3508 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Christophe Vandeplas	79b80b0869	chg: [rels] more threat actor relations	2023-04-23 17:54:58 +02:00
Christophe Vandeplas	3c6c204f01	chg: [rels] more threat actor relations	2023-04-23 17:45:58 +02:00
Christophe Vandeplas	138c7c7ba8	chg: [rels] more relations on cluster "value"	2023-04-23 17:36:02 +02:00
Christophe Vandeplas	fd44ebaee0	fix: [tool] minor cosmetic fix	2023-04-23 16:31:31 +02:00
Christophe Vandeplas	568e6a7507	fix: [tool] minor cosmetic fix	2023-04-23 15:00:57 +02:00
Christophe Vandeplas	7d98ac013c	chg: [tool] gen_relationships is now interactive	2023-04-23 14:59:26 +02:00
Christophe Vandeplas	bea5fda2ab	new: [tool] Initial version of a Relationship generator.	2023-04-23 13:23:23 +02:00
Christophe Vandeplas	bf7c5f1dd9	chg: [rels] threat-actor & MS activity group - on synonym	2023-04-23 11:56:41 +02:00
Christophe Vandeplas	a5e7e0c95f	chg: [rels] threat-actor & MS activity group - on value	2023-04-23 11:55:57 +02:00
Christophe Vandeplas	e056a9ea0c	fix: [tools] 360net cosmetic fix	2023-04-23 10:19:48 +02:00
Christophe Vandeplas	f070943ee9	chg: [atrm] updated to latest version	2023-04-23 07:45:16 +02:00
Alexandre Dulaunoy	4152b9fb83	chg: [doc] updated	2023-04-21 11:24:50 +02:00
Alexandre Dulaunoy	adc7a70cf9	chg: [microsoft-activity-group] country code added	2023-04-21 07:39:37 +02:00
Alexandre Dulaunoy	8688c41796	chg: [microsoft activity group] remove duplicate	2023-04-20 17:25:32 +02:00
Alexandre Dulaunoy	592361826a	fix: [microsoft activity group] duplicate in Microsoft source	2023-04-20 17:20:57 +02:00
Alexandre Dulaunoy	309f4f2ea5	chg: [microsoft-activity-group] updated following contribution from @botlabsDev script	2023-04-20 17:04:05 +02:00
Alexandre Dulaunoy	2cc6bdfbc1	chg: [sigma] rules updated	2023-04-20 12:17:46 +02:00
Alexandre Dulaunoy	7e25c9ef1f	Merge pull request #831 from sebdraven/main ... Update threat-actor.json	2023-04-19 17:47:22 +02:00
Sebastien Larinier	862badf2c9	Update threat-actor.json	2023-04-19 17:41:44 +02:00
Sebastien Larinier	1c751b1ea8	Update threat-actor.json	2023-04-19 17:34:50 +02:00
Sebastien Larinier	165ce70a28	Merge branch 'MISP:main' into main	2023-04-19 16:48:02 +02:00
Alexandre Dulaunoy	a891f2b5f7	Merge pull request #843 from Delta-Sierra/main ... Update Snowyamber, Halfrig & quarterrig relationships	2023-04-19 16:23:40 +02:00
Alexandre Dulaunoy	bf7005c1c3	chg: [microsoft-activity-group] jq all the things	2023-04-19 16:23:02 +02:00
Sebastien Larinier	87ef0a400e	Update threat-actor.json	2023-04-19 15:42:14 +02:00
Sebastien Larinier	a77dc82c0a	Update threat-actor.json ... new apt30 group	2023-04-19 15:35:36 +02:00
Delta-Sierra	063ac9fc71	jq?	2023-04-19 15:10:25 +02:00
Delta-Sierra	ecb7e79a6e	Merge https://github.com/MISP/misp-galaxy	2023-04-19 15:06:51 +02:00
Alexandre Dulaunoy	4277fd393e	Merge pull request #842 from neok0/main ... replace "sector" tag with "country" for matching data. this allows to…	2023-04-19 14:43:33 +02:00
Tobias Mainka	8d2b9537f1	replace "sector" tag with "country" for matching data. this allows to be confirm with existing clusters.	2023-04-19 12:38:37 +02:00
Sebastien Larinier	926035633f	Merge branch 'MISP:main' into main	2023-04-19 11:55:57 +02:00
Alexandre Dulaunoy	ccc8f0f801	chg: [microsoft-activity-group] updated to map the new funky Microsoft "taxonomy" ... Script to generate the cluster is the following, UUIDv5 based on standard misp-stix source UUIDv4. ~~~python lcluster = [] for v in data: cluster = {} cluster['value'] = v['threat_actor'] cluster['meta'] = {} cluster['meta']['sector'] = v['sector'] cluster['meta']['synonyms'] = v['synonyms'] cluster['meta']['refs'] = [] cluster['meta']['refs'].append('https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide') _uuid = uuid.uuid5(uuid.UUID("76beed5f-7251-457e-8c2a-b45f7b589d3d"), "{}".format(cluster['value'])) cluster['uuid'] = str(_uuid) lcluster.append(cluster) ~~~ Relationships might be added in a later stage to map with the MISP threat actor galaxy.	2023-04-19 10:47:11 +02:00
Alexandre Dulaunoy	76ff618d60	Merge pull request #840 from danielplohmann/patch-33 ... adding Trend Micro alias Earth Smilodon for APT27	2023-04-18 23:13:16 +02:00
Daniel Plohmann	41afab1c06	adding Trend Micro alias Earth Smilodon for APT27	2023-04-18 20:11:57 +02:00
Delta-Sierra	6b8994271e	add relationships for HALFRIG & QUATTERRIG	2023-04-18 12:20:20 +02:00
Alexandre Dulaunoy	dd9e033ce5	Merge pull request #839 from danielplohmann/patch-32 ... adding Google alias HOODOO for APT41	2023-04-17 22:52:14 +02:00
Daniel Plohmann	02e23a9a47	adding Google alias HOODOO for APT41	2023-04-17 22:32:50 +02:00
Delta-Sierra	4a4fa6d16f	fix versions	2023-04-17 11:32:51 +02:00
Delta-Sierra	6d5df91efa	add relationship SNOWYAMBER & Notion	2023-04-17 11:31:48 +02:00
Delta-Sierra	233a066a03	Merge https://github.com/MISP/misp-galaxy	2023-04-17 11:16:23 +02:00
Delta-Sierra	d4225c5469	add some SNOWYAMBER relationships	2023-04-17 11:16:21 +02:00
Alexandre Dulaunoy	91af071bae	new: [online-service] online service added	2023-04-17 10:59:18 +02:00
Alexandre Dulaunoy	5f9760923f	Merge pull request #838 from Delta-Sierra/main ... Adding SNOWYAMBER, HALFRIG, QUARTERRIG tools & PowerMagic backdoor	2023-04-14 16:03:57 +02:00
Delta-Sierra	8e9880d932	Add SNOWYAMBER, HALFRIG, QUARTERRIG tools	2023-04-14 15:59:42 +02:00
Delta-Sierra	c5590ff79a	add PowerMagic backdoor	2023-04-13 14:11:36 +02:00
Alexandre Dulaunoy	c0cde98818	Merge pull request #835 from danielplohmann/patch-31 ... adding Trend Micro alias Earth Preta for Mustang Panda	2023-04-12 17:49:45 +02:00
Daniel Plohmann	a966b3ff88	adding Trend Micro alias Earth Preta for Mustang Panda	2023-04-12 16:59:36 +02:00
Alexandre Dulaunoy	2763cdd72b	chg:[sigma] Sigma rules updated	2023-04-12 11:44:43 +02:00
Alexandre Dulaunoy	f877cb4d08	Merge pull request #834 from Delta-Sierra/main ... more ransomwares from ransomlook	2023-04-12 10:17:24 +02:00
Delta-Sierra	8c831d70c8	jq	2023-04-11 15:06:59 +02:00
Delta-Sierra	d30e7357fe	merge	2023-04-11 13:57:30 +02:00