Example reports including capabilites/behaviours

[3c7]

Hello MAEC-Team,

I'm not sure if this is the right place, but I'm wondering if there are any reports available that include capabilites and behaviours according to the MAEC-language as these datasets only using actions?

Searched a lot, but really found nothing useful.

[ikiril01]

Hi @3c7, great question. Unfortunately the only examples we currently have with Capabilities and Behaviours are the manually generated ones: https://github.com/MAECProject/schemas/tree/master/examples

However, we are working on an updated output module for Cuckoo Sandbox that will likely include support for Capabilities and Behaviors. Also, Joe Sandbox and some other tools do currently output Behaviors, for example:

https://www.joesecurity.org/resources/wannacry/maecreport-db349b97c37d22f5ea1d1841e3c89eb4.xml

Hope this helps a bit.

[3c7]

Hey @ikiril01, thank you very much for your answer. That helps for sure. :)

I'm using MAEC as a base for my bachelor thesis and I created an overview of Capabilites and Behaviours and just recognized that the WannaCry sample does not include the combination of availability violation / compromise data availability / encrypt files Capabilities and Behaviours. I'd expect that in a ransomware MAEC report, especially if found during analysis. 😄

[kloepma]

Hello MAEC Team

I'm looking for MAEC 5.0 real world data sets. Something like the wannacry report referenced above would be great if it were MAEC 5.0. Would you be able to point me in the right direction to find some MAEC 5.0 real world data sets?

Thank you for your time.