feat(malwarebazaar): add external references and link indicators to malware family (#6940, #2044)

[romain-filigran]

Proposed changes

This PR improves the malwarebazaar (external-import) connector with two related enhancements.

1. Add external references to indicators — closes #6940

The connector did not attach any External Reference to the entities it created, so
analysts could not navigate from an OpenCTI entity back to the corresponding
MalwareBazaar sample page.

• Add a MalwareBazaar external reference pointing to
  https://bazaar.abuse.ch/sample/{sha256}/ on each Indicator and File observable.
• Implemented purely via the STIX bundle (stix2.ExternalReference), not through direct
  OpenCTI API calls, unlike the legacy malwarebazaar-recent-additions connector.

2. Create malware from the signature and link it to the indicator — closes #2044

The MalwareBazaar signature column (malware family) was not exploited.

• Create a Malware SDO from the signature field (deterministic id via
  Malware.generate_id, is_family=True) when a signature is present.
• Add an indicates relationship from the Indicator to the Malware.
• The signature == null case (frequent) is handled and simply skips malware creation.

Note: the other points originally listed in #2044 (applying a marking on indicators,
using based-on instead of related-to) are already satisfied by the current
connector, so only the signature/malware part is implemented here.

Related issues

• Closes feat(MalwareBazaar): Add external references to indicators linking to MalwareBazaar #6940
• Closes feat(malwarebazaar): improve the connector #2044

Checklist

• I consider the submitted work as finished
• I have signed my commits using GPG key.
• I tested the code for its functionality using different use cases
• I added/update the relevant documentation (either on github or on notion)
• Where necessary I refactored code to improve the overall quality

Further comments

[github-actions]

🔴 Connector Linter errors detected

• VC309: Relative import: from .client_api import ConnectorClient (external-import/malwarebazaar/src/malwarebazaar_connector/connector.py:7)
• VC309: Relative import: from .converter_to_stix import ConverterToStix (external-import/malwarebazaar/src/malwarebazaar_connector/connector.py:8)
• VC402: Dockerfile uses entrypoint.sh at line 17 (external-import/malwarebazaar/Dockerfile:17)

[Copilot]

Pull request overview

This PR enhances the external-import/malwarebazaar connector by enriching generated STIX objects with (1) MalwareBazaar sample-page external references and (2) optional Malware family creation from the signature field, linked from Indicators via an indicates relationship.

Changes:

• Add a MalwareBazaar sample-page ExternalReference to each generated Indicator and File observable.
• Create a Malware SDO when signature is present and link Indicator → Malware with an indicates relationship.
• Update connector collection logic and README behavior documentation to reflect the new objects/relationships.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
external-import/malwarebazaar/src/malwarebazaar_connector/converter_to_stix.py	Adds external-reference creation, malware creation from signature, and an Indicator→Malware indicates relationship.
external-import/malwarebazaar/src/malwarebazaar_connector/connector.py	Includes the optional Malware and relationship in the outgoing STIX bundle.
external-import/malwarebazaar/README.md	Documents the updated behavior and entity mapping (Indicator + optional Malware).

Comments suppressed due to low confidence (2)

external-import/malwarebazaar/src/malwarebazaar_connector/converter_to_stix.py:133

• object_marking_refs should be provided as a list. Using self.tlp_marking directly is inconsistent with the rest of the repo and can lead to invalid STIX JSON. Use object_marking_refs=[self.tlp_marking].

            pattern_type="stix",
            description=indicator_description,
            labels=labels,
            created_by_ref=self.author["id"],
            object_marking_refs=self.tlp_marking,
            external_references=[external_reference],
            custom_properties={

external-import/malwarebazaar/src/malwarebazaar_connector/converter_to_stix.py:153

• object_marking_refs on the new Malware SDO should be a list. Use object_marking_refs=[self.tlp_marking] to ensure valid STIX output and consistency with other connectors.

        malware = stix2.Malware(
            id=Malware.generate_id(signature),
            name=signature,
            is_family=True,
            created_by_ref=self.author["id"],
            object_marking_refs=self.tlp_marking,
        )