http-request-pattern-1.xml

<stix:STIX_Package
	xmlns:example="http://example.com"
	xmlns:stix="http://stix.mitre.org/stix-1"
	xmlns:xlink="http://www.w3.org/1999/xlink"
	xmlns:xs="http://www.w3.org/2001/XMLSchema"
	xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
	xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
	xmlns:HTTPSessionObj="http://cybox.mitre.org/objects#HTTPSessionObject-2"
	xmlns:stixCommon="http://stix.mitre.org/common-1"
	xmlns:SocketAddressObj="http://cybox.mitre.org/objects#SocketAddressObject-1"
	xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
	xmlns:indicator="http://stix.mitre.org/Indicator-2"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
	xmlns:cybox="http://cybox.mitre.org/cybox-2"
	xmlns:NetworkConnectionObj="http://cybox.mitre.org/objects#NetworkConnectionObject-2"
	 id="example:STIXPackage-b6aab69d-1feb-41fb-8412-8cbf8560452c" version="1.2">
    <stix:Indicators>
        <stix:Indicator id="example:indicator-7b0c19d9-9711-4ac6-ae18-10ffba3a411e" timestamp="2014-05-08T09:00:00+00:00" xsi:type='indicator:IndicatorType'>
            <indicator:Title>IP Address for known C2 channel</indicator:Title>
            <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
            <indicator:Valid_Time_Position>
                <indicator:Start_Time precision="second">2014-05-08T09:00:00+00:00</indicator:Start_Time>
            </indicator:Valid_Time_Position>
            <indicator:Observable id="example:Observable-64d4ada3-2d9f-4b25-8838-5dfa9f24f2c7">
                <cybox:Object id="example:NetworkConnection-ee2588ee-27f5-4ab7-99bd-fbd3b10eff9f">
                    <cybox:Properties xsi:type="NetworkConnectionObj:NetworkConnectionObjectType">
                        <NetworkConnectionObj:Destination_Socket_Address xsi:type="SocketAddressObj:SocketAddressObjectType">
                            <SocketAddressObj:IP_Address xsi:type="AddressObj:AddressObjectType" category="ipv4-addr">
                                <AddressObj:Address_Value condition="Equals">198.51.100.53</AddressObj:Address_Value>
                            </SocketAddressObj:IP_Address>
                        </NetworkConnectionObj:Destination_Socket_Address>
                        <NetworkConnectionObj:Layer7_Connections>
                            <NetworkConnectionObj:HTTP_Session xsi:type="HTTPSessionObj:HTTPSessionObjectType">
                                <HTTPSessionObj:HTTP_Request_Response>
                                    <HTTPSessionObj:HTTP_Client_Request>
                                        <HTTPSessionObj:HTTP_Request_Line>
                                            <HTTPSessionObj:HTTP_Method condition="Equals">get</HTTPSessionObj:HTTP_Method>
                                        </HTTPSessionObj:HTTP_Request_Line>
                                    </HTTPSessionObj:HTTP_Client_Request>
                                </HTTPSessionObj:HTTP_Request_Response>
                            </NetworkConnectionObj:HTTP_Session>
                        </NetworkConnectionObj:Layer7_Connections>
                    </cybox:Properties>
                </cybox:Object>
            </indicator:Observable>
        </stix:Indicator>
    </stix:Indicators>
</stix:STIX_Package>