MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-30 02:37:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #162 from Delta-Sierra/master

Browse source 
add uuid to every cluster
This commit is contained in:
Alexandre Dulaunoy 2018-03-01 15:06:51 +01:00 committed by GitHub
commit f11846a842
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
15 changed files with 4023 additions and 2001 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1242
clusters/android.json
View file

File diff suppressed because it is too large Load diff

120
clusters/banker.json
View file

@ -11,7 +11,8 @@
"date": "Initally discovered between 2006 and 2007. New bankers with Zeus roots still active today." "date": "Initally discovered between 2006 and 2007. New bankers with Zeus roots still active today."
}, },
"description": "Zeus is a trojan horse that is primarily delivered via drive-by-downloads, malvertising, exploit kits and malspam campaigns. It uses man-in-the-browser keystroke logging and form grabbing to steal information from victims. Source was leaked in 2011.", "description": "Zeus is a trojan horse that is primarily delivered via drive-by-downloads, malvertising, exploit kits and malspam campaigns. It uses man-in-the-browser keystroke logging and form grabbing to steal information from victims. Source was leaked in 2011.",
"value": "Zeus" "value": "Zeus",
"uuid": "f0ec2df5-2e38-4df3-970d-525352006f2e"
}, },
{ {
"meta": { "meta": {
@ -27,7 +28,8 @@
"date": "Discovered early 2013" "date": "Discovered early 2013"
}, },
"description": "Delivered primarily by exploit kits as well as malspam campaigns utilizing macro based Microsoft Office documents as attachments. Vawtrak/Neverquest is a modularized banking trojan designed to steal credentials through harvesting, keylogging, Man-In-The-Browser, etc.", "description": "Delivered primarily by exploit kits as well as malspam campaigns utilizing macro based Microsoft Office documents as attachments. Vawtrak/Neverquest is a modularized banking trojan designed to steal credentials through harvesting, keylogging, Man-In-The-Browser, etc.",
"value": "Vawtrak" "value": "Vawtrak",
"uuid": "f3813bbd-682c-400d-8165-778be6d3f91f"
}, },
{ {
"meta": { "meta": {
@ -41,7 +43,8 @@
"date": "Discovery in 2014, still active" "date": "Discovery in 2014, still active"
}, },
"description": " Dridex leverages redirection attacks designed to send victims to malicious replicas of the banking sites they think they're visiting.", "description": " Dridex leverages redirection attacks designed to send victims to malicious replicas of the banking sites they think they're visiting.",
"value": "Dridex" "value": "Dridex",
"uuid": "44754726-e1d5-4e5f-a113-234c4a8ca65e"
}, },
{ {
"meta": { "meta": {
@ -59,7 +62,8 @@
"date": "First seen ~ 2007" "date": "First seen ~ 2007"
}, },
"description": "Banking trojan delivered primarily via email (typically malspam) and exploit kits. Gozi 1.0 source leaked in 2010", "description": "Banking trojan delivered primarily via email (typically malspam) and exploit kits. Gozi 1.0 source leaked in 2010",
"value": "Gozi" "value": "Gozi",
"uuid": "b9448d2a-a23c-4bf2-92a1-d860716ba2f3"
}, },
{ {
"meta": { "meta": {
@ -74,7 +78,8 @@
"date": "Fall Oct. 2012 - Spring 2013" "date": "Fall Oct. 2012 - Spring 2013"
}, },
"description": "Banking trojan attributed to Project Blitzkrieg targeting U.S. Financial institutions.", "description": "Banking trojan attributed to Project Blitzkrieg targeting U.S. Financial institutions.",
"value": "Goziv2" "value": "Goziv2",
"uuid": "71ad2c86-b9da-4351-acf9-7005f64062c7"
}, },
{ {
"meta": { "meta": {
@ -87,7 +92,8 @@
"date": "Beginning 2010" "date": "Beginning 2010"
}, },
"description": "Banking trojan based on Gozi source. Features include web injects for the victims’ browsers, screenshoting, video recording, transparent redirections, etc. Source leaked ~ end of 2015.", "description": "Banking trojan based on Gozi source. Features include web injects for the victims’ browsers, screenshoting, video recording, transparent redirections, etc. Source leaked ~ end of 2015.",
"value": "Gozi ISFB" "value": "Gozi ISFB",
"uuid": "ffbbbc14-1cdb-4be9-a631-ed53c5407369"
}, },
{ {
"meta": { "meta": {
@ -99,7 +105,8 @@
"date": "Since 2014" "date": "Since 2014"
}, },
"description": "Dreambot is a variant of Gozi ISFB that is spread via numerous exploit kits as well as through malspam email attachments and links.", "description": "Dreambot is a variant of Gozi ISFB that is spread via numerous exploit kits as well as through malspam email attachments and links.",
"value": "Dreambot" "value": "Dreambot",
"uuid": "549d1f8c-f76d-4d66-a1a2-2cd048d739ea"
}, },
{ {
"meta": { "meta": {
@ -110,7 +117,8 @@
"date": "Seen Autumn 2014" "date": "Seen Autumn 2014"
}, },
"description": "Gozi ISFB variant ", "description": "Gozi ISFB variant ",
"value": "IAP" "value": "IAP",
"uuid": "0f96a666-bf26-44e0-8ad6-f2136208c924"
}, },
{ {
"meta": { "meta": {
@ -121,7 +129,8 @@
"date": "Spring 2016" "date": "Spring 2016"
}, },
"description": "GozNym hybrid takes the best of both the Nymaim and Gozi ISFB. From the Nymaim malware, it leverages the dropper’s stealth and persistence; the Gozi ISFB parts add the banking Trojan’s capabilities to facilitate fraud via infected Internet browsers.", "description": "GozNym hybrid takes the best of both the Nymaim and Gozi ISFB. From the Nymaim malware, it leverages the dropper’s stealth and persistence; the Gozi ISFB parts add the banking Trojan’s capabilities to facilitate fraud via infected Internet browsers.",
"value": "GozNym" "value": "GozNym",
"uuid": "bcefac9a-a928-490f-9cb6-a8863f40c949"
}, },
{ {
"meta": { "meta": {
@ -135,7 +144,8 @@
"date": "First seen in Fall 2016 and still active today." "date": "First seen in Fall 2016 and still active today."
}, },
"description": "Zloader is a loader that loads different payloads, one of which is a Zeus module. Delivered via exploit kits and malspam emails. ", "description": "Zloader is a loader that loads different payloads, one of which is a Zeus module. Delivered via exploit kits and malspam emails. ",
"value": "Zloader Zeus" "value": "Zloader Zeus",
"uuid": "2eb658ed-aff4-4253-a21f-9059b133ce17"
}, },
{ {
"meta": { "meta": {
@ -149,7 +159,8 @@
"date": "First seen ~Feb 2014" "date": "First seen ~Feb 2014"
}, },
"description": "Zeus variant that utilizes steganography in image files to retrieve configuration file. ", "description": "Zeus variant that utilizes steganography in image files to retrieve configuration file. ",
"value": "Zeus VM" "value": "Zeus VM",
"uuid": "09d1cad8-6b06-48d7-a968-5b17bbe9ca65"
}, },
{ {
"meta": { "meta": {
@ -159,7 +170,8 @@
"date": "First seen ~Aug 2015" "date": "First seen ~Aug 2015"
}, },
"description": "Sphinx is a modular banking trojan that is a commercial offering sold to cybercriminals via underground fraudster boards.", "description": "Sphinx is a modular banking trojan that is a commercial offering sold to cybercriminals via underground fraudster boards.",
"value": "Zeus Sphinx" "value": "Zeus Sphinx",
"uuid": "8914802c-3aca-4a0d-874a-85ac7a1bc505"
}, },
{ {
"meta": { "meta": {
@ -174,7 +186,8 @@
"date": "First seen ~ Spring 2016" "date": "First seen ~ Spring 2016"
}, },
"description": "Zeus like banking trojan that is delivered primarily through malspam emails and exploit kits.", "description": "Zeus like banking trojan that is delivered primarily through malspam emails and exploit kits.",
"value": "Panda Banker" "value": "Panda Banker",
"uuid": "f1971442-6477-4aa2-aafa-7529b8252455"
}, },
{ {
"meta": { "meta": {
@ -189,7 +202,8 @@
"date": "First seen 2014" "date": "First seen 2014"
}, },
"description": "Zeus KINS is a modified version of ZeuS 2.0.8.9. It contains an encrypted version of it's config in the registry. ", "description": "Zeus KINS is a modified version of ZeuS 2.0.8.9. It contains an encrypted version of it's config in the registry. ",
"value": "Zeus KINS" "value": "Zeus KINS",
"uuid": "bc0be3a4-89d8-4c4c-b2aa-2dddbed1f71d"
}, },
{ {
"meta": { "meta": {
@ -200,7 +214,8 @@
"date": "First seen fall of 2014" "date": "First seen fall of 2014"
}, },
"description": "Chthonic according to Kaspersky is an evolution of Zeus VM. It uses the same encryptor as Andromeda bot, the same encryption scheme as Zeus AES and Zeus V2 Trojans, and a virtual machine similar to that used in ZeusVM and KINS malware.", "description": "Chthonic according to Kaspersky is an evolution of Zeus VM. It uses the same encryptor as Andromeda bot, the same encryption scheme as Zeus AES and Zeus V2 Trojans, and a virtual machine similar to that used in ZeusVM and KINS malware.",
"value": "Chthonic" "value": "Chthonic",
"uuid": "6deb9f26-969b-45aa-9222-c23663fd6ef8"
}, },
{ {
"meta": { "meta": {
@ -217,7 +232,8 @@
"date": "Discovered Fall 2016" "date": "Discovered Fall 2016"
}, },
"description": "Trickbot is a bot that is delivered via exploit kits and malspam campaigns. The bot is capable of downloading modules, including a banker module. Trickbot also shares roots with the Dyre banking trojan", "description": "Trickbot is a bot that is delivered via exploit kits and malspam campaigns. The bot is capable of downloading modules, including a banker module. Trickbot also shares roots with the Dyre banking trojan",
"value": "Trickbot" "value": "Trickbot",
"uuid": "07e3260b-d80c-4c86-bd28-8adc111bbec6"
}, },
{ {
"meta": { "meta": {
@ -231,7 +247,8 @@
"date": "Discovered ~June 2014" "date": "Discovered ~June 2014"
}, },
"description": "Dyre is a banking trojan distributed via exploit kits and malspam emails primarily. It has a modular architectur and utilizes man-in-the-browser functionality. It also leverages a backconnect server that allows threat actors to connect to a bank website through the victim's computer.", "description": "Dyre is a banking trojan distributed via exploit kits and malspam emails primarily. It has a modular architectur and utilizes man-in-the-browser functionality. It also leverages a backconnect server that allows threat actors to connect to a bank website through the victim's computer.",
"value": "Dyre" "value": "Dyre",
"uuid": "15e969e6-f031-4441-a49b-f401332e4b00"
}, },
{ {
"meta": { "meta": {
@ -249,7 +266,8 @@
"date": "Discovered ~Spring 2012" "date": "Discovered ~Spring 2012"
}, },
"description": "Tinba is a very small banking trojan that hooks into browsers and steals login data and sniffs on network traffic. It also uses Man in The Browser (MiTB) and webinjects. Tinba is primarily delivered via exploit kits, malvertising and malspam email campaigns.", "description": "Tinba is a very small banking trojan that hooks into browsers and steals login data and sniffs on network traffic. It also uses Man in The Browser (MiTB) and webinjects. Tinba is primarily delivered via exploit kits, malvertising and malspam email campaigns.",
"value": "Tinba" "value": "Tinba",
"uuid": "5594b171-32ec-4145-b712-e7701effffdd"
}, },
{ {
"meta": { "meta": {
@ -264,7 +282,8 @@
"date": "Discovered ~Summer 2014" "date": "Discovered ~Summer 2014"
}, },
"description": "Geodo is a banking trojan delivered primarily through malspam emails. It is capable of sniffing network activity to steal information by hooking certain network API calls.", "description": "Geodo is a banking trojan delivered primarily through malspam emails. It is capable of sniffing network activity to steal information by hooking certain network API calls.",
"value": "Geodo" "value": "Geodo",
"uuid": "8e002f78-7fb8-4e70-afd7-0b4ac655be26"
}, },
{ {
"meta": { "meta": {
@ -280,7 +299,8 @@
"date": "Discovered ~September 2011" "date": "Discovered ~September 2011"
}, },
"description": "Feodo is a banking trojan that utilizes web injects and is also capable of monitoring & manipulating cookies. Version A = Port 8080, Version B = Port 80 It is delivered primarily via exploit kits and malspam emails.", "description": "Feodo is a banking trojan that utilizes web injects and is also capable of monitoring & manipulating cookies. Version A = Port 8080, Version B = Port 80 It is delivered primarily via exploit kits and malspam emails.",
"value": "Feodo" "value": "Feodo",
"uuid": "7ca93488-c357-44c3-b246-3f88391aca5a"
}, },
{ {
"meta": { "meta": {
@ -293,7 +313,8 @@
"date": "Discovered ~2010." "date": "Discovered ~2010."
}, },
"description": "Originally not a banking trojan in 2010, Ramnit became a banking trojan after the Zeus source code leak. It is capable of perforrming Man-in-the-Browser attacks. Distributed primarily via exploit kits.", "description": "Originally not a banking trojan in 2010, Ramnit became a banking trojan after the Zeus source code leak. It is capable of perforrming Man-in-the-Browser attacks. Distributed primarily via exploit kits.",
"value": "Ramnit" "value": "Ramnit",
"uuid": "7e2288ec-e7d4-4833-9245-a2bc5ae40ee2"
}, },
{ {
"meta": { "meta": {
@ -309,7 +330,8 @@
"date": "Discovered ~2007" "date": "Discovered ~2007"
}, },
"description": "Qakbot is a banking trojan that leverages webinjects to steal banking information from victims. It also utilizes DGA for command and control. It is primarily delivered via exploit kits.", "description": "Qakbot is a banking trojan that leverages webinjects to steal banking information from victims. It also utilizes DGA for command and control. It is primarily delivered via exploit kits.",
"value": "Qakbot" "value": "Qakbot",
"uuid": "b2ec1f16-2a76-4910-adc5-ecb3570e7c1a"
}, },
{ {
"meta": { "meta": {
@ -321,7 +343,8 @@
"date": "Discovered ~Fall 2015" "date": "Discovered ~Fall 2015"
}, },
"description": "Corebot is a modular trojan that leverages a banking module that can perform browser hooking, form grabbing, MitM, webinjection to steal financial information from victims. Distributed primarily via malspam emails and exploit kits.", "description": "Corebot is a modular trojan that leverages a banking module that can perform browser hooking, form grabbing, MitM, webinjection to steal financial information from victims. Distributed primarily via malspam emails and exploit kits.",
"value": "Corebot" "value": "Corebot",
"uuid": "8a3d46db-d3b4-4f89-99e2-d1f0de3f484c"
}, },
{ {
"meta": { "meta": {
@ -341,7 +364,8 @@
"date": "Discovered ~December 2016" "date": "Discovered ~December 2016"
}, },
"description": "TinyNuke is a modular banking trojan that includes a HiddenDesktop/VNC server and reverse SOCKS 4 server. It's main functionality is to make web injections into specific pages to steal user data. Distributed primarily via malspam emails and exploit kits.", "description": "TinyNuke is a modular banking trojan that includes a HiddenDesktop/VNC server and reverse SOCKS 4 server. It's main functionality is to make web injections into specific pages to steal user data. Distributed primarily via malspam emails and exploit kits.",
"value": "TinyNuke" "value": "TinyNuke",
"uuid": "e683cd91-40b4-4e1c-be25-34a27610a22e"
}, },
{ {
"meta": { "meta": {
@ -359,7 +383,8 @@
"date": "Discovered in 2014" "date": "Discovered in 2014"
}, },
"description": "Retefe is a banking trojan that is distributed by what SWITCH CERT calls the Retefe gang or Operation Emmental. It uses geolocation based targeting. It also leverages fake root certificate and changes the DNS server for domain name resolution in order to display fake banking websites to victims. It is spread primarily through malspam emails. ", "description": "Retefe is a banking trojan that is distributed by what SWITCH CERT calls the Retefe gang or Operation Emmental. It uses geolocation based targeting. It also leverages fake root certificate and changes the DNS server for domain name resolution in order to display fake banking websites to victims. It is spread primarily through malspam emails. ",
"value": "Retefe" "value": "Retefe",
"uuid": "87b69cb4-8b65-47ee-91b0-9b1decdd5c5c"
}, },
{ {
"meta": { "meta": {
@ -372,7 +397,8 @@
"date": "Discovered ~early 2015" "date": "Discovered ~early 2015"
}, },
"description": "ReactorBot is sometimes mistakenly tagged as Rovnix. ReactorBot is a full fledged modular bot that includes a banking module that has roots with the Carberp banking trojan. Distributed primarily via malspam emails.", "description": "ReactorBot is sometimes mistakenly tagged as Rovnix. ReactorBot is a full fledged modular bot that includes a banking module that has roots with the Carberp banking trojan. Distributed primarily via malspam emails.",
"value": "ReactorBot" "value": "ReactorBot",
"uuid": "d939e802-acb2-4881-bdaf-ece1eccf5699"
}, },
{ {
"meta": { "meta": {
@ -382,7 +408,8 @@
"date": "Discovered ~Spring 2017" "date": "Discovered ~Spring 2017"
}, },
"description": "Matrix Banker is named accordingly because of the Matrix reference in it's C2 panel. Distributed primarily via malspam emails.", "description": "Matrix Banker is named accordingly because of the Matrix reference in it's C2 panel. Distributed primarily via malspam emails.",
"value": "Matrix Banker" "value": "Matrix Banker",
"uuid": "aa3fc68c-413c-4bfb-b4cd-bca7094da985"
}, },
{ {
"meta": { "meta": {
@ -393,7 +420,8 @@
"date": "Discovered ~Sept. 2011" "date": "Discovered ~Sept. 2011"
}, },
"description": "Zeus Gameover captures banking credentials from infected computers, then use those credentials to initiate or re-direct wire transfers to accounts overseas that are controlled by the criminals. GameOver has a decentralized, peer-to-peer command and control infrastructure rather than centralized points of origin. Distributed primarily via malspam emails and exploit kits.", "description": "Zeus Gameover captures banking credentials from infected computers, then use those credentials to initiate or re-direct wire transfers to accounts overseas that are controlled by the criminals. GameOver has a decentralized, peer-to-peer command and control infrastructure rather than centralized points of origin. Distributed primarily via malspam emails and exploit kits.",
"value": "Zeus Gameover" "value": "Zeus Gameover",
"uuid": "8653a94e-3eb3-4d88-8683-a1ae4a524774"
}, },
{ {
"meta": { "meta": {
@ -405,7 +433,8 @@
"date": "Discovered early 2011" "date": "Discovered early 2011"
}, },
"description": "SpyEye is a similar to the Zeus botnet banking trojan. It utilizes a web control panel for C2 and can perform form grabbing, autofill credit card modules, ftp grabber, pop3 grabber and HTTP basic access authorization grabber. It also contained a Kill Zeus feature which would remove any Zeus infections if SpyEye was on the system. Distributed primarily via exploit kits and malspam emails.", "description": "SpyEye is a similar to the Zeus botnet banking trojan. It utilizes a web control panel for C2 and can perform form grabbing, autofill credit card modules, ftp grabber, pop3 grabber and HTTP basic access authorization grabber. It also contained a Kill Zeus feature which would remove any Zeus infections if SpyEye was on the system. Distributed primarily via exploit kits and malspam emails.",
"value": "SpyEye" "value": "SpyEye",
"uuid": "ebce18e9-b387-4b7d-bab9-4acd4fca7a7c"
}, },
{ {
"meta": { "meta": {
@ -417,7 +446,8 @@
"date": "Discovered ~January 2012" "date": "Discovered ~January 2012"
}, },
"description": "Citadel is an offspring of the Zeus banking trojan. Delivered primarily via exploit kits.", "description": "Citadel is an offspring of the Zeus banking trojan. Delivered primarily via exploit kits.",
"value": "Citadel" "value": "Citadel",
"uuid": "9eb89081-3245-423a-995f-c1d78ce39619"
}, },
{ {
"meta": { "meta": {
@ -428,7 +458,8 @@
"date": "Discovered ~spring 2016" "date": "Discovered ~spring 2016"
}, },
"description": "Atmos is derived from the Citadel banking trojan. Delivered primarily via exploit kits and malspam emails.", "description": "Atmos is derived from the Citadel banking trojan. Delivered primarily via exploit kits and malspam emails.",
"value": "Atmos" "value": "Atmos",
"uuid": "ee021933-929d-4d6c-abca-5827cfb77289"
}, },
{ {
"meta": { "meta": {
@ -438,7 +469,8 @@
"date": "Discovered ~Fall 2011" "date": "Discovered ~Fall 2011"
}, },
"description": "Ice IX is a bot created using the source code of ZeuS 2.0.8.9. No major improvements compared to ZeuS 2.0.8.9.", "description": "Ice IX is a bot created using the source code of ZeuS 2.0.8.9. No major improvements compared to ZeuS 2.0.8.9.",
"value": "Ice IX" "value": "Ice IX",
"uuid": "1d4a5704-c6fb-4bbb-92b2-88dc67f86339"
}, },
{ {
"meta": { "meta": {
@ -448,7 +480,8 @@
"date": "Discovered ~end of 2010" "date": "Discovered ~end of 2010"
}, },
"description": "Zeus in the mobile. Banking trojan developed for mobile devices such as Windows Mobile, Blackberry and Android.", "description": "Zeus in the mobile. Banking trojan developed for mobile devices such as Windows Mobile, Blackberry and Android.",
"value": "Zitmo" "value": "Zitmo",
"uuid": "3b1aff8f-647d-4709-aab0-6db1859c5f11"
}, },
{ {
"meta": { "meta": {
@ -463,7 +496,8 @@
"date": "Discovered in 2010" "date": "Discovered in 2010"
}, },
"description": "Banking trojan based on Zeus V2. Murofet is a newer version of Licat found ~end of 2011", "description": "Banking trojan based on Zeus V2. Murofet is a newer version of Licat found ~end of 2011",
"value": "Licat" "value": "Licat",
"uuid": "0b097926-2e1a-4134-8ab9-4c16d0cca0fc"
}, },
{ {
"meta": { "meta": {
@ -473,7 +507,8 @@
"date": "Discovered end of 2012" "date": "Discovered end of 2012"
}, },
"description": "Skynet is a Tor-powered trojan with DDoS, Bitcoin mining and Banking capabilities. Spread via USENET as per rapid7.", "description": "Skynet is a Tor-powered trojan with DDoS, Bitcoin mining and Banking capabilities. Spread via USENET as per rapid7.",
"value": "Skynet" "value": "Skynet",
"uuid": "f20791e4-26a7-45e0-90e6-709553b223b2"
}, },
{ {
"meta": { "meta": {
@ -484,7 +519,8 @@
"date": "Discovered in September 2017" "date": "Discovered in September 2017"
}, },
"description": "According to X-Force research, the new banking Trojan emerged in the wild in September 2017, when its first test campaigns were launched. Our researchers noted that IcedID has a modular malicious code with modern banking Trojan capabilities comparable to malware such as the Zeus Trojan. At this time, the malware targets banks, payment card providers, mobile services providers, payroll, webmail and e-commerce sites in the U.S. Two major banks in the U.K. are also on the target list the malware fetches.", "description": "According to X-Force research, the new banking Trojan emerged in the wild in September 2017, when its first test campaigns were launched. Our researchers noted that IcedID has a modular malicious code with modern banking Trojan capabilities comparable to malware such as the Zeus Trojan. At this time, the malware targets banks, payment card providers, mobile services providers, payroll, webmail and e-commerce sites in the U.S. Two major banks in the U.K. are also on the target list the malware fetches.",
"value": "IcedID" "value": "IcedID",
"uuid": "9d67069c-b778-486f-8158-53f5dcd05d08"
}, },
{ {
"value": "GratefulPOS", "value": "GratefulPOS",
@ -493,7 +529,8 @@
"refs": [ "refs": [
"https://community.rsa.com/community/products/netwitness/blog/2017/12/08/gratefulpos-credit-card-stealing-malware-just-in-time-for-the-shopping-season" "https://community.rsa.com/community/products/netwitness/blog/2017/12/08/gratefulpos-credit-card-stealing-malware-just-in-time-for-the-shopping-season"
] ]
} },
"uuid": "7d9362e5-e3cf-4640-88a2-3faf31952963"
}, },
{ {
"value": "Dok", "value": "Dok",
@ -502,7 +539,8 @@
"refs": [ "refs": [
"https://objective-see.com/blog/blog_0x25.html#Dok" "https://objective-see.com/blog/blog_0x25.html#Dok"
] ]
} },
"uuid": "e159c4f8-3c22-49f9-a60a-16588a9c22b0"
}, },
{ {
"value": "downAndExec", "value": "downAndExec",
@ -511,7 +549,8 @@
"refs": [ "refs": [
"https://www.welivesecurity.com/2017/09/13/downandexec-banking-malware-cdns-brazil/" "https://www.welivesecurity.com/2017/09/13/downandexec-banking-malware-cdns-brazil/"
] ]
} },
"uuid": "bfff538a-89dd-4bed-9ac1-b4faee373724"
}, },
{ {
"value": "Smominru", "value": "Smominru",
@ -524,7 +563,8 @@
"Ismo", "Ismo",
"lsmo" "lsmo"
] ]
} },
"uuid": "f93acc85-8d2c-41e0-b0c5-47795b8c6194"
} }
], ],
"version": 7, "version": 7,

120
clusters/botnet.json
View file

@ -7,7 +7,8 @@
"refs": [ "refs": [
"https://www.bleepingcomputer.com/news/security/android-devices-targeted-by-new-monero-mining-botnet/" "https://www.bleepingcomputer.com/news/security/android-devices-targeted-by-new-monero-mining-botnet/"
] ]
} },
"uuid": "6d7fc046-61c8-4f4e-add9-eebe5b5f4f69"
}, },
{ {
"value": "Bagle", "value": "Bagle",
@ -22,7 +23,8 @@
"Lodeight" "Lodeight"
], ],
"date": "2004" "date": "2004"
} },
"uuid": "d530ea76-9bbc-4276-a2e3-df04e0e5a14c"
}, },
{ {
"value": "Marina Botnet", "value": "Marina Botnet",
@ -38,7 +40,8 @@
"Hacktool.Spammer", "Hacktool.Spammer",
"Kraken" "Kraken"
] ]
} },
"uuid": "7296f769-9bb7-474d-bbc7-5839f71d052a"
}, },
{ {
"value": "Torpig", "value": "Torpig",
@ -52,7 +55,8 @@
"Anserin" "Anserin"
], ],
"date": "2005" "date": "2005"
} },
"uuid": "415a3667-4ac4-4718-a6ea-617540a4abb1"
}, },
{ {
"value": "Storm", "value": "Storm",
@ -69,7 +73,8 @@
"Ecard" "Ecard"
], ],
"date": "2007" "date": "2007"
} },
"uuid": "74ebec0c-6db3-47b9-9879-0d125e413e76"
}, },
{ {
"value": "Rustock", "value": "Rustock",
@ -82,7 +87,8 @@
"Costrat" "Costrat"
], ],
"date": "2006" "date": "2006"
} },
"uuid": "9bca63cc-f0c7-4704-9c5f-b5bf473a9b43"
}, },
{ {
"value": "Donbot", "value": "Donbot",
@ -94,7 +100,8 @@
"Buzus", "Buzus",
"Bachsoy" "Bachsoy"
] ]
} },
"uuid": "27a7fd9b-ec9a-4f4a-b3f5-a3b81c71970a"
}, },
{ {
"value": "Cutwail", "value": "Cutwail",
@ -108,7 +115,8 @@
"Mutant" "Mutant"
], ],
"date": "2007" "date": "2007"
} },
"uuid": "35e25aad-7c39-4a1d-aa17-73fa638362e8"
}, },
{ {
"value": "Akbot", "value": "Akbot",
@ -118,7 +126,8 @@
"https://en.wikipedia.org/wiki/Akbot" "https://en.wikipedia.org/wiki/Akbot"
], ],
"date": "2007" "date": "2007"
} },
"uuid": "6e1168e6-7768-4fa2-951f-6d6934531633"
}, },
{ {
"value": "Srizbi", "value": "Srizbi",
@ -132,7 +141,8 @@
"Exchanger" "Exchanger"
], ],
"date": "March 2007" "date": "March 2007"
} },
"uuid": "6df98396-b52a-4f84-bec2-0060bc46bdbf"
}, },
{ {
"value": "Lethic", "value": "Lethic",
@ -142,7 +152,8 @@
"https://en.wikipedia.org/wiki/Lethic_botnet" "https://en.wikipedia.org/wiki/Lethic_botnet"
], ],
"date": "2008" "date": "2008"
} },
"uuid": "a73e150f-1431-4f72-994a-4000405eff07"
}, },
{ {
"value": "Xarvester", "value": "Xarvester",
@ -154,7 +165,8 @@
"Rlsloup", "Rlsloup",
"Pixoliz" "Pixoliz"
] ]
} },
"uuid": "e965dd3a-bfd9-4c88-b7a5-a8fc328ac859"
}, },
{ {
"value": "Sality", "value": "Sality",
@ -173,7 +185,8 @@
"Kukacka" "Kukacka"
], ],
"date": "2008" "date": "2008"
} },
"uuid": "6fe5f49d-48b5-4dc2-92f7-8c94397b9c96"
}, },
{ {
"value": "Mariposa", "value": "Mariposa",
@ -183,7 +196,8 @@
"https://en.wikipedia.org/wiki/Mariposa_botnet" "https://en.wikipedia.org/wiki/Mariposa_botnet"
], ],
"date": "2008" "date": "2008"
} },
"uuid": "f4878385-c6c7-4f6b-8637-08146841d2a2"
}, },
{ {
"value": "Conficker", "value": "Conficker",
@ -199,7 +213,8 @@
"Kido" "Kido"
], ],
"date": "November 2008" "date": "November 2008"
} },
"uuid": "ab49815e-8ba6-41ec-9f51-8a9587334069"
}, },
{ {
"value": "Waledac", "value": "Waledac",
@ -213,7 +228,8 @@
"Waledpak" "Waledpak"
], ],
"date": "November 2008" "date": "November 2008"
} },
"uuid": "4e324956-3177-4c8f-b0b6-e3bc4c3ede2f"
}, },
{ {
"value": "Maazben", "value": "Maazben",
@ -222,7 +238,8 @@
"refs": [ "refs": [
"https://www.symantec.com/connect/blogs/evaluating-botnet-capacity" "https://www.symantec.com/connect/blogs/evaluating-botnet-capacity"
] ]
} },
"uuid": "a461f744-ab52-4a78-85e4-aedca1303a4c"
}, },
{ {
"value": "Onewordsub", "value": "Onewordsub",
@ -230,7 +247,8 @@
"refs": [ "refs": [
"https://www.botnets.fr/wiki/OneWordSub" "https://www.botnets.fr/wiki/OneWordSub"
] ]
} },
"uuid": "4cc97d31-c9ab-4682-aae4-21dcbc02118f"
}, },
{ {
"value": "Gheg", "value": "Gheg",
@ -243,7 +261,8 @@
"Tofsee", "Tofsee",
"Mondera" "Mondera"
] ]
} },
"uuid": "ca11e3f2-cda1-45dc-bed1-8708fa9e27a6"
}, },
{ {
"value": "Nucrypt", "value": "Nucrypt",
@ -251,7 +270,8 @@
"refs": [ "refs": [
"https://www.botnets.fr/wiki.old/index.php?title=Nucrypt&setlang=en" "https://www.botnets.fr/wiki.old/index.php?title=Nucrypt&setlang=en"
] ]
} },
"uuid": "ec9917f4-006b-4a32-9a58-c03b5c85abe4"
}, },
{ {
"value": "Wopla", "value": "Wopla",
@ -259,7 +279,8 @@
"refs": [ "refs": [
"https://www.botnets.fr/wiki.old/index.php/Wopla" "https://www.botnets.fr/wiki.old/index.php/Wopla"
] ]
} },
"uuid": "b2ec8e6b-414d-4d76-b51c-8ba3eee2918d"
}, },
{ {
"value": "Asprox", "value": "Asprox",
@ -275,7 +296,8 @@
"Hydraflux" "Hydraflux"
], ],
"date": "2008" "date": "2008"
} },
"uuid": "0d58f329-1356-468c-88ab-e21fbb64c02b"
}, },
{ {
"value": "Spamthru", "value": "Spamthru",
@ -289,7 +311,8 @@
"Covesmer", "Covesmer",
"Xmiler" "Xmiler"
] ]
} },
"uuid": "3da8c2f9-dbbf-4825-9010-2261b2007d22"
}, },
{ {
"value": "Gumblar", "value": "Gumblar",
@ -299,7 +322,8 @@
"https://en.wikipedia.org/wiki/Gumblar" "https://en.wikipedia.org/wiki/Gumblar"
], ],
"date": "2008" "date": "2008"
} },
"uuid": "5b83d0ac-3661-465e-b3ab-ca182d1eacad"
}, },
{ {
"value": "BredoLab", "value": "BredoLab",
@ -312,7 +336,8 @@
"synonyms": [ "synonyms": [
"Oficla" "Oficla"
] ]
} },
"uuid": "65a30580-d542-4113-b00f-7fab98bd046c"
}, },
{ {
"value": "Grum", "value": "Grum",
@ -326,7 +351,8 @@
"Tedroo", "Tedroo",
"Reddyb" "Reddyb"
] ]
} },
"uuid": "a2a601db-2ae7-4695-ac0c-0a3ea8822356"
}, },
{ {
"value": "Mega-D", "value": "Mega-D",
@ -338,7 +364,8 @@
"synonyms": [ "synonyms": [
"Ozdok" "Ozdok"
] ]
} },
"uuid": "c12537fc-1de5-4d12-ae36-649f32919059"
}, },
{ {
"value": "Kraken", "value": "Kraken",
@ -350,7 +377,8 @@
"synonyms": [ "synonyms": [
"Kracken" "Kracken"
] ]
} },
"uuid": "e721809b-2785-4ce3-b95a-7fde2762f736"
}, },
{ {
"value": "Festi", "value": "Festi",
@ -363,7 +391,8 @@
"synonyms": [ "synonyms": [
"Spamnost" "Spamnost"
] ]
} },
"uuid": "b76128e3-cea5-4df8-8d23-d9f3305e5a14"
}, },
{ {
"value": "Vulcanbot", "value": "Vulcanbot",
@ -373,7 +402,8 @@
"https://en.wikipedia.org/wiki/Vulcanbot" "https://en.wikipedia.org/wiki/Vulcanbot"
], ],
"date": "March 2010" "date": "March 2010"
} },
"uuid": "dfd17a50-65df-4ddc-899e-1052e5001a1f"
}, },
{ {
"value": "LowSec", "value": "LowSec",
@ -384,7 +414,8 @@
"FreeMoney", "FreeMoney",
"Ring0.Tools" "Ring0.Tools"
] ]
} },
"uuid": "533e3474-d08d-4d02-8adc-3765750dd3a3"
}, },
{ {
"value": "TDL4", "value": "TDL4",
@ -398,7 +429,8 @@
"TDSS", "TDSS",
"Alureon" "Alureon"
] ]
} },
"uuid": "61a17703-7837-4cc9-b022-b5ed6b30efc1"
}, },
{ {
"value": "Zeus", "value": "Zeus",
@ -415,7 +447,8 @@
"Gorhax", "Gorhax",
"Kneber" "Kneber"
] ]
} },
"uuid": "e878d24d-f122-48c4-930c-f6b6d5f0ee28"
}, },
{ {
"value": "Kelihos", "value": "Kelihos",
@ -428,7 +461,8 @@
"synonyms": [ "synonyms": [
"Hlux" "Hlux"
] ]
} },
"uuid": "07b10419-e8b5-4b5f-a179-77fc9b127dc6"
}, },
{ {
"value": "Ramnit", "value": "Ramnit",
@ -438,7 +472,8 @@
"https://en.wikipedia.org/wiki/Botnet" "https://en.wikipedia.org/wiki/Botnet"
], ],
"date": "2011" "date": "2011"
} },
"uuid": "8ed81090-f098-4878-b87e-2d801b170759"
}, },
{ {
"value": "Zer0n3t", "value": "Zer0n3t",
@ -449,7 +484,8 @@
"Zer0n3t", "Zer0n3t",
"Zer0Log1x" "Zer0Log1x"
] ]
} },
"uuid": "417c36fb-fff7-40df-8387-07169113b9b4"
}, },
{ {
"value": "Chameleon", "value": "Chameleon",
@ -459,7 +495,8 @@
"https://en.wikipedia.org/wiki/Chameleon_botnet" "https://en.wikipedia.org/wiki/Chameleon_botnet"
], ],
"date": "2012" "date": "2012"
} },
"uuid": "3084cd06-e415-4ff0-abd0-cf8fbf67c53c"
}, },
{ {
"value": "Mirai", "value": "Mirai",
@ -469,7 +506,8 @@
"https://en.wikipedia.org/wiki/Mirai_(malware)" "https://en.wikipedia.org/wiki/Mirai_(malware)"
], ],
"date": "August 2016" "date": "August 2016"
} },
"uuid": "fcdfd4af-da35-49a8-9610-19be8a487185"
}, },
{ {
"value": "Satori", "value": "Satori",
@ -482,13 +520,15 @@
"synonyms": [ "synonyms": [
"Okiru" "Okiru"
] ]
} },
"uuid": "e77cf495-632a-4459-aad1-cdf29d73683f"
}, },
{ {
"value": "BetaBot", "value": "BetaBot",
"meta": { "meta": {
"date": "April 2017" "date": "April 2017"
} },
"uuid": "3d7c771b-b175-41c9-8ba1-904ef29715fa"
} }
], ],
"name": "Botnet", "name": "Botnet",

33
clusters/branded_vulnerability.json
View file

@ -10,7 +10,8 @@
"logo": [ "logo": [
"https://upload.wikimedia.org/wikipedia/commons/thumb/5/56/Meltdown_with_text.svg/300px-Meltdown_with_text.svg.png" "https://upload.wikimedia.org/wikipedia/commons/thumb/5/56/Meltdown_with_text.svg/300px-Meltdown_with_text.svg.png"
] ]
} },
"uuid": "70bee5b7-0fa3-4a4d-98ee-d8ab787c6db1"
}, },
{ {
"value": "Spectre", "value": "Spectre",
@ -23,7 +24,8 @@
"logo": [ "logo": [
"https://en.wikipedia.org/wiki/File:Spectre_with_text.svg" "https://en.wikipedia.org/wiki/File:Spectre_with_text.svg"
] ]
} },
"uuid": "36168188-6d14-463a-9713-f88764a83329"
}, },
{ {
"value": "Heartbleed", "value": "Heartbleed",
@ -35,7 +37,8 @@
"logo": [ "logo": [
"https://upload.wikimedia.org/wikipedia/commons/thumb/d/dc/Heartbleed.svg/440px-Heartbleed.svg.png" "https://upload.wikimedia.org/wikipedia/commons/thumb/d/dc/Heartbleed.svg/440px-Heartbleed.svg.png"
] ]
} },
"uuid": "d6d85947-e6ee-4d2e-bb48-437f31c7a270"
}, },
{ {
"value": "Shellshock", "value": "Shellshock",
@ -49,7 +52,8 @@
"https://upload.wikimedia.org/wikipedia/commons/8/86/Shellshock.png", "https://upload.wikimedia.org/wikipedia/commons/8/86/Shellshock.png",
"https://cdn-images-1.medium.com/max/1600/1*bopQcJtKouPOJ_isSzanLw.png" "https://cdn-images-1.medium.com/max/1600/1*bopQcJtKouPOJ_isSzanLw.png"
] ]
} },
"uuid": "2102db77-5a51-40c1-bfc1-38fb7dcb7f05"
}, },
{ {
"value": "Ghost", "value": "Ghost",
@ -61,7 +65,8 @@
"logo": [ "logo": [
"https://cdn-images-1.medium.com/max/1600/1*HnCEOo0RUT1fliJjRT02lA.png" "https://cdn-images-1.medium.com/max/1600/1*HnCEOo0RUT1fliJjRT02lA.png"
] ]
} },
"uuid": "a1640081-aa8d-4070-84b2-d23e2ae82799"
}, },
{ {
"value": "Stagefright", "value": "Stagefright",
@ -81,7 +86,8 @@
"https://upload.wikimedia.org/wikipedia/en/f/f2/Stagefright_bug_logo.png", "https://upload.wikimedia.org/wikipedia/en/f/f2/Stagefright_bug_logo.png",
"https://cdn-images-1.medium.com/max/1600/1*-Ivm3lZHNaOUwmklT4Rb1g.png" "https://cdn-images-1.medium.com/max/1600/1*-Ivm3lZHNaOUwmklT4Rb1g.png"
] ]
} },
"uuid": "352916e7-62bf-4b0c-bce7-da759d1a4f5f"
}, },
{ {
"value": "Badlock", "value": "Badlock",
@ -91,7 +97,8 @@
"https://upload.wikimedia.org/wikipedia/commons/thumb/4/4b/Badlock_logo.svg/440px-Badlock_logo.svg.png", "https://upload.wikimedia.org/wikipedia/commons/thumb/4/4b/Badlock_logo.svg/440px-Badlock_logo.svg.png",
"https://cdn-images-1.medium.com/max/1600/1*EVbwwxEBOU83NKxgQrPG9w.png" "https://cdn-images-1.medium.com/max/1600/1*EVbwwxEBOU83NKxgQrPG9w.png"
] ]
} },
"uuid": "74f2bd2c-69f1-4d28-8d42-94b7ef89f31e"
}, },
{ {
"value": "Dirty COW", "value": "Dirty COW",
@ -103,7 +110,8 @@
"logo": [ "logo": [
"https://upload.wikimedia.org/wikipedia/commons/thumb/1/1b/DirtyCow.svg/440px-DirtyCow.svg.png" "https://upload.wikimedia.org/wikipedia/commons/thumb/1/1b/DirtyCow.svg/440px-DirtyCow.svg.png"
] ]
} },
"uuid": "54196537-cb0c-425c-83d6-437d41b4cc65"
}, },
{ {
"value": "POODLE", "value": "POODLE",
@ -112,11 +120,13 @@
"aliases": [ "aliases": [
"CVE-2014-3566" "CVE-2014-3566"
] ]
} },
"uuid": "22b9af72-48c9-4da1-b13d-15667dbdd998"
}, },
{ {
"value": "BadUSB", "value": "BadUSB",
"description": "The ‘BadUSB’ vulnerability exploits unprotected firmware in order to deliver malicious code to computers and networks. This is achieved by reverse-engineering the device and reprogramming it. As the reprogrammed firmware is not monitored or assessed by modern security software, this attack method is extremely difficult for antivirus/security software to detect and prevent." "description": "The ‘BadUSB’ vulnerability exploits unprotected firmware in order to deliver malicious code to computers and networks. This is achieved by reverse-engineering the device and reprogramming it. As the reprogrammed firmware is not monitored or assessed by modern security software, this attack method is extremely difficult for antivirus/security software to detect and prevent.",
"uuid": "bc3a3299-1443-4390-8b25-4bb280c1abd7"
}, },
{ {
"value": "ImageTragick", "value": "ImageTragick",
@ -127,7 +137,8 @@
"logo": [ "logo": [
"https://imagetragick.com/img/logo-medium.png" "https://imagetragick.com/img/logo-medium.png"
] ]
} },
"uuid": "e85e1270-eec5-4331-8004-a063125a54b4"
} }
], ],
"version": 1, "version": 1,

18
clusters/cert-eu-govsector.json
View file

@ -1,22 +1,28 @@
{ {
"values": [ "values": [
{ {
"value": "Constituency" "value": "Constituency",
"uuid": "8ebd301f-067f-499d-8718-f63c8ced73ac"
}, },
{ {
"value": "EU-Centric" "value": "EU-Centric",
"uuid": "bf3fd6a1-692e-4d77-b17d-496f71eebac9"
}, },
{ {
"value": "EU-nearby" "value": "EU-nearby",
"uuid": "536dada1-30e5-453a-9611-33597ab5c373"
}, },
{ {
"value": "World-class" "value": "World-class",
"uuid": "8024aa5d-d0b0-4114-87c9-92e358c96850"
}, },
{ {
"value": "Unknown" "value": "Unknown",
"uuid": "32f8b3dd-defc-47c8-a070-378f5e0e1be8"
}, },
{ {
"value": "Outside World" "value": "Outside World",
"uuid": "adc80f46-86ef-4de8-95d1-15c45c15d002"
} }
], ],
"version": 1, "version": 1,

129
clusters/exploit-kit.json
View file

@ -12,14 +12,16 @@
"Stegano EK" "Stegano EK"
], ],
"status": "Active" "status": "Active"
} },
"uuid": "e9ca60cd-94fc-4a54-ac98-30e675a46b3e"
}, },
{ {
"value": "Bingo", "value": "Bingo",
"description": "Bingo EK is the name chosen by the defense for a Fiesta-ish EK first spotted in March 2017 and targetting at that times mostly Russia", "description": "Bingo EK is the name chosen by the defense for a Fiesta-ish EK first spotted in March 2017 and targetting at that times mostly Russia",
"meta": { "meta": {
"status": "Active" "status": "Active"
} },
"uuid": "9e864c01-3d9e-4b8d-811e-46471ff866e9"
}, },
{ {
"value": "Terror EK", "value": "Terror EK",
@ -33,7 +35,8 @@
"Neptune EK" "Neptune EK"
], ],
"status": "Active" "status": "Active"
} },
"uuid": "f15f9264-854e-4e25-8641-cde2faeb86e9"
}, },
{ {
"value": "DealersChoice", "value": "DealersChoice",
@ -48,7 +51,8 @@
"Sednit RTF EK" "Sednit RTF EK"
], ],
"status": "Active" "status": "Active"
} },
"uuid": "0f116533-a755-4cfc-815a-fa6bcb85efb7"
}, },
{ {
"value": "DNSChanger", "value": "DNSChanger",
@ -62,7 +66,8 @@
"RouterEK" "RouterEK"
], ],
"status": "Active" "status": "Active"
} },
"uuid": "74fb6a14-1279-4a5b-939a-76478d36d3e1"
}, },
{ {
"value": "Disdain", "value": "Disdain",
@ -72,7 +77,8 @@
"http://blog.trendmicro.com/trendlabs-security-intelligence/new-disdain-exploit-kit-detected-wild/" "http://blog.trendmicro.com/trendlabs-security-intelligence/new-disdain-exploit-kit-detected-wild/"
], ],
"status": "Active" "status": "Active"
} },
"uuid": "1ded776d-6772-4cc8-a27f-f61e24a58d96"
}, },
{ {
"value": "Kaixin", "value": "Kaixin",
@ -86,7 +92,8 @@
"CK vip" "CK vip"
], ],
"status": "Active" "status": "Active"
} },
"uuid": "e6c1cfcf-3e37-4f5a-9494-989dd8c43d88"
}, },
{ {
"value": "Magnitude", "value": "Magnitude",
@ -103,7 +110,8 @@
"TopExp" "TopExp"
], ],
"status": "Active" "status": "Active"
} },
"uuid": "6a313e11-5bb2-40ed-8cde-9de768b783b1"
}, },
{ {
"value": "MWI", "value": "MWI",
@ -114,7 +122,8 @@
"https://www.sophos.com/en-us/medialibrary/PDFs/technical%20papers/sophos-microsoft-word-intruder-revealed.pdf" "https://www.sophos.com/en-us/medialibrary/PDFs/technical%20papers/sophos-microsoft-word-intruder-revealed.pdf"
], ],
"status": "Active" "status": "Active"
} },
"uuid": "489acbf2-d80b-4bb5-ac7d-c8573dcb6324"
}, },
{ {
"value": "RIG", "value": "RIG",
@ -133,7 +142,8 @@
"Meadgive" "Meadgive"
], ],
"status": "Active" "status": "Active"
} },
"uuid": "0545e5c0-ed0d-4a02-a69d-31e9e2b31e8a"
}, },
{ {
"value": "Sednit EK", "value": "Sednit EK",
@ -147,7 +157,8 @@
"SedKit" "SedKit"
], ],
"status": "Active" "status": "Active"
} },
"uuid": "c8b9578a-78be-420c-a29b-9214d09685c8"
}, },
{ {
"value": "Sundown-P", "value": "Sundown-P",
@ -161,7 +172,8 @@
"CaptainBlack" "CaptainBlack"
], ],
"status": "Active" "status": "Active"
} },
"uuid": "3235ae90-598b-45dc-b336-852817b271a8"
}, },
{ {
"value": "Bizarro Sundown", "value": "Bizarro Sundown",
@ -175,7 +187,8 @@
"Sundown-b" "Sundown-b"
], ],
"status": "Retired" "status": "Retired"
} },
"uuid": "ef3b170e-3fbe-420b-b202-4689da137c50"
}, },
{ {
"value": "Hunter", "value": "Hunter",
@ -188,7 +201,8 @@
"3ROS Exploit Kit" "3ROS Exploit Kit"
], ],
"status": "Retired - Last seen 2017-02-06" "status": "Retired - Last seen 2017-02-06"
} },
"uuid": "96b2b31e-b191-43c4-9929-48ba1cbee62c"
}, },
{ {
"value": "GreenFlash Sundown", "value": "GreenFlash Sundown",
@ -201,7 +215,8 @@
"Sundown-GF" "Sundown-GF"
], ],
"status": "Active" "status": "Active"
} },
"uuid": "6e5c0dbb-fb0b-45ea-ac6c-bb6d8324bbd2"
}, },
{ {
"value": "Angler", "value": "Angler",
@ -218,7 +233,8 @@
"Axpergle" "Axpergle"
], ],
"status": "Retired - Last seen: 2016-06-07" "status": "Retired - Last seen: 2016-06-07"
} },
"uuid": "5daf41c7-b297-4228-85d1-eb040d5b7c90"
}, },
{ {
"value": "Archie", "value": "Archie",
@ -228,7 +244,8 @@
"https://www.alienvault.com/blogs/labs-research/archie-just-another-exploit-kit" "https://www.alienvault.com/blogs/labs-research/archie-just-another-exploit-kit"
], ],
"status": "Retired" "status": "Retired"
} },
"uuid": "2756caae-d2c5-4170-9e76-2b7f1b1fccb1"
}, },
{ {
"value": "BlackHole", "value": "BlackHole",
@ -242,7 +259,8 @@
"BHEK" "BHEK"
], ],
"status": "Retired - Last seen: 2013-10-07" "status": "Retired - Last seen: 2013-10-07"
} },
"uuid": "e6201dc3-01a7-40c5-ba72-02fa470ada53"
}, },
{ {
"value": "Bleeding Life", "value": "Bleeding Life",
@ -257,7 +275,8 @@
"BL2" "BL2"
], ],
"status": "Retired" "status": "Retired"
} },
"uuid": "5abe6240-dce2-4455-8125-ddae2e651243"
}, },
{ {
"value": "Cool", "value": "Cool",
@ -273,7 +292,8 @@
"Styxy Cool" "Styxy Cool"
], ],
"status": "Retired - Last seen: 2013-10-07" "status": "Retired - Last seen: 2013-10-07"
} },
"uuid": "9bb229b0-80f9-48e5-b8fb-00ee7af070cb"
}, },
{ {
"value": "Fiesta", "value": "Fiesta",
@ -288,7 +308,8 @@
"Fiexp" "Fiexp"
], ],
"status": "Retired - Last Seen: beginning of 2015-07" "status": "Retired - Last Seen: beginning of 2015-07"
} },
"uuid": "f50f860a-d795-4f4e-a170-8190f65499ad"
}, },
{ {
"value": "Empire", "value": "Empire",
@ -301,7 +322,8 @@
"RIG-E" "RIG-E"
], ],
"status": "Retired - Last seen: 2016-12-29" "status": "Retired - Last seen: 2016-12-29"
} },
"uuid": "6eb15569-4ddd-4820-9a44-7bca5b303b86"
}, },
{ {
"value": "FlashPack", "value": "FlashPack",
@ -318,7 +340,8 @@
"Vintage Pack" "Vintage Pack"
], ],
"status": "Retired - Last seen: middle of 2015-04" "status": "Retired - Last seen: middle of 2015-04"
} },
"uuid": "55a30ccc-8905-4af2-a498-5c0010815cc1"
}, },
{ {
"value": "GrandSoft", "value": "GrandSoft",
@ -334,7 +357,8 @@
"SofosFO" "SofosFO"
], ],
"status": "Active" "status": "Active"
} },
"uuid": "180b6969-2aca-4642-b684-b57db8f0eff8"
}, },
{ {
"value": "HanJuan", "value": "HanJuan",
@ -347,7 +371,8 @@
"https://twitter.com/kafeine/status/562575744501428226" "https://twitter.com/kafeine/status/562575744501428226"
], ],
"status": "Retired - Last seen: 2015-07" "status": "Retired - Last seen: 2015-07"
} },
"uuid": "886abdc6-db1a-4fc5-afe0-e17d65a83614"
}, },
{ {
"value": "Himan", "value": "Himan",
@ -360,7 +385,8 @@
"High Load" "High Load"
], ],
"status": "Retired - Last seen: 2014-04" "status": "Retired - Last seen: 2014-04"
} },
"uuid": "3d0cb558-7f04-4be8-963e-5f137566b07b"
}, },
{ {
"value": "Impact", "value": "Impact",
@ -370,7 +396,8 @@
"http://malware.dontneedcoffee.com/2012/12/inside-impact-exploit-kit-back-on-track.html" "http://malware.dontneedcoffee.com/2012/12/inside-impact-exploit-kit-back-on-track.html"
], ],
"status": "Retired" "status": "Retired"
} },
"uuid": "319357b4-3041-4a71-89c5-51be08041d1b"
}, },
{ {
"value": "Infinity", "value": "Infinity",
@ -385,7 +412,8 @@
"Goon" "Goon"
], ],
"status": "Retired - Last seen: 2014-07" "status": "Retired - Last seen: 2014-07"
} },
"uuid": "4b858835-7b31-4b94-8144-b5175da1551f"
}, },
{ {
"value": "Lightsout", "value": "Lightsout",
@ -397,7 +425,8 @@
"http://malwageddon.blogspot.fr/2013/09/unknown-ek-by-way-how-much-is-fish.html" "http://malwageddon.blogspot.fr/2013/09/unknown-ek-by-way-how-much-is-fish.html"
], ],
"status": "Unknown - Last seen: 2014-03" "status": "Unknown - Last seen: 2014-03"
} },
"uuid": "244c05f8-1a2f-47fb-9dcf-2eaa99ab6aa1"
}, },
{ {
"value": "Nebula", "value": "Nebula",
@ -407,7 +436,8 @@
"http://malware.dontneedcoffee.com/2017/03/nebula-exploit-kit.html" "http://malware.dontneedcoffee.com/2017/03/nebula-exploit-kit.html"
], ],
"status": "Retired - Last seen 2017-03-09" "status": "Retired - Last seen 2017-03-09"
} },
"uuid": "4ca96067-8fdd-4b48-bd34-d2e175e27bad"
}, },
{ {
"value": "Neutrino", "value": "Neutrino",
@ -423,7 +453,8 @@
"Neutrino-v" "Neutrino-v"
], ],
"status": "Retired - Last seen 2017-04-10" "status": "Retired - Last seen 2017-04-10"
} },
"uuid": "218ae39b-2f92-4355-91c6-50cce319d26d"
}, },
{ {
"value": "Niteris", "value": "Niteris",
@ -437,7 +468,8 @@
"CottonCastle" "CottonCastle"
], ],
"status": "Unknown - Last seen: 2015-11" "status": "Unknown - Last seen: 2015-11"
} },
"uuid": "b344133f-e223-4fda-8fb2-88ad7999e549"
}, },
{ {
"value": "Nuclear", "value": "Nuclear",
@ -453,7 +485,8 @@
"Neclu" "Neclu"
], ],
"status": "Retired - Last seen: 2015-04-30" "status": "Retired - Last seen: 2015-04-30"
} },
"uuid": "e7c516f9-5222-4f0d-b80b-ae9f4c24583d"
}, },
{ {
"value": "Phoenix", "value": "Phoenix",
@ -467,7 +500,8 @@
"PEK" "PEK"
], ],
"status": "Retired" "status": "Retired"
} },
"uuid": "0df2c7a6-046f-4489-8c77-0999c92c839d"
}, },
{ {
"value": "Private Exploit Pack", "value": "Private Exploit Pack",
@ -481,7 +515,8 @@
"PEP" "PEP"
], ],
"status": "Retired" "status": "Retired"
} },
"uuid": "cfd0a4af-f559-496f-b56b-97145ea4e4c3"
}, },
{ {
"value": "Redkit", "value": "Redkit",
@ -493,7 +528,8 @@
"https://nakedsecurity.sophos.com/2013/05/09/redkit-exploit-kit-part-2/" "https://nakedsecurity.sophos.com/2013/05/09/redkit-exploit-kit-part-2/"
], ],
"status": "Retired" "status": "Retired"
} },
"uuid": "6958ff90-75e8-47ee-ab07-daa8d487130c"
}, },
{ {
"value": "Sakura", "value": "Sakura",
@ -503,7 +539,8 @@
"http://www.xylibox.com/2012/01/sakura-exploit-pack-10.html" "http://www.xylibox.com/2012/01/sakura-exploit-pack-10.html"
], ],
"status": "Retired - Last seen: 2013-09" "status": "Retired - Last seen: 2013-09"
} },
"uuid": "12af9112-3ac5-4422-858e-a22c293c6117"
}, },
{ {
"value": "SPL", "value": "SPL",
@ -518,7 +555,8 @@
"SPLNet", "SPLNet",
"SPL2" "SPL2"
] ]
} },
"uuid": "15936d30-c151-4051-835e-df327143ce76"
}, },
{ {
"value": "Sundown", "value": "Sundown",
@ -535,7 +573,8 @@
], ],
"status": "Retired - Last seen 2017-03-08", "status": "Retired - Last seen 2017-03-08",
"colour": "#C03701" "colour": "#C03701"
} },
"uuid": "670e28c4-001a-4ba4-b276-441620225123"
}, },
{ {
"value": "Sweet-Orange", "value": "Sweet-Orange",
@ -549,7 +588,8 @@
"Anogre" "Anogre"
], ],
"status": "Retired - Last seen: 2015-04-05" "status": "Retired - Last seen: 2015-04-05"
} },
"uuid": "222bc508-4d8d-4972-9cac-65192cfefd43"
}, },
{ {
"value": "Styx", "value": "Styx",
@ -561,7 +601,8 @@
"http://malware.dontneedcoffee.com/2013/05/inside-styx-2013-05.html" "http://malware.dontneedcoffee.com/2013/05/inside-styx-2013-05.html"
], ],
"status": "Retired - Last seen: 2014-06" "status": "Retired - Last seen: 2014-06"
} },
"uuid": "006eaa87-e8a6-4808-93ff-302b52c628b0"
}, },
{ {
"value": "WhiteHole", "value": "WhiteHole",
@ -571,7 +612,8 @@
"http://malware.dontneedcoffee.com/2013/02/briefly-wave-whitehole-exploit-kit-hello.html" "http://malware.dontneedcoffee.com/2013/02/briefly-wave-whitehole-exploit-kit-hello.html"
], ],
"status": "Retired - Last seen: 2013-12" "status": "Retired - Last seen: 2013-12"
} },
"uuid": "570bc715-7fe8-430b-bd2e-5512c95f2370"
}, },
{ {
"value": "Unknown", "value": "Unknown",
@ -582,7 +624,8 @@
"https://twitter.com/node5", "https://twitter.com/node5",
"https://twitter.com/kahusecurity" "https://twitter.com/kahusecurity"
] ]
} },
"uuid": "00815961-3249-4e2e-9421-bb57feb73bb2"
} }
], ],
"version": 6, "version": 6,

27
clusters/microsoft-activity-group.json
View file

@ -16,7 +16,8 @@
] ]
}, },
"description": "PROMETHIUM is an activity group that has been active as early as 2012. The group primarily uses Truvasys, a first-stage malware that has been in circulation for several years. Truvasys has been involved in several attack campaigns, where it has masqueraded as one of server common computer utilities, including WinUtils, TrueCrypt, WinRAR, or SanDisk. In each of the campaigns, Truvasys malware evolved with additional features—this shows a close relationship between the activity groups behind the campaigns and the developers of the malware.", "description": "PROMETHIUM is an activity group that has been active as early as 2012. The group primarily uses Truvasys, a first-stage malware that has been in circulation for several years. Truvasys has been involved in several attack campaigns, where it has masqueraded as one of server common computer utilities, including WinUtils, TrueCrypt, WinRAR, or SanDisk. In each of the campaigns, Truvasys malware evolved with additional features—this shows a close relationship between the activity groups behind the campaigns and the developers of the malware.",
"value": "PROMETHIUM" "value": "PROMETHIUM",
"uuid": "5744f91a-d2d8-4f92-920f-943dd80c578f"
}, },
{ {
"meta": { "meta": {
@ -25,7 +26,8 @@
] ]
}, },
"description": "NEODYMIUM is an activity group that is known to use a backdoor malware detected by Microsoft as Wingbird. This backdoor’s characteristics closely match FinFisher, a government-grade commercial surveillance package. Data about Wingbird activity indicate that it is typically used to attack individual computers instead of networks.", "description": "NEODYMIUM is an activity group that is known to use a backdoor malware detected by Microsoft as Wingbird. This backdoor’s characteristics closely match FinFisher, a government-grade commercial surveillance package. Data about Wingbird activity indicate that it is typically used to attack individual computers instead of networks.",
"value": "NEODYMIUM" "value": "NEODYMIUM",
"uuid": "47b5007a-3fb1-466a-9578-629e6e735493"
}, },
{ {
"meta": { "meta": {
@ -34,7 +36,8 @@
] ]
}, },
"description": "Microsoft Threat Intelligence identified similarities between this recent attack and previous 2012 attacks against tens of thousands of computers belonging to organizations in the energy sector. Microsoft Threat Intelligence refers to the activity group behind these attacks as TERBIUM, following our internal practice of assigning rogue actors chemical element names.", "description": "Microsoft Threat Intelligence identified similarities between this recent attack and previous 2012 attacks against tens of thousands of computers belonging to organizations in the energy sector. Microsoft Threat Intelligence refers to the activity group behind these attacks as TERBIUM, following our internal practice of assigning rogue actors chemical element names.",
"value": "TERBIUM" "value": "TERBIUM",
"uuid": "99784b80-6298-45ba-885c-0ed37bfd8324"
}, },
{ {
"meta": { "meta": {
@ -58,7 +61,8 @@
] ]
}, },
"description": "STRONTIUM has been active since at least 2007. Whereas most modern untargeted malware is ultimately profit-oriented, STRONTIUM mainly seeks sensitive information. Its primary institutional targets have included government bodies, diplomatic institutions, and military forces and installations in NATO member states and certain Eastern European countries. Additional targets have included journalists, political advisors, and organizations associated with political activism in central Asia. STRONTIUM is an activity group that usually targets government agencies, diplomatic institutions, and military organizations, as well as affiliated private sector organizations such as defense contractors and public policy research institutes. Microsoft has attributed more 0-day exploits to STRONTIUM than any other tracked group in 2016. STRONTIUM frequently uses compromised e-mail accounts from one victim to send malicious e-mails to a second victim and will persistently pursue specific targets for months until they are successful in compromising the victims’ computer. ", "description": "STRONTIUM has been active since at least 2007. Whereas most modern untargeted malware is ultimately profit-oriented, STRONTIUM mainly seeks sensitive information. Its primary institutional targets have included government bodies, diplomatic institutions, and military forces and installations in NATO member states and certain Eastern European countries. Additional targets have included journalists, political advisors, and organizations associated with political activism in central Asia. STRONTIUM is an activity group that usually targets government agencies, diplomatic institutions, and military organizations, as well as affiliated private sector organizations such as defense contractors and public policy research institutes. Microsoft has attributed more 0-day exploits to STRONTIUM than any other tracked group in 2016. STRONTIUM frequently uses compromised e-mail accounts from one victim to send malicious e-mails to a second victim and will persistently pursue specific targets for months until they are successful in compromising the victims’ computer. ",
"value": "STRONTIUM" "value": "STRONTIUM",
"uuid": "213cdde9-c11a-4ea9-8ce0-c868e9826fec"
}, },
{ {
"description": "DUBNIUM (which shares indicators with what Kaspersky researchers have called DarkHotel) is one of the activity groups that has been very active in recent years, and has many distinctive features.", "description": "DUBNIUM (which shares indicators with what Kaspersky researchers have called DarkHotel) is one of the activity groups that has been very active in recent years, and has many distinctive features.",
@ -73,7 +77,8 @@
"synonyms": [ "synonyms": [
"darkhotel" "darkhotel"
] ]
} },
"uuid": "b56af6ab-69f8-457a-bf50-c3aefa6dc14a"
}, },
{ {
"description": "PLATINUM has been targeting its victims since at least as early as 2009, and may have been active for several years prior. Its activities are distinctly different not only from those typically seen in untargeted attacks, but from many targeted attacks as well. A large share of targeted attacks can be characterized as opportunistic: the activity group changes its target profiles and attack geographies based on geopolitical seasons, and may attack institutions all over the world. Like many such groups, PLATINUM seeks to steal sensitive intellectual property related to government interests, but its range of preferred targets is consistently limited to specific governmental organizations, defense institutes, intelligence agencies, diplomatic institutions, and telecommunication providers in South and Southeast Asia. The group’s persistent use of spear phishing tactics (phishing attempts aimed at specific individuals) and access to previously undiscovered zero-day exploits have made it a highly resilient threat.", "description": "PLATINUM has been targeting its victims since at least as early as 2009, and may have been active for several years prior. Its activities are distinctly different not only from those typically seen in untargeted attacks, but from many targeted attacks as well. A large share of targeted attacks can be characterized as opportunistic: the activity group changes its target profiles and attack geographies based on geopolitical seasons, and may attack institutions all over the world. Like many such groups, PLATINUM seeks to steal sensitive intellectual property related to government interests, but its range of preferred targets is consistently limited to specific governmental organizations, defense institutes, intelligence agencies, diplomatic institutions, and telecommunication providers in South and Southeast Asia. The group’s persistent use of spear phishing tactics (phishing attempts aimed at specific individuals) and access to previously undiscovered zero-day exploits have made it a highly resilient threat.",
@ -83,7 +88,8 @@
"https://blogs.technet.microsoft.com/mmpc/2016/04/26/digging-deep-for-platinum/", "https://blogs.technet.microsoft.com/mmpc/2016/04/26/digging-deep-for-platinum/",
"http://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf" "http://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"
] ]
} },
"uuid": "154e97b5-47ef-415a-99a6-2157f1b50339"
}, },
{ {
"meta": { "meta": {
@ -92,7 +98,8 @@
] ]
}, },
"description": "Microsoft Threat Intelligence associates Winnti with multiple activity groups—collections of malware, supporting infrastructure, online personas, victimology, and other attack artifacts that the Microsoft intelligent security graph uses to categorize and attribute threat activity. Microsoft labels activity groups using code names derived from elements in the periodic table. In the case of this malware, the activity groups strongly associated with Winnti are BARIUM and LEAD. But even though they share the use of Winnti, the BARIUM and LEAD activity groups are involved in very different intrusion scenarios. BARIUM begins its attacks by cultivating relationships with potential victims—particularly those working in Business Development or Human Resources—on various social media platforms. Once BARIUM has established rapport, they spear-phish the victim using a variety of unsophisticated malware installation vectors, including malicious shortcut (.lnk) files with hidden payloads, compiled HTML help (.chm) files, or Microsoft Office documents containing macros or exploits. Initial intrusion stages feature the Win32/Barlaiy implant—notable for its use of social network profiles, collaborative document editing sites, and blogs for C&C. Later stages of the intrusions rely upon Winnti for persistent access. The majority of victims recorded to date have been in electronic gaming, multimedia, and Internet content industries, although occasional intrusions against technology companies have occurred.", "description": "Microsoft Threat Intelligence associates Winnti with multiple activity groups—collections of malware, supporting infrastructure, online personas, victimology, and other attack artifacts that the Microsoft intelligent security graph uses to categorize and attribute threat activity. Microsoft labels activity groups using code names derived from elements in the periodic table. In the case of this malware, the activity groups strongly associated with Winnti are BARIUM and LEAD. But even though they share the use of Winnti, the BARIUM and LEAD activity groups are involved in very different intrusion scenarios. BARIUM begins its attacks by cultivating relationships with potential victims—particularly those working in Business Development or Human Resources—on various social media platforms. Once BARIUM has established rapport, they spear-phish the victim using a variety of unsophisticated malware installation vectors, including malicious shortcut (.lnk) files with hidden payloads, compiled HTML help (.chm) files, or Microsoft Office documents containing macros or exploits. Initial intrusion stages feature the Win32/Barlaiy implant—notable for its use of social network profiles, collaborative document editing sites, and blogs for C&C. Later stages of the intrusions rely upon Winnti for persistent access. The majority of victims recorded to date have been in electronic gaming, multimedia, and Internet content industries, although occasional intrusions against technology companies have occurred.",
"value": "BARIUM" "value": "BARIUM",
"uuid": "cc70bdbd-afa7-4e19-bba2-2443811ef3af"
}, },
{ {
"meta": { "meta": {
@ -101,7 +108,8 @@
] ]
}, },
"description": "In contrast, LEAD has established a far greater reputation for industrial espionage. In the past few years, LEAD’s victims have included: Multinational, multi-industry companies involved in the manufacture of textiles, chemicals, and electronics Pharmaceutical companies A company in the chemical industry University faculty specializing in aeronautical engineering and research A company involved in the design and manufacture of motor vehicles A cybersecurity company focusing on protecting industrial control systems During these intrusions, LEAD’s objective was to steal sensitive data, including research materials, process documents, and project plans. LEAD also steals code-signing certificates to sign its malware in subsequent attacks. In most cases, LEAD’s attacks do not feature any advanced exploit techniques. The group also does not make special effort to cultivate victims prior to an attack. Instead, the group often simply emails a Winnti installer to potential victims, relying on basic social engineering tactics to convince recipients to run the attached malware. In some other cases, LEAD gains access to a target by brute-forcing remote access login credentials, performing SQL injection, or exploiting unpatched web servers, and then they copy the Winnti installer directly to compromised machines.", "description": "In contrast, LEAD has established a far greater reputation for industrial espionage. In the past few years, LEAD’s victims have included: Multinational, multi-industry companies involved in the manufacture of textiles, chemicals, and electronics Pharmaceutical companies A company in the chemical industry University faculty specializing in aeronautical engineering and research A company involved in the design and manufacture of motor vehicles A cybersecurity company focusing on protecting industrial control systems During these intrusions, LEAD’s objective was to steal sensitive data, including research materials, process documents, and project plans. LEAD also steals code-signing certificates to sign its malware in subsequent attacks. In most cases, LEAD’s attacks do not feature any advanced exploit techniques. The group also does not make special effort to cultivate victims prior to an attack. Instead, the group often simply emails a Winnti installer to potential victims, relying on basic social engineering tactics to convince recipients to run the attached malware. In some other cases, LEAD gains access to a target by brute-forcing remote access login credentials, performing SQL injection, or exploiting unpatched web servers, and then they copy the Winnti installer directly to compromised machines.",
"value": "LEAD" "value": "LEAD",
"uuid": "f542442e-ba0f-425d-b386-6c10351a468e"
}, },
{ {
"meta": { "meta": {
@ -110,7 +118,8 @@
] ]
}, },
"description": "In addition to strengthening generic detection of EoP exploits, Microsoft security researchers are actively gathering threat intelligence and indicators attributable to ZIRCONIUM, the activity group using the CVE-2017-0005 exploit. ", "description": "In addition to strengthening generic detection of EoP exploits, Microsoft security researchers are actively gathering threat intelligence and indicators attributable to ZIRCONIUM, the activity group using the CVE-2017-0005 exploit. ",
"value": "ZIRCONIUM" "value": "ZIRCONIUM",
"uuid": "2d19c573-252b-49d8-8c2e-3b529b91e72d"
} }
] ]
} }

54
clusters/preventive-measure.json
View file

@ -13,7 +13,8 @@
] ]
}, },
"value": "Backup and Restore Process", "value": "Backup and Restore Process",
"description": "Make sure to have adequate backup processes on place and frequently test a restore of these backups.\n(Schrödinger's backup - it is both existent and non-existent until you've tried a restore" "description": "Make sure to have adequate backup processes on place and frequently test a restore of these backups.\n(Schrödinger's backup - it is both existent and non-existent until you've tried a restore",
"uuid": "5f942376-ea5b-4b23-9c26-81d3aeba7fb4"
}, },
{ {
"meta": { "meta": {
@ -29,7 +30,8 @@
] ]
}, },
"value": "Block Macros", "value": "Block Macros",
"description": "Disable macros in Office files downloaded from the Internet. This can be configured to work in two different modes:\nA.) Open downloaded documents in 'Protected View'\nB.) Open downloaded documents and block all macros" "description": "Disable macros in Office files downloaded from the Internet. This can be configured to work in two different modes:\nA.) Open downloaded documents in 'Protected View'\nB.) Open downloaded documents and block all macros",
"uuid": "79563662-8d92-4fd1-929a-9b8926a62685"
}, },
{ {
"meta": { "meta": {
@ -45,7 +47,8 @@
"possible_issues": "Administrative VBS scripts on Workstations" "possible_issues": "Administrative VBS scripts on Workstations"
}, },
"value": "Disable WSH", "value": "Disable WSH",
"description": "Disable Windows Script Host" "description": "Disable Windows Script Host",
"uuid": "e6df1619-f8b3-476c-b5cf-22b4c9e9dd7f"
}, },
{ {
"meta": { "meta": {
@ -57,7 +60,8 @@
] ]
}, },
"value": "Filter Attachments Level 1", "value": "Filter Attachments Level 1",
"description": "Filter the following attachments on your mail gateway:\n.ade, .adp, .ani, .bas, .bat, .chm, .cmd, .com, .cpl, .crt, .exe, .hlp, .ht, .hta, .inf, .ins, .isp, .jar, .job, .js, .jse, .lnk, .mda, .mdb, .mde, .mdz, .msc, .msi, .msp, .mst, .ocx, .pcd, .ps1, .reg, .scr, .sct, .shs, .svg, .url, .vb, .vbe, .vbs, .wbk, .wsc, .ws, .wsf, .wsh, .exe, .pif, .pub" "description": "Filter the following attachments on your mail gateway:\n.ade, .adp, .ani, .bas, .bat, .chm, .cmd, .com, .cpl, .crt, .exe, .hlp, .ht, .hta, .inf, .ins, .isp, .jar, .job, .js, .jse, .lnk, .mda, .mdb, .mde, .mdz, .msc, .msi, .msp, .mst, .ocx, .pcd, .ps1, .reg, .scr, .sct, .shs, .svg, .url, .vb, .vbe, .vbs, .wbk, .wsc, .ws, .wsf, .wsh, .exe, .pif, .pub",
"uuid": "7055b72b-b113-4f93-8387-e6f58ce5fc92"
}, },
{ {
"meta": { "meta": {
@ -70,7 +74,8 @@
"possible_issues": "Office Communication with old versions of Microsoft Office files (.doc, .xls) " "possible_issues": "Office Communication with old versions of Microsoft Office files (.doc, .xls) "
}, },
"value": "Filter Attachments Level 2", "value": "Filter Attachments Level 2",
"description": "Filter the following attachments on your mail gateway:\n(Filter expression of Level 1 plus) .doc, .xls, .rtf, .docm, .xlsm, .pptm" "description": "Filter the following attachments on your mail gateway:\n(Filter expression of Level 1 plus) .doc, .xls, .rtf, .docm, .xlsm, .pptm",
"uuid": "8c9bbbf5-a321-4eb1-8c03-a399a9687687"
}, },
{ {
"meta": { "meta": {
@ -87,7 +92,8 @@
"possible_issues": "Web embedded software installers" "possible_issues": "Web embedded software installers"
}, },
"value": "Restrict program execution", "value": "Restrict program execution",
"description": "Block all program executions from the %LocalAppData% and %AppData% folder" "description": "Block all program executions from the %LocalAppData% and %AppData% folder",
"uuid": "6a234b1d-8e86-49c4-91d6-cc3be3d04f74"
}, },
{ {
"meta": { "meta": {
@ -102,7 +108,8 @@
] ]
}, },
"value": "Show File Extensions", "value": "Show File Extensions",
"description": "Set the registry key \"HideFileExt\" to 0 in order to show all file extensions, even of known file types. This helps avoiding cloaking tricks that use double extensions. (e.g. \"not_a_virus.pdf.exe\")" "description": "Set the registry key \"HideFileExt\" to 0 in order to show all file extensions, even of known file types. This helps avoiding cloaking tricks that use double extensions. (e.g. \"not_a_virus.pdf.exe\")",
"uuid": "5b911d46-66c8-4180-ab97-663a0868264e"
}, },
{ {
"meta": { "meta": {
@ -118,7 +125,8 @@
"possible_issues": "administrator resentment" "possible_issues": "administrator resentment"
}, },
"value": "Enforce UAC Prompt", "value": "Enforce UAC Prompt",
"description": "Enforce administrative users to confirm an action that requires elevated rights" "description": "Enforce administrative users to confirm an action that requires elevated rights",
"uuid": "3f8c55db-611e-4831-b624-f9cbdc3b0e11"
}, },
{ {
"meta": { "meta": {
@ -131,7 +139,8 @@
"possible_issues": "Higher administrative costs" "possible_issues": "Higher administrative costs"
}, },
"value": "Remove Admin Privileges", "value": "Remove Admin Privileges",
"description": "Remove and restrict administrative rights whenever possible. Malware can only modify files that users have write access to." "description": "Remove and restrict administrative rights whenever possible. Malware can only modify files that users have write access to.",
"uuid": "168f94d3-4ffc-4ea6-8f2e-8ba699f0fef6"
}, },
{ {
"meta": { "meta": {
@ -143,7 +152,8 @@
] ]
}, },
"value": "Restrict Workstation Communication", "value": "Restrict Workstation Communication",
"description": "Activate the Windows Firewall to restrict workstation to workstation communication" "description": "Activate the Windows Firewall to restrict workstation to workstation communication",
"uuid": "fb25c345-0cee-4ae7-ab31-c1c801cde1c2"
}, },
{ {
"meta": { "meta": {
@ -154,7 +164,8 @@
] ]
}, },
"value": "Sandboxing Email Input", "value": "Sandboxing Email Input",
"description": "Using sandbox that opens email attachments and removes attachments based on behavior analysis" "description": "Using sandbox that opens email attachments and removes attachments based on behavior analysis",
"uuid": "7960740f-71a5-42db-8a1a-1c7ccbf83349"
}, },
{ {
"meta": { "meta": {
@ -165,7 +176,8 @@
] ]
}, },
"value": "Execution Prevention", "value": "Execution Prevention",
"description": "Software that allows to control the execution of processes - sometimes integrated in Antivirus software\nFree: AntiHook, ProcessGuard, System Safety Monitor" "description": "Software that allows to control the execution of processes - sometimes integrated in Antivirus software\nFree: AntiHook, ProcessGuard, System Safety Monitor",
"uuid": "bfda0c9e-1303-4861-b028-e0506dd8861c"
}, },
{ {
"meta": { "meta": {
@ -181,7 +193,8 @@
"possible_issues": "Some extensions will have legitimate uses, e.g., .vbs for logon scripts." "possible_issues": "Some extensions will have legitimate uses, e.g., .vbs for logon scripts."
}, },
"value": "Change Default \"Open With\" to Notepad", "value": "Change Default \"Open With\" to Notepad",
"description": "Force extensions primarily used for infections to open up in Notepad rather than Windows Script Host or Internet Explorer" "description": "Force extensions primarily used for infections to open up in Notepad rather than Windows Script Host or Internet Explorer",
"uuid": "3b7bc1b2-e04f-4492-b3b1-87bb6701635b"
}, },
{ {
"meta": { "meta": {
@ -196,7 +209,8 @@
] ]
}, },
"value": "File Screening", "value": "File Screening",
"description": "Server-side file screening with the help of File Server Resource Manager" "description": "Server-side file screening with the help of File Server Resource Manager",
"uuid": "79769940-7cd2-4aaa-80da-b90c0372b898"
}, },
{ {
"meta": { "meta": {
@ -213,7 +227,8 @@
"possible_issues": "Configure & test extensively" "possible_issues": "Configure & test extensively"
}, },
"value": "Restrict program execution #2", "value": "Restrict program execution #2",
"description": "Block program executions (AppLocker)" "description": "Block program executions (AppLocker)",
"uuid": "feb6cddb-4182-4515-94dc-0eadffcdc098"
}, },
{ {
"meta": { "meta": {
@ -229,7 +244,8 @@
] ]
}, },
"value": "EMET", "value": "EMET",
"description": "Detect and block exploitation techniques" "description": "Detect and block exploitation techniques",
"uuid": "5f0a749f-88f2-4e6e-8fd8-46307f8439f6"
}, },
{ {
"meta": { "meta": {
@ -244,7 +260,8 @@
] ]
}, },
"value": "Sysmon", "value": "Sysmon",
"description": "Detect Ransomware in an early stage with new Sysmon 5 File/Registry monitoring" "description": "Detect Ransomware in an early stage with new Sysmon 5 File/Registry monitoring",
"uuid": "1b1e5664-4250-459b-adbb-f0b33f64bf7e"
}, },
{ {
"value": "Blacklist-phone-numbers", "value": "Blacklist-phone-numbers",
@ -256,7 +273,8 @@
"effectiveness": "Medium", "effectiveness": "Medium",
"impact": "Medium", "impact": "Medium",
"complexity": "Low" "complexity": "Low"
} },
"uuid": "123e20c5-8f44-4de5-a183-6890788e5a81"
} }
], ],
"name": "Preventive Measure", "name": "Preventive Measure",

1581
clusters/ransomware.json
View file

File diff suppressed because it is too large Load diff

690
clusters/rat.json
View file

File diff suppressed because it is too large Load diff

357
clusters/sector.json
View file

@ -1,361 +1,480 @@
{ {
"values": [ "values": [
{ {
"value": "Unknown" "value": "Unknown",
"uuid": "3ff4e243-7e26-4535-b911-fdda2f724aa2"
}, },
{ {
"value": "Other" "value": "Other",
"uuid": "03655488-3d11-4fbf-8fe6-6148aaa01b83"
}, },
{ {
"value": "Academia - University" "value": "Academia - University",
"uuid": "98821a86-3c11-474b-afab-3c84af061407"
}, },
{ {
"value": "Activists" "value": "Activists",
"uuid": "0a62f502-0a51-44ac-82a3-0a965b98c7a9"
}, },
{ {
"value": "Aerospace" "value": "Aerospace",
"uuid": "12f90076-f03d-4a2d-9f33-7a274dc462bb"
}, },
{ {
"value": "Agriculture" "value": "Agriculture",
"uuid": "e2214f48-0cdd-4110-ba59-e703282adf2c"
}, },
{ {
"value": "Arts" "value": "Arts",
"uuid": "b5283132-9245-4a5f-b4bc-1937fd80d80a"
}, },
{ {
"value": "Bank" "value": "Bank",
"uuid": "19cc9f22-e682-4808-a96c-82e573703dff"
}, },
{ {
"value": "Chemical" "value": "Chemical",
"uuid": "306f828d-8eb8-4adb-bee9-3211bf2a4ff7"
}, },
{ {
"value": "Citizens" "value": "Citizens",
"uuid": "f50c1d4d-9d7c-4076-b5d4-e86dd5de4628"
}, },
{ {
"value": "Civil Aviation" "value": "Civil Aviation",
"uuid": "ed13b6c9-c32c-4a58-82a7-ce64dc7fa086"
}, },
{ {
"value": "Country" "value": "Country",
"uuid": "89e7e93a-394f-48e3-ba70-501df2f010c0"
}, },
{ {
"value": "Culture" "value": "Culture",
"uuid": "8c645d4e-8fcc-48a8-9656-5135cfbc10a6"
}, },
{ {
"value": "Data Broker" "value": "Data Broker",
"uuid": "0a2c80eb-ae5d-4d5e-b6fd-2703bc6a750d"
}, },
{ {
"value": "Defense" "value": "Defense",
"uuid": "9df5fb28-2298-4030-9db3-8cdef35bee14"
}, },
{ {
"value": "Development" "value": "Development",
"uuid": "96b329b2-2f04-4ce7-8ef2-bf3d898028c9"
}, },
{ {
"value": "Diplomacy" "value": "Diplomacy",
"uuid": "33cbaf17-7600-47f7-87c7-39640874a1b4"
}, },
{ {
"value": "Education" "value": "Education",
"uuid": "19eca562-123d-449b-af33-5a36e5279b12"
}, },
{ {
"value": "Electric" "value": "Electric",
"uuid": "ac2dad84-5194-41bb-9edd-aad8d42f828f"
}, },
{ {
"value": "Electronic" "value": "Electronic",
"uuid": "04e0eef9-d7e8-4280-86bb-cc9897be8e08"
}, },
{ {
"value": "Employment" "value": "Employment",
"uuid": "474e6647-ff06-4a9b-8061-a1a43baf8b15"
}, },
{ {
"value": "Energy" "value": "Energy",
"uuid": "3a94474b-7e23-4e06-9129-faea7ef55af8"
}, },
{ {
"value": "Entertainment" "value": "Entertainment",
"uuid": "beb9d5d6-53df-4e99-8fa8-e52880fbe740"
}, },
{ {
"value": "Environment" "value": "Environment",
"uuid": "8291a998-e888-4351-87ec-c6da6b06bff6"
}, },
{ {
"value": "Finance" "value": "Finance",
"uuid": "75597b7f-54e8-4f14-88c9-e81485ece483"
}, },
{ {
"value": "Food" "value": "Food",
"uuid": "9ade7eff-e2ce-4f05-85de-bb6b70444db4"
}, },
{ {
"value": "Game" "value": "Game",
"uuid": "64493b1b-04eb-4f4d-94c7-65c3713131de"
}, },
{ {
"value": "Gas" "value": "Gas",
"uuid": "851c28c6-2e80-4d63-959b-44037931175b"
}, },
{ {
"value": "Government, Administration" "value": "Government, Administration",
"uuid": "6012ecea-dcc8-490c-b368-e2e06b2cb62f"
}, },
{ {
"value": "Health" "value": "Health",
"uuid": "4649fe79-cb8f-4aa3-b3e0-e67d4161fcb0"
}, },
{ {
"value": "Higher education" "value": "Higher education",
"uuid": "b822d660-fad3-40da-b4db-9bbf8fe23b27"
}, },
{ {
"value": "Hotels" "value": "Hotels",
"uuid": "909f4de6-91ea-44b6-9c8f-5983fd4877c2"
}, },
{ {
"value": "Infrastructure" "value": "Infrastructure",
"uuid": "641af156-12d0-4fb4-b89d-971cd454914f"
}, },
{ {
"value": "Intelligence" "value": "Intelligence",
"uuid": "7aeb79bf-cc1a-49b5-b2ec-5b1fe4a7e295"
}, },
{ {
"value": "IT" "value": "IT",
"uuid": "3f18e5e7-c77d-4890-9d09-412a39a822e5"
}, },
{ {
"value": "IT - Hacker" "value": "IT - Hacker",
"uuid": "342d0a71-584c-4e3f-9b2d-1dc5b5e53e97"
}, },
{ {
"value": "IT - ISP" "value": "IT - ISP",
"uuid": "872de996-e069-4cd9-b227-d5ca01dc020c"
}, },
{ {
"value": "IT - Security" "value": "IT - Security",
"uuid": "6d9dbde3-25de-48b9-ab98-361c4211e6be"
}, },
{ {
"value": "Justice" "value": "Justice",
"uuid": "784e59ae-89bb-4bc8-82c8-7fab6ca5fb8a"
}, },
{ {
"value": "Manufacturing" "value": "Manufacturing",
"uuid": "5cacd8fb-a3d4-4ed7-84b5-d69378038591"
}, },
{ {
"value": "Maritime" "value": "Maritime",
"uuid": "82ac6245-8691-4216-a6dd-8c99ebb8ce51"
}, },
{ {
"value": "Military" "value": "Military",
"uuid": "5aec0d78-53b2-4fcf-b165-537494b866e4"
}, },
{ {
"value": "Multi-sector" "value": "Multi-sector",
"uuid": "e10093ef-ccbf-4c24-9093-61e856c05ccd"
}, },
{ {
"value": "News - Media" "value": "News - Media",
"uuid": "a0499041-2b4e-43aa-8fe3-04c2de23abdd"
}, },
{ {
"value": "NGO" "value": "NGO",
"uuid": "d2f31b1f-a9b1-4f5b-b2b3-1aa2732a0608"
}, },
{ {
"value": "Oil" "value": "Oil",
"uuid": "5875cc3f-d0a5-445e-abb2-08411fc82522"
}, },
{ {
"value": "Payment" "value": "Payment",
"uuid": "0d688425-afb5-4f71-8b5a-f9be7d2d1551"
}, },
{ {
"value": "Pharmacy" "value": "Pharmacy",
"uuid": "8d7aa230-d07f-46e8-a099-6f1753793b84"
}, },
{ {
"value": "Police - Law enforcement" "value": "Police - Law enforcement",
"uuid": "36432a96-225a-4c90-b0f5-44eaee45e306"
}, },
{ {
"value": "Research - Innovation" "value": "Research - Innovation",
"uuid": "738939b4-c93f-4972-938a-7eb1f60188b9"
}, },
{ {
"value": "Satellite navigation" "value": "Satellite navigation",
"uuid": "40082760-ed9e-4fcb-8bfa-2341d81d5e22"
}, },
{ {
"value": "Security systems" "value": "Security systems",
"uuid": "23429f36-298a-4ac6-8db9-87223bef9cbf"
}, },
{ {
"value": "Social networks" "value": "Social networks",
"uuid": "61809257-9f13-4910-b824-f483c4334bb5"
}, },
{ {
"value": "Space" "value": "Space",
"uuid": "595be3ad-bfb3-4bea-b81a-2fef618a1075"
}, },
{ {
"value": "Steel" "value": "Steel",
"uuid": "cdc8b76f-a8df-4d30-81c1-bdb4935c718d"
}, },
{ {
"value": "Telecoms" "value": "Telecoms",
"uuid": "0de938bd-4efa-4c7a-9244-71a79317d142"
}, },
{ {
"value": "Think Tanks" "value": "Think Tanks",
"uuid": "3c70895b-573b-450c-ad0a-98b0e1a9741e"
}, },
{ {
"value": "Trade" "value": "Trade",
"uuid": "4fef12b1-0bee-4855-81fb-9b7d2c5a1dec"
}, },
{ {
"value": "Transport" "value": "Transport",
"uuid": "e93eb8db-72b1-4407-be3e-8cfea8f9efee"
}, },
{ {
"value": "Travel" "value": "Travel",
"uuid": "33a4f4fe-9bc3-4d43-b5ab-64fcc35882cf"
}, },
{ {
"value": "Turbine" "value": "Turbine",
"uuid": "69b8bfcd-600e-45d8-962a-ce09ed0914ab"
}, },
{ {
"value": "Tourism" "value": "Tourism",
"uuid": "bf0753fd-cb62-440d-a2c5-1adfb037676e"
}, },
{ {
"value": "Life science" "value": "Life science",
"uuid": "87eae00d-b973-46db-83a2-1f520aebcd44"
}, },
{ {
"value": "Biomedical" "value": "Biomedical",
"uuid": "58282b0e-10d4-4294-8845-6f41a1e79730"
}, },
{ {
"value": "High tech" "value": "High tech",
"uuid": "cd4dfa11-5f4a-4d02-a2cc-35603261e631"
}, },
{ {
"value": "Opposition" "value": "Opposition",
"uuid": "18daafae-a923-4cf5-bf87-d8b35dd297e2"
}, },
{ {
"value": "Political party" "value": "Political party",
"uuid": "a93f281c-1fb4-471d-88ba-dfe5f3af13ff"
}, },
{ {
"value": "Hospitality" "value": "Hospitality",
"uuid": "d1aa1165-981a-4d9f-aece-c130c5034e1b"
}, },
{ {
"value": "Automotive" "value": "Automotive",
"uuid": "79e7755d-d7fa-4bbc-b956-e296c614745e"
}, },
{ {
"value": "Metal" "value": "Metal",
"uuid": "3a7dae7d-2590-4e80-9c13-c22048a09f8a"
}, },
{ {
"value": "Railway" "value": "Railway",
"uuid": "02847338-fe03-4073-9f5b-c6fedc244b04"
}, },
{ {
"value": "Water" "value": "Water",
"uuid": "26282f7e-8db4-4369-8af1-3981f6a93350"
}, },
{ {
"value": "Smart meter" "value": "Smart meter",
"uuid": "62487559-c0e5-4250-af48-d43fa2e61b82"
}, },
{ {
"value": "Retai" "value": "Retai",
"uuid": "a26ae91b-df10-4c6f-b7bc-14c7ba13f21d"
}, },
{ {
"value": "Retail" "value": "Retail",
"uuid": "6ce2374c-2c81-4298-a941-666bf4258c00"
}, },
{ {
"value": "Technology" "value": "Technology",
"uuid": "ff403f0f-67d0-494c-aff9-1d748b7e7d8d"
}, },
{ {
"value": "engineering" "value": "engineering",
"uuid": "e07cd84c-1d66-4de3-8b93-15fa93f119cc"
}, },
{ {
"value": "Mining" "value": "Mining",
"uuid": "7508db07-ffd1-4137-9941-718f18370c4c"
}, },
{ {
"value": "Sport" "value": "Sport",
"uuid": "e8355f07-48c7-497b-9a14-3c2a6325ef3d"
}, },
{ {
"value": "Restaurant" "value": "Restaurant",
"uuid": "5eee85f4-f8dc-4dea-9ba2-af1e9f957097"
}, },
{ {
"value": "Semi-conductors" "value": "Semi-conductors",
"uuid": "5b9bb2f4-3e03-46b9-ab65-a7f99b726a32"
}, },
{ {
"value": "Insurance" "value": "Insurance",
"uuid": "c4f35266-0f80-4948-9c0a-f4681ed0d507"
}, },
{ {
"value": "Legal" "value": "Legal",
"uuid": "94a7ffd4-d2e4-4324-be71-f274e84de089"
}, },
{ {
"value": "Shipping" "value": "Shipping",
"uuid": "64483d7b-71a4-4130-803e-2c614a098d8b"
}, },
{ {
"value": "Logistic" "value": "Logistic",
"uuid": "934bc859-ebc4-48d7-adb7-5accd4f0f965"
}, },
{ {
"value": "Construction" "value": "Construction",
"uuid": "4b5c230d-70b8-4748-a27c-bec121c436d8"
}, },
{ {
"value": "Industrial" "value": "Industrial",
"uuid": "3153215a-784d-478e-a147-3410a5b43b39"
}, },
{ {
"value": "Communication equipment" "value": "Communication equipment",
"uuid": "f4e11fd2-f2a2-4d09-8ed4-7ef978ccc03b"
}, },
{ {
"value": "Security Service" "value": "Security Service",
"uuid": "886e517c-0331-445e-9c4b-ebe08aeb01cd"
}, },
{ {
"value": "Tax firm" "value": "Tax firm",
"uuid": "138159c5-0b29-46a5-91e2-fe01f7e7111d"
}, },
{ {
"value": "Television broadcast" "value": "Television broadcast",
"uuid": "13fe4a5d-8d86-4875-b763-02bc5705810f"
}, },
{ {
"value": "Separatists" "value": "Separatists",
"uuid": "d6335a0a-dfa2-4150-804b-86d06139e38a"
}, },
{ {
"value": "Dissidents" "value": "Dissidents",
"uuid": "c2f32e7c-6162-4999-ac3b-356007446d18"
}, },
{ {
"value": "Digital services" "value": "Digital services",
"uuid": "5a9da7ef-57b8-4a22-88be-b8b6556fd447"
}, },
{ {
"value": "Digital infrastructure" "value": "Digital infrastructure",
"uuid": "a10c2362-3ee9-4741-b5a5-c2fd1c7c730f"
}, },
{ {
"value": "Security actors" "value": "Security actors",
"uuid": "0904672b-c18a-450e-88d6-6a94dd0eb25a"
}, },
{ {
"value": "eCommerce" "value": "eCommerce",
"uuid": "7e1ec8ba-24c4-4ad4-a596-7532ecbd0fbd"
}, },
{ {
"value": "Islamic forums" "value": "Islamic forums",
"uuid": "c529331a-e2a9-4ba9-bb92-d4f88ae3704b"
}, },
{ {
"value": "Journalist" "value": "Journalist",
"uuid": "ea95dce2-c2fc-48cb-95c7-d9200811f030"
}, },
{ {
"value": "Streaming service" "value": "Streaming service",
"uuid": "2287c024-9643-43ef-8776-858d3994b9ac"
}, },
{ {
"value": "Puplishing industry" "value": "Puplishing industry",
"uuid": "97e018e8-e03b-48ff-8add-1059f035069a"
}, },
{ {
"value": "Publishing industry" "value": "Publishing industry",
"uuid": "867cbcb3-8baa-476f-bec5-ceb36e9b1e09"
}, },
{ {
"value": "Islamic organisation" "value": "Islamic organisation",
"uuid": "3929f589-ac94-4a6a-8360-122e06484db8"
}, },
{ {
"value": "Casino" "value": "Casino",
"uuid": "2e7ad54f-7637-4268-a9b9-cb2975d6bab9"
}, },
{ {
"value": "Consulting" "value": "Consulting",
"uuid": "87ad7866-bdfa-4a22-a4f3-c411fecb1d0d"
}, },
{ {
"value": "Online marketplace" "value": "Online marketplace",
"uuid": "737a196b-7bab-460b-b199-d6626fca1af1"
}, },
{ {
"value": "DNS service provider" "value": "DNS service provider",
"uuid": "e48c0afc-afab-4ced-9a8b-a28d4a2efa08"
}, },
{ {
"value": "Veterinary" "value": "Veterinary",
"uuid": "4bc73e7c-d174-4faf-9176-d0ccc8ccfbbf"
}, },
{ {
"value": "Marketing" "value": "Marketing",
"uuid": "ee5720bb-c638-46f8-bdf2-55579bf37eb2"
}, },
{ {
"value": "Video Sharing" "value": "Video Sharing",
"uuid": "55d12d41-c558-4cdf-b2c5-f246403ca68f"
}, },
{ {
"value": "Advertising" "value": "Advertising",
"uuid": "b018010e-272e-4ca9-8551-073618d7f2ad"
}, },
{ {
"value": "Investment" "value": "Investment",
"uuid": "40d66f31-36c2-42ff-97c6-97b34b5ce04e"
}, },
{ {
"value": "Accounting" "value": "Accounting",
"uuid": "6edffd60-443c-4238-b368-362b47340d8b"
}, },
{ {
"value": "Programming" "value": "Programming",
"uuid": "855f40e1-074e-4818-8082-696a54adf13f"
}, },
{ {
"value": "Managed Services Provider" "value": "Managed Services Provider",
"uuid": "f9260307-f792-4e60-8aa5-e2b4f84adadb"
}, },
{ {
"value": "Lawyers" "value": "Lawyers",
"uuid": "56eee132-fc01-410c-ada0-44d713443bf2"
}, },
{ {
"value": "Civil society" "value": "Civil society",
"uuid": "9c1f6a5b-d9de-4cce-a024-7437cb20e24e"
}, },
{ {
"value": "Petrochemical" "value": "Petrochemical",
"uuid": "1f1c762b-1e39-4989-8679-cc1f9cb08349"
}, },
{ {
"value": "Immigration" "value": "Immigration",
"uuid": "bfd171a5-33f5-4c79-81c5-3dda99dae559"
} }
], ],
"version": 1, "version": 1,

27
clusters/tds.json
View file

@ -10,7 +10,8 @@
"type": [ "type": [
"Commercial" "Commercial"
] ]
} },
"uuid": "94c57fc0-4477-4643-b539-55ba8c455df6"
}, },
{ {
"value": "BlackTDS", "value": "BlackTDS",
@ -22,7 +23,8 @@
"type": [ "type": [
"Underground" "Underground"
] ]
} },
"uuid": "d5c0cf8d-8ed0-4fa2-a2e6-7274516ea1c8"
}, },
{ {
"value": "ShadowTDS", "value": "ShadowTDS",
@ -31,7 +33,8 @@
"type": [ "type": [
"Underground" "Underground"
] ]
} },
"uuid": "2680a4b1-84d1-4af0-8126-4429a90f8ef8"
}, },
{ {
"value": "Sutra", "value": "Sutra",
@ -43,7 +46,8 @@
"type": [ "type": [
"Commercial" "Commercial"
] ]
} },
"uuid": "67f21003-bbc8-4993-b615-f990e539929f"
}, },
{ {
"value": "SimpleTDS", "value": "SimpleTDS",
@ -58,7 +62,8 @@
"type": [ "type": [
"OpenSource" "OpenSource"
] ]
} },
"uuid": "aa179c37-1a8a-4761-841a-cc940e19d7be"
}, },
{ {
"value": "BossTDS", "value": "BossTDS",
@ -70,7 +75,8 @@
"type": [ "type": [
"Commercial" "Commercial"
] ]
} },
"uuid": "5a483b4b-671a-4113-9b99-a115d2d2d644"
}, },
{ {
"value": "BlackHat TDS", "value": "BlackHat TDS",
@ -82,7 +88,8 @@
"type": [ "type": [
"Underground" "Underground"
] ]
} },
"uuid": "36aa3b2d-4927-45e5-be08-f30144fd1909"
}, },
{ {
"value": "Futuristic TDS", "value": "Futuristic TDS",
@ -91,7 +98,8 @@
"type": [ "type": [
"Underground" "Underground"
] ]
} },
"uuid": "19d8eab9-72d5-4f22-affb-c0d6aed66346"
}, },
{ {
"value": "Orchid TDS", "value": "Orchid TDS",
@ -100,7 +108,8 @@
"type": [ "type": [
"Underground" "Underground"
] ]
} },
"uuid": "ec0048f2-a7b2-4a71-83de-6e8fe4fef252"
} }
], ],
"version": 3, "version": 3,

531
clusters/threat-actor.json
View file

File diff suppressed because it is too large Load diff

1074
clusters/tool.json
View file

File diff suppressed because it is too large Load diff

21
tools/add_missing_uuid.py Normal file
View file

@ -0,0 +1,21 @@
#!/usr/bin/env python
# -*- coding: utf-8 -*-
import json
import argparse
import uuid
parser = argparse.ArgumentParser(description='Add missing uuids in clusters')
parser.add_argument("-f", "--filename", required=True, help="name of the cluster")
args = parser.parse_args()
with open(args.filename) as json_file:
data = json.load(json_file)
json_file.close()
for value in data['values']:
if 'uuid' not in value:
value['uuid'] = str(uuid.uuid4())
with open(args.filename, 'w') as json_file:
json.dump(data, json_file, indent=4)