"Type not syncing"; Event not appearing

[misp]

"Type not syncing"; Event not appearing

[FloatingGhost]

Working as intended. No representation of WinDriver exists in the MISP type list.

Closing as WONTFIX.

[FloatingGhost]

Interestingly that STIX file does throw AST errors though, implying there are some really weird strings in there

[FloatingGhost]

There you go, fixed the weird string issues. Update the converter and try again

[adulau]

@combobulator Could you share with us the STIX file or at least the Windows Driver Device Object Struct shared? I would like to make a misp-object out of it. misp-objects

[combobulator]

@adulau Here's a copy of the specific STIX: stuxnet.stix.xml.txt.
It was pulled from this repo

[adulau]

Interesting so it's just the name of driver in the example:

<cybox:Object>
<cybox:Properties xsi:type="WinDriverObj:WindowsDriverObjectType">
        <WinDriverObj:Device_Object_List>
            <WinDriverObj:Device_Object_Struct>
                <WinDriverObj:Attached_To_Driver_Name condition="Contains">fs_rec.sys</WinDriverObj:Attached_To_Driver_Name>
            </WinDriverObj:Device_Object_Struct>
        </WinDriverObj:Device_Object_List>
    </cybox:Properties>
</cybox:Object>

Not the complete struct as mentioned in the specification. Now the funky part, is "fs_rec.sys" really the driver name? or the filename as used it here? (http://docs.oasis-open.org/cti/cybox/v2.1.1/csprd01/part66-win-driver/cybox-v2.1.1-csprd01-part66-win-driver.html#_Toc458614796)