MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-22 14:57:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
misp-galaxy/clusters/mitre-pre-attack-intrusion-set.json

381 lines
12 KiB
JSON
Raw Permalink Normal View History

add MITRE Galaxies V2.0
2018-02-21 15:28:11 +00:00
{
jq
2018-05-19 10:57:20 +00:00
"authors": [
"MITRE"
],
jq
2018-10-19 08:23:09 +00:00
"category": "actor",
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
"description": "Name of ATT&CK Group",
fix: Duplicate values, typos.
2019-05-06 15:17:16 +00:00
"name": "Pre Attack - Intrusion Set",
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
"source": "https://github.com/mitre/cti",
"type": "mitre-pre-attack-intrusion-set",
"uuid": "1fdc8fa2-1708-11e8-99a3-67b4efc13c4f",
jq
2018-05-19 10:57:20 +00:00
"values": [
{
"description": "APT16 is a China-based threat group that has launched spearphishing campaigns targeting Japanese and Taiwanese organizations. (Citation: FireEye EPS Awakens Part 2)",
"meta": {
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
"external_id": "G0023",
jq
2018-05-19 10:57:20 +00:00
"refs": [
"https://attack.mitre.org/wiki/Group/G0023",
"https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html"
],
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
"synonyms": [
"APT16"
]
jq
2018-05-19 10:57:20 +00:00
},
chg: MITRE relationships included in the respective cluster.
2018-10-17 06:08:58 +00:00
"related": [
{
"dest-uuid": "3cab1b76-2f40-4cd0-8d2c-7ed16eeb909c",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
"uuid": "d6e88e18-81e8-4709-82d8-973095da1e70",
"value": "APT16 - G0023"
jq
2018-05-19 10:57:20 +00:00
},
{
"description": "APT28 is a threat group that has been attributed to the Russian government. (Citation: FireEye APT28) (Citation: SecureWorks TG-4127) (Citation: FireEye APT28) January 2017 (Citation: GRIZZLY STEPPE JAR) This group reportedly compromised the Democratic National Committee in April 2016. (Citation: Crowdstrike DNC June 2016)",
"meta": {
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
"external_id": "G0007",
"refs": [
"https://attack.mitre.org/wiki/Group/G0007",
"https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/",
"https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf",
"https://www.secureworks.com/research/threat-group-4127-targets-hillary-clinton-presidential-campaign"
],
jq
2018-05-19 10:57:20 +00:00
"synonyms": [
"APT28",
"Sednit",
"Sofacy",
"Pawn Storm",
"Fancy Bear",
"STRONTIUM",
"Tsar Team",
"Threat Group-4127",
"TG-4127"
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
]
jq
2018-05-19 10:57:20 +00:00
},
chg: [mapping] Generated automatic mapping between clusters
2018-08-14 07:32:24 +00:00
"related": [
{
"dest-uuid": "213cdde9-c11a-4ea9-8ce0-c868e9826fec",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "5b4ee3ea-eee3-4c8e-8323-85ae32658754",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
chg: MITRE relationships included in the respective cluster.
2018-10-17 06:08:58 +00:00
},
{
"dest-uuid": "62b8c999-dcc0-4755-bd69-09442d9359f5",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [mitre att&ck] updated with new version
2019-03-20 11:37:38 +00:00
},
{
"dest-uuid": "6aac77c4-eaf2-4366-8c13-ce50ab951f38",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [mapping] Generated automatic mapping between clusters
2018-08-14 07:32:24 +00:00
}
],
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
"uuid": "bef4c620-0787-42a8-a96d-b7eb6e85917c",
"value": "APT28 - G0007"
jq
2018-05-19 10:57:20 +00:00
},
{
"description": "Cleaver is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. (Citation: Cylance Cleaver) Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 (TG-2889). (Citation: Dell Threat Group 2889)",
"meta": {
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
"external_id": "G0003",
jq
2018-05-19 10:57:20 +00:00
"refs": [
"https://attack.mitre.org/wiki/Group/G0003",
"https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance%20Operation%20Cleaver%20Report.pdf",
"http://www.secureworks.com/cyber-threat-intelligence/threats/suspected-iran-based-hacker-group-creates-network-of-fake-linkedin-profiles/"
],
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
"synonyms": [
"Cleaver",
"TG-2889",
"Threat Group 2889"
]
jq
2018-05-19 10:57:20 +00:00
},
chg: [mapping] Generated automatic mapping between clusters
2018-08-14 07:32:24 +00:00
"related": [
{
"dest-uuid": "11e17436-6ede-4733-8547-4ce0254ea19e",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "86724806-7ec9-4a48-a0a7-ecbde3bf4810",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "42be2a84-5a5c-4c6d-9864-3f09d75bb0ba",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "d56c99fa-4710-472c-81a6-41b7a84ea4be",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "a0082cfa-32e2-42b8-92d8-5c7a7409dcf1",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
fix: intrusion is an actor and not a tool
2018-10-17 14:59:01 +00:00
{
"dest-uuid": "b96e02f1-4037-463f-b158-5a964352f8d9",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
chg: [mapping] Generated automatic mapping between clusters
2018-08-14 07:32:24 +00:00
{
"dest-uuid": "f9d6633a-55e6-4adc-9263-6ae080421a13",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "ba724df5-9aa0-45ca-8e0e-7101c208ae48",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "f98bac6b-12fd-4cad-be84-c84666932232",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "f873db71-3d53-41d5-b141-530675ade27a",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
chg: MITRE relationships included in the respective cluster.
2018-10-17 06:08:58 +00:00
},
{
"dest-uuid": "c0c45d38-fe57-4cd4-b2b2-9ecd0ddd4ca9",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [mapping] Generated automatic mapping between clusters
2018-08-14 07:32:24 +00:00
}
],
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
"uuid": "8f5e8dc7-739d-4f5e-a8a1-a66e004d7063",
"value": "Cleaver - G0003"
jq
2018-05-19 10:57:20 +00:00
},
{
"description": "APT12 is a threat group that has been attributed to China. (Citation: Meyers Numbered Panda)",
"meta": {
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
"external_id": "G0005",
"refs": [
"https://attack.mitre.org/wiki/Group/G0005",
"http://www.crowdstrike.com/blog/whois-numbered-panda/"
],
jq
2018-05-19 10:57:20 +00:00
"synonyms": [
"APT12",
"IXESHE",
"DynCalc",
"Numbered Panda",
"DNSCALC"
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
]
jq
2018-05-19 10:57:20 +00:00
},
chg: [mapping] Generated automatic mapping between clusters
2018-08-14 07:32:24 +00:00
"related": [
{
"dest-uuid": "48146604-6693-4db1-bd94-159744726514",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
chg: MITRE relationships included in the respective cluster.
2018-10-17 06:08:58 +00:00
},
{
"dest-uuid": "8beac7c2-48d2-4cd9-9b15-6c452f38ac06",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [mitre att&ck] updated with new version
2019-03-20 11:37:38 +00:00
},
{
"dest-uuid": "ad4f146f-e3ec-444a-ba71-24bffd7f0f8e",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [att&ck] July ATT&CK release included in MISP galaxy
2019-08-01 13:51:03 +00:00
},
{
"dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [mapping] Generated automatic mapping between clusters
2018-08-14 07:32:24 +00:00
}
],
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
"uuid": "c47f937f-1022-4f42-8525-e7a4779a14cb",
"value": "APT12 - G0005"
jq
2018-05-19 10:57:20 +00:00
},
{
"description": "APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398. (Citation: Mandiant APT1)",
"meta": {
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
"external_id": "G0006",
"refs": [
"https://attack.mitre.org/wiki/Group/G0006",
"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
],
jq
2018-05-19 10:57:20 +00:00
"synonyms": [
"APT1",
"Comment Crew",
"Comment Group",
"Comment Panda"
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
]
jq
2018-05-19 10:57:20 +00:00
},
chg: [mapping] Generated automatic mapping between clusters
2018-08-14 07:32:24 +00:00
"related": [
{
"dest-uuid": "1cb7e1cc-d695-42b1-92f4-fd0112a3c9be",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
chg: MITRE relationships included in the respective cluster.
2018-10-17 06:08:58 +00:00
},
{
"dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [mitre att&ck] updated with new version
2019-03-20 11:37:38 +00:00
},
{
"dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
},
{
"dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [mapping] Generated automatic mapping between clusters
2018-08-14 07:32:24 +00:00
}
],
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
"uuid": "6a2e693f-24e5-451a-9f88-b36a108e5662",
"value": "APT1 - G0006"
jq
2018-05-19 10:57:20 +00:00
},
{
"description": "Night Dragon is a campaign name for activity involving threat group that has conducted activity originating primarily in China. (Citation: McAfee Night Dragon) The activity from this group is also known as Musical Chairs. (Citation: Arbor Musical Chairs Feb 2018)",
"meta": {
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
"external_id": "G0014",
jq
2018-05-19 10:57:20 +00:00
"refs": [
"https://attack.mitre.org/wiki/Group/G0014",
"https://securingtomorrow.mcafee.com/wp-content/uploads/2011/02/McAfee%20NightDragon%20wp%20draft%20to%20customersv1-1.pdf",
"https://www.arbornetworks.com/blog/asert/musical-chairs-playing-tetris/"
],
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
"synonyms": [
"Night Dragon",
"Musical Chairs"
]
jq
2018-05-19 10:57:20 +00:00
},
chg: [mapping] Generated automatic mapping between clusters
2018-08-14 07:32:24 +00:00
"related": [
{
"dest-uuid": "b3714d59-b61e-4713-903a-9b4f04ae7f3d",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
chg: MITRE relationships included in the respective cluster.
2018-10-17 06:08:58 +00:00
},
{
"dest-uuid": "88c621a7-aef9-4ae0-94e3-1fc87123eb24",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
},
{
"dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [mapping] Generated automatic mapping between clusters
2018-08-14 07:32:24 +00:00
}
],
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
"uuid": "23b6a0f5-fa95-46f9-a6f3-4549c5e45ec8",
"value": "Night Dragon - G0014"
jq
2018-05-19 10:57:20 +00:00
},
{
"description": "APT17 is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations. (Citation: FireEye APT17)",
"meta": {
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
"external_id": "G0025",
jq
2018-05-19 10:57:20 +00:00
"refs": [
"https://attack.mitre.org/wiki/Group/G0025",
"https://www2.fireeye.com/rs/fireye/images/APT17%20Report.pdf"
],
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
"synonyms": [
"APT17",
"Deputy Dog"
]
jq
2018-05-19 10:57:20 +00:00
},
chg: [mapping] Generated automatic mapping between clusters
2018-08-14 07:32:24 +00:00
"related": [
{
"dest-uuid": "c5947e1c-1cbc-434c-94b8-27c7e3be0fff",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "24110866-cb22-4c85-a7d2-0413e126694b",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "99e30d89-9361-4b73-a999-9e5ff9320bcb",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "a0cb9370-e39b-44d5-9f50-ef78e412b973",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
chg: MITRE relationships included in the respective cluster.
2018-10-17 06:08:58 +00:00
},
{
"dest-uuid": "d69c8146-ab35-4d50-8382-6fc80e641d43",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [mapping] Generated automatic mapping between clusters
2018-08-14 07:32:24 +00:00
}
],
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
"uuid": "090242d7-73fc-4738-af68-20162f7a5aae",
"value": "APT17 - G0025"
jq
2018-05-19 10:57:20 +00:00
}
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
],
chg: [att&ck] July ATT&CK release included in MISP galaxy
2019-08-01 13:51:03 +00:00
"version": 9
fix: Make validate all happy
2019-03-20 11:58:18 +00:00
}
Reference in a new issue Copy permalink