558 lines
14 KiB
JSON
558 lines
14 KiB
JSON
|
{
|
||
|
|
"exercise": {
|
||
|
|
"description": "MISP Encoding Exercise : Scam Call",
|
||
|
|
"expanded": "MISP Encoding Exercise : Scam Call",
|
||
|
|
"meta": {
|
||
|
|
"author": "MISP Project",
|
||
|
|
"level": "beginner",
|
||
|
|
"priority": 5
|
||
|
|
},
|
||
|
|
"name": "MISP Encoding Exercise : Scam Call",
|
||
|
|
"namespace": "data-model",
|
||
|
|
"tags": [
|
||
|
|
"exercise:software-scope=\"misp\"",
|
||
|
|
"state:production"
|
||
|
|
],
|
||
|
|
"total_duration": "7200",
|
||
|
|
"uuid": "6c61b3a5-a760-4bac-be23-de97af397c2f",
|
||
|
|
"version": "20240702"
|
||
|
|
},
|
||
|
|
"inject_flow": [
|
||
|
|
{
|
||
|
|
"description": "event-creation",
|
||
|
|
"inject_uuid": "de9f4c9b-dc97-4e84-85f3-859f30d3a3cd",
|
||
|
|
"reporting_callback": [],
|
||
|
|
"requirements": {},
|
||
|
|
"sequence": {
|
||
|
|
"completion_trigger": [
|
||
|
|
"time_expiration",
|
||
|
|
"completion"
|
||
|
|
],
|
||
|
|
"followed_by": [
|
||
|
|
],
|
||
|
|
"trigger": [
|
||
|
|
"startex"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
"timing": {
|
||
|
|
"triggered_at": null
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"description": "IP-address",
|
||
|
|
"inject_uuid": "cdf465dc-a859-43ed-b782-510427cfb451",
|
||
|
|
"reporting_callback": [],
|
||
|
|
"requirements": {
|
||
|
|
"inject_uuid": "de9f4c9b-dc97-4e84-85f3-859f30d3a3cd"
|
||
|
|
},
|
||
|
|
"sequence": {
|
||
|
|
"completion_trigger": [
|
||
|
|
"time_expiration",
|
||
|
|
"completion"
|
||
|
|
],
|
||
|
|
"followed_by": [
|
||
|
|
],
|
||
|
|
"trigger": [
|
||
|
|
]
|
||
|
|
},
|
||
|
|
"timing": {
|
||
|
|
"triggered_at": null
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"description": "malicious-payload",
|
||
|
|
"inject_uuid": "79c8a538-28de-4edf-b0e2-253c59cbb973",
|
||
|
|
"reporting_callback": [],
|
||
|
|
"requirements": {
|
||
|
|
"inject_uuid": "de9f4c9b-dc97-4e84-85f3-859f30d3a3cd"
|
||
|
|
},
|
||
|
|
"sequence": {
|
||
|
|
"completion_trigger": [
|
||
|
|
"time_expiration",
|
||
|
|
"completion"
|
||
|
|
],
|
||
|
|
"followed_by": [
|
||
|
|
],
|
||
|
|
"trigger": [
|
||
|
|
]
|
||
|
|
},
|
||
|
|
"timing": {
|
||
|
|
"triggered_at": null
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"description": "Download URL",
|
||
|
|
"inject_uuid": "60c6cfcc-99be-4b98-9eb7-e0a3e77bb449",
|
||
|
|
"reporting_callback": [],
|
||
|
|
"requirements": {
|
||
|
|
"inject_uuid": "de9f4c9b-dc97-4e84-85f3-859f30d3a3cd"
|
||
|
|
},
|
||
|
|
"sequence": {
|
||
|
|
"completion_trigger": [
|
||
|
|
"time_expiration",
|
||
|
|
"completion"
|
||
|
|
],
|
||
|
|
"followed_by": [
|
||
|
|
],
|
||
|
|
"trigger": [
|
||
|
|
]
|
||
|
|
},
|
||
|
|
"timing": {
|
||
|
|
"triggered_at": null
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"description": "IBAN Number",
|
||
|
|
"inject_uuid": "ab32278b-a8e4-4539-8c1b-f262a2706ca8",
|
||
|
|
"reporting_callback": [],
|
||
|
|
"requirements": {
|
||
|
|
"inject_uuid": "de9f4c9b-dc97-4e84-85f3-859f30d3a3cd"
|
||
|
|
},
|
||
|
|
"sequence": {
|
||
|
|
"completion_trigger": [
|
||
|
|
"time_expiration",
|
||
|
|
"completion"
|
||
|
|
],
|
||
|
|
"followed_by": [
|
||
|
|
],
|
||
|
|
"trigger": [
|
||
|
|
]
|
||
|
|
},
|
||
|
|
"timing": {
|
||
|
|
"triggered_at": null
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"description": "Phone Number",
|
||
|
|
"inject_uuid": "ee4a684e-2648-419a-bd65-29ab219660c4",
|
||
|
|
"reporting_callback": [],
|
||
|
|
"requirements": {
|
||
|
|
"inject_uuid": "de9f4c9b-dc97-4e84-85f3-859f30d3a3cd"
|
||
|
|
},
|
||
|
|
"sequence": {
|
||
|
|
"completion_trigger": [
|
||
|
|
"time_expiration",
|
||
|
|
"completion"
|
||
|
|
],
|
||
|
|
"followed_by": [
|
||
|
|
],
|
||
|
|
"trigger": [
|
||
|
|
]
|
||
|
|
},
|
||
|
|
"timing": {
|
||
|
|
"triggered_at": null
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"description": "Person",
|
||
|
|
"inject_uuid": "14d11e1b-6609-47d5-9867-91996f432f34",
|
||
|
|
"reporting_callback": [],
|
||
|
|
"requirements": {
|
||
|
|
"inject_uuid": "de9f4c9b-dc97-4e84-85f3-859f30d3a3cd"
|
||
|
|
},
|
||
|
|
"sequence": {
|
||
|
|
"completion_trigger": [
|
||
|
|
"time_expiration",
|
||
|
|
"completion"
|
||
|
|
],
|
||
|
|
"followed_by": [
|
||
|
|
],
|
||
|
|
"trigger": [
|
||
|
|
]
|
||
|
|
},
|
||
|
|
"timing": {
|
||
|
|
"triggered_at": null
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"description": "Contextualization",
|
||
|
|
"inject_uuid": "4c242d49-fcf7-4c76-974b-6d5983c0eff9",
|
||
|
|
"reporting_callback": [],
|
||
|
|
"requirements": {
|
||
|
|
"inject_uuid": ""
|
||
|
|
},
|
||
|
|
"sequence": {
|
||
|
|
"completion_trigger": [
|
||
|
|
"time_expiration",
|
||
|
|
"completion"
|
||
|
|
],
|
||
|
|
"followed_by": [
|
||
|
|
],
|
||
|
|
"trigger": [
|
||
|
|
]
|
||
|
|
},
|
||
|
|
"timing": {
|
||
|
|
"triggered_at": null
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"description": "Published",
|
||
|
|
"inject_uuid": "68cc60ff-e659-4589-88e5-7490fa4e1dfa",
|
||
|
|
"reporting_callback": [],
|
||
|
|
"requirements": {
|
||
|
|
"inject_uuid": "de9f4c9b-dc97-4e84-85f3-859f30d3a3cd"
|
||
|
|
},
|
||
|
|
"sequence": {
|
||
|
|
"completion_trigger": [
|
||
|
|
"time_expiration",
|
||
|
|
"completion"
|
||
|
|
],
|
||
|
|
"followed_by": [
|
||
|
|
],
|
||
|
|
"trigger": [
|
||
|
|
]
|
||
|
|
},
|
||
|
|
"timing": {
|
||
|
|
"triggered_at": null
|
||
|
|
}
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"inject_payloads": [
|
||
|
|
],
|
||
|
|
"injects": [
|
||
|
|
{
|
||
|
|
"action": "event-creation",
|
||
|
|
"inject_evaluation": [
|
||
|
|
{
|
||
|
|
"parameters": [
|
||
|
|
{
|
||
|
|
".Event.info": {
|
||
|
|
"comparison": "contains",
|
||
|
|
"values": [
|
||
|
|
"scam",
|
||
|
|
"call"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"result": "MISP Event created",
|
||
|
|
"evaluation_strategy": "data_filtering",
|
||
|
|
"evaluation_context": {
|
||
|
|
},
|
||
|
|
"score_range": [
|
||
|
|
0,
|
||
|
|
10
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"name": "Event Creation",
|
||
|
|
"target_tool": "MISP",
|
||
|
|
"uuid": "de9f4c9b-dc97-4e84-85f3-859f30d3a3cd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"action": "ip-address",
|
||
|
|
"inject_evaluation": [
|
||
|
|
{
|
||
|
|
"parameters": [
|
||
|
|
{
|
||
|
|
".Event.info": {
|
||
|
|
"comparison": "contains",
|
||
|
|
"values": [
|
||
|
|
"scam",
|
||
|
|
"call"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"[.Event.Object[].Attribute[], .Event.Attribute[]] | .[] | select(.value == \"194.78.89.250\").to_ids": {
|
||
|
|
"extract_type": "all",
|
||
|
|
"comparison": "contains",
|
||
|
|
"values": [
|
||
|
|
true,
|
||
|
|
1
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"result": "IP Address added",
|
||
|
|
"evaluation_strategy": "data_filtering",
|
||
|
|
"evaluation_context": {
|
||
|
|
},
|
||
|
|
"score_range": [
|
||
|
|
0,
|
||
|
|
20
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"name": "IP Address",
|
||
|
|
"target_tool": "MISP",
|
||
|
|
"uuid": "cdf465dc-a859-43ed-b782-510427cfb451"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"action": "malware-sample",
|
||
|
|
"inject_evaluation": [
|
||
|
|
{
|
||
|
|
"parameters": [
|
||
|
|
{
|
||
|
|
".Event.info": {
|
||
|
|
"comparison": "contains",
|
||
|
|
"values": [
|
||
|
|
"scam",
|
||
|
|
"call"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
".Event.Object[].Attribute[] | select((.type == \"sha1\")).value": {
|
||
|
|
"extract_type": "all",
|
||
|
|
"comparison": "equals",
|
||
|
|
"values": [
|
||
|
|
"04d496d39bc9409bfdabdeb07002b97093b58f77"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"result": "Malware sample added",
|
||
|
|
"evaluation_strategy": "data_filtering",
|
||
|
|
"evaluation_context": {
|
||
|
|
},
|
||
|
|
"score_range": [
|
||
|
|
0,
|
||
|
|
20
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"name": "Malware sample",
|
||
|
|
"target_tool": "MISP",
|
||
|
|
"uuid": "79c8a538-28de-4edf-b0e2-253c59cbb973"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"action": "url",
|
||
|
|
"inject_evaluation": [
|
||
|
|
{
|
||
|
|
"parameters": [
|
||
|
|
{
|
||
|
|
".Event.info": {
|
||
|
|
"comparison": "contains",
|
||
|
|
"values": [
|
||
|
|
"scam",
|
||
|
|
"call"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
".Event.Object[].Attribute[] | select((.type == \"url\")).value": {
|
||
|
|
"extract_type": "all",
|
||
|
|
"comparison": "equals",
|
||
|
|
"values": [
|
||
|
|
"https://zdgyot.ugic0k.ru/assets/bin.exe"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
".Event.Object[].Attribute[] | select((.type == \"domain\")).value": {
|
||
|
|
"extract_type": "all",
|
||
|
|
"comparison": "equals",
|
||
|
|
"values": [
|
||
|
|
"zdgyot.ugic0k.ru"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"result": "Download URL added",
|
||
|
|
"evaluation_strategy": "data_filtering",
|
||
|
|
"evaluation_context": {
|
||
|
|
},
|
||
|
|
"score_range": [
|
||
|
|
0,
|
||
|
|
20
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"name": "Download URL",
|
||
|
|
"target_tool": "MISP",
|
||
|
|
"uuid": "60c6cfcc-99be-4b98-9eb7-e0a3e77bb449"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"action": "iban",
|
||
|
|
"inject_evaluation": [
|
||
|
|
{
|
||
|
|
"parameters": [
|
||
|
|
{
|
||
|
|
".Event.info": {
|
||
|
|
"comparison": "contains",
|
||
|
|
"values": [
|
||
|
|
"scam",
|
||
|
|
"call"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"[.Event.Object[].Attribute[], .Event.Attribute[]] | .[] | select((.type == \"iban\")).value": {
|
||
|
|
"extract_type": "all",
|
||
|
|
"comparison": "contains",
|
||
|
|
"values": [
|
||
|
|
"GB29NWBK60161331926819"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"result": "IBAN Number added",
|
||
|
|
"evaluation_strategy": "data_filtering",
|
||
|
|
"evaluation_context": {
|
||
|
|
},
|
||
|
|
"score_range": [
|
||
|
|
0,
|
||
|
|
20
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"name": "IBAN Number",
|
||
|
|
"target_tool": "MISP",
|
||
|
|
"uuid": "ab32278b-a8e4-4539-8c1b-f262a2706ca8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"action": "phone",
|
||
|
|
"inject_evaluation": [
|
||
|
|
{
|
||
|
|
"parameters": [
|
||
|
|
{
|
||
|
|
".Event.info": {
|
||
|
|
"comparison": "contains",
|
||
|
|
"values": [
|
||
|
|
"scam",
|
||
|
|
"call"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"[.Event.Object[].Attribute[], .Event.Attribute[]] | .[] | select((.type == \"phone-number\")).value": {
|
||
|
|
"extract_type": "all",
|
||
|
|
"comparison": "contains-regex",
|
||
|
|
"values": [
|
||
|
|
"\\+?12243359185"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"result": "Phone Number added",
|
||
|
|
"evaluation_strategy": "data_filtering",
|
||
|
|
"evaluation_context": {
|
||
|
|
},
|
||
|
|
"score_range": [
|
||
|
|
0,
|
||
|
|
20
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"name": "Phone Number",
|
||
|
|
"target_tool": "MISP",
|
||
|
|
"uuid": "ee4a684e-2648-419a-bd65-29ab219660c4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"action": "person",
|
||
|
|
"inject_evaluation": [
|
||
|
|
{
|
||
|
|
"parameters": [
|
||
|
|
{
|
||
|
|
".Event.info": {
|
||
|
|
"comparison": "contains",
|
||
|
|
"values": [
|
||
|
|
"scam",
|
||
|
|
"call"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
".Event.Object[] | select((.name == \"domain-ip\")).distribution": {
|
||
|
|
"comparison": "contains",
|
||
|
|
"values": [
|
||
|
|
"0",
|
||
|
|
"1",
|
||
|
|
"4"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"result": "Person added",
|
||
|
|
"evaluation_strategy": "data_filtering",
|
||
|
|
"evaluation_context": {
|
||
|
|
},
|
||
|
|
"score_range": [
|
||
|
|
0,
|
||
|
|
20
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"name": "Person",
|
||
|
|
"target_tool": "MISP",
|
||
|
|
"uuid": "14d11e1b-6609-47d5-9867-91996f432f34"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"action": "context",
|
||
|
|
"inject_evaluation": [
|
||
|
|
{
|
||
|
|
"parameters": [
|
||
|
|
{
|
||
|
|
".Event.info": {
|
||
|
|
"comparison": "contains",
|
||
|
|
"values": [
|
||
|
|
"scam",
|
||
|
|
"call"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
".Event.Tag | select(length > 0) | .[].name": {
|
||
|
|
"extract_type": "all",
|
||
|
|
"comparison": "count",
|
||
|
|
"values": [
|
||
|
|
">=3"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"result": "Context added",
|
||
|
|
"evaluation_strategy": "data_filtering",
|
||
|
|
"evaluation_context": {
|
||
|
|
},
|
||
|
|
"score_range": [
|
||
|
|
0,
|
||
|
|
20
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"name": "Contextualization",
|
||
|
|
"target_tool": "MISP",
|
||
|
|
"uuid": "4c242d49-fcf7-4c76-974b-6d5983c0eff9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"action": "published",
|
||
|
|
"inject_evaluation": [
|
||
|
|
{
|
||
|
|
"parameters": [
|
||
|
|
{
|
||
|
|
".Event.info": {
|
||
|
|
"comparison": "contains",
|
||
|
|
"values": [
|
||
|
|
"scam",
|
||
|
|
"call"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
".Event.published": {
|
||
|
|
"comparison": "equals",
|
||
|
|
"values": [
|
||
|
|
"1"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"result": "Event published",
|
||
|
|
"evaluation_strategy": "data_filtering",
|
||
|
|
"evaluation_context": {
|
||
|
|
},
|
||
|
|
"score_range": [
|
||
|
|
0,
|
||
|
|
20
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"name": "Published",
|
||
|
|
"target_tool": "MISP",
|
||
|
|
"uuid": "68cc60ff-e659-4589-88e5-7490fa4e1dfa"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
|