:Address>
                                 </iodef:Node>  
   <iodef:Service ip_protocol="6">
      <iodef:Port>1337</iodef:Port>
      <iodef:Application user-agent="Mozilla/5.0 (Macintosh; U; 
             Intel Mac OS X 10.5; en-US; rv:1.9.2.12) Gecko/
             20101026 Firefox/3.6.12">
      </iodef:Application>
   </iodef:Service>
              </iodef:System>
               <iodef:System category="target">
                  <iodef:Node>
                    <iodef:Address category="ipv4-addr">
   10.1.1.1</iodef:Address>
                 </iodef:Node>
                 <iodef:Service ip_protocol="6">
                   <iodef:Port>80</iodef:Port>
                 </iodef:Service>
               </iodef:System>
               <iodef:System category="sensor"><iodef:Description>
                   Information provided in FLow class instance is from
                   Inspection of traffic from network tap
               </iodef:Description></iodef:System>
            </iodef:Flow>   
        </iodef:EventData>
    </iodef:Incident>
</IODEF-Document>
              ]]></artwork></figure></t>
            </section>

            <section title="Spear-Phishing">
                <t>The Spear-Phishing test exchanged information that described a Spear-Phishing
                email including DNS records and addresses about the sender, malicious attached 
                file information and email data. The IODEF version used for the data 
                representation was based on <xref target="I-D.ietf-mile-rfc5070-bis"/>.
                <figure><artwork><![CDATA[
<?xml version="1.0" encoding="UTF-8"?>
<IODEF-Document version="1.00" lang="en"
    xmlns="urn:ietf:params:xml:ns:iodef-1.41"
    xmlns:iodef="urn:ietf:params:xml:ns:iodef-1.41"
    xmlns:iodef-sci="urn:ietf:params:xml:ns:iodef-sci-1.0"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
     <iodef:Incident purpose="reporting">
         <iodef:IncidentID name="csirt.example.com">
            189601
         </iodef:IncidentID>
         <iodef:StartTime>2013-01-04T08:01:34+00:00</iodef:StartTime>
         <iodef:StopTime>2013-01-04T08:31:27+00:00</iodef:StopTime>
         <iodef:DetectTime>2013-01-04T08:06:12+00:00</iodef:DetectTime>
         <iodef:ReportTime>2013-01-04T09:15:45+00:00</iodef:ReportTime>
         <iodef:description>
            Zeus Spear Phishing E-mail with Malware Attachment
         </iodef:description>
            <iodef:Assessment occurrence="potential">
                <iodef:Impact severity="medium" type="info-leak">
                Malware with Command and Control Server and System 
                Changes</iodef:Impact>
            </iodef:Assessment>
            <iodef:Contact role="creator" type="organization">
                <iodef:ContactName>example.com CSIRT
                </iodef:ContactName>
                <iodef:Email>contact@csirt.example.com</iodef:Email>
            </iodef:Contact>
            <iodef:EventData>
              <iodef:Description>Targeting Defense Contractors, 
                 specifically board members attending Dummy Con
              </iodef:Description>
            <iodef:Expectation action="other"/>
            <iodef:Method>
               <iodef:Reference indicator_uid="1234">
                  <iodef:ReferenceName>Zeus</iodef:ReferenceName>
                  </iodef:Reference>
            </iodef:Method>
            <iodef:Flow>
               <iodef:System category="source">
                  <iodef:Node>
                    <iodef:Address category="url">
                          http://www.zeusevil.com</iodef:Address>
                    <iodef:Address category="ipv4-addr">
                          10.10.10.166</iodef:Address>
                   <iodef:Address category="as">
                          225</iodef:Address>
                    <iodef:Address category="ext-value" 
                      ext-category="as-name">
                      EXAMPLE-AS - University of Example”
                      </iodef:Address>
                    <iodef:Address category="ext-value" 
                      ext-category="as-prefix">
                      172.16..0.0/16
                      </iodef:Address>
                    <iodef:NodeRole category="www" 
                      attacktype="malware-distribution"/>
                 </iodef:Node>
              </iodef:System>
            </iodef:Flow>
            <iodef:Flow>
               <iodef:System category="source">
                  <iodef:Node>
                   <iodef:NodeName>mail1.evildave.com</iodef:NodeName>
                    <iodef:Address category="ipv4-addr">
                          172.16.55.6</iodef:Address>
                   <iodef:Address category="asn">
                          225</iodef:Address>
                    <iodef:Address category="ext-value" 
                      ext-category="as-name">
                      EXAMPLE-AS - University of Example
                    </iodef:Address>
   <iodef:DomainData>
      <iodef:Name>evildaveexample.com</iodef:Name>
      <iodef:DateDomainWasChecked>2013-01-04T09:10:24+00:00
      </iodef:DateDomainWasChecked>
      <iodef:RelatedDNS RecordType="MX">
          evildaveexample.com MX prefernce = 10, mail exchanger 
          = mail1.evildave.com</iodef:RelatedDNS>
      <iodef:RelatedDNS RecordType="A">
          mail1.evildaveexample.com 
          internet address = 172.16.55.6</iodef:RelatedDNS>
      <iodef:RelatedDNS RecordType="SPF">
           zuesevil.com. IN TXT \"v=spf1 a mx –all\"
      </iodef:RelatedDNS>
   </iodef:DomainData>
                 <iodef:NodeRole category="mail" 
                       attacktype="spear-phishing"/>
                 </iodef:Node>
                 <iodef:Service>
                    <iodef:EmailInfo>
                       <iodef:Email>emaildave@evildaveexample.com
                       </iodef:Email>
                       <iodef:EmailSubject>Join us at Dummy Con
                       </iodef:EmailSubject>
                       <iodef:X-Mailer>StormRider 4.0
                       </iodef:X-Mailer>
                    </iodef:EmailInfo>
                 </iodef:Service>
              </iodef:System>
              <iodef:System category="target">
                 <iodef:Node>
                    <iodef:Address category="ipv4">
                      192.168.54.2</iodef:Address>
                 </iodef:Node>
               </iodef:System>
            </iodef:Flow>   

            <iodef:Record>
              <iodef:RecordData>
                <iodef:HashData type="file_hash" 
                   indicator_uid="1234">
                   <iodef:FileName>Dummy Con Sign Up Sheet.txt
                   </iodef:FileName>
                   <iodef:FileSize>152</iodef:FileSize>
                <ds:Reference>
                   <ds:DigestMethod Algorithm=
                      "http://www.w3.org/2001/04/xmlenc#sha256"/>
                      <ds:DigestValue>
                        141accec23e7e5157de60853cb1e01bc38042d
                        08f9086040815300b7fe75c184
                      </ds:DigestValue>
                </ds:Reference>
              </iodef:HashData>
             </iodef:RecordData>
             <iodef:RecordData>
              <iodef:HashData type="PKI_email_ds" valid="0">
                <ds:Signature>
                 <ds:KeyInfo>
                    <ds:X509Data>
                       <ds:X509IssuerSerial>
                          <ds:X509IssuerName>FakeCA
                       </ds:X509IssuerName>
                       </ds:X509IssuerSerial>
                       <ds:X509SubjectName>EvilDaveExample
                       </ds:X509SubjectName>
                    </ds:X509Data>
                 </ds:KeyInfo>
                    <ds:SignedInfo>
                     <ds:Reference>
                        <ds:DigestMethod Algorithm=
                          "http://www.w3.org/2001/04/xmlenc#sha256"/>
                        <ds:DigestValue>
                         352bddec13e4e5257ee63854cb1f05de48043d09f9
                         076070845307b7ce76c185
                        </ds:DigestValue>
                    </ds:Reference>
                  </ds:SignedInfo>
                </ds:Signature>
             </iodef:HashData>
          </iodef:RecordData>
         </iodef:Record>  
        </iodef:EventData>
    </iodef:Incident>
</IODEF-Document>
              ]]></artwork></figure></t>
            </section>
        <!-- 02 update end --> 
        </section>
    </back>

</rfc>

PAFTECH AB 2003-20262026-04-24 06:53:43