SPARK Version 1.17.0 adds extensive STIXv2 support.
This allows you to easily extend SPARK’s signature bases with IOCs from any sandbox, analysis or threat intel platforms that support STIXv2 export by placing the exported [cci]*.json[/cci] files in the [cci]./custom-signatures[/cci] folder.
For now, the supported observable object types are:
- file:name with = != LIKE and MATCHES
- file:parent_directory_ref.path with = != LIKE and MATCHES
- file:hashes.sha-256 / file:hashes.sha256 with = and !=
- file:hashes.sha-1 / file:hashes.sha1 with = and !=
- file:hashes.md-5 / file:hashes.md5 with = and !=
- file:size with < <= > >= = !=
- file:created with < <= > >= = !=
- file:modified with < <= > >= = !=
- file:accessed with < <= > >= = !=
- win-registry-key:key with = != LIKE and MATCHES
- win-registry-key:values.name with = != LIKE and MATCHES
- win-registry-key:values.data with = != LIKE and MATCHES
- win-registry-key:values.modified_time with < <= > >= = !=
These types are applied in different modules:
- FileScan: file:*
- Registry: win-registry-key:* and file:name (applied to data field)
You can find a list of products that support the STIX data exchange format here.
