icmp-pattern.xml

<stix:STIX_Package
	xmlns:example="http://example.com"
	xmlns:NetworkConnectionObj="http://cybox.mitre.org/objects#NetworkConnectionObject-2"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:xs="http://www.w3.org/2001/XMLSchema"
	xmlns:cybox="http://cybox.mitre.org/cybox-2"
	xmlns:indicator="http://stix.mitre.org/Indicator-2"
	xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
	xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
	xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
	xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
	xmlns:xlink="http://www.w3.org/1999/xlink"
	xmlns:stixCommon="http://stix.mitre.org/common-1"
	xmlns:stix="http://stix.mitre.org/stix-1"
	xmlns:PacketObj="http://cybox.mitre.org/objects#PacketObject-2"
	 id="example:STIXPackage-4ea2f83e-f012-48ad-b90b-21ff4d572872" version="1.2">
    <stix:Indicators>
        <stix:Indicator id="example:indicator-cb2ae57d-c4db-438b-a1a4-b069410bc2de" timestamp="2014-05-08T09:00:00+00:00" xsi:type='indicator:IndicatorType'>
            <indicator:Title>IP Address for known C2 channel</indicator:Title>
            <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
            <indicator:Valid_Time_Position>
                <indicator:Start_Time precision="second">2014-05-08T09:00:00+00:00</indicator:Start_Time>
            </indicator:Valid_Time_Position>
            <indicator:Observable id="example:Observable-aec557cb-c7a6-4f60-8cfa-142d8f130467">
                <cybox:Object id="example:NetworkConnection-ef7d3099-c7ef-4577-8927-90fa2cc06be2">
                    <cybox:Properties xsi:type="NetworkConnectionObj:NetworkConnectionObjectType">
                    </cybox:Properties>
                    <cybox:Related_Objects>
                        <cybox:Related_Object id="example:NetworkPacket-4a0bfdb1-3f39-45b0-9000-25fdc9907971">
                            <cybox:Properties xsi:type="PacketObj:NetworkPacketObjectType">
                                <PacketObj:Internet_Layer>
                                    <PacketObj:ICMPv4>
                                        <PacketObj:ICMPv4_Header>
                                            <PacketObj:Type condition="Equals">08</PacketObj:Type>
                                            <PacketObj:Code condition="Equals">00</PacketObj:Code>
                                        </PacketObj:ICMPv4_Header>
                                    </PacketObj:ICMPv4>
                                </PacketObj:Internet_Layer>
                            </cybox:Properties>
                            <cybox:Relationship>ICMP_Packet</cybox:Relationship>
                        </cybox:Related_Object>
                    </cybox:Related_Objects>
                </cybox:Object>
            </indicator:Observable>
        </stix:Indicator>
    </stix:Indicators>
</stix:STIX_Package>