The updated release of href="/content/fireeye-www/en_US/services/freeware/ioc-editor.html">IOC
Editor has been a long time coming, but it is well worth the
upgrade. There have always been grumblings about IOC Editor, but
lately those grumblings have been growing louder. The noise
eventually got so loud that even my noise canceling headphones
couldn't silence it. I could have just turned up the music a little
more, but instead I decided to grab the code and fix some of the
issues once and for all.
Some of the changes to IOC Editor
were minor (Ctrl-X no longer exits the program), some were major
(check out the new Properties panel where commenting per
IndicatorItem is now available), and of course I discovered some
bugs that I didn't even know existed (No, I didn't cause them with
my other changes). Long story short, there are a lot of new features
and improvements in this version.
Make sure you pay attention
to what's different and any messages that pop-up as the wording and
options may have changed.
In this blog post, I am going to
touch on a couple of new features and improvements. If you would
like to see the full list, please check-out the href="/content/dam/fireeye-www/services/freeware/rn-ioc-editor.pdf">release
notes. Fair warning, there is a lot to read as I did get a bit
fix happy.
Some of the New:
Options Dialog
This is still a bit of a work in
progress, but there is now a place to set some of the defaults for href="/content/fireeye-www/en_US/services/freeware/ioc-editor.html">
IOC Editor.
href="https://www.fireeye.com/content/dam/legacy/ammo/Figure-1-Option-Dialog.png">
width="300" height="220" class="size-medium wp-image-3958"
title="Figure 1: Option Dialog"
src="https://www.fireeye.com/content/dam/legacy/ammo/Figure-1-Option-Dialog-300x220.png" />Figure
1: Option Dialog
Figure 1 shows the preferences that are currently
available in the options dialog. You can set the default author (we
typically use the e-mail address to identify the author), and set
whether you want to warn on Deleting or Pruning.
Now before
we go too far, let me quickly discuss the difference between
deleting and pruning:
Deleting will only delete the selected
item, whether it's an individual item, or a logic item (AND, OR). If
you delete a logic item, the items that are below it will be bumped
up a level.
href="https://www.fireeye.com/content/dam/legacy/ammo/Figure-2-Before-Delete.png">
width="300" height="90" class="size-medium wp-image-3959"
title="Figure 2: Before Delete"
src="https://www.fireeye.com/content/dam/legacy/ammo/Figure-2-Before-Delete-300x90.png" />Figure
2: Before Delete
href="https://www.fireeye.com/content/dam/legacy/ammo/Figure-3-After-Delete.png">
width="300" height="77" class="size-medium wp-image-3960"
title="Figure 3: After Delete"
src="https://www.fireeye.com/content/dam/legacy/ammo/Figure-3-After-Delete-300x77.png" />Figure
3: After Delete
Figure 2 shows what the Indicator of Compromise
(IOC) looks like before deleting the AND. Figure 3 shows what the
IOC looks like after deleting the AND. Notice that the items that
were under the AND were moved up a level and are now under the top
OR.
There is no problem with this IOC, but what happens if you
were to delete the AND in the following IOC?
href="https://www.fireeye.com/content/dam/legacy/ammo/Figure-4-Before-Delete.png">
width="300" height="100" class="size-medium wp-image-3961"
title="Figure 4: Before Delete"
src="https://www.fireeye.com/content/dam/legacy/ammo/Figure-4-Before-Delete-300x100.png" />Figure
4: Before Delete
If you delete the AND that is shown in Figure 4,
you will end up with the "File Name is not good_file.exe"
under the top OR. If you were to search your enterprise for all
files that were not "good_file.exe", that would be very,
very bad.
Now, onto pruning. The Prune option is only
available for logic items (ANDs and ORs) and will remove the entire
logic branch.
Going back to the example shown in Figure 4, if
you Prune the selected AND, the AND, in addition to all items under
it, will be deleted.
href="https://www.fireeye.com/content/dam/legacy/ammo/Figure-5-After-Prune.png">
width="300" height="41" class="size-medium wp-image-3962"
title="Figure 5: After Prune"
src="https://www.fireeye.com/content/dam/legacy/ammo/Figure-5-After-Prune-300x41.png" />Figure
5: After Prune
You can see in Figure 5 that the only items that
remain were directly under the top OR.
Now that we have that
cleared up, let's continue with the rest of the cool new stuff in href="/content/fireeye-www/en_US/services/freeware/ioc-editor.html">IOC
Editor.
Keyboard Shortcuts
Everybody loves keyboard shortcuts;
the less we have to type-out, the better. With that in mind, I've
gone through and added shortcuts where appropriate. Below is a list
of the shortcuts currently available in the editor:
href="https://www.fireeye.com/content/dam/legacy/ammo/Shortcuts.png">
width="287" height="267" class="size-full wp-image-3966"
title="Shortcuts" src="https://www.fireeye.com/content/dam/legacy/ammo/Shortcuts.png" />Shortcuts
Add Buttons (AND, OR, Item)
The buttons to add an AND,
OR, or Item have been moved to a menu bar above the definition area.
This takes up less space and allows for future expansion.
href="https://www.fireeye.com/content/dam/legacy/ammo/Figure-6-New-Add-Buttons.png">
width="297" height="157" class="size-full wp-image-3963"
title="Figure 6: New Add Buttons"
src="https://www.fireeye.com/content/dam/legacy/ammo/Figure-6-New-Add-Buttons.png" />Figure
6: New Add Buttons
If you just click the button, the
"Item" button remembers what you recently added. It also
has a drop down with a list of terms (same as right-clicking in the
definition area and selecting "Add Item.")
Properties Panel
The properties panel is an area to
the right of the definition area that will show all pertinent
details of the selected item. By default, the properties panel is
not shown. To display it, either click the button or use the Ctrl+P
keyboard shortcut.
For those who have used Visual Studio
before, the properties panel will look very familiar.
href="https://www.fireeye.com/content/dam/legacy/ammo/Figure-7-Properties.png">
width="242" height="216" class="size-full wp-image-3964"
title="Figure 7: Properties"
src="https://www.fireeye.com/content/dam/legacy/ammo/Figure-7-Properties.png" />Figure
7: Properties
Figure 7 shows the details that are given for a
selected item. Not all of the items are editable from here, but it
at least gives you a view into what's going on
behind-the-scenes.
You can also edit/add comments for the item.
With this upgrade, you can add a comment to individual items, such
as an MD5, that lets someone know what file it actually goes
with.
Improvements:
In addition to the new features,
there were a number of improvements (aka bug fixes).
Unsaved Changes Warning
An important change was the
rewording of the unsaved changes dialog box that better aligns with
other standard Windows applications.
NOTE: Read this carefully as this has changed from the
previous version of href="/content/fireeye-www/en_US/services/freeware/ioc-editor.html">IOC
Editor.
href="https://www.fireeye.com/content/dam/legacy/ammo/Figure-8-Unsaved-changes.png">
width="265" height="132" class="size-full wp-image-3965"
title="Figure 8: Unsaved changes"
src="https://www.fireeye.com/content/dam/legacy/ammo/Figure-8-Unsaved-changes.png" />Figure
8: Unsaved changes
Figure 8 shows the new wording presented when
exiting IOC Editor with unsaved changes.
Yes - saves changes and exits
No - does not save changes and exits
Cancel - cancels the exit process and does not save
changes
Description Improvements
The Description field has
been tweaked a bit, and now allows for proper display of carriage
returns and tabs. You now don't have to deal with descriptions that
look like this:
"This malware is evil⌷Why would
anyone have this⌷Report Immediately"
Too Many More
As I stated earlier in this post, I went
a little bug fix crazy. If you're interested in a full list of bug
fixes, please href="/content/fireeye-www/en_US/services/freeware/ioc-editor.html">click
here.
The Future:
There are still plenty of other
features and enhancements that I would like to make to href="/content/fireeye-www/en_US/services/freeware/ioc-editor.html">IOC
Editor, such as ioc_lint integration, additional options, etc.
I'm also looking forward to your feedback on the current
updates/additions.
