Add artifacts from Cyble shadowcat report

[netfl0]

https://cyble.com/blog/operation-shadowcat-targeting-indian-political-observers-via-a-stealthy-rat/

As I was modeling this out with the ontology I am keeping track of necessary new artifacts here:

• .LNK files as a subclass of file system link, not sure if we want to put under "soft link"
• Powershell Script File, we have Powershell Profile Script (this should be a child of the new one)
• We should probably make a distinction between Script Content and Script File
  • Digital Information: {Powershell,Python} Script
  • Digital Information Bearer: {Powershell,Python} Script File

  • The Powershell script in this case is a command line arguments to the powershell.exe program

• Need synonym or new file for DLL File.
• Need Image File or something to cover JPG / PNG etc... (how do we not have this?)
• Need to model Reflection.Assembly method in powershell somehow.
• QueueUserAPC

CC @ryantxu1

[aamedina]

images are a very rich source of metadata

[aamedina]

(XMP is serialized as RDF, BTW)

This can be embedded in all sorts of media.

[aamedina]

I think publishing d3fend as a semantic knowledge graph has potentially enabled the most future proof and powerful countermeasure yet devised to inform the implementation of user extensible logic-based detections against these kinds of stealthy artifacts. Scan everything in your environment into a knowledge graph of d3fend artifacts (the more metadata the better) and combine that with queries/rules + graph analytics to get great detections, but it requires a lot of expertise to do that right now. Imagine future d3fend-trained graph neural networks that can predict relations which are hard to capture with logic, where the neural networks predictive structure has been influenced by the grounded semantic inferences learned by using the knowledge graph during training. At least it's a dream.

[netfl0]

progress so far:
d3fend-shadowcat.json

[netfl0]

more progress
d3fend-shadowcat.json