build(deps): bump urllib3 from 2.5.0 to 2.6.0

.github/actions/setup-python/action.yml

@@ -0,0 +1,23 @@
+name: 'Setup Python Environment'
+description: 'Checkout code, setup Python, and install dependencies'
+runs:
+  using: 'composite'
+  steps:
+    - name: Checkout code
+      uses: actions/checkout@v5
+
+    - name: Set up Python
+      uses: actions/setup-python@v6
+      with:
+        python-version: '3.x'
+
+    - name: Create virtual environment and install dependencies
+      shell: bash
+      run: |
+        python3 -m venv .venv
+        . .venv/bin/activate
+        pip install -r requirements.txt
+
+        # Set environment variables for subsequent steps
+        echo "VIRTUAL_ENV=$VIRTUAL_ENV" >> $GITHUB_ENV
+        echo "$VIRTUAL_ENV/bin" >> $GITHUB_PATH

.github/workflows/test-schema.yml

@@ -0,0 +1,43 @@
+name: Test IOC Schema
+
+on: [push, pull_request, merge_group, workflow_dispatch]
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    name: Lint Schema File
+    steps:
+    - name: Setup Python Environment
+      uses: ./.github/actions/setup-python
+
+    - name: Check JSON schema
+      run: check-jsonschema --check-metaschema yaml-ioc-schema.json
+
+  valid-iocs-check:
+    runs-on: ubuntu-latest
+    needs: lint
+    name: Test Valid IOCs
+    steps:
+    - name: Setup Python Environment
+      uses: ./.github/actions/setup-python
+
+    - name: Validate IOC files
+      run: |
+        for f in testdata/valid/*.yml; do
+          check-jsonschema --verbose --schemafile yaml-ioc-schema.json "$f" || exit $?
+        done
+
+  invalid-iocs-check:
+    runs-on: ubuntu-latest
+    needs: lint
+    name: Test Invalid IOCs
+    steps:
+    - name: Setup Python Environment
+      uses: ./.github/actions/setup-python
+
+    - name: Verify invalid IOC files fail validation
+      run: |
+        for f in testdata/invalid/*.yml; do
+          check-jsonschema --schemafile yaml-ioc-schema.json "$f" && exit 1
+        done
+        exit 0

README.md

@@ -1,2 +1,4 @@
-# yaml-ioc-specification
-Specification for the IOCs in YAML format. It is used in Nextron products such as THOR.
+# Nextron YAML IOC Specification
+
+This repository is used to maintain the specification for the IOC YAML format
+used in Nextron products such as THOR.

requirements.txt

@@ -0,0 +1,15 @@
+attrs==25.3.0
+certifi==2025.8.3
+charset-normalizer==3.4.3
+check-jsonschema==0.33.3
+click==8.2.1
+idna==3.10
+jsonschema==4.25.1
+jsonschema-specifications==2025.9.1
+referencing==0.36.2
+regress==2025.5.1
+requests==2.32.5
+rpds-py==0.27.1
+ruamel.yaml==0.18.15
+ruamel.yaml.clib==0.2.12
+urllib3==2.6.0

testdata/invalid/bad_ioc_type.yml

@@ -0,0 +1,13 @@
+title: Test report
+id: 047b9ad4-6ad1-439e-b64a-38dae67dede2
+references:
+    - My reference link
+date: 2025-09-09
+version: 2.0.0
+iocs:
+    files:
+        value: '.bat$'
+        score: 70
+    invalid_type:
+        value: 'bad'
+        score: 70

testdata/invalid/invalid_type.yml

@@ -0,0 +1,11 @@
+title: Test report
+id: 047b9ad4-6ad1-439e-b64a-38dae67dede2
+references:
+    - My reference link
+date: 2025-09-09
+version: 2.0.0
+iocs:
+    hashes:
+        - value: '000000000000000000000000000000000000000'
+          score: 70
+          type: sha256

testdata/invalid/missing_metadata.yml

@@ -0,0 +1,8 @@
+title: Test report
+id: 047b9ad4-6ad1-439e-b64a-38dae67dede2
+date: 2025-09-09
+version: 2.0.0
+iocs:
+    files:
+        value: '.bat$'
+        score: 70

testdata/invalid/old_case_insensitive.yml

@@ -0,0 +1,11 @@
+title: Test report
+id: 047b9ad4-6ad1-439e-b64a-38dae67dede2
+references:
+    - My reference link
+date: 2025-09-09
+version: 2.0.0
+iocs:
+    files:
+        - value: '(?i).bat$'
+          score: 70
+          type: regex

testdata/invalid/typo.yml

@@ -0,0 +1,11 @@
+title: Test report
+id: 047b9ad4-6ad1-439e-b64a-38dae67dede2
+references:
+    - My reference link
+date: 2025-09-09
+version: 2.0.0
+iocs:
+    files:
+        - valeu: '.bat$'
+          score: 70
+          type: regex

testdata/valid/case_sensitivity.yml

@@ -0,0 +1,25 @@
+title: Test report
+id: 047b9ad4-6ad1-439e-b64a-38dae67dede2
+references:
+    - My reference link
+date: 2025-09-09
+version: 2.0.0
+iocs:
+    files:
+        - value: '.bat$'
+          score: 70
+          type: regex
+          case_sensitive: false
+          false_positives:
+            value: '\DisableDefender.bat'
+            type: plain
+            case_sensitive: true
+        - value: '.cmd'
+          score: 80
+          type: plain
+          case_sensitive: true
+          false_positives:
+            value: '\\Program Files\\'
+            type: regex
+            case_sensitive: false
+

testdata/valid/false_positives.yml

@@ -0,0 +1,24 @@
+title: Test report
+id: 047b9ad4-6ad1-439e-b64a-38dae67dede2
+references:
+    - My reference link
+date: 2025-09-09
+version: 2.0.0
+iocs:
+    files:
+        - value: '.bat$'
+          score: 70
+          type: regex
+          false_positives:
+            value: '\DisableDefender.bat'
+            type: plain
+        - value: '.cmd'
+          score: 80
+          type: plain
+          false_positives:
+            - value:
+               - '\SomeOtherFile.cmd'
+               - '\Valid.cmd'
+            - value: '\\Program Files\\.*\.cmd$'
+              type: regex
+

testdata/valid/ioc_types.yml

@@ -0,0 +1,25 @@
+title: Test report
+id: 047b9ad4-6ad1-439e-b64a-38dae67dede2
+references:
+    - My reference link
+date: 2025-09-09
+version: 2.0.0
+iocs:
+    files:
+        value: ':\Users\Public\Pictures\pbs'
+        score: 70
+    c2s:
+        value: 'blogs.libraryutilitis.live'
+        score: 80
+    events:
+        value: 'niiopokjdfk'
+        score: 90
+    mutexes:
+        value: 'Global\A7B8C9D0E1F2G3H4I5J6K7L8M9N0O1P2'
+        score: 50
+    named_pipes:
+        value: 'PipeExample'
+        score: 60
+    hashes:
+        value: 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
+        score: 100

testdata/valid/multiple_patterns.yml

@@ -0,0 +1,14 @@
+title: Test report
+id: 047b9ad4-6ad1-439e-b64a-38dae67dede2
+references:
+    - My reference link
+date: 2025-09-09
+version: 2.0.0
+iocs:
+    files:
+        - value: ':\Users\Public\Pictures\pbs'
+          score: 70
+        - value:
+              - '\BgAgent.ETW'
+              - '\\dll[0-9]{0,5}\.xor'
+          score: 80

testdata/valid/stanza_types.yml

@@ -0,0 +1,14 @@
+title: Test report
+id: 047b9ad4-6ad1-439e-b64a-38dae67dede2
+references:
+    - My reference link
+date: 2025-09-09
+version: 2.0.0
+iocs:
+    files:
+        - value: '.bat$'
+          score: 70
+          type: regex
+        - value: 'a.bat'
+          score: 80
+          type: plain