20914 lines
1.3 MiB
JSON
20914 lines
1.3 MiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--570f47a0-ee58-4aa8-ac55-96e4950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T09:00:36.000Z",
|
||
|
|
"modified": "2016-04-14T09:00:36.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--570f47a0-ee58-4aa8-ac55-96e4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T09:00:36.000Z",
|
||
|
|
"modified": "2016-04-14T09:00:36.000Z",
|
||
|
|
"name": "Malspam via Spambots (2016-04-14)",
|
||
|
|
"published": "2016-04-14T09:20:00Z",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--570f48d6-0d44-45ac-b32e-96e5950d210f",
|
||
|
|
"indicator--570f48d6-3f38-4fa1-88d4-96e5950d210f",
|
||
|
|
"indicator--570f48d7-81a8-4763-8f9b-96e5950d210f",
|
||
|
|
"indicator--570f48d7-c508-4566-b950-96e5950d210f",
|
||
|
|
"indicator--570f48d7-3348-4bf9-9e5e-96e5950d210f",
|
||
|
|
"indicator--570f48d8-71a8-447f-897b-96e5950d210f",
|
||
|
|
"indicator--570f48d8-becc-4537-b8e8-96e5950d210f",
|
||
|
|
"indicator--570f48d8-d0d0-4a6c-930c-96e5950d210f",
|
||
|
|
"indicator--570f48d9-7cb0-4107-9a73-96e5950d210f",
|
||
|
|
"indicator--570f48d9-ce54-4e46-aa6e-96e5950d210f",
|
||
|
|
"indicator--570f48d9-dd64-4cfa-98da-96e5950d210f",
|
||
|
|
"indicator--570f48da-c458-4630-9374-96e5950d210f",
|
||
|
|
"indicator--570f48da-0594-4d8d-a802-96e5950d210f",
|
||
|
|
"indicator--570f48da-7174-4375-8764-96e5950d210f",
|
||
|
|
"indicator--570f48da-8f90-4332-bfa6-96e5950d210f",
|
||
|
|
"indicator--570f48db-1fc0-47da-94e9-96e5950d210f",
|
||
|
|
"indicator--570f48db-b748-4bb7-bb1e-96e5950d210f",
|
||
|
|
"indicator--570f48db-81d4-4e49-aa63-96e5950d210f",
|
||
|
|
"indicator--570f48dc-e304-4cd1-90a4-96e5950d210f",
|
||
|
|
"indicator--570f48dc-5e04-456d-a3b7-96e5950d210f",
|
||
|
|
"indicator--570f48dc-9cb8-453e-85ea-96e5950d210f",
|
||
|
|
"indicator--570f48dd-d148-4056-8eb8-96e5950d210f",
|
||
|
|
"indicator--570f48dd-7bfc-46b2-806c-96e5950d210f",
|
||
|
|
"indicator--570f48dd-b4e8-4cf4-9108-96e5950d210f",
|
||
|
|
"indicator--570f48de-60a0-4158-9042-96e5950d210f",
|
||
|
|
"indicator--570f48de-059c-4f3a-a3bb-96e5950d210f",
|
||
|
|
"indicator--570f48de-863c-4b3b-b79b-96e5950d210f",
|
||
|
|
"indicator--570f48de-9d6c-4ca8-a8c0-96e5950d210f",
|
||
|
|
"indicator--570f48df-2500-42d9-9d10-96e5950d210f",
|
||
|
|
"indicator--570f48df-eae8-42e0-ac28-96e5950d210f",
|
||
|
|
"indicator--570f48df-7420-4b3e-9449-96e5950d210f",
|
||
|
|
"indicator--570f48e0-a0a0-4928-9535-96e5950d210f",
|
||
|
|
"indicator--570f48e0-8314-41ee-b8b4-96e5950d210f",
|
||
|
|
"indicator--570f48e0-3780-49a9-99e6-96e5950d210f",
|
||
|
|
"indicator--570f48e1-1a2c-4add-a7ff-96e5950d210f",
|
||
|
|
"indicator--570f48e1-4414-4bd9-8df7-96e5950d210f",
|
||
|
|
"indicator--570f48e1-4108-4208-b576-96e5950d210f",
|
||
|
|
"indicator--570f48e2-c138-48d3-b72f-96e5950d210f",
|
||
|
|
"indicator--570f48e2-9168-4608-8a49-96e5950d210f",
|
||
|
|
"indicator--570f48e2-2720-4cf7-bff5-96e5950d210f",
|
||
|
|
"indicator--570f48e2-53a8-4674-8d33-96e5950d210f",
|
||
|
|
"indicator--570f48e3-88ac-499b-8093-96e5950d210f",
|
||
|
|
"indicator--570f48e3-b144-40e6-8281-96e5950d210f",
|
||
|
|
"indicator--570f48e3-3358-43a6-adfc-96e5950d210f",
|
||
|
|
"indicator--570f48e4-e558-4e49-a839-96e5950d210f",
|
||
|
|
"indicator--570f48e4-8f98-4499-9e0d-96e5950d210f",
|
||
|
|
"indicator--570f48e4-5790-4b49-89bb-96e5950d210f",
|
||
|
|
"indicator--570f48e5-61c0-4fca-9e8e-96e5950d210f",
|
||
|
|
"indicator--570f48e5-4434-4bc1-babd-96e5950d210f",
|
||
|
|
"indicator--570f48e6-ca00-4737-84cd-96e5950d210f",
|
||
|
|
"indicator--570f48e6-3f10-482c-a2f2-96e5950d210f",
|
||
|
|
"indicator--570f48e6-96d0-47e9-a388-96e5950d210f",
|
||
|
|
"indicator--570f48e7-b584-4610-879e-96e5950d210f",
|
||
|
|
"indicator--570f48e7-6d14-4826-a607-96e5950d210f",
|
||
|
|
"indicator--570f48e7-3dfc-476d-b211-96e5950d210f",
|
||
|
|
"indicator--570f48e8-aa40-4729-a229-96e5950d210f",
|
||
|
|
"indicator--570f48e8-d470-4733-8b87-96e5950d210f",
|
||
|
|
"indicator--570f48e8-638c-4821-b811-96e5950d210f",
|
||
|
|
"indicator--570f48e8-1a18-4b6a-b9ad-96e5950d210f",
|
||
|
|
"indicator--570f48e9-b1e4-46e3-8129-96e5950d210f",
|
||
|
|
"indicator--570f48e9-311c-4861-8a4c-96e5950d210f",
|
||
|
|
"indicator--570f48e9-cc0c-4140-9275-96e5950d210f",
|
||
|
|
"indicator--570f48ea-becc-444b-a9a5-96e5950d210f",
|
||
|
|
"indicator--570f48ea-4c18-4213-b918-96e5950d210f",
|
||
|
|
"indicator--570f48ea-a988-4f9a-b71d-96e5950d210f",
|
||
|
|
"indicator--570f48eb-ced0-4cc5-a961-96e5950d210f",
|
||
|
|
"indicator--570f48eb-1ac8-4398-a048-96e5950d210f",
|
||
|
|
"indicator--570f48eb-e5a4-441c-8c5f-96e5950d210f",
|
||
|
|
"indicator--570f48ec-a0ec-4664-aa58-96e5950d210f",
|
||
|
|
"indicator--570f48ec-57a0-4ba3-afc1-96e5950d210f",
|
||
|
|
"indicator--570f48ec-dbe8-4a75-bf13-96e5950d210f",
|
||
|
|
"indicator--570f48ed-4dec-4657-b148-96e5950d210f",
|
||
|
|
"indicator--570f48ed-138c-4c1b-9493-96e5950d210f",
|
||
|
|
"indicator--570f48ed-eaa0-4c7a-bda4-96e5950d210f",
|
||
|
|
"indicator--570f48ee-d538-4056-bf49-96e5950d210f",
|
||
|
|
"indicator--570f48ee-bfec-4c45-9a9b-96e5950d210f",
|
||
|
|
"indicator--570f48ef-5df4-404c-a805-96e5950d210f",
|
||
|
|
"indicator--570f48ef-512c-4c0b-9f93-96e5950d210f",
|
||
|
|
"indicator--570f48ef-8c74-4475-8d8a-96e5950d210f",
|
||
|
|
"indicator--570f48f0-4c64-442d-82d6-96e5950d210f",
|
||
|
|
"indicator--570f48f0-06cc-4ef4-957a-96e5950d210f",
|
||
|
|
"indicator--570f48f0-b80c-4117-a70c-96e5950d210f",
|
||
|
|
"indicator--570f48f1-f534-4094-94db-96e5950d210f",
|
||
|
|
"indicator--570f48f1-6fa8-43a3-b09f-96e5950d210f",
|
||
|
|
"indicator--570f48f2-6110-47ae-9d67-96e5950d210f",
|
||
|
|
"indicator--570f48f2-3e7c-4883-9a90-96e5950d210f",
|
||
|
|
"indicator--570f48f2-6a90-4bff-87a0-96e5950d210f",
|
||
|
|
"indicator--570f48f3-407c-42b3-ba72-96e5950d210f",
|
||
|
|
"indicator--570f48f3-2e10-4ad4-a917-96e5950d210f",
|
||
|
|
"indicator--570f48f4-8660-4f82-84d8-96e5950d210f",
|
||
|
|
"indicator--570f48f4-c95c-4841-bad0-96e5950d210f",
|
||
|
|
"indicator--570f48f4-a89c-4912-8f9e-96e5950d210f",
|
||
|
|
"indicator--570f48f4-d774-4302-964d-96e5950d210f",
|
||
|
|
"indicator--570f48f5-5348-4f57-a4c2-96e5950d210f",
|
||
|
|
"indicator--570f48f5-c294-495d-8bf1-96e5950d210f",
|
||
|
|
"indicator--570f48f5-75b0-4bb1-af96-96e5950d210f",
|
||
|
|
"indicator--570f48f6-dbf8-46f2-91ba-96e5950d210f",
|
||
|
|
"indicator--570f48f6-32cc-40bd-98fb-96e5950d210f",
|
||
|
|
"indicator--570f48f7-0610-4ded-95cb-96e5950d210f",
|
||
|
|
"indicator--570f48f7-a4b4-4285-81df-96e5950d210f",
|
||
|
|
"indicator--570f48f7-69c4-44d5-b9fa-96e5950d210f",
|
||
|
|
"indicator--570f48f8-36ec-47ca-80ae-96e5950d210f",
|
||
|
|
"indicator--570f48f8-8ba0-47fe-9fb4-96e5950d210f",
|
||
|
|
"indicator--570f48f8-9850-4c94-881b-96e5950d210f",
|
||
|
|
"indicator--570f48f9-93f4-463f-9640-96e5950d210f",
|
||
|
|
"indicator--570f48f9-79a4-41da-a424-96e5950d210f",
|
||
|
|
"indicator--570f48fa-a48c-4164-ab5c-96e5950d210f",
|
||
|
|
"indicator--570f48fa-aee4-468e-99b9-96e5950d210f",
|
||
|
|
"indicator--570f48fa-d86c-45b9-bac9-96e5950d210f",
|
||
|
|
"indicator--570f48fb-1554-4730-948b-96e5950d210f",
|
||
|
|
"indicator--570f48fb-edd0-42ae-bd7f-96e5950d210f",
|
||
|
|
"indicator--570f48fc-1300-4597-8e09-96e5950d210f",
|
||
|
|
"indicator--570f48fc-32f8-4f53-b0bf-96e5950d210f",
|
||
|
|
"indicator--570f48fc-92ec-4178-8a11-96e5950d210f",
|
||
|
|
"indicator--570f48fd-080c-4dba-8f4c-96e5950d210f",
|
||
|
|
"indicator--570f48fd-5ae0-4906-8aeb-96e5950d210f",
|
||
|
|
"indicator--570f48fd-9288-44d8-8f65-96e5950d210f",
|
||
|
|
"indicator--570f48fe-583c-4e0d-a6b1-96e5950d210f",
|
||
|
|
"indicator--570f48fe-5150-4faa-884e-96e5950d210f",
|
||
|
|
"indicator--570f48ff-9df4-42ad-bc45-96e5950d210f",
|
||
|
|
"indicator--570f48ff-5cc4-40c0-a89c-96e5950d210f",
|
||
|
|
"indicator--570f48ff-e314-4d0c-a6d6-96e5950d210f",
|
||
|
|
"indicator--570f4900-257c-49e1-bfbe-96e5950d210f",
|
||
|
|
"indicator--570f4900-e2ac-47bc-bcef-96e5950d210f",
|
||
|
|
"indicator--570f4900-f5c8-4482-9608-96e5950d210f",
|
||
|
|
"indicator--570f4901-2e4c-4032-9d66-96e5950d210f",
|
||
|
|
"indicator--570f4901-1530-4926-b701-96e5950d210f",
|
||
|
|
"indicator--570f4902-588c-4052-824b-96e5950d210f",
|
||
|
|
"indicator--570f4902-8000-4b87-8ba9-96e5950d210f",
|
||
|
|
"indicator--570f4902-2330-4666-84d1-96e5950d210f",
|
||
|
|
"indicator--570f4903-9628-40fc-992a-96e5950d210f",
|
||
|
|
"indicator--570f4903-f51c-4f65-8983-96e5950d210f",
|
||
|
|
"indicator--570f4903-d704-4841-8a6e-96e5950d210f",
|
||
|
|
"indicator--570f4904-f030-4afc-ac58-96e5950d210f",
|
||
|
|
"indicator--570f4904-cfbc-4cde-83d8-96e5950d210f",
|
||
|
|
"indicator--570f4904-5ee8-479f-b45e-96e5950d210f",
|
||
|
|
"indicator--570f4905-5f54-4dc8-a77a-96e5950d210f",
|
||
|
|
"indicator--570f4905-8d70-4bda-b6fd-96e5950d210f",
|
||
|
|
"indicator--570f4905-a8c4-4e35-8f8e-96e5950d210f",
|
||
|
|
"indicator--570f4905-7de4-474f-b1e1-96e5950d210f",
|
||
|
|
"indicator--570f4906-918c-4e16-865f-96e5950d210f",
|
||
|
|
"indicator--570f4906-8014-48ed-8d68-96e5950d210f",
|
||
|
|
"indicator--570f4906-f740-4d81-b100-96e5950d210f",
|
||
|
|
"indicator--570f4907-8cf8-4cbb-91b4-96e5950d210f",
|
||
|
|
"indicator--570f4907-39dc-4706-ba52-96e5950d210f",
|
||
|
|
"indicator--570f4907-d70c-4790-b5a1-96e5950d210f",
|
||
|
|
"indicator--570f4908-e2cc-47f3-9517-96e5950d210f",
|
||
|
|
"indicator--570f4908-a440-4b5f-9c55-96e5950d210f",
|
||
|
|
"indicator--570f4908-b538-4893-8caa-96e5950d210f",
|
||
|
|
"indicator--570f4908-87e0-4cf3-934f-96e5950d210f",
|
||
|
|
"indicator--570f4909-6674-4356-b988-96e5950d210f",
|
||
|
|
"indicator--570f4909-b87c-4725-87ef-96e5950d210f",
|
||
|
|
"indicator--570f4909-bccc-4557-9330-96e5950d210f",
|
||
|
|
"indicator--570f490a-9384-4085-b346-96e5950d210f",
|
||
|
|
"indicator--570f490a-fec8-4c75-a5e9-96e5950d210f",
|
||
|
|
"indicator--570f490a-dd04-4fbf-8101-96e5950d210f",
|
||
|
|
"indicator--570f490b-d208-40b4-8fdf-96e5950d210f",
|
||
|
|
"indicator--570f490b-7338-471b-a486-96e5950d210f",
|
||
|
|
"indicator--570f490b-26c4-4ad5-96f8-96e5950d210f",
|
||
|
|
"indicator--570f490c-7590-4764-aa4f-96e5950d210f",
|
||
|
|
"indicator--570f490c-6938-4639-a085-96e5950d210f",
|
||
|
|
"indicator--570f490c-b49c-4230-96f1-96e5950d210f",
|
||
|
|
"indicator--570f490d-2ab0-4af2-a993-96e5950d210f",
|
||
|
|
"indicator--570f490d-ce40-46fa-adb8-96e5950d210f",
|
||
|
|
"indicator--570f490d-3700-4b70-b2e7-96e5950d210f",
|
||
|
|
"indicator--570f490e-e9a8-43a6-ab1f-96e5950d210f",
|
||
|
|
"indicator--570f490e-9a18-4b19-8423-96e5950d210f",
|
||
|
|
"indicator--570f490e-28bc-483f-8f3e-96e5950d210f",
|
||
|
|
"indicator--570f490e-3398-445b-b8ea-96e5950d210f",
|
||
|
|
"indicator--570f490f-ad30-4ada-bb31-96e5950d210f",
|
||
|
|
"indicator--570f490f-4e94-4cf1-9bbd-96e5950d210f",
|
||
|
|
"indicator--570f490f-add0-4ec6-b4b4-96e5950d210f",
|
||
|
|
"indicator--570f4910-b168-4656-ae7d-96e5950d210f",
|
||
|
|
"indicator--570f4910-1390-4ac1-8477-96e5950d210f",
|
||
|
|
"indicator--570f4910-a334-4fe0-b83f-96e5950d210f",
|
||
|
|
"indicator--570f4911-f4a8-4623-954b-96e5950d210f",
|
||
|
|
"indicator--570f4911-8e58-4e9d-9bc9-96e5950d210f",
|
||
|
|
"indicator--570f4911-a4a4-43e5-aeba-96e5950d210f",
|
||
|
|
"indicator--570f4912-0eac-42cc-a63f-96e5950d210f",
|
||
|
|
"indicator--570f4912-4e18-4d06-9619-96e5950d210f",
|
||
|
|
"indicator--570f4912-9e50-443e-9668-96e5950d210f",
|
||
|
|
"indicator--570f4913-f264-4ab1-b67f-96e5950d210f",
|
||
|
|
"indicator--570f4913-7494-485b-9f4e-96e5950d210f",
|
||
|
|
"indicator--570f4913-ed74-44b0-b42a-96e5950d210f",
|
||
|
|
"indicator--570f4914-9994-4699-8b52-96e5950d210f",
|
||
|
|
"indicator--570f4914-4c0c-46ad-94ee-96e5950d210f",
|
||
|
|
"indicator--570f4914-0804-4701-9bce-96e5950d210f",
|
||
|
|
"indicator--570f4915-3344-4f4f-aeaa-96e5950d210f",
|
||
|
|
"indicator--570f4915-0960-45d1-aa67-96e5950d210f",
|
||
|
|
"indicator--570f4915-08a4-40f9-841c-96e5950d210f",
|
||
|
|
"indicator--570f4916-3cb8-47d3-900c-96e5950d210f",
|
||
|
|
"indicator--570f4916-3450-45d5-8f30-96e5950d210f",
|
||
|
|
"indicator--570f4917-8af8-49b0-b0cc-96e5950d210f",
|
||
|
|
"indicator--570f4917-fdb8-4f44-b7c2-96e5950d210f",
|
||
|
|
"indicator--570f4917-93e8-424f-82e4-96e5950d210f",
|
||
|
|
"indicator--570f4918-6ee0-4d9b-946c-96e5950d210f",
|
||
|
|
"indicator--570f4918-2a74-47a9-9d93-96e5950d210f",
|
||
|
|
"indicator--570f4918-1e80-4dd6-ba3f-96e5950d210f",
|
||
|
|
"indicator--570f4919-d6f8-4e54-9406-96e5950d210f",
|
||
|
|
"indicator--570f4919-1228-46ce-bf18-96e5950d210f",
|
||
|
|
"indicator--570f491a-ff74-4d5a-a4ee-96e5950d210f",
|
||
|
|
"indicator--570f491a-ec20-41e2-831e-96e5950d210f",
|
||
|
|
"indicator--570f491a-a128-44ca-8653-96e5950d210f",
|
||
|
|
"indicator--570f491b-373c-4404-a63a-96e5950d210f",
|
||
|
|
"indicator--570f491b-74cc-4ab1-8bc6-96e5950d210f",
|
||
|
|
"indicator--570f491b-9c2c-4974-a5ef-96e5950d210f",
|
||
|
|
"indicator--570f491c-79a8-45a0-b821-96e5950d210f",
|
||
|
|
"indicator--570f491c-f84c-48fb-bd24-96e5950d210f",
|
||
|
|
"indicator--570f491c-f24c-4a97-8682-96e5950d210f",
|
||
|
|
"indicator--570f491d-7578-4bde-b531-96e5950d210f",
|
||
|
|
"indicator--570f491d-149c-4adb-9d32-96e5950d210f",
|
||
|
|
"indicator--570f491d-88e4-4e24-8758-96e5950d210f",
|
||
|
|
"indicator--570f491e-a78c-4af6-ae69-96e5950d210f",
|
||
|
|
"indicator--570f491e-cbfc-4577-8268-96e5950d210f",
|
||
|
|
"indicator--570f491e-fd50-4ba1-be51-96e5950d210f",
|
||
|
|
"indicator--570f491e-9f6c-4e18-b40e-96e5950d210f",
|
||
|
|
"indicator--570f491f-b584-480d-b3b0-96e5950d210f",
|
||
|
|
"indicator--570f491f-38a4-4bef-9a7b-96e5950d210f",
|
||
|
|
"indicator--570f491f-ca34-40e7-b9d1-96e5950d210f",
|
||
|
|
"indicator--570f4920-5a80-43d7-99cb-96e5950d210f",
|
||
|
|
"indicator--570f4920-fb40-46f5-abcd-96e5950d210f",
|
||
|
|
"indicator--570f4920-7b60-49c5-bc1e-96e5950d210f",
|
||
|
|
"indicator--570f4921-d788-49a7-a89d-96e5950d210f",
|
||
|
|
"indicator--570f4921-80dc-49c2-ac08-96e5950d210f",
|
||
|
|
"indicator--570f4921-9208-4363-b88c-96e5950d210f",
|
||
|
|
"indicator--570f4922-438c-4b4f-92ae-96e5950d210f",
|
||
|
|
"indicator--570f4922-8b74-4cfa-85ed-96e5950d210f",
|
||
|
|
"indicator--570f4922-9544-484a-ad80-96e5950d210f",
|
||
|
|
"indicator--570f4923-1e18-44c4-940f-96e5950d210f",
|
||
|
|
"indicator--570f4923-c0f8-4f26-8cba-96e5950d210f",
|
||
|
|
"indicator--570f4923-6ecc-436b-832b-96e5950d210f",
|
||
|
|
"indicator--570f4924-f9a0-449c-a415-96e5950d210f",
|
||
|
|
"indicator--570f4924-1ef8-41eb-aad1-96e5950d210f",
|
||
|
|
"indicator--570f4924-2aac-4190-be94-96e5950d210f",
|
||
|
|
"indicator--570f4925-98d4-4a83-a48c-96e5950d210f",
|
||
|
|
"indicator--570f4925-049c-4f23-bc76-96e5950d210f",
|
||
|
|
"indicator--570f4925-d828-4481-be4b-96e5950d210f",
|
||
|
|
"indicator--570f4925-fc60-41dc-adc3-96e5950d210f",
|
||
|
|
"indicator--570f4926-bd30-4f61-a88e-96e5950d210f",
|
||
|
|
"indicator--570f4926-2d98-4825-8007-96e5950d210f",
|
||
|
|
"indicator--570f4926-a7d4-463b-8edc-96e5950d210f",
|
||
|
|
"indicator--570f4927-58d0-4008-bd57-96e5950d210f",
|
||
|
|
"indicator--570f4927-9320-48cb-9c07-96e5950d210f",
|
||
|
|
"indicator--570f4927-9458-46a1-8157-96e5950d210f",
|
||
|
|
"indicator--570f4927-fed8-4f2f-93a0-96e5950d210f",
|
||
|
|
"indicator--570f4928-cf54-47a4-b4ff-96e5950d210f",
|
||
|
|
"indicator--570f4928-6cf8-4414-990e-96e5950d210f",
|
||
|
|
"indicator--570f4928-9200-4190-9080-96e5950d210f",
|
||
|
|
"indicator--570f4929-4cfc-4f0b-a93c-96e5950d210f",
|
||
|
|
"indicator--570f4929-3988-4193-9398-96e5950d210f",
|
||
|
|
"indicator--570f4929-568c-44f3-bdc8-96e5950d210f",
|
||
|
|
"indicator--570f492a-5b44-4176-a243-96e5950d210f",
|
||
|
|
"indicator--570f492a-7bd8-4ec8-b610-96e5950d210f",
|
||
|
|
"indicator--570f492a-bc10-4e35-998a-96e5950d210f",
|
||
|
|
"indicator--570f492b-eb44-4036-b70f-96e5950d210f",
|
||
|
|
"indicator--570f492b-8224-4cf6-97a3-96e5950d210f",
|
||
|
|
"indicator--570f492b-8204-45e1-a8b7-96e5950d210f",
|
||
|
|
"indicator--570f492c-7f24-43b8-ac70-96e5950d210f",
|
||
|
|
"indicator--570f492c-74e4-4655-9ca5-96e5950d210f",
|
||
|
|
"indicator--570f492c-9f78-4beb-962a-96e5950d210f",
|
||
|
|
"indicator--570f492d-0300-42cd-b3e5-96e5950d210f",
|
||
|
|
"indicator--570f492d-cae8-4467-a028-96e5950d210f",
|
||
|
|
"indicator--570f492d-ce7c-4ec5-bf31-96e5950d210f",
|
||
|
|
"indicator--570f492e-485c-4318-8df1-96e5950d210f",
|
||
|
|
"indicator--570f492e-c28c-4b8a-902c-96e5950d210f",
|
||
|
|
"indicator--570f492e-e334-4c70-9701-96e5950d210f",
|
||
|
|
"indicator--570f492e-1e4c-4f5f-93c9-96e5950d210f",
|
||
|
|
"indicator--570f492f-c57c-4e58-8af1-96e5950d210f",
|
||
|
|
"indicator--570f492f-aca0-415b-b261-96e5950d210f",
|
||
|
|
"indicator--570f492f-ffdc-4537-995b-96e5950d210f",
|
||
|
|
"indicator--570f4930-c5e0-4b44-ab5e-96e5950d210f",
|
||
|
|
"indicator--570f4930-d99c-4d70-8963-96e5950d210f",
|
||
|
|
"indicator--570f4930-e700-421a-a487-96e5950d210f",
|
||
|
|
"indicator--570f4931-520c-470b-85a5-96e5950d210f",
|
||
|
|
"indicator--570f4931-6d64-4bfc-99fa-96e5950d210f",
|
||
|
|
"indicator--570f4931-9dc8-4d29-84f8-96e5950d210f",
|
||
|
|
"indicator--570f4932-00fc-4984-acb5-96e5950d210f",
|
||
|
|
"indicator--570f4932-2794-48fa-bcdf-96e5950d210f",
|
||
|
|
"indicator--570f4932-7b10-46a9-90ba-96e5950d210f",
|
||
|
|
"indicator--570f4933-a508-4d4b-8aa6-96e5950d210f",
|
||
|
|
"indicator--570f4933-fad8-4622-b45d-96e5950d210f",
|
||
|
|
"indicator--570f4933-92a4-476a-84bf-96e5950d210f",
|
||
|
|
"indicator--570f4934-23d0-484d-ac3a-96e5950d210f",
|
||
|
|
"indicator--570f4934-1fc8-469d-b6f2-96e5950d210f",
|
||
|
|
"indicator--570f4934-857c-4943-a2e2-96e5950d210f",
|
||
|
|
"indicator--570f4935-bd54-4f20-84fa-96e5950d210f",
|
||
|
|
"indicator--570f4935-6c0c-4bf8-b30f-96e5950d210f",
|
||
|
|
"indicator--570f4935-801c-4467-8646-96e5950d210f",
|
||
|
|
"indicator--570f4936-91b8-4447-acbe-96e5950d210f",
|
||
|
|
"indicator--570f4936-aab0-4f29-8598-96e5950d210f",
|
||
|
|
"indicator--570f4936-3514-4575-8cda-96e5950d210f",
|
||
|
|
"indicator--570f4937-049c-49db-b771-96e5950d210f",
|
||
|
|
"indicator--570f4937-cbf0-4d36-aeed-96e5950d210f",
|
||
|
|
"indicator--570f4937-e32c-4bf9-87de-96e5950d210f",
|
||
|
|
"indicator--570f4938-aed0-4959-b2b4-96e5950d210f",
|
||
|
|
"indicator--570f4938-1c20-4dce-8bd5-96e5950d210f",
|
||
|
|
"indicator--570f4938-2688-4435-bba3-96e5950d210f",
|
||
|
|
"indicator--570f4939-7a68-4148-849d-96e5950d210f",
|
||
|
|
"indicator--570f4939-91f4-4c76-8f4a-96e5950d210f",
|
||
|
|
"indicator--570f4939-e33c-4171-96df-96e5950d210f",
|
||
|
|
"indicator--570f493a-c664-4ddb-86ed-96e5950d210f",
|
||
|
|
"indicator--570f493a-6fec-4fb9-af46-96e5950d210f",
|
||
|
|
"indicator--570f493b-f014-4625-8b2a-96e5950d210f",
|
||
|
|
"indicator--570f493b-6bc8-4034-a64d-96e5950d210f",
|
||
|
|
"indicator--570f493b-0674-4ada-8c7b-96e5950d210f",
|
||
|
|
"indicator--570f493b-9634-463e-9e35-96e5950d210f",
|
||
|
|
"indicator--570f493c-0c0c-4e7c-b0ad-96e5950d210f",
|
||
|
|
"indicator--570f493c-bba8-4ee3-abb8-96e5950d210f",
|
||
|
|
"indicator--570f493c-b47c-42df-8ba6-96e5950d210f",
|
||
|
|
"indicator--570f493d-9c84-4ef3-afa6-96e5950d210f",
|
||
|
|
"indicator--570f493d-e5c8-4803-92b2-96e5950d210f",
|
||
|
|
"indicator--570f493d-15b8-4621-b795-96e5950d210f",
|
||
|
|
"indicator--570f493e-5724-4ae8-8a95-96e5950d210f",
|
||
|
|
"indicator--570f493e-b204-471c-ba24-96e5950d210f",
|
||
|
|
"indicator--570f493e-4254-4048-a06b-96e5950d210f",
|
||
|
|
"indicator--570f493f-9ba0-4360-b140-96e5950d210f",
|
||
|
|
"indicator--570f493f-1268-43a0-b656-96e5950d210f",
|
||
|
|
"indicator--570f4940-0104-4e9e-8f59-96e5950d210f",
|
||
|
|
"indicator--570f4940-5c10-465c-8fc1-96e5950d210f",
|
||
|
|
"indicator--570f4940-5b3c-4c6d-aa32-96e5950d210f",
|
||
|
|
"indicator--570f4940-48b0-4598-b4eb-96e5950d210f",
|
||
|
|
"indicator--570f4941-657c-4862-97c7-96e5950d210f",
|
||
|
|
"indicator--570f4941-3d84-4a45-82ee-96e5950d210f",
|
||
|
|
"indicator--570f4941-92e4-4182-ac47-96e5950d210f",
|
||
|
|
"indicator--570f4942-2e34-436c-93de-96e5950d210f",
|
||
|
|
"indicator--570f4942-ad4c-480e-a00f-96e5950d210f",
|
||
|
|
"indicator--570f4942-22a4-4d22-92e2-96e5950d210f",
|
||
|
|
"indicator--570f4943-8cc8-4709-b659-96e5950d210f",
|
||
|
|
"indicator--570f4943-6ce4-49cd-a66f-96e5950d210f",
|
||
|
|
"indicator--570f4943-a344-4183-adbd-96e5950d210f",
|
||
|
|
"indicator--570f4944-5d9c-4491-ac50-96e5950d210f",
|
||
|
|
"indicator--570f4944-6fac-4859-b68b-96e5950d210f",
|
||
|
|
"indicator--570f4944-24d0-4d35-98ea-96e5950d210f",
|
||
|
|
"indicator--570f4945-a7b4-454c-859f-96e5950d210f",
|
||
|
|
"indicator--570f4945-efc0-42bf-b24d-96e5950d210f",
|
||
|
|
"indicator--570f4945-0848-4652-ad4c-96e5950d210f",
|
||
|
|
"indicator--570f4946-af7c-4fb3-b9fd-96e5950d210f",
|
||
|
|
"indicator--570f4946-6bd4-4b71-a2c5-96e5950d210f",
|
||
|
|
"indicator--570f4946-6188-4aee-b48a-96e5950d210f",
|
||
|
|
"indicator--570f4947-1950-45d3-b724-96e5950d210f",
|
||
|
|
"indicator--570f4947-8554-45eb-876c-96e5950d210f",
|
||
|
|
"indicator--570f4947-7c88-4b48-ae09-96e5950d210f",
|
||
|
|
"indicator--570f4947-7a0c-4667-99a9-96e5950d210f",
|
||
|
|
"indicator--570f4948-29f8-4026-8aa1-96e5950d210f",
|
||
|
|
"indicator--570f4948-bc90-418d-b629-96e5950d210f",
|
||
|
|
"indicator--570f4948-bda8-44c6-a5bf-96e5950d210f",
|
||
|
|
"indicator--570f4949-3110-47f6-b403-96e5950d210f",
|
||
|
|
"indicator--570f4949-b14c-4fa3-a1c2-96e5950d210f",
|
||
|
|
"indicator--570f4949-615c-4119-9e7b-96e5950d210f",
|
||
|
|
"indicator--570f494a-0978-41ee-81de-96e5950d210f",
|
||
|
|
"indicator--570f494a-8260-4ede-b02b-96e5950d210f",
|
||
|
|
"indicator--570f494a-b738-4daf-b8b5-96e5950d210f",
|
||
|
|
"indicator--570f494b-b054-417a-98b7-96e5950d210f",
|
||
|
|
"indicator--570f494b-7ca8-411c-b3a3-96e5950d210f",
|
||
|
|
"indicator--570f494b-6fe0-4393-a6e9-96e5950d210f",
|
||
|
|
"indicator--570f494c-ef4c-4a57-98c9-96e5950d210f",
|
||
|
|
"indicator--570f494c-bd94-4cd2-835a-96e5950d210f",
|
||
|
|
"indicator--570f494c-7348-4e22-8397-96e5950d210f",
|
||
|
|
"indicator--570f494d-5a3c-4487-a6a1-96e5950d210f",
|
||
|
|
"indicator--570f494d-6cf4-42ec-85e2-96e5950d210f",
|
||
|
|
"indicator--570f494d-a0a0-4c00-b70b-96e5950d210f",
|
||
|
|
"indicator--570f494e-98d8-45dc-a26e-96e5950d210f",
|
||
|
|
"indicator--570f494e-51c0-45a3-8c9b-96e5950d210f",
|
||
|
|
"indicator--570f494e-9c14-4733-b3b5-96e5950d210f",
|
||
|
|
"indicator--570f494f-c37c-4cd9-b735-96e5950d210f",
|
||
|
|
"indicator--570f494f-f068-4c72-8dfb-96e5950d210f",
|
||
|
|
"indicator--570f494f-1af8-42f1-bec1-96e5950d210f",
|
||
|
|
"indicator--570f4950-84b8-455d-bacd-96e5950d210f",
|
||
|
|
"indicator--570f4950-d1b8-47de-9fe7-96e5950d210f",
|
||
|
|
"indicator--570f4950-d9c4-4de0-a2bd-96e5950d210f",
|
||
|
|
"indicator--570f4951-8f44-47da-83e9-96e5950d210f",
|
||
|
|
"indicator--570f4951-6df4-4afa-a12e-96e5950d210f",
|
||
|
|
"indicator--570f4951-e4a4-42d3-95e9-96e5950d210f",
|
||
|
|
"indicator--570f4952-041c-4a40-8a79-96e5950d210f",
|
||
|
|
"indicator--570f4952-1bdc-4a9e-a9e6-96e5950d210f",
|
||
|
|
"indicator--570f4952-558c-493c-8943-96e5950d210f",
|
||
|
|
"indicator--570f4953-d0d8-45ca-af71-96e5950d210f",
|
||
|
|
"indicator--570f4953-eabc-4c9c-8da0-96e5950d210f",
|
||
|
|
"indicator--570f4953-67a0-4129-b1be-96e5950d210f",
|
||
|
|
"indicator--570f4954-b9b8-4838-8d6a-96e5950d210f",
|
||
|
|
"indicator--570f4954-1848-4d8d-91a8-96e5950d210f",
|
||
|
|
"indicator--570f4954-ef74-4b23-bf54-96e5950d210f",
|
||
|
|
"indicator--570f4954-0a58-40b2-9bbb-96e5950d210f",
|
||
|
|
"indicator--570f4955-f6ac-4574-b281-96e5950d210f",
|
||
|
|
"indicator--570f4955-4db0-4517-84f8-96e5950d210f",
|
||
|
|
"indicator--570f4955-af98-4e73-bbec-96e5950d210f",
|
||
|
|
"indicator--570f4956-2f44-4a29-8918-96e5950d210f",
|
||
|
|
"indicator--570f4956-b080-4ac0-9806-96e5950d210f",
|
||
|
|
"indicator--570f4956-ca1c-4215-82c1-96e5950d210f",
|
||
|
|
"indicator--570f4957-1330-4a0d-b019-96e5950d210f",
|
||
|
|
"indicator--570f4957-57e8-482c-a1ad-96e5950d210f",
|
||
|
|
"indicator--570f4957-cb88-4ca8-bd99-96e5950d210f",
|
||
|
|
"indicator--570f4957-c220-4535-a27d-96e5950d210f",
|
||
|
|
"indicator--570f4958-aee0-401f-bdfe-96e5950d210f",
|
||
|
|
"indicator--570f4958-fc44-437e-b328-96e5950d210f",
|
||
|
|
"indicator--570f4958-1390-4073-b4f1-96e5950d210f",
|
||
|
|
"indicator--570f4959-1f10-4243-a086-96e5950d210f",
|
||
|
|
"indicator--570f4959-1ab4-4204-9530-96e5950d210f",
|
||
|
|
"indicator--570f4959-33c8-42da-9393-96e5950d210f",
|
||
|
|
"indicator--570f495a-8740-4b49-a700-96e5950d210f",
|
||
|
|
"indicator--570f495a-16b0-46e6-b0cf-96e5950d210f",
|
||
|
|
"indicator--570f495a-f67c-4e70-a318-96e5950d210f",
|
||
|
|
"indicator--570f495a-71ac-44b7-88b7-96e5950d210f",
|
||
|
|
"indicator--570f495b-2f4c-426c-a4a5-96e5950d210f",
|
||
|
|
"indicator--570f495b-b644-41d4-9d0e-96e5950d210f",
|
||
|
|
"indicator--570f495b-83e4-499b-91c6-96e5950d210f",
|
||
|
|
"indicator--570f495c-9358-467b-bd33-96e5950d210f",
|
||
|
|
"indicator--570f495c-fd50-45eb-9e87-96e5950d210f",
|
||
|
|
"indicator--570f495c-8878-4e7c-93a0-96e5950d210f",
|
||
|
|
"indicator--570f495d-06a0-450e-a260-96e5950d210f",
|
||
|
|
"indicator--570f495d-53b4-4660-b3b8-96e5950d210f",
|
||
|
|
"indicator--570f495d-e08c-4354-80ca-96e5950d210f",
|
||
|
|
"indicator--570f495e-be00-4d85-aab8-96e5950d210f",
|
||
|
|
"indicator--570f495e-8d7c-4280-bed3-96e5950d210f",
|
||
|
|
"indicator--570f495e-3c98-46a4-ae3d-96e5950d210f",
|
||
|
|
"indicator--570f495f-d484-49d2-a2bd-96e5950d210f",
|
||
|
|
"indicator--570f495f-2fa4-47b6-b78f-96e5950d210f",
|
||
|
|
"indicator--570f495f-b2c8-47bc-a725-96e5950d210f",
|
||
|
|
"indicator--570f4960-a7c8-41b7-a137-96e5950d210f",
|
||
|
|
"indicator--570f4960-3148-4895-9a82-96e5950d210f",
|
||
|
|
"indicator--570f4960-3638-46fe-9120-96e5950d210f",
|
||
|
|
"indicator--570f4961-5a28-4bb9-9707-96e5950d210f",
|
||
|
|
"indicator--570f4961-358c-44f1-9b25-96e5950d210f",
|
||
|
|
"indicator--570f4961-bcfc-4b99-86f3-96e5950d210f",
|
||
|
|
"indicator--570f4962-9174-4dc0-80f7-96e5950d210f",
|
||
|
|
"indicator--570f4962-48f0-43ba-b2cd-96e5950d210f",
|
||
|
|
"indicator--570f4962-4958-4c85-80ad-96e5950d210f",
|
||
|
|
"indicator--570f4963-17a0-40ce-9454-96e5950d210f",
|
||
|
|
"indicator--570f4963-23bc-4e63-8795-96e5950d210f",
|
||
|
|
"indicator--570f4963-e97c-487d-ae5c-96e5950d210f",
|
||
|
|
"indicator--570f4964-9090-4e3e-af05-96e5950d210f",
|
||
|
|
"indicator--570f4964-1720-4ae9-bc55-96e5950d210f",
|
||
|
|
"indicator--570f4964-d1b4-4d2d-947d-96e5950d210f",
|
||
|
|
"indicator--570f4965-b834-4dbb-b466-96e5950d210f",
|
||
|
|
"indicator--570f4965-fb64-4064-ad3d-96e5950d210f",
|
||
|
|
"indicator--570f4965-0d24-41c6-bd9b-96e5950d210f",
|
||
|
|
"indicator--570f4966-2858-48cc-bc9f-96e5950d210f",
|
||
|
|
"indicator--570f4966-aec8-4b27-a6d5-96e5950d210f",
|
||
|
|
"indicator--570f4966-0858-4bdd-90a5-96e5950d210f",
|
||
|
|
"indicator--570f4967-54a8-40c5-9a41-96e5950d210f",
|
||
|
|
"indicator--570f4967-7d88-4b70-a034-96e5950d210f",
|
||
|
|
"indicator--570f4967-eeb4-40fe-8364-96e5950d210f",
|
||
|
|
"indicator--570f4968-9560-402f-af4c-96e5950d210f",
|
||
|
|
"indicator--570f4968-0528-4f31-a9c9-96e5950d210f",
|
||
|
|
"indicator--570f4968-97f4-4641-9f4a-96e5950d210f",
|
||
|
|
"indicator--570f4969-3288-4ef4-9c91-96e5950d210f",
|
||
|
|
"indicator--570f4969-6d48-41a0-8d9f-96e5950d210f",
|
||
|
|
"indicator--570f4969-8458-4377-955f-96e5950d210f",
|
||
|
|
"indicator--570f496a-5f20-47b8-ba3a-96e5950d210f",
|
||
|
|
"indicator--570f496a-5c60-47c6-a66d-96e5950d210f",
|
||
|
|
"indicator--570f496a-9948-4304-9848-96e5950d210f",
|
||
|
|
"indicator--570f496b-bd04-4aa2-8b4d-96e5950d210f",
|
||
|
|
"indicator--570f496b-fd5c-4279-b5c4-96e5950d210f",
|
||
|
|
"indicator--570f496b-2258-4667-be30-96e5950d210f",
|
||
|
|
"indicator--570f496c-f720-46a3-840f-96e5950d210f",
|
||
|
|
"indicator--570f496c-fe80-4157-b0da-96e5950d210f",
|
||
|
|
"indicator--570f496c-dee8-4e78-9e14-96e5950d210f",
|
||
|
|
"indicator--570f496c-88b0-4820-8bcf-96e5950d210f",
|
||
|
|
"indicator--570f496d-f7e8-42b0-8a22-96e5950d210f",
|
||
|
|
"indicator--570f496d-8160-48a6-9949-96e5950d210f",
|
||
|
|
"indicator--570f496e-4714-4f78-b4c4-96e5950d210f",
|
||
|
|
"indicator--570f496e-50d0-45d5-b5bd-96e5950d210f",
|
||
|
|
"indicator--570f496e-46fc-49d3-b37d-96e5950d210f",
|
||
|
|
"indicator--570f496e-2d84-45ae-bb14-96e5950d210f",
|
||
|
|
"indicator--570f496f-1260-4dc0-8236-96e5950d210f",
|
||
|
|
"indicator--570f496f-253c-45a5-aa28-96e5950d210f",
|
||
|
|
"indicator--570f496f-0d3c-49a4-b29a-96e5950d210f",
|
||
|
|
"indicator--570f4970-6778-409f-8986-96e5950d210f",
|
||
|
|
"indicator--570f4970-40c8-4143-9ad3-96e5950d210f",
|
||
|
|
"indicator--570f4970-910c-44e4-8ae1-96e5950d210f",
|
||
|
|
"indicator--570f4971-ee10-4c02-9a56-96e5950d210f",
|
||
|
|
"indicator--570f4971-aee4-471d-91ec-96e5950d210f",
|
||
|
|
"indicator--570f4971-813c-4f25-8ced-96e5950d210f",
|
||
|
|
"indicator--570f4972-b478-44e8-afbc-96e5950d210f",
|
||
|
|
"indicator--570f4972-428c-4990-addb-96e5950d210f",
|
||
|
|
"indicator--570f4973-5940-4237-8407-96e5950d210f",
|
||
|
|
"indicator--570f4973-d0ec-4134-a795-96e5950d210f",
|
||
|
|
"indicator--570f4973-e280-443b-8c33-96e5950d210f",
|
||
|
|
"indicator--570f4974-c95c-40e3-b564-96e5950d210f",
|
||
|
|
"indicator--570f4974-5998-4e6f-96cb-96e5950d210f",
|
||
|
|
"indicator--570f4974-54a8-4d81-b53b-96e5950d210f",
|
||
|
|
"indicator--570f4975-3c4c-454e-9dd0-96e5950d210f",
|
||
|
|
"indicator--570f4975-b58c-4722-9096-96e5950d210f",
|
||
|
|
"indicator--570f4975-aaf4-4efc-8e6d-96e5950d210f",
|
||
|
|
"indicator--570f4976-1250-42c7-b33b-96e5950d210f",
|
||
|
|
"indicator--570f4976-371c-49d8-9fa2-96e5950d210f",
|
||
|
|
"indicator--570f4976-8e30-4b94-9663-96e5950d210f",
|
||
|
|
"indicator--570f4977-0008-4514-96a6-96e5950d210f",
|
||
|
|
"indicator--570f4977-3430-4a09-8450-96e5950d210f",
|
||
|
|
"indicator--570f4977-34b8-46d9-92b4-96e5950d210f",
|
||
|
|
"indicator--570f4978-4338-46e8-9426-96e5950d210f",
|
||
|
|
"indicator--570f4978-349c-4864-8f77-96e5950d210f",
|
||
|
|
"indicator--570f4978-1810-4a7b-8de2-96e5950d210f",
|
||
|
|
"indicator--570f4979-8da8-4655-83be-96e5950d210f",
|
||
|
|
"indicator--570f4979-d564-4f81-b63e-96e5950d210f",
|
||
|
|
"indicator--570f4979-e878-404a-9c3e-96e5950d210f",
|
||
|
|
"indicator--570f4979-d994-4b39-ba23-96e5950d210f",
|
||
|
|
"indicator--570f497a-8838-4dc9-b9fe-96e5950d210f",
|
||
|
|
"indicator--570f497a-ce88-4638-a9f9-96e5950d210f",
|
||
|
|
"indicator--570f497a-cabc-46c1-86d6-96e5950d210f",
|
||
|
|
"indicator--570f497b-a558-415a-afc8-96e5950d210f",
|
||
|
|
"indicator--570f497b-cc78-4fc9-ae64-96e5950d210f",
|
||
|
|
"indicator--570f497b-6448-45ae-a4c7-96e5950d210f",
|
||
|
|
"indicator--570f497c-7b08-4a4c-9f9f-96e5950d210f",
|
||
|
|
"indicator--570f497c-dae8-4f82-b736-96e5950d210f",
|
||
|
|
"indicator--570f497c-76a8-459d-98e0-96e5950d210f",
|
||
|
|
"indicator--570f497d-6fe4-4417-8833-96e5950d210f",
|
||
|
|
"indicator--570f497d-21f8-492b-90ff-96e5950d210f",
|
||
|
|
"indicator--570f497d-89e0-4fba-96c5-96e5950d210f",
|
||
|
|
"indicator--570f497e-8420-4153-a1b5-96e5950d210f",
|
||
|
|
"indicator--570f497e-3e60-4ab7-a0bc-96e5950d210f",
|
||
|
|
"indicator--570f497e-be24-4786-b9ef-96e5950d210f",
|
||
|
|
"indicator--570f497f-ba0c-44f1-9e4e-96e5950d210f",
|
||
|
|
"indicator--570f497f-7eec-43d6-9bac-96e5950d210f",
|
||
|
|
"indicator--570f497f-f994-49ce-9da1-96e5950d210f",
|
||
|
|
"indicator--570f497f-33f4-41d5-915d-96e5950d210f",
|
||
|
|
"indicator--570f4980-b55c-4189-8270-96e5950d210f",
|
||
|
|
"indicator--570f4980-1c48-4972-bbae-96e5950d210f",
|
||
|
|
"indicator--570f4980-87e0-45d9-afbe-96e5950d210f",
|
||
|
|
"indicator--570f4981-9ba4-436d-8bf0-96e5950d210f",
|
||
|
|
"indicator--570f4981-5404-42d0-a655-96e5950d210f",
|
||
|
|
"indicator--570f4981-9ae4-4bac-84a7-96e5950d210f",
|
||
|
|
"indicator--570f4982-e160-48fe-a36b-96e5950d210f",
|
||
|
|
"indicator--570f4982-de30-45b8-b2dc-96e5950d210f",
|
||
|
|
"indicator--570f4982-b534-41f4-b4eb-96e5950d210f",
|
||
|
|
"indicator--570f4983-f290-4c8e-8260-96e5950d210f",
|
||
|
|
"indicator--570f4983-9098-42bb-90fc-96e5950d210f",
|
||
|
|
"indicator--570f4983-fc84-4289-864f-96e5950d210f",
|
||
|
|
"indicator--570f4983-b258-4946-bf81-96e5950d210f",
|
||
|
|
"indicator--570f4984-5a98-432e-9890-96e5950d210f",
|
||
|
|
"indicator--570f4984-4bc4-4cb6-b9c4-96e5950d210f",
|
||
|
|
"indicator--570f4984-cc48-49c4-9847-96e5950d210f",
|
||
|
|
"indicator--570f4985-8df4-443f-a646-96e5950d210f",
|
||
|
|
"indicator--570f4985-d7b8-465f-80a5-96e5950d210f",
|
||
|
|
"indicator--570f4986-1d94-4a90-9e57-96e5950d210f",
|
||
|
|
"indicator--570f4986-513c-4bc5-b299-96e5950d210f",
|
||
|
|
"indicator--570f4986-bd80-47b6-ab19-96e5950d210f",
|
||
|
|
"indicator--570f4987-9a78-455b-ab5a-96e5950d210f",
|
||
|
|
"indicator--570f4987-9210-417c-bff9-96e5950d210f",
|
||
|
|
"indicator--570f4987-5b30-4b85-baad-96e5950d210f",
|
||
|
|
"indicator--570f4988-7ef4-4150-b350-96e5950d210f",
|
||
|
|
"indicator--570f4988-c1f4-417d-97b7-96e5950d210f",
|
||
|
|
"indicator--570f4988-b2b0-4efb-b81a-96e5950d210f",
|
||
|
|
"indicator--570f4989-824c-492c-8679-96e5950d210f",
|
||
|
|
"indicator--570f4989-da68-4eae-9d13-96e5950d210f",
|
||
|
|
"indicator--570f4989-8884-442d-9601-96e5950d210f",
|
||
|
|
"indicator--570f498a-baf0-4659-b9e2-96e5950d210f",
|
||
|
|
"indicator--570f498a-b234-4200-a920-96e5950d210f",
|
||
|
|
"indicator--570f498a-59b4-4cfb-b033-96e5950d210f",
|
||
|
|
"indicator--570f498b-c558-4848-ba11-96e5950d210f",
|
||
|
|
"indicator--570f498b-63e4-4cd3-8109-96e5950d210f",
|
||
|
|
"indicator--570f498b-350c-4b6b-a68a-96e5950d210f",
|
||
|
|
"indicator--570f498c-ebac-4aa3-8c50-96e5950d210f",
|
||
|
|
"indicator--570f498c-6654-4e44-90b8-96e5950d210f",
|
||
|
|
"indicator--570f498c-7c08-4b20-be7c-96e5950d210f",
|
||
|
|
"indicator--570f498d-f138-4b8c-a060-96e5950d210f",
|
||
|
|
"indicator--570f498d-4754-4032-9c26-96e5950d210f",
|
||
|
|
"indicator--570f498d-c620-4fb1-9304-96e5950d210f",
|
||
|
|
"indicator--570f498e-6424-4ca8-8671-96e5950d210f",
|
||
|
|
"indicator--570f498e-efcc-41a7-b2a5-96e5950d210f",
|
||
|
|
"indicator--570f498e-448c-4f7e-9b04-96e5950d210f",
|
||
|
|
"indicator--570f498f-0694-4574-bd83-96e5950d210f",
|
||
|
|
"indicator--570f498f-e3ac-4c46-bbee-96e5950d210f",
|
||
|
|
"indicator--570f498f-50d4-4da6-889a-96e5950d210f",
|
||
|
|
"indicator--570f498f-d644-4458-a4ea-96e5950d210f",
|
||
|
|
"indicator--570f4990-88e8-4038-9c85-96e5950d210f",
|
||
|
|
"indicator--570f4990-8648-4e3c-9eee-96e5950d210f",
|
||
|
|
"indicator--570f4990-a158-47ca-bee5-96e5950d210f",
|
||
|
|
"indicator--570f4991-3e7c-46be-8119-96e5950d210f",
|
||
|
|
"indicator--570f4991-9124-43aa-b25a-96e5950d210f",
|
||
|
|
"indicator--570f4991-793c-47f5-b7f9-96e5950d210f",
|
||
|
|
"indicator--570f4992-424c-4aed-93aa-96e5950d210f",
|
||
|
|
"indicator--570f4992-3454-44c4-b44b-96e5950d210f",
|
||
|
|
"indicator--570f4992-28dc-4173-be24-96e5950d210f",
|
||
|
|
"indicator--570f4993-32ec-4ab4-abec-96e5950d210f",
|
||
|
|
"indicator--570f4993-eb8c-4357-bccb-96e5950d210f",
|
||
|
|
"indicator--570f4993-abfc-41de-8e36-96e5950d210f",
|
||
|
|
"indicator--570f4994-6768-4870-a364-96e5950d210f",
|
||
|
|
"indicator--570f4994-1ac4-4606-b7c5-96e5950d210f",
|
||
|
|
"indicator--570f4994-b3a0-40a9-bd76-96e5950d210f",
|
||
|
|
"indicator--570f4994-8a80-4ab2-ba3f-96e5950d210f",
|
||
|
|
"indicator--570f4995-4a20-4f3f-8a19-96e5950d210f",
|
||
|
|
"indicator--570f4995-9ee4-4ed8-96b9-96e5950d210f",
|
||
|
|
"indicator--570f4995-49e8-4a48-ac05-96e5950d210f",
|
||
|
|
"indicator--570f4996-83fc-47cd-8571-96e5950d210f",
|
||
|
|
"indicator--570f4996-5f74-4921-8018-96e5950d210f",
|
||
|
|
"indicator--570f4996-1704-4def-a544-96e5950d210f",
|
||
|
|
"indicator--570f4997-2e4c-4b7d-8568-96e5950d210f",
|
||
|
|
"indicator--570f4997-32f0-44b2-a53c-96e5950d210f",
|
||
|
|
"indicator--570f4997-b150-42ea-832b-96e5950d210f",
|
||
|
|
"indicator--570f4998-7180-4c4c-a80e-96e5950d210f",
|
||
|
|
"indicator--570f4998-12f8-45ae-9ddc-96e5950d210f",
|
||
|
|
"indicator--570f4998-b1a0-4a4c-905a-96e5950d210f",
|
||
|
|
"indicator--570f4999-c4c4-447a-825f-96e5950d210f",
|
||
|
|
"indicator--570f4999-ca04-464b-aa29-96e5950d210f",
|
||
|
|
"indicator--570f4999-b5c0-4b4e-85a2-96e5950d210f",
|
||
|
|
"indicator--570f499a-52b8-47cd-8c50-96e5950d210f",
|
||
|
|
"indicator--570f499a-ad7c-4f81-b24a-96e5950d210f",
|
||
|
|
"indicator--570f499a-a1d0-4dc8-981d-96e5950d210f",
|
||
|
|
"indicator--570f499b-d9e4-48c3-bb6f-96e5950d210f",
|
||
|
|
"indicator--570f499b-496c-43bf-967c-96e5950d210f",
|
||
|
|
"indicator--570f499b-070c-4738-b64b-96e5950d210f",
|
||
|
|
"indicator--570f499c-4620-4aa2-9523-96e5950d210f",
|
||
|
|
"indicator--570f499c-6c6c-42ee-ab09-96e5950d210f",
|
||
|
|
"indicator--570f499c-6af0-4c80-ab40-96e5950d210f",
|
||
|
|
"indicator--570f499d-1ddc-4c08-af1a-96e5950d210f",
|
||
|
|
"indicator--570f499d-e4e4-4aac-a2c3-96e5950d210f",
|
||
|
|
"indicator--570f499d-ff08-40db-a3b2-96e5950d210f",
|
||
|
|
"indicator--570f499e-56b4-4e77-9550-96e5950d210f",
|
||
|
|
"indicator--570f499e-ddf8-47c2-a8da-96e5950d210f",
|
||
|
|
"indicator--570f499e-e684-4172-9987-96e5950d210f",
|
||
|
|
"indicator--570f499f-d1ec-47cf-99a8-96e5950d210f",
|
||
|
|
"indicator--570f499f-1604-4dc5-a7b1-96e5950d210f",
|
||
|
|
"indicator--570f499f-abfc-48c9-999d-96e5950d210f",
|
||
|
|
"indicator--570f499f-8478-453c-a6c1-96e5950d210f",
|
||
|
|
"indicator--570f49a0-5fa4-4160-bfee-96e5950d210f",
|
||
|
|
"indicator--570f49a0-c3a8-4e5a-a47e-96e5950d210f",
|
||
|
|
"indicator--570f49a1-3860-4fb5-aae8-96e5950d210f",
|
||
|
|
"indicator--570f49a1-c648-4478-a38c-96e5950d210f",
|
||
|
|
"indicator--570f49a1-e108-4d63-a507-96e5950d210f",
|
||
|
|
"indicator--570f49a2-c274-4b86-a0ff-96e5950d210f",
|
||
|
|
"indicator--570f49a2-7264-4fbe-9dc4-96e5950d210f",
|
||
|
|
"indicator--570f49a2-55d8-4d78-8a98-96e5950d210f",
|
||
|
|
"indicator--570f49a2-1a68-41a3-8eda-96e5950d210f",
|
||
|
|
"indicator--570f49a3-4b3c-409f-9eda-96e5950d210f",
|
||
|
|
"indicator--570f49a3-8258-497e-a9cd-96e5950d210f",
|
||
|
|
"indicator--570f49a4-2660-4139-af4b-96e5950d210f",
|
||
|
|
"indicator--570f49a4-df38-4a0c-82d4-96e5950d210f",
|
||
|
|
"indicator--570f49a4-9fa8-4086-87f5-96e5950d210f",
|
||
|
|
"indicator--570f49a5-5534-45bc-ab19-96e5950d210f",
|
||
|
|
"indicator--570f49a5-1308-451d-82cc-96e5950d210f",
|
||
|
|
"indicator--570f49a5-44b4-48da-8a92-96e5950d210f",
|
||
|
|
"indicator--570f49a6-a658-43fe-9dc9-96e5950d210f",
|
||
|
|
"indicator--570f49a6-5084-4a43-a057-96e5950d210f",
|
||
|
|
"indicator--570f49a6-6888-4fae-b549-96e5950d210f",
|
||
|
|
"indicator--570f49a7-ba6c-4331-9a1d-96e5950d210f",
|
||
|
|
"indicator--570f49a7-6f8c-4d8d-8644-96e5950d210f",
|
||
|
|
"indicator--570f49a7-7638-4b36-98fc-96e5950d210f",
|
||
|
|
"indicator--570f49a7-e39c-4093-a8de-96e5950d210f",
|
||
|
|
"indicator--570f49a8-9224-49af-9c72-96e5950d210f",
|
||
|
|
"indicator--570f49a8-afb8-463e-b9ae-96e5950d210f",
|
||
|
|
"indicator--570f49a8-7ce4-4948-95fe-96e5950d210f",
|
||
|
|
"indicator--570f49a9-8e14-46bb-b81d-96e5950d210f",
|
||
|
|
"indicator--570f49a9-57bc-4581-89db-96e5950d210f",
|
||
|
|
"indicator--570f49a9-4f74-4177-bafe-96e5950d210f",
|
||
|
|
"indicator--570f49aa-68d0-4ec9-ab05-96e5950d210f",
|
||
|
|
"indicator--570f49aa-6558-4a55-9cc4-96e5950d210f",
|
||
|
|
"indicator--570f49aa-8964-4c94-828e-96e5950d210f",
|
||
|
|
"indicator--570f49ab-0fd0-48b1-8b7b-96e5950d210f",
|
||
|
|
"indicator--570f49ab-5c30-4ba4-ad92-96e5950d210f",
|
||
|
|
"indicator--570f49ab-bb38-4800-869b-96e5950d210f",
|
||
|
|
"indicator--570f49ac-6cc8-4e6c-9ff3-96e5950d210f",
|
||
|
|
"indicator--570f49ac-7470-440e-9692-96e5950d210f",
|
||
|
|
"indicator--570f49ac-5c1c-448a-adf3-96e5950d210f",
|
||
|
|
"indicator--570f49ad-0b94-46e0-a817-96e5950d210f",
|
||
|
|
"indicator--570f49ad-23b0-4254-b50d-96e5950d210f",
|
||
|
|
"indicator--570f49ad-0f7c-443f-a8c6-96e5950d210f",
|
||
|
|
"indicator--570f49ae-05c0-4be3-a388-96e5950d210f",
|
||
|
|
"indicator--570f49ae-7318-4e93-ac76-96e5950d210f",
|
||
|
|
"indicator--570f49ae-18e0-475b-b774-96e5950d210f",
|
||
|
|
"indicator--570f49af-1264-4044-92a2-96e5950d210f",
|
||
|
|
"indicator--570f49af-f314-4184-92aa-96e5950d210f",
|
||
|
|
"indicator--570f49af-51c0-405e-9510-96e5950d210f",
|
||
|
|
"indicator--570f49b0-ce58-4c99-8c2e-96e5950d210f",
|
||
|
|
"indicator--570f49b0-4594-4ec1-85a1-96e5950d210f",
|
||
|
|
"indicator--570f49b0-6530-4b09-a7a7-96e5950d210f",
|
||
|
|
"indicator--570f49b1-15e4-4217-aea2-96e5950d210f",
|
||
|
|
"indicator--570f49b1-0f0c-41b0-bf24-96e5950d210f",
|
||
|
|
"indicator--570f49b1-fed8-4b93-af70-96e5950d210f",
|
||
|
|
"indicator--570f49b2-8490-44f0-b0ce-96e5950d210f",
|
||
|
|
"indicator--570f49b2-3b18-466e-a322-96e5950d210f",
|
||
|
|
"indicator--570f49b2-c37c-48c0-ae9e-96e5950d210f",
|
||
|
|
"indicator--570f49b3-6020-45c1-87c9-96e5950d210f",
|
||
|
|
"indicator--570f49b3-52dc-49cf-a4f0-96e5950d210f",
|
||
|
|
"indicator--570f49b3-c004-4070-9abd-96e5950d210f",
|
||
|
|
"indicator--570f49b4-9014-4eb6-9978-96e5950d210f",
|
||
|
|
"indicator--570f49b4-1144-471d-8194-96e5950d210f",
|
||
|
|
"indicator--570f49b4-d028-4251-a436-96e5950d210f",
|
||
|
|
"indicator--570f49b5-8f64-435e-a090-96e5950d210f",
|
||
|
|
"indicator--570f49b5-af24-434c-ac79-96e5950d210f",
|
||
|
|
"indicator--570f49b5-5fe8-4ca9-b2d1-96e5950d210f",
|
||
|
|
"indicator--570f49b6-ddb0-450c-83e5-96e5950d210f",
|
||
|
|
"indicator--570f49b6-2054-4126-9697-96e5950d210f",
|
||
|
|
"indicator--570f49b6-448c-4e49-aac4-96e5950d210f",
|
||
|
|
"indicator--570f49b7-8de0-4b46-8872-96e5950d210f",
|
||
|
|
"indicator--570f49b7-6218-4725-929e-96e5950d210f",
|
||
|
|
"indicator--570f49b7-fff4-4a3d-b92c-96e5950d210f",
|
||
|
|
"indicator--570f49b8-92d0-42d4-8ba3-96e5950d210f",
|
||
|
|
"indicator--570f49b8-ee9c-4219-93eb-96e5950d210f",
|
||
|
|
"indicator--570f49b8-bab4-466f-8ae9-96e5950d210f",
|
||
|
|
"indicator--570f49b9-b620-4bb0-85b2-96e5950d210f",
|
||
|
|
"indicator--570f49b9-c158-41a2-b39f-96e5950d210f",
|
||
|
|
"indicator--570f49b9-9360-4469-b345-96e5950d210f",
|
||
|
|
"indicator--570f49ba-df30-4441-b754-96e5950d210f",
|
||
|
|
"indicator--570f49ba-0f8c-4745-ac3f-96e5950d210f",
|
||
|
|
"indicator--570f49ba-62c0-471d-b5e9-96e5950d210f",
|
||
|
|
"indicator--570f49bb-cfd0-46c3-92bb-96e5950d210f",
|
||
|
|
"indicator--570f49bb-49c4-46b1-92c7-96e5950d210f",
|
||
|
|
"indicator--570f49bb-6644-4bf6-a3bf-96e5950d210f",
|
||
|
|
"indicator--570f49bc-e960-4760-a5fa-96e5950d210f",
|
||
|
|
"indicator--570f49bc-0304-4abc-bc54-96e5950d210f",
|
||
|
|
"indicator--570f49bc-5d20-4fda-abce-96e5950d210f",
|
||
|
|
"indicator--570f49bd-745c-4a60-8fdd-96e5950d210f",
|
||
|
|
"indicator--570f49bd-1de4-495c-b60d-96e5950d210f",
|
||
|
|
"indicator--570f49bd-5134-405a-80e3-96e5950d210f",
|
||
|
|
"indicator--570f49be-9568-422a-ac62-96e5950d210f",
|
||
|
|
"indicator--570f49be-00c4-45fa-ba73-96e5950d210f",
|
||
|
|
"indicator--570f49be-3d90-4023-8a55-96e5950d210f",
|
||
|
|
"indicator--570f49bf-a09c-4cb9-9f9b-96e5950d210f",
|
||
|
|
"indicator--570f49bf-80dc-40bb-ac1e-96e5950d210f",
|
||
|
|
"indicator--570f49c0-a234-406c-b9cd-96e5950d210f",
|
||
|
|
"indicator--570f49c0-ce74-4b40-a8dc-96e5950d210f",
|
||
|
|
"indicator--570f49c0-e700-43c4-87b0-96e5950d210f",
|
||
|
|
"indicator--570f49c1-7ec4-4c4d-8f5c-96e5950d210f",
|
||
|
|
"indicator--570f49c1-76f4-4d84-9b67-96e5950d210f",
|
||
|
|
"indicator--570f49c1-b01c-41d6-bfad-96e5950d210f",
|
||
|
|
"indicator--570f49c1-08d4-430f-9a09-96e5950d210f",
|
||
|
|
"indicator--570f49c2-f8ac-4cc4-9ad8-96e5950d210f",
|
||
|
|
"indicator--570f49c2-94bc-4085-ab7b-96e5950d210f",
|
||
|
|
"indicator--570f49c3-fecc-4e29-b579-96e5950d210f",
|
||
|
|
"indicator--570f49c3-608c-4c88-b777-96e5950d210f",
|
||
|
|
"indicator--570f49c3-e260-4649-beef-96e5950d210f",
|
||
|
|
"indicator--570f49c4-6ce8-4bdc-afdb-96e5950d210f",
|
||
|
|
"indicator--570f49c4-92a0-4845-9f5a-96e5950d210f",
|
||
|
|
"indicator--570f49c4-61f0-42f2-a520-96e5950d210f",
|
||
|
|
"indicator--570f49c5-19a4-4308-9ff9-96e5950d210f",
|
||
|
|
"indicator--570f49c5-c714-4c8d-b507-96e5950d210f",
|
||
|
|
"indicator--570f49c5-9fa0-445a-942d-96e5950d210f",
|
||
|
|
"indicator--570f49c6-3740-4ca6-86e0-96e5950d210f",
|
||
|
|
"indicator--570f49c6-8f80-47dd-8357-96e5950d210f",
|
||
|
|
"indicator--570f49c6-3de4-4527-ab31-96e5950d210f",
|
||
|
|
"indicator--570f49c7-af78-4a1c-adcd-96e5950d210f",
|
||
|
|
"indicator--570f49c7-12a4-403e-a2cb-96e5950d210f",
|
||
|
|
"indicator--570f49c7-4e64-451c-b3c4-96e5950d210f",
|
||
|
|
"indicator--570f49c8-1c5c-43c1-bd79-96e5950d210f",
|
||
|
|
"indicator--570f49c8-ad0c-49d4-a0a2-96e5950d210f",
|
||
|
|
"indicator--570f49c8-061c-479e-9c74-96e5950d210f",
|
||
|
|
"indicator--570f49c9-8cc4-4a11-9105-96e5950d210f",
|
||
|
|
"indicator--570f49c9-884c-49c7-acde-96e5950d210f",
|
||
|
|
"indicator--570f49c9-3518-4535-bce7-96e5950d210f",
|
||
|
|
"indicator--570f49ca-8ef0-4ddd-b432-96e5950d210f",
|
||
|
|
"indicator--570f49ca-e908-41f9-939a-96e5950d210f",
|
||
|
|
"indicator--570f49ca-86f4-4dfd-804b-96e5950d210f",
|
||
|
|
"indicator--570f49cb-f34c-4615-809b-96e5950d210f",
|
||
|
|
"indicator--570f49cb-17e4-4a4c-b5b7-96e5950d210f",
|
||
|
|
"indicator--570f49cb-0340-4739-8400-96e5950d210f",
|
||
|
|
"indicator--570f49cc-35c4-4467-9a4a-96e5950d210f",
|
||
|
|
"indicator--570f49cc-e5b0-43e6-a07b-96e5950d210f",
|
||
|
|
"indicator--570f49cc-0d54-4923-9e72-96e5950d210f",
|
||
|
|
"indicator--570f49cd-4c5c-4f83-9e11-96e5950d210f",
|
||
|
|
"indicator--570f49cd-3cbc-4815-bab8-96e5950d210f",
|
||
|
|
"indicator--570f49cd-2ae0-431d-ac02-96e5950d210f",
|
||
|
|
"indicator--570f49ce-d7c4-4c6a-811a-96e5950d210f",
|
||
|
|
"indicator--570f49ce-5348-4ffe-95f9-96e5950d210f",
|
||
|
|
"indicator--570f49ce-48c4-40e9-a73f-96e5950d210f",
|
||
|
|
"indicator--570f49cf-6624-470e-b0ba-96e5950d210f",
|
||
|
|
"indicator--570f49cf-82e8-4715-8612-96e5950d210f",
|
||
|
|
"indicator--570f49cf-d3cc-499f-bd12-96e5950d210f",
|
||
|
|
"indicator--570f49d0-34d0-4fc1-891d-96e5950d210f",
|
||
|
|
"indicator--570f49d0-fcf4-4f43-bd56-96e5950d210f",
|
||
|
|
"indicator--570f49d0-ca9c-48ee-b7b3-96e5950d210f",
|
||
|
|
"indicator--570f49d1-763c-42c1-96b9-96e5950d210f",
|
||
|
|
"indicator--570f49d1-d250-426b-9b1e-96e5950d210f",
|
||
|
|
"indicator--570f49d1-4b74-4bbe-9da4-96e5950d210f",
|
||
|
|
"indicator--570f518b-1c54-45ef-8423-96eb950d210f",
|
||
|
|
"indicator--570f518c-d700-4365-ac93-96eb950d210f",
|
||
|
|
"indicator--570f518c-b5cc-4472-b6e1-96eb950d210f",
|
||
|
|
"indicator--570f518d-f9fc-45e6-ad15-96eb950d210f",
|
||
|
|
"indicator--570f518e-24f0-48f6-acbb-96eb950d210f",
|
||
|
|
"indicator--570f518f-cfa8-41a1-aa00-96eb950d210f",
|
||
|
|
"indicator--570f518f-6b78-4697-9e9e-96eb950d210f",
|
||
|
|
"indicator--570f5190-a664-4b4e-b3d3-96eb950d210f",
|
||
|
|
"indicator--570f5190-ae50-4516-98b0-96eb950d210f",
|
||
|
|
"indicator--570f5191-ed80-49bf-b0f0-96eb950d210f",
|
||
|
|
"indicator--570f5192-ddd0-461c-a26d-96eb950d210f",
|
||
|
|
"indicator--570f5192-3d18-478d-9aad-96eb950d210f",
|
||
|
|
"indicator--570f5193-5f08-4eca-ae8e-96eb950d210f",
|
||
|
|
"indicator--570f5194-c62c-4660-86d0-96eb950d210f",
|
||
|
|
"indicator--570f5195-09a0-4a11-ac48-96eb950d210f",
|
||
|
|
"indicator--570f5195-1e50-43c1-875f-96eb950d210f",
|
||
|
|
"indicator--570f5196-f424-48a5-8f8a-96eb950d210f",
|
||
|
|
"indicator--570f5196-4fc4-4ddb-a80c-96eb950d210f",
|
||
|
|
"indicator--570f5197-1f20-4cb9-a93e-96eb950d210f",
|
||
|
|
"indicator--570f5198-5d80-4b20-84b6-96eb950d210f",
|
||
|
|
"indicator--570f5198-9b8c-4704-9a3a-96eb950d210f",
|
||
|
|
"indicator--570f5199-5790-47d6-b2d1-96eb950d210f",
|
||
|
|
"indicator--570f519a-1538-4ba7-a115-96eb950d210f",
|
||
|
|
"indicator--570f519a-fd4c-4e67-86e1-96eb950d210f",
|
||
|
|
"indicator--570f519b-898c-419b-a448-96eb950d210f",
|
||
|
|
"indicator--570f519c-ded4-4bf4-8707-96eb950d210f",
|
||
|
|
"indicator--570f519c-a400-4bdf-b9b8-96eb950d210f",
|
||
|
|
"indicator--570f519d-47d0-4352-9046-96eb950d210f",
|
||
|
|
"indicator--570f519e-2dfc-4e7a-8d7b-96eb950d210f",
|
||
|
|
"indicator--570f519e-42f8-4eb3-92ed-96eb950d210f",
|
||
|
|
"indicator--570f519f-aa80-4b70-b23b-96eb950d210f",
|
||
|
|
"indicator--570f51a0-87dc-46b9-8a3b-96eb950d210f",
|
||
|
|
"indicator--570f51a0-bc70-4c3c-bc5d-96eb950d210f",
|
||
|
|
"indicator--570f51a1-99d4-4fe7-8e06-96eb950d210f",
|
||
|
|
"indicator--570f51a2-bfe0-4d7c-bb6b-96eb950d210f",
|
||
|
|
"indicator--570f51a2-4d3c-47de-97dc-96eb950d210f",
|
||
|
|
"indicator--570f51a3-1390-4062-acdb-96eb950d210f",
|
||
|
|
"indicator--570f51a4-37a4-4205-bee4-96eb950d210f",
|
||
|
|
"indicator--570f51a4-1180-452a-ad94-96eb950d210f",
|
||
|
|
"indicator--570f51a5-420c-458a-aad0-96eb950d210f",
|
||
|
|
"indicator--570f51a6-d7c8-457a-8672-96eb950d210f",
|
||
|
|
"indicator--570f51a6-99e8-4ae3-9b58-96eb950d210f",
|
||
|
|
"indicator--570f51a7-db28-4bbf-a4be-96eb950d210f",
|
||
|
|
"indicator--570f51a8-5140-4470-aba3-96eb950d210f",
|
||
|
|
"indicator--570f51a9-8220-490d-8a86-96eb950d210f",
|
||
|
|
"indicator--570f51a9-1b08-4ee2-a20b-96eb950d210f",
|
||
|
|
"indicator--570f51aa-360c-469f-91b1-96eb950d210f",
|
||
|
|
"indicator--570f51aa-2c10-40d9-9419-96eb950d210f",
|
||
|
|
"indicator--570f51ab-e184-400d-bbdb-96eb950d210f",
|
||
|
|
"indicator--570f51ac-640c-445d-8ec3-96eb950d210f",
|
||
|
|
"indicator--570f51ac-b188-4f69-a57b-96eb950d210f",
|
||
|
|
"indicator--570f5afc-f418-44b9-aacf-a269950d210f",
|
||
|
|
"indicator--570f5afc-7694-47b2-b5e9-a269950d210f",
|
||
|
|
"observed-data--570f5c34-6584-4644-be96-a51d02de0b81",
|
||
|
|
"url--570f5c34-6584-4644-be96-a51d02de0b81",
|
||
|
|
"observed-data--570f5c34-32d0-464c-9834-a51d02de0b81",
|
||
|
|
"url--570f5c34-32d0-464c-9834-a51d02de0b81",
|
||
|
|
"observed-data--570f5c35-1148-4918-bf3d-a51d02de0b81",
|
||
|
|
"url--570f5c35-1148-4918-bf3d-a51d02de0b81",
|
||
|
|
"observed-data--570f5c35-0eb8-467f-a613-a51d02de0b81",
|
||
|
|
"url--570f5c35-0eb8-467f-a613-a51d02de0b81",
|
||
|
|
"observed-data--570f5c35-50d4-4005-a9d8-a51d02de0b81",
|
||
|
|
"url--570f5c35-50d4-4005-a9d8-a51d02de0b81",
|
||
|
|
"observed-data--570f5c36-5088-458a-aa1a-a51d02de0b81",
|
||
|
|
"url--570f5c36-5088-458a-aa1a-a51d02de0b81",
|
||
|
|
"observed-data--570f5c36-7c3c-4b06-b386-a51d02de0b81",
|
||
|
|
"url--570f5c36-7c3c-4b06-b386-a51d02de0b81",
|
||
|
|
"observed-data--570f5c36-a1dc-4320-a627-a51d02de0b81",
|
||
|
|
"url--570f5c36-a1dc-4320-a627-a51d02de0b81",
|
||
|
|
"observed-data--570f5c37-57fc-49fe-ae68-a51d02de0b81",
|
||
|
|
"url--570f5c37-57fc-49fe-ae68-a51d02de0b81",
|
||
|
|
"observed-data--570f5c37-0714-4ea3-8993-a51d02de0b81",
|
||
|
|
"url--570f5c37-0714-4ea3-8993-a51d02de0b81",
|
||
|
|
"observed-data--570f5c37-ef64-4c43-bb2f-a51d02de0b81",
|
||
|
|
"url--570f5c37-ef64-4c43-bb2f-a51d02de0b81",
|
||
|
|
"observed-data--570f5c38-8014-444f-ac7e-a51d02de0b81",
|
||
|
|
"url--570f5c38-8014-444f-ac7e-a51d02de0b81",
|
||
|
|
"observed-data--570f5c38-9e54-4db9-aaa1-a51d02de0b81",
|
||
|
|
"url--570f5c38-9e54-4db9-aaa1-a51d02de0b81",
|
||
|
|
"observed-data--570f5c38-17c0-4eb6-8e4d-a51d02de0b81",
|
||
|
|
"url--570f5c38-17c0-4eb6-8e4d-a51d02de0b81",
|
||
|
|
"observed-data--570f5c39-6000-4192-b569-a51d02de0b81",
|
||
|
|
"url--570f5c39-6000-4192-b569-a51d02de0b81",
|
||
|
|
"observed-data--570f5c39-fc64-4d34-93db-a51d02de0b81",
|
||
|
|
"url--570f5c39-fc64-4d34-93db-a51d02de0b81",
|
||
|
|
"observed-data--570f5c39-fc70-417d-9a75-a51d02de0b81",
|
||
|
|
"url--570f5c39-fc70-417d-9a75-a51d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"circl:incident-classification=\"malware\"",
|
||
|
|
"circl:incident-classification=\"system-compromise\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48d6-0d44-45ac-b32e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:37:58.000Z",
|
||
|
|
"modified": "2016-04-14T07:37:58.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '1.39.20.192']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:37:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48d6-3f38-4fa1-88d4-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:37:58.000Z",
|
||
|
|
"modified": "2016-04-14T07:37:58.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '1.39.20.251']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:37:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48d7-81a8-4763-8f9b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:37:59.000Z",
|
||
|
|
"modified": "2016-04-14T07:37:59.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '1.39.35.97']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:37:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48d7-c508-4566-b950-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:37:59.000Z",
|
||
|
|
"modified": "2016-04-14T07:37:59.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '1.47.11.40']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:37:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48d7-3348-4bf9-9e5e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:37:59.000Z",
|
||
|
|
"modified": "2016-04-14T07:37:59.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '1.54.15.222']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:37:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48d8-71a8-447f-897b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:00.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:00.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '1.55.11.246']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48d8-becc-4537-b8e8-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:00.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:00.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '1.55.175.107']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48d8-d0d0-4a6c-930c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:00.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:00.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '100.100.81.234']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48d9-7cb0-4107-9a73-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:01.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:01.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '101.2.167.130']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48d9-ce54-4e46-aa6e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:01.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:01.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '101.56.228.136']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48d9-dd64-4cfa-98da-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:01.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:01.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '103.15.141.214']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48da-c458-4630-9374-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:02.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:02.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '103.20.2.39']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48da-0594-4d8d-a802-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:02.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:02.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '103.226.144.121']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48da-7174-4375-8764-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:02.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:02.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '103.242.157.66']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48da-8f90-4332-bfa6-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:02.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:02.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '103.243.54.102']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48db-1fc0-47da-94e9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:03.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:03.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '103.252.217.87']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48db-b748-4bb7-bb1e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:03.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:03.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '103.252.7.177']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48db-81d4-4e49-aa63-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:03.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:03.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '103.5.125.50']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48dc-e304-4cd1-90a4-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:04.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:04.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '103.60.198.229']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48dc-5e04-456d-a3b7-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:04.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:04.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '103.61.102.65']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48dc-9cb8-453e-85ea-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:04.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:04.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '105.106.5.250']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48dd-d148-4056-8eb8-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:05.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:05.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '105.228.165.6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48dd-7bfc-46b2-806c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:05.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:05.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '106.194.27.250']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48dd-b4e8-4cf4-9108-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:05.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:05.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '106.215.153.210']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48de-60a0-4158-9042-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:06.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:06.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '106.216.147.215']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48de-059c-4f3a-a3bb-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:06.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:06.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '106.221.137.140']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48de-863c-4b3b-b79b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:06.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:06.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '106.51.130.111']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48de-9d6c-4ca8-a8c0-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:06.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:06.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '106.51.138.45']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48df-2500-42d9-9d10-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:07.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:07.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '106.51.165.91']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48df-eae8-42e0-ac28-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:07.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:07.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '106.51.21.161']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48df-7420-4b3e-9449-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:07.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:07.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '106.51.31.237']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e0-a0a0-4928-9535-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:08.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:08.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '109.102.219.37']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e0-8314-41ee-b8b4-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:08.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:08.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '109.231.13.252']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e0-3780-49a9-99e6-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:08.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:08.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '109.231.30.125']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e1-1a2c-4add-a7ff-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:09.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:09.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '109.236.40.153']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e1-4414-4bd9-8df7-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:09.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:09.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '109.64.38.127']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e1-4108-4208-b576-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:09.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:09.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '110.173.178.146']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e2-c138-48d3-b72f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:10.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:10.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '110.232.76.247']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e2-9168-4608-8a49-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:10.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:10.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '111.92.50.219']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e2-2720-4cf7-bff5-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:10.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:10.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '111.93.180.138']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e2-53a8-4674-8d33-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:10.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:10.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '111.93.184.170']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e3-88ac-499b-8093-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:11.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:11.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '113.160.200.138']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e3-b144-40e6-8281-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:11.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:11.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '113.160.249.187']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e3-3358-43a6-adfc-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:11.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:11.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '113.161.196.10']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e4-e558-4e49-a839-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:12.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:12.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '113.162.56.137']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e4-8f98-4499-9e0d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:12.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:12.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '113.163.243.29']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e4-5790-4b49-89bb-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:12.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:12.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '113.173.153.210']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e5-61c0-4fca-9e8e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:13.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:13.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '113.174.144.162']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e5-4434-4bc1-babd-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:13.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:13.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '113.183.145.251']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e6-ca00-4737-84cd-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:14.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:14.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '113.183.49.221']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e6-3f10-482c-a2f2-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:14.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:14.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '113.22.51.20']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e6-96d0-47e9-a388-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:14.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:14.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '114.4.78.5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e7-b584-4610-879e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:15.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:15.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '115.134.98.26']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e7-6d14-4826-a607-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:15.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:15.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '115.164.60.153']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e7-3dfc-476d-b211-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:15.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:15.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '115.166.129.44']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e8-aa40-4729-a229-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:16.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:16.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '115.186.104.138']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e8-d470-4733-8b87-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:16.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:16.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '115.242.58.109']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e8-638c-4821-b811-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:16.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:16.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '115.42.54.113']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e8-1a18-4b6a-b9ad-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:16.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:16.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '115.73.135.245']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e9-b1e4-46e3-8129-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:17.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:17.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '115.74.115.175']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e9-311c-4861-8a4c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:17.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:17.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '115.76.242.18']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48e9-cc0c-4140-9275-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:17.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:17.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '115.79.207.194']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48ea-becc-444b-a9a5-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:18.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:18.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '116.100.151.159']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48ea-4c18-4213-b918-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:18.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:18.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '116.104.218.134']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48ea-a988-4f9a-b71d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:18.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:18.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '116.105.35.34']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48eb-ced0-4cc5-a961-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:19.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:19.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '116.106.8.155']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48eb-1ac8-4398-a048-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:19.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:19.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '116.14.163.123']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48eb-e5a4-441c-8c5f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:19.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:19.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '116.203.72.32']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48ec-a0ec-4664-aa58-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:20.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:20.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '116.212.137.162']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48ec-57a0-4ba3-afc1-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:20.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:20.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '116.74.213.14']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48ec-dbe8-4a75-bf13-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:20.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:20.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '116.74.221.201']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48ed-4dec-4657-b148-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:21.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:21.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '116.75.196.227']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48ed-138c-4c1b-9493-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:21.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:21.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '117.1.207.4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48ed-eaa0-4c7a-bda4-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:21.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:21.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '117.192.82.12']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48ee-d538-4056-bf49-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:22.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:22.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '117.194.41.152']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48ee-bfec-4c45-9a9b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:22.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:22.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '117.196.78.18']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48ef-5df4-404c-a805-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:23.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:23.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '117.198.215.127']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48ef-512c-4c0b-9f93-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:23.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:23.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '117.206.84.165']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48ef-8c74-4475-8d8a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:23.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:23.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '117.208.126.234']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f0-4c64-442d-82d6-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:24.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:24.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '117.223.0.5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f0-06cc-4ef4-957a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:24.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:24.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '117.223.176.209']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f0-b80c-4117-a70c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:24.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:24.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '117.241.26.254']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f1-f534-4094-94db-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:25.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:25.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '117.242.38.196']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f1-6fa8-43a3-b09f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:25.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:25.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '117.248.14.141']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f2-6110-47ae-9d67-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:26.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:26.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '117.3.46.224']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f2-3e7c-4883-9a90-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:26.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:26.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '117.5.194.125']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f2-6a90-4bff-87a0-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:26.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:26.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '117.5.88.203']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f3-407c-42b3-ba72-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:27.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:27.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '117.83.198.64']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f3-2e10-4ad4-a917-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:27.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:27.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '118.179.161.102']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f4-8660-4f82-84d8-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:28.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:28.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '118.68.136.226']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f4-c95c-4841-bad0-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:28.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:28.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '118.69.27.48']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f4-a89c-4912-8f9e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:28.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:28.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '118.69.35.52']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f4-d774-4302-964d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:28.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:28.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '118.69.54.51']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f5-5348-4f57-a4c2-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:29.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:29.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '118.70.13.222']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f5-c294-495d-8bf1-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:29.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:29.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '118.71.119.193']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f5-75b0-4bb1-af96-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:29.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:29.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '119.63.132.217']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f6-dbf8-46f2-91ba-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:30.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:30.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '12.37.0.227']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f6-32cc-40bd-98fb-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:30.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:30.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '120.63.250.200']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f7-0610-4ded-95cb-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:31.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:31.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '121.245.59.38']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f7-a4b4-4285-81df-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:31.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:31.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '121.97.115.69']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f7-69c4-44d5-b9fa-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:31.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:31.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '122.3.85.39']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f8-36ec-47ca-80ae-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:32.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:32.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '122.53.100.196']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f8-8ba0-47fe-9fb4-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:32.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:32.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '123.16.67.89']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f8-9850-4c94-881b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:32.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:32.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '123.231.125.240']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f9-93f4-463f-9640-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:33.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:33.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '123.27.11.119']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48f9-79a4-41da-a424-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:33.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:33.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '124.107.175.186']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48fa-a48c-4164-ab5c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:34.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:34.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '124.82.101.224']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48fa-aee4-468e-99b9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:34.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:34.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '125.161.168.108']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48fa-d86c-45b9-bac9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:34.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:34.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '130.0.30.20']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48fb-1554-4730-948b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:35.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:35.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '130.193.182.192']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48fb-edd0-42ae-bd7f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:35.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:35.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '130.204.18.34']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48fc-1300-4597-8e09-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:36.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:36.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '131.178.200.65']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48fc-32f8-4f53-b0bf-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:36.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:36.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '131.72.220.195']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48fc-92ec-4178-8a11-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:36.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:36.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '138.229.17.217']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48fd-080c-4dba-8f4c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:37.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:37.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '139.190.165.186']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48fd-5ae0-4906-8aeb-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:37.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:37.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '139.194.177.81']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48fd-9288-44d8-8f65-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:37.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:37.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '14.1.193.95']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48fe-583c-4e0d-a6b1-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:38.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:38.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '14.161.25.127']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48fe-5150-4faa-884e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:38.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:38.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '14.161.34.212']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48ff-9df4-42ad-bc45-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:39.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:39.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '14.161.6.23']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48ff-5cc4-40c0-a89c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:39.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:39.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '14.162.166.196']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f48ff-e314-4d0c-a6d6-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:39.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:39.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '14.167.206.16']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4900-257c-49e1-bfbe-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:40.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:40.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '14.168.16.46']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4900-e2ac-47bc-bcef-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:40.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:40.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '14.169.125.233']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4900-f5c8-4482-9608-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:40.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:40.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '14.177.192.115']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4901-2e4c-4032-9d66-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:41.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:41.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '14.186.151.116']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4901-1530-4926-b701-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:41.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:41.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '14.186.156.73']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4902-588c-4052-824b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:42.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:42.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '14.192.210.104']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4902-8000-4b87-8ba9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:42.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:42.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '140.0.90.73']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4902-2330-4666-84d1-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:42.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:42.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '143.0.249.98']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4903-9628-40fc-992a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:43.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:43.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '148.246.168.23']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4903-f51c-4f65-8983-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:43.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:43.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '148.246.69.72']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4903-d704-4841-8a6e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:43.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:43.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '148.3.188.219']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4904-f030-4afc-ac58-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:44.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:44.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '150.129.46.183']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4904-cfbc-4cde-83d8-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:44.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:44.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '151.232.244.195']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4904-5ee8-479f-b45e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:44.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:44.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '151.234.38.182']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4905-5f54-4dc8-a77a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:45.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:45.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '151.30.47.47']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4905-8d70-4bda-b6fd-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:45.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:45.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '151.63.53.29']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4905-a8c4-4e35-8f8e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:45.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:45.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '154.118.45.218']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4905-7de4-474f-b1e1-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:45.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:45.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '154.66.224.53']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4906-918c-4e16-865f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:46.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:46.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '156.213.11.59']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4906-8014-48ed-8d68-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:46.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:46.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '157.100.1.196']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4906-f740-4d81-b100-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:46.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:46.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '161.18.112.119']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4907-8cf8-4cbb-91b4-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:47.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:47.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '161.18.129.248']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4907-39dc-4706-ba52-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:47.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:47.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '166.170.34.228']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4907-d70c-4790-b5a1-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:47.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:47.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '167.0.127.161']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4908-e2cc-47f3-9517-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:48.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:48.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '168.176.100.228']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4908-a440-4b5f-9c55-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:48.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:48.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '168.227.52.4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4908-b538-4893-8caa-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:48.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:48.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '171.224.21.138']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4908-87e0-4cf3-934f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:48.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:48.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '171.233.170.181']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4909-6674-4356-b988-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:49.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:49.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '171.234.248.80']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4909-b87c-4725-87ef-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:49.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:49.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '171.7.149.207']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4909-bccc-4557-9330-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:49.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:49.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '171.78.235.30']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f490a-9384-4085-b346-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:50.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:50.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '173.33.241.39']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f490a-fec8-4c75-a5e9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:50.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:50.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '175.101.12.131']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f490a-dd04-4fbf-8101-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:50.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:50.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '175.157.18.220']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f490b-d208-40b4-8fdf-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:51.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:51.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '176.218.13.167']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f490b-7338-471b-a486-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:51.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:51.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '176.218.146.159']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f490b-26c4-4ad5-96f8-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:51.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:51.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '176.218.174.83']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f490c-7590-4764-aa4f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:52.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:52.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '176.32.23.219']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f490c-6938-4639-a085-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:52.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:52.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.0.33.95']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f490c-b49c-4230-96f1-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:52.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:52.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.125.128.150']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f490d-2ab0-4af2-a993-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:53.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:53.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.126.81.22']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f490d-ce40-46fa-adb8-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:53.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:53.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.129.48.109']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f490d-3700-4b70-b2e7-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:53.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:53.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.154.64.248']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f490e-e9a8-43a6-ab1f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:54.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:54.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.225.131.220']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f490e-9a18-4b19-8423-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:54.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:54.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.225.165.213']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f490e-28bc-483f-8f3e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:54.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:54.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.227.166.171']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f490e-3398-445b-b8ea-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:54.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:54.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.228.108.85']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f490f-ad30-4ada-bb31-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:55.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:55.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.228.118.206']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f490f-4e94-4cf1-9bbd-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:55.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:55.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.228.2.71']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f490f-add0-4ec6-b4b4-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:55.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:55.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.228.53.84']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4910-b168-4656-ae7d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:56.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:56.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.228.88.180']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4910-1390-4ac1-8477-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:56.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:56.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.228.88.49']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4910-a334-4fe0-b83f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:56.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:56.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.228.95.88']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4911-f4a8-4623-954b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:57.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:57.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.230.44.119']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4911-8e58-4e9d-9bc9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:57.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:57.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.230.67.36']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4911-a4a4-43e5-aeba-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:57.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:57.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.230.9.133']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4912-0eac-42cc-a63f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:58.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:58.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.234.19.154']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4912-4e18-4d06-9619-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:58.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:58.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.237.176.233']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4912-9e50-443e-9668-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:58.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:58.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.240.44.155']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4913-f264-4ab1-b67f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:59.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:59.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.240.59.236']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4913-7494-485b-9f4e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:59.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:59.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.243.17.202']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4913-ed74-44b0-b42a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:38:59.000Z",
|
||
|
|
"modified": "2016-04-14T07:38:59.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.243.71.98']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:38:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4914-9994-4699-8b52-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:00.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:00.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.244.17.184']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4914-4c0c-46ad-94ee-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:00.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:00.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.247.118.205']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4914-0804-4701-9bce-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:00.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:00.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.247.119.5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4915-3344-4f4f-aeaa-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:01.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:01.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.247.123.12']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4915-0960-45d1-aa67-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:01.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:01.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.247.81.213']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4915-08a4-40f9-841c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:01.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:01.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.247.96.56']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4916-3cb8-47d3-900c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:02.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:02.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.4.174.34']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4916-3450-45d5-8f30-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:02.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:02.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.43.90.153']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4917-8af8-49b0-b0cc-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:03.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:03.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.5.83.153']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4917-fdb8-4f44-b7c2-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:03.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:03.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.54.57.210']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4917-93e8-424f-82e4-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:03.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:03.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '177.75.57.82']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4918-6ee0-4d9b-946c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:04.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:04.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '178.149.118.225']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4918-2a74-47a9-9d93-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:04.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:04.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '178.40.211.93']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4918-1e80-4dd6-ba3f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:04.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:04.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '178.59.21.80']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4919-d6f8-4e54-9406-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:05.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:05.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '178.91.132.242']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4919-1228-46ce-bf18-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:05.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:05.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '179.186.174.80']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f491a-ff74-4d5a-a4ee-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:06.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:06.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '179.191.239.164']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f491a-ec20-41e2-831e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:06.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:06.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '179.233.236.244']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f491a-a128-44ca-8653-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:06.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:06.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '179.236.210.43']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f491b-373c-4404-a63a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:07.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:07.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '180.178.183.249']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f491b-74cc-4ab1-8bc6-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:07.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:07.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '180.193.106.139']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f491b-9c2c-4974-a5ef-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:07.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:07.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '180.250.72.108']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f491c-79a8-45a0-b821-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:08.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:08.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '181.114.115.5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f491c-f84c-48fb-bd24-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:08.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:08.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '181.114.98.25']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f491c-f24c-4a97-8682-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:08.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:08.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '181.118.151.10']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f491d-7578-4bde-b531-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:09.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:09.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '181.143.112.50']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f491d-149c-4adb-9d32-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:09.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:09.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '181.174.104.115']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f491d-88e4-4e24-8758-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:09.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:09.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '181.174.104.134']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f491e-a78c-4af6-ae69-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:10.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:10.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '181.174.106.241']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f491e-cbfc-4577-8268-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:10.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:10.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '181.174.78.234']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f491e-fd50-4ba1-be51-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:10.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:10.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '181.175.21.18']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f491e-9f6c-4e18-b40e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:10.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:10.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '181.176.192.157']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f491f-b584-480d-b3b0-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:11.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:11.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '181.196.254.36']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f491f-38a4-4bef-9a7b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:11.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:11.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '181.196.76.49']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f491f-ca34-40e7-b9d1-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:11.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:11.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '181.228.194.91']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4920-5a80-43d7-99cb-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:12.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:12.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '181.39.16.230']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4920-fb40-46f5-abcd-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:12.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:12.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '181.49.74.122']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4920-7b60-49c5-bc1e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:12.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:12.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '181.50.200.13']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4921-d788-49a7-a89d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:13.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:13.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '181.51.100.203']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4921-80dc-49c2-ac08-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:13.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:13.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '181.52.113.82']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4921-9208-4363-b88c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:13.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:13.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '181.52.80.46']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4922-438c-4b4f-92ae-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:14.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:14.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '181.55.197.242']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4922-8b74-4cfa-85ed-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:14.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:14.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '181.55.209.155']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4922-9544-484a-ad80-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:14.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:14.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '181.58.109.205']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4923-1e18-44c4-940f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:15.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:15.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '181.63.252.11']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4923-c0f8-4f26-8cba-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:15.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:15.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '182.178.255.75']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4923-6ecc-436b-832b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:15.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:15.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '182.180.161.68']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4924-f9a0-449c-a415-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:16.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:16.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '182.185.125.6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4924-1ef8-41eb-aad1-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:16.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:16.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '182.185.201.176']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4924-2aac-4190-be94-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:16.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:16.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '182.187.16.106']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4925-98d4-4a83-a48c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:17.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:17.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '182.187.81.131']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4925-049c-4f23-bc76-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:17.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:17.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '182.19.60.45']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4925-d828-4481-be4b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:17.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:17.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '182.253.6.186']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4925-fc60-41dc-adc3-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:17.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:17.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '182.73.153.146']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4926-bd30-4f61-a88e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:18.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:18.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '183.171.224.226']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4926-2d98-4825-8007-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:18.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:18.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '183.87.129.238']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4926-a7d4-463b-8edc-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:18.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:18.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '183.88.96.164']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4927-58d0-4008-bd57-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:19.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:19.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '183.91.13.9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4927-9320-48cb-9c07-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:19.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:19.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '185.12.184.57']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4927-9458-46a1-8157-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:19.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:19.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '185.120.125.46']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4927-fed8-4f2f-93a0-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:19.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:19.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '185.134.98.49']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4928-cf54-47a4-b4ff-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:20.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:20.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '185.6.22.133']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4928-6cf8-4414-990e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:20.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:20.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '185.90.171.84']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4928-9200-4190-9080-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:20.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:20.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '186.116.30.172']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4929-4cfc-4f0b-a93c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:21.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:21.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '186.120.122.95']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4929-3988-4193-9398-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:21.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:21.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '186.147.252.132']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4929-568c-44f3-bdc8-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:21.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:21.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '186.150.69.61']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f492a-5b44-4176-a243-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:22.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:22.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '186.170.116.158']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f492a-7bd8-4ec8-b610-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:22.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:22.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '186.176.158.195']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f492a-bc10-4e35-998a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:22.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:22.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '186.192.10.26']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f492b-eb44-4036-b70f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:23.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:23.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '186.208.78.22']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f492b-8224-4cf6-97a3-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:23.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:23.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '186.227.186.18']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f492b-8204-45e1-a8b7-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:23.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:23.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '186.236.134.141']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f492c-7f24-43b8-ac70-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:24.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:24.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '186.251.4.116']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f492c-74e4-4655-9ca5-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:24.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:24.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '186.28.240.194']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f492c-9f78-4beb-962a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:24.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:24.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '186.3.179.76']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f492d-0300-42cd-b3e5-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:25.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:25.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '186.34.201.5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f492d-cae8-4467-a028-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:25.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:25.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '186.4.129.49']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f492d-ce7c-4ec5-bf31-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:25.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:25.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '186.4.147.179']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f492e-485c-4318-8df1-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:26.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:26.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '186.4.189.44']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f492e-c28c-4b8a-902c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:26.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:26.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '186.46.31.107']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f492e-e334-4c70-9701-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:26.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:26.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '186.47.215.226']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f492e-1e4c-4f5f-93c9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:26.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:26.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '186.77.229.33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f492f-c57c-4e58-8af1-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:27.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:27.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '186.91.42.85']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f492f-aca0-415b-b261-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:27.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:27.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.131.103.229']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f492f-ffdc-4537-995b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:27.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:27.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.134.35.28']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4930-c5e0-4b44-ab5e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:28.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:28.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.136.44.185']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4930-d99c-4d70-8963-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:28.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:28.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.142.80.112']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4930-e700-421a-a487-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:28.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:28.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.148.194.19']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4931-520c-470b-85a5-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:29.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:29.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.149.205.2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4931-6d64-4bfc-99fa-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:29.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:29.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.149.38.126']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4931-9dc8-4d29-84f8-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:29.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:29.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.150.142.135']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4932-00fc-4984-acb5-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:30.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:30.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.158.133.87']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4932-2794-48fa-bcdf-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:30.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:30.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.159.86.177']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4932-7b10-46a9-90ba-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:30.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:30.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.163.211.56']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4933-a508-4d4b-8aa6-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:31.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:31.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.168.84.199']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4933-fad8-4622-b45d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:31.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:31.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.169.4.191']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4933-92a4-476a-84bf-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:31.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:31.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.172.16.255']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4934-23d0-484d-ac3a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:32.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:32.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.172.7.166']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4934-1fc8-469d-b6f2-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:32.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:32.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.175.112.63']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4934-857c-4943-a2e2-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:32.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:32.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.175.43.150']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4935-bd54-4f20-84fa-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:33.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:33.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.175.53.245']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4935-6c0c-4bf8-b30f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:33.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:33.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.185.226.42']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4935-801c-4467-8646-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:33.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:33.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.188.11.245']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4936-91b8-4447-acbe-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:34.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:34.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.188.186.77']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4936-aab0-4f29-8598-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:34.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:34.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.188.71.88']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4936-3514-4575-8cda-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:34.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:34.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.188.8.81']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4937-049c-49db-b771-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:35.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:35.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.188.80.194']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4937-cbf0-4d36-aeed-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:35.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:35.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.188.9.21']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4937-e32c-4bf9-87de-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:35.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:35.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.189.10.178']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4938-aed0-4959-b2b4-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:36.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:36.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.189.108.190']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4938-1c20-4dce-8bd5-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:36.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:36.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.189.242.58']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4938-2688-4435-bba3-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:36.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:36.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.190.153.252']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4939-7a68-4148-849d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:37.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:37.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.190.26.25']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4939-91f4-4c76-8f4a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:37.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:37.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.190.26.5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4939-e33c-4171-96df-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:37.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:37.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.191.10.37']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f493a-c664-4ddb-86ed-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:38.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:38.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.191.10.61']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f493a-6fec-4fb9-af46-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:38.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:38.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.191.33.198']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f493b-f014-4625-8b2a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:39.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:39.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.192.244.26']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f493b-6bc8-4034-a64d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:39.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:39.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.193.202.249']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f493b-0674-4ada-8c7b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:39.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:39.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.194.156.120']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f493b-9634-463e-9e35-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:39.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:39.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.194.31.43']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f493c-0c0c-4e7c-b0ad-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:40.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:40.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.202.207.10']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f493c-bba8-4ee3-abb8-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:40.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:40.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.205.12.64']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f493c-b47c-42df-8ba6-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:40.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:40.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.210.68.194']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f493d-9c84-4ef3-afa6-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:41.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:41.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.212.73.37']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f493d-e5c8-4803-92b2-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:41.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:41.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.213.221.119']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f493d-15b8-4621-b795-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:41.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:41.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.222.109.150']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f493e-5724-4ae8-8a95-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:42.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:42.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.226.168.167']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f493e-b204-471c-ba24-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:42.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:42.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.234.168.39']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f493e-4254-4048-a06b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:42.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:42.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.235.173.89']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f493f-9ba0-4360-b140-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:43.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:43.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.235.208.129']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f493f-1268-43a0-b656-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:43.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:43.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.235.235.60']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4940-0104-4e9e-8f59-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:44.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:44.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.237.233.62']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4940-5c10-465c-8fc1-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:44.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:44.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.240.124.210']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4940-5b3c-4c6d-aa32-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:44.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:44.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.240.196.159']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4940-48b0-4598-b4eb-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:44.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:44.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.240.71.111']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4941-657c-4862-97c7-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:45.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:45.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.244.10.135']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4941-3d84-4a45-82ee-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:45.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:45.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.244.81.88']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4941-92e4-4182-ac47-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:45.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:45.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.254.32.117']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4942-2e34-436c-93de-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:46.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:46.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '187.37.20.41']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4942-ad4c-480e-a00f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:46.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:46.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '188.121.130.39']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4942-22a4-4d22-92e2-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:46.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:46.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '188.135.43.90']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4943-8cc8-4709-b659-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:47.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:47.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '188.135.44.247']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4943-6ce4-49cd-a66f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:47.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:47.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '188.135.46.61']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4943-a344-4183-adbd-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:47.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:47.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '188.152.53.195']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4944-5d9c-4491-ac50-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:48.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:48.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '188.159.177.190']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4944-6fac-4859-b68b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:48.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:48.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '188.159.19.234']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4944-24d0-4d35-98ea-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:48.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:48.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '188.173.163.210']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4945-a7b4-454c-859f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:49.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:49.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '188.3.234.162']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4945-efc0-42bf-b24d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:49.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:49.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '188.50.182.60']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4945-0848-4652-ad4c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:49.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:49.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '188.75.87.50']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4946-af7c-4fb3-b9fd-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:50.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:50.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.121.250.192']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4946-6bd4-4b71-a2c5-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:50.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:50.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.126.71.202']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4946-6188-4aee-b48a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:50.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:50.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.130.136.105']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4947-1950-45d3-b724-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:51.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:51.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.130.74.9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4947-8554-45eb-876c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:51.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:51.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.131.143.251']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4947-7c88-4b48-ae09-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:51.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:51.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.131.5.87']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4947-7a0c-4667-99a9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:51.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:51.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.132.60.97']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4948-29f8-4026-8aa1-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:52.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:52.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.137.23.177']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4948-bc90-418d-b629-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:52.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:52.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.137.67.192']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4948-bda8-44c6-a5bf-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:52.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:52.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.138.139.6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4949-3110-47f6-b403-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:53.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:53.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.141.93.167']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4949-b14c-4fa3-a1c2-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:53.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:53.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.142.167.158']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4949-615c-4119-9e7b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:53.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:53.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.142.36.249']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f494a-0978-41ee-81de-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:54.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:54.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.143.204.85']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f494a-8260-4ede-b02b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:54.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:54.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.145.20.63']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f494a-b738-4daf-b8b5-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:54.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:54.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.151.210.138']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f494b-b054-417a-98b7-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:55.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:55.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.152.12.209']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f494b-7ca8-411c-b3a3-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:55.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:55.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.152.86.50']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f494b-6fe0-4393-a6e9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:55.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:55.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.158.25.111']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f494c-ef4c-4a57-98c9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:56.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:56.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.158.37.166']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f494c-bd94-4cd2-835a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:56.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:56.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.158.55.250']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f494c-7348-4e22-8397-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:56.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:56.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.160.23.81']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f494d-5a3c-4487-a6a1-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:57.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:57.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.161.94.9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f494d-6cf4-42ec-85e2-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:57.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:57.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.167.202.106']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f494d-a0a0-4c00-b70b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:57.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:57.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.168.207.69']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f494e-98d8-45dc-a26e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:58.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:58.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.169.0.101']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f494e-51c0-45a3-8c9b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:58.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:58.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.170.255.188']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f494e-9c14-4733-b3b5-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:58.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:58.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.172.141.93']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f494f-c37c-4cd9-b735-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:59.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:59.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.172.233.17']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f494f-f068-4c72-8dfb-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:59.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:59.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.173.17.150']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f494f-1af8-42f1-bec1-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:39:59.000Z",
|
||
|
|
"modified": "2016-04-14T07:39:59.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.173.195.155']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:39:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4950-84b8-455d-bacd-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:00.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:00.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.173.242.122']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4950-d1b8-47de-9fe7-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:00.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:00.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.174.189.90']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4950-d9c4-4de0-a2bd-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:00.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:00.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.174.31.185']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4951-8f44-47da-83e9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:01.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:01.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.174.35.253']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4951-6df4-4afa-a12e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:01.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:01.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.176.255.26']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4951-e4a4-42d3-95e9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:01.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:01.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.179.176.154']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4952-041c-4a40-8a79-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:02.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:02.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.179.217.247']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4952-1bdc-4a9e-a9e6-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:02.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:02.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.187.21.202']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4952-558c-493c-8943-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:02.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:02.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.187.25.125']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4953-d0d8-45ca-af71-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:03.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:03.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.188.245.250']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4953-eabc-4c9c-8da0-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:03.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:03.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.189.250.126']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4953-67a0-4129-b1be-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:03.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:03.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.190.109.62']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4954-b9b8-4838-8d6a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:04.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:04.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.190.70.198']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4954-1848-4d8d-91a8-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:04.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:04.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.195.162.6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4954-ef74-4b23-bf54-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:04.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:04.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.195.65.170']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4954-0a58-40b2-9bbb-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:04.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:04.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.196.206.222']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4955-f6ac-4574-b281-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:05.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:05.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.196.53.54']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4955-4db0-4517-84f8-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:05.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:05.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.198.56.189']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4955-af98-4e73-bbec-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:05.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:05.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.198.56.24']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4956-2f44-4a29-8918-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:06.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:06.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.198.58.223']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4956-b080-4ac0-9806-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:06.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:06.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.20.208.50']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4956-ca1c-4215-82c1-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:06.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:06.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.201.136.212']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4957-1330-4a0d-b019-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:07.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:07.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.202.24.87']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4957-57e8-482c-a1ad-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:07.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:07.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.202.54.11']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4957-cb88-4ca8-bd99-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:07.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:07.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.203.142.28']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4957-c220-4535-a27d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:07.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:07.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.203.254.6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4958-aee0-401f-bdfe-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:08.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:08.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.204.109.202']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4958-fc44-437e-b328-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:08.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:08.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.207.12.98']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4958-1390-4073-b4f1-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:08.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:08.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.207.31.253']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4959-1f10-4243-a086-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:09.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:09.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.208.171.45']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4959-1ab4-4204-9530-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:09.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:09.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.209.167.184']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4959-33c8-42da-9393-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:09.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:09.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.210.118.75']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f495a-8740-4b49-a700-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:10.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:10.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.211.173.30']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f495a-16b0-46e6-b0cf-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:10.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:10.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.211.65.209']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f495a-f67c-4e70-a318-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:10.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:10.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.212.167.8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f495a-71ac-44b7-88b7-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:10.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:10.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.212.83.138']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f495b-2f4c-426c-a4a5-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:11.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:11.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.213.9.4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f495b-b644-41d4-9d0e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:11.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:11.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.214.1.251']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f495b-83e4-499b-91c6-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:11.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:11.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.214.14.236']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f495c-9358-467b-bd33-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:12.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:12.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.215.225.166']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f495c-fd50-45eb-9e87-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:12.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:12.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.217.107.232']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f495c-8878-4e7c-93a0-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:12.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:12.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.217.133.231']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f495d-06a0-450e-a260-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:13.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:13.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.217.152.190']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f495d-53b4-4660-b3b8-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:13.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:13.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.217.38.63']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f495d-e08c-4354-80ca-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:13.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:13.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.221.38.13']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f495e-be00-4d85-aab8-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:14.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:14.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.224.43.216']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f495e-8d7c-4280-bed3-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:14.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:14.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.230.106.6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f495e-3c98-46a4-ae3d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:14.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:14.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.234.254.167']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f495f-d484-49d2-a2bd-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:15.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:15.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.235.215.236']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f495f-2fa4-47b6-b78f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:15.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:15.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.236.190.81']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f495f-b2c8-47bc-a725-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:15.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:15.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.238.134.64']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4960-a7c8-41b7-a137-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:16.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:16.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.238.5.150']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4960-3148-4895-9a82-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:16.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:16.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.242.187.232']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4960-3638-46fe-9120-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:16.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:16.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.244.115.33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4961-5a28-4bb9-9707-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:17.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:17.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.248.191.144']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4961-358c-44f1-9b25-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:17.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:17.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.251.172.146']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4961-bcfc-4b99-86f3-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:17.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:17.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.252.123.140']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4962-9174-4dc0-80f7-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:18.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:18.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.254.123.225']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4962-48f0-43ba-b2cd-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:18.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:18.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '189.56.94.43']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4962-4958-4c85-80ad-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:18.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:18.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.106.209.27']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4963-17a0-40ce-9454-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:19.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:19.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.107.180.90']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4963-23bc-4e63-8795-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:19.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:19.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.109.226.209']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4963-e97c-487d-ae5c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:19.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:19.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.111.20.212']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4964-9090-4e3e-af05-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:20.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:20.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.117.149.85']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4964-1720-4ae9-bc55-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:20.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:20.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.117.204.114']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4964-d1b4-4d2d-947d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:20.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:20.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.117.244.17']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4965-b834-4dbb-b466-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:21.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:21.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.117.78.123']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4965-fb64-4064-ad3d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:21.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:21.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.12.76.18']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4965-0d24-41c6-bd9b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:21.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:21.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.124.127.168']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4966-2858-48cc-bc9f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:22.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:22.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.129.173.157']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4966-aec8-4b27-a6d5-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:22.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:22.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.131.50.96']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4966-0858-4bdd-90a5-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:22.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:22.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.14.229.58']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4967-54a8-40c5-9a41-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:23.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:23.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.145.78.20']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4967-7d88-4b70-a034-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:23.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:23.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.147.11.169']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4967-eeb4-40fe-8364-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:23.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:23.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.147.204.79']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4968-9560-402f-af4c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:24.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:24.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.147.25.48']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4968-0528-4f31-a9c9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:24.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:24.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.152.102.13']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4968-97f4-4641-9f4a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:24.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:24.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.155.202.26']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4969-3288-4ef4-9c91-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:25.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:25.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.158.230.167']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4969-6d48-41a0-8d9f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:25.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:25.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.159.254.74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4969-8458-4377-955f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:25.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:25.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.180.38.3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f496a-5f20-47b8-ba3a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:26.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:26.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.181.12.243']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f496a-5c60-47c6-a66d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:26.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:26.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.181.8.116']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f496a-9948-4304-9848-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:26.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:26.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.187.238.10']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f496b-bd04-4aa2-8b4d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:27.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:27.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.191.248.14']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f496b-fd5c-4279-b5c4-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:27.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:27.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.191.9.241']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f496b-2258-4667-be30-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:27.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:27.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.2.0.169']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f496c-f720-46a3-840f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:28.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:28.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.202.89.34']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f496c-fe80-4157-b0da-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:28.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:28.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.214.24.250']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f496c-dee8-4e78-9e14-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:28.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:28.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.214.48.125']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f496c-88b0-4820-8bcf-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:28.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:28.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.220.159.154']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f496d-f7e8-42b0-8a22-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:29.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:29.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.233.95.97']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f496d-8160-48a6-9949-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:29.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:29.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.235.148.67']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f496e-4714-4f78-b4c4-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:30.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:30.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.235.181.149']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f496e-50d0-45d5-b5bd-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:30.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:30.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.242.133.137']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f496e-46fc-49d3-b37d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:30.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:30.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.242.53.26']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f496e-2d84-45ae-bb14-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:30.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:30.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.249.129.200']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f496f-1260-4dc0-8236-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:31.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:31.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.255.95.184']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f496f-253c-45a5-aa28-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:31.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:31.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.36.181.114']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f496f-0d3c-49a4-b29a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:31.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:31.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.57.178.200']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4970-6778-409f-8986-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:32.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:32.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.60.109.166']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4970-40c8-4143-9ad3-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:32.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:32.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.62.81.220']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4970-910c-44e4-8ae1-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:32.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:32.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.66.185.220']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4971-ee10-4c02-9a56-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:33.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:33.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.66.233.84']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4971-aee4-471d-91ec-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:33.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:33.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.67.223.203']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4971-813c-4f25-8ced-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:33.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:33.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.69.86.218']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4972-b478-44e8-afbc-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:34.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:34.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.74.240.1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4972-428c-4990-addb-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:34.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:34.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.74.5.232']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4973-5940-4237-8407-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:35.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:35.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.90.189.114']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4973-d0ec-4134-a795-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:35.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:35.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.90.38.187']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4973-e280-443b-8c33-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:35.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:35.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.92.69.33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4974-c95c-40e3-b564-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:36.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:36.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.93.137.60']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4974-5998-4e6f-96cb-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:36.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:36.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.94.107.95']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4974-54a8-4d81-b53b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:36.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:36.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '190.94.215.187']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4975-3c4c-454e-9dd0-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:37.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:37.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '191.183.125.139']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4975-b58c-4722-9096-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:37.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:37.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '191.254.241.161']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4975-aaf4-4efc-8e6d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:37.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:37.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '191.34.74.54']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4976-1250-42c7-b33b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:38.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:38.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '191.97.100.118']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4976-371c-49d8-9fa2-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:38.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:38.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '193.242.195.6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4976-8e30-4b94-9663-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:38.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:38.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '194.225.33.158']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4977-0008-4514-96a6-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:39.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:39.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '195.175.90.226']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4977-3430-4a09-8450-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:39.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:39.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '195.214.168.29']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4977-34b8-46d9-92b4-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:39.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:39.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '196.1.139.59']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4978-4338-46e8-9426-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:40.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:40.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '196.201.206.208']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4978-349c-4864-8f77-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:40.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:40.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '196.201.74.100']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4978-1810-4a7b-8de2-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:40.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:40.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '196.207.92.91']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4979-8da8-4655-83be-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:41.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:41.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '197.0.116.140']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4979-d564-4f81-b63e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:41.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:41.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '197.1.238.24']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4979-e878-404a-9c3e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:41.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:41.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '197.159.189.90']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4979-d994-4b39-ba23-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:41.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:41.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '197.215.202.128']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f497a-8838-4dc9-b9fe-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:42.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:42.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '197.218.203.110']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f497a-ce88-4638-a9f9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:42.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:42.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '197.232.248.18']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f497a-cabc-46c1-86d6-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:42.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:42.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '197.232.36.254']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f497b-a558-415a-afc8-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:43.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:43.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '197.243.116.158']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f497b-cc78-4fc9-ae64-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:43.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:43.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '197.248.53.2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f497b-6448-45ae-a4c7-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:43.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:43.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '197.254.255.171']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f497c-7b08-4a4c-9f9f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:44.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:44.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '197.6.150.92']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f497c-dae8-4f82-b736-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:44.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:44.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '197.89.11.211']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f497c-76a8-459d-98e0-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:44.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:44.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '2.180.18.150']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f497d-6fe4-4417-8833-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:45.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:45.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '2.180.239.87']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f497d-21f8-492b-90ff-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:45.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:45.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '2.180.49.139']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f497d-89e0-4fba-96c5-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:45.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:45.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '2.181.64.254']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f497e-8420-4153-a1b5-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:46.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:46.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '2.185.163.61']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f497e-3e60-4ab7-a0bc-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:46.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:46.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '2.186.202.193']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f497e-be24-4786-b9ef-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:46.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:46.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '2.190.106.129']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f497f-ba0c-44f1-9e4e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:47.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:47.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '2.220.197.189']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f497f-7eec-43d6-9bac-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:47.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:47.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '2.237.133.1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f497f-f994-49ce-9da1-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:47.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:47.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '2.50.130.219']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f497f-33f4-41d5-915d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:47.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:47.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '2.50.134.42']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4980-b55c-4189-8270-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:48.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:48.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '2.50.9.221']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4980-1c48-4972-bbae-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:48.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:48.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '200.105.251.10']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4980-87e0-45d9-afbe-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:48.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:48.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '200.106.235.10']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4981-9ba4-436d-8bf0-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:49.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:49.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '200.116.38.58']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4981-5404-42d0-a655-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:49.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:49.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '200.119.211.20']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4981-9ae4-4bac-84a7-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:49.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:49.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '200.123.170.65']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4982-e160-48fe-a36b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:50.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:50.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '200.125.189.154']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4982-de30-45b8-b2dc-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:50.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:50.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '200.164.82.26']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4982-b534-41f4-b4eb-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:50.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:50.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '200.37.43.234']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4983-f290-4c8e-8260-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:51.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:51.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '200.38.66.121']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4983-9098-42bb-90fc-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:51.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:51.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '200.39.15.102']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4983-fc84-4289-864f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:51.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:51.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '200.40.5.171']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4983-b258-4946-bf81-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:51.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:51.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '200.57.100.76']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4984-5a98-432e-9890-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:52.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:52.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '200.58.171.84']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4984-4bc4-4cb6-b9c4-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:52.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:52.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '200.66.59.247']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4984-cc48-49c4-9847-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:52.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:52.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '200.68.73.61']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4985-8df4-443f-a646-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:53.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:53.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '200.78.3.69']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4985-d7b8-465f-80a5-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:53.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:53.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '200.87.107.164']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4986-1d94-4a90-9e57-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:54.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:54.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '200.87.64.82']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4986-513c-4bc5-b299-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:54.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:54.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '200.88.158.234']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4986-bd80-47b6-ab19-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:54.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:54.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.114.50.46']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4987-9a78-455b-ab5a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:55.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:55.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.132.110.50']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4987-9210-417c-bff9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:55.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:55.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.134.169.212']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4987-5b30-4b85-baad-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:55.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:55.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.138.31.124']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4988-7ef4-4150-b350-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:56.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:56.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.141.130.11']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4988-c1f4-417d-97b7-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:56.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:56.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.141.160.36']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4988-b2b0-4efb-b81a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:56.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:56.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.141.162.248']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4989-824c-492c-8679-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:57.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:57.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.141.170.203']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4989-da68-4eae-9d13-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:57.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:57.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.141.202.165']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4989-8884-442d-9601-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:57.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:57.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.141.57.110']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f498a-baf0-4659-b9e2-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:58.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:58.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.143.152.118']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f498a-b234-4200-a920-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:58.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:58.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.152.65.219']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f498a-59b4-4cfb-b033-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:58.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:58.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.157.108.109']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f498b-c558-4848-ba11-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:59.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:59.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.164.7.222']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f498b-63e4-4cd3-8109-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:59.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:59.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.167.114.30']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f498b-350c-4b6b-a68a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:40:59.000Z",
|
||
|
|
"modified": "2016-04-14T07:40:59.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.170.33.83']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:40:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f498c-ebac-4aa3-8c50-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:00.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:00.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.171.18.139']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f498c-6654-4e44-90b8-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:00.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:00.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.171.7.4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f498c-7c08-4b20-be7c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:00.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:00.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.183.173.207']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f498d-f138-4b8c-a060-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:01.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:01.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.2.90.164']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f498d-4754-4032-9c26-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:01.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:01.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.210.161.96']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f498d-c620-4fb1-9304-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:01.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:01.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.211.58.106']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f498e-6424-4ca8-8671-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:02.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:02.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.218.54.253']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f498e-efcc-41a7-b2a5-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:02.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:02.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.22.148.151']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f498e-448c-4f7e-9b04-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:02.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:02.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '201.25.111.230']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f498f-0694-4574-bd83-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:03.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:03.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '202.4.62.116']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f498f-e3ac-4c46-bbee-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:03.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:03.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '202.51.111.106']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f498f-50d4-4da6-889a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:03.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:03.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '202.71.190.35']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f498f-d644-4458-a4ea-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:03.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:03.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '203.115.104.126']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4990-88e8-4038-9c85-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:04.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:04.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '203.217.145.250']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4990-8648-4e3c-9eee-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:04.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:04.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '203.82.34.44']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4990-a158-47ca-bee5-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:04.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:04.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '209.124.114.12']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4991-3e7c-46be-8119-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:05.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:05.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '210.4.113.26']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4991-9124-43aa-b25a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:05.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:05.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '212.50.59.74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4991-793c-47f5-b7f9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:05.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:05.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '212.50.72.78']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4992-424c-4aed-93aa-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:06.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:06.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '212.98.201.2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4992-3454-44c4-b44b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:06.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:06.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '213.149.51.225']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4992-28dc-4173-be24-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:06.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:06.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '213.248.169.194']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4993-32ec-4ab4-abec-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:07.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:07.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '213.60.147.182']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4993-eb8c-4357-bccb-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:07.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:07.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '217.165.220.181']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4993-abfc-41de-8e36-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:07.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:07.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '217.165.243.219']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4994-6768-4870-a364-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:08.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:08.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '217.165.62.24']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4994-1ac4-4606-b7c5-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:08.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:08.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '217.18.250.109']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4994-b3a0-40a9-bd76-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:08.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:08.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '217.196.202.119']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4994-8a80-4ab2-ba3f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:08.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:08.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '217.196.205.185']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4995-4a20-4f3f-8a19-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:09.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:09.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '217.219.22.214']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4995-9ee4-4ed8-96b9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:09.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:09.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '217.27.120.31']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4995-49e8-4a48-ac05-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:09.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:09.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '219.92.224.85']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4996-83fc-47cd-8571-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:10.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:10.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '221.154.161.101']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4996-5f74-4921-8018-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:10.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:10.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '222.124.3.34']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4996-1704-4def-a544-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:10.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:10.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '223.176.56.246']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4997-2e4c-4b7d-8568-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:11.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:11.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '223.223.152.157']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4997-32f0-44b2-a53c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:11.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:11.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '223.236.245.197']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4997-b150-42ea-832b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:11.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:11.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '223.30.204.42']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4998-7180-4c4c-a80e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:12.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:12.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '24.122.14.49']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4998-12f8-45ae-9ddc-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:12.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:12.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '27.2.114.8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4998-b1a0-4a4c-905a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:12.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:12.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '27.2.83.65']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4999-c4c4-447a-825f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:13.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:13.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '27.7.130.144']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4999-ca04-464b-aa29-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:13.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:13.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '31.155.78.37']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f4999-b5c0-4b4e-85a2-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:13.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:13.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '31.44.70.139']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f499a-52b8-47cd-8c50-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:14.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:14.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '36.66.163.202']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f499a-ad7c-4f81-b24a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:14.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:14.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '36.69.158.13']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f499a-a1d0-4dc8-981d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:14.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:14.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '37.128.154.97']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f499b-d9e4-48c3-bb6f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:15.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:15.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '37.182.105.108']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f499b-496c-43bf-967c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:15.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:15.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '37.201.6.236']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f499b-070c-4738-b64b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:15.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:15.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '37.216.18.221']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f499c-4620-4aa2-9523-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:16.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:16.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '37.231.101.58']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f499c-6c6c-42ee-ab09-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:16.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:16.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '37.255.169.216']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f499c-6af0-4c80-ab40-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:16.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:16.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '39.32.15.82']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f499d-1ddc-4c08-af1a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:17.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:17.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '39.33.112.230']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f499d-e4e4-4aac-a2c3-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:17.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:17.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '39.36.185.157']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f499d-ff08-40db-a3b2-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:17.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:17.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '39.36.206.117']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f499e-56b4-4e77-9550-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:18.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:18.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '39.42.66.77']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f499e-ddf8-47c2-a8da-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:18.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:18.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '39.45.242.20']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f499e-e684-4172-9987-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:18.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:18.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '39.45.244.75']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f499f-d1ec-47cf-99a8-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:19.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:19.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '39.50.246.34']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f499f-1604-4dc5-a7b1-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:19.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:19.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '39.54.99.9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f499f-abfc-48c9-999d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:19.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:19.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '39.55.191.224']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f499f-8478-453c-a6c1-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:19.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:19.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '41.150.93.86']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a0-5fa4-4160-bfee-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:20.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:20.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '41.182.172.46']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a0-c3a8-4e5a-a47e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:20.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:20.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '41.189.39.156']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a1-3860-4fb5-aae8-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:21.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:21.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '41.191.246.34']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a1-c648-4478-a38c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:21.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:21.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '41.209.255.110']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a1-e108-4d63-a507-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:21.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:21.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '41.218.252.165']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a2-c274-4b86-a0ff-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:22.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:22.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '41.225.79.112']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a2-7264-4fbe-9dc4-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:22.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:22.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '41.227.184.131']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a2-55d8-4d78-8a98-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:22.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:22.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '41.228.211.237']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a2-1a68-41a3-8eda-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:22.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:22.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '41.252.101.167']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a3-4b3c-409f-9eda-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:23.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:23.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '41.66.38.208']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a3-8258-497e-a9cd-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:23.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:23.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '41.66.52.97']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a4-2660-4139-af4b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:24.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:24.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '41.83.15.246']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a4-df38-4a0c-82d4-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:24.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:24.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '42.114.42.26']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a4-9fa8-4086-87f5-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:24.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:24.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '42.115.190.6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a5-5534-45bc-ab19-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:25.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:25.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '42.115.234.222']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a5-1308-451d-82cc-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:25.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:25.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '42.117.148.194']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a5-44b4-48da-8a92-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:25.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:25.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '42.118.21.7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a6-a658-43fe-9dc9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:26.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:26.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '42.119.140.167']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a6-5084-4a43-a057-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:26.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:26.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '42.119.243.157']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a6-6888-4fae-b549-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:26.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:26.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '43.247.41.48']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a7-ba6c-4331-9a1d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:27.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:27.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '45.127.65.190']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a7-6f8c-4d8d-8644-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:27.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:27.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '46.161.81.160']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a7-7638-4b36-98fc-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:27.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:27.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '46.176.103.58']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a7-e39c-4093-a8de-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:27.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:27.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '46.2.182.239']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a8-9224-49af-9c72-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:28.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:28.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '46.2.237.57']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a8-afb8-463e-b9ae-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:28.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:28.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '46.2.34.52']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a8-7ce4-4948-95fe-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:28.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:28.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '46.2.74.83']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a9-8e14-46bb-b81d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:29.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:29.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '46.2.76.51']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a9-57bc-4581-89db-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:29.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:29.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '46.224.116.125']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49a9-4f74-4177-bafe-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:29.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:29.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '46.224.162.102']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49aa-68d0-4ec9-ab05-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:30.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:30.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '46.224.53.13']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49aa-6558-4a55-9cc4-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:30.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:30.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '46.238.29.205']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49aa-8964-4c94-828e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:30.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:30.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '46.252.33.164']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49ab-0fd0-48b1-8b7b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:31.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:31.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '46.30.179.208']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49ab-5c30-4ba4-ad92-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:31.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:31.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '46.40.199.94']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49ab-bb38-4800-869b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:31.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:31.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '46.41.221.71']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49ac-6cc8-4e6c-9ff3-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:32.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:32.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '46.41.247.205']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49ac-7470-440e-9692-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:32.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:32.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '49.204.139.170']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49ac-5c1c-448a-adf3-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:32.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:32.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '49.207.187.11']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49ad-0b94-46e0-a817-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:33.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:33.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '49.207.187.196']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49ad-23b0-4254-b50d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:33.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:33.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '49.229.41.42']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49ad-0f7c-443f-a8c6-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:33.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:33.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '49.32.36.161']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49ae-05c0-4be3-a388-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:34.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:34.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '49.38.2.156']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49ae-7318-4e93-ac76-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:34.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:34.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '49.48.175.52']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49ae-18e0-475b-b774-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:34.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:34.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '5.206.237.179']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49af-1264-4044-92a2-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:35.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:35.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '5.223.57.43']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49af-f314-4184-92aa-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:35.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:35.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '5.232.175.53']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49af-51c0-405e-9510-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:35.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:35.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '5.234.245.3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b0-ce58-4c99-8c2e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:36.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:36.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '5.47.145.38']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b0-4594-4ec1-85a1-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:36.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:36.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '50.192.71.89']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b0-6530-4b09-a7a7-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:36.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:36.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '50.233.34.30']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b1-15e4-4217-aea2-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:37.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:37.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '51.36.116.13']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b1-0f0c-41b0-bf24-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:37.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:37.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '51.39.144.128']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b1-fed8-4b93-af70-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:37.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:37.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '51.39.244.95']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b2-8490-44f0-b0ce-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:38.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:38.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '58.187.125.136']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b2-3b18-466e-a322-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:38.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:38.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '58.187.5.158']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b2-c37c-48c0-ae9e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:38.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:38.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '58.65.218.234']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b3-6020-45c1-87c9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:39.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:39.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '59.185.102.42']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b3-52dc-49cf-a4f0-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:39.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:39.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '61.3.157.4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b3-c004-4070-9abd-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:39.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:39.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '61.3.161.21']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b4-9014-4eb6-9978-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:40.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:40.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '62.121.111.143']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b4-1144-471d-8194-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:40.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:40.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '62.24.114.29']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b4-d028-4251-a436-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:40.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:40.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '62.24.125.125']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b5-8f64-435e-a090-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:41.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:41.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '72.190.60.252']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b5-af24-434c-ac79-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:41.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:41.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '73.178.68.169']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b5-5fe8-4ca9-b2d1-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:41.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:41.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '74.84.168.181']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b6-ddb0-450c-83e5-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:42.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:42.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '75.69.120.39']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b6-2054-4126-9697-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:42.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:42.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '77.13.100.33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b6-448c-4e49-aac4-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:42.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:42.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '77.230.27.21']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b7-8de0-4b46-8872-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:43.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:43.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '77.235.137.194']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b7-6218-4725-929e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:43.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:43.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '77.28.211.239']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b7-fff4-4a3d-b92c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:43.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:43.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '77.30.216.198']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b8-92d0-42d4-8ba3-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:44.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:44.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '77.65.89.61']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b8-ee9c-4219-93eb-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:44.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:44.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '77.71.108.98']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b8-bab4-466f-8ae9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:44.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:44.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '77.89.74.70']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b9-b620-4bb0-85b2-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:45.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:45.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '78.130.172.74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b9-c158-41a2-b39f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:45.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:45.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '78.166.12.128']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49b9-9360-4469-b345-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:45.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:45.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '78.187.231.209']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49ba-df30-4441-b754-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:46.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:46.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '78.90.64.223']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49ba-0f8c-4745-ac3f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:46.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:46.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '79.108.194.242']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49ba-62c0-471d-b5e9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:46.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:46.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '79.115.245.196']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49bb-cfd0-46c3-92bb-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:47.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:47.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '79.13.138.1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49bb-49c4-46b1-92c7-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:47.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:47.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '79.134.135.38']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49bb-6644-4bf6-a3bf-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:47.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:47.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '79.134.146.50']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49bc-e960-4760-a5fa-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:48.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:48.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '79.177.238.66']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49bc-0304-4abc-bc54-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:48.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:48.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '79.182.147.187']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49bc-5d20-4fda-abce-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:48.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:48.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '79.187.78.161']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49bd-745c-4a60-8fdd-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:49.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:49.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '79.3.84.251']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49bd-1de4-495c-b60d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:49.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:49.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '80.30.255.164']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49bd-5134-405a-80e3-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:49.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:49.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '81.202.134.97']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49be-9568-422a-ac62-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:50.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:50.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '81.203.225.167']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49be-00c4-45fa-ba73-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:50.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:50.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '82.114.81.18']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49be-3d90-4023-8a55-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:50.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:50.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '83.110.240.111']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49bf-a09c-4cb9-9f9b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:51.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:51.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '83.43.250.121']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49bf-80dc-40bb-ac1e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:51.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:51.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '83.57.235.246']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c0-a234-406c-b9cd-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:52.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:52.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '84.112.131.205']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c0-ce74-4b40-a8dc-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:52.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:52.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '84.120.174.2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c0-e700-43c4-87b0-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:52.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:52.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '84.123.92.63']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c1-7ec4-4c4d-8f5c-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:53.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:53.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '84.78.151.18']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c1-76f4-4d84-9b67-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:53.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:53.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '85.130.102.216']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c1-b01c-41d6-bfad-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:53.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:53.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '85.136.221.218']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c1-08d4-430f-9a09-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:53.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:53.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '85.186.135.126']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c2-f8ac-4cc4-9ad8-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:54.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:54.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '85.202.105.127']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c2-94bc-4085-ab7b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:54.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:54.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '85.242.133.151']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c3-fecc-4e29-b579-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:55.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:55.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '85.245.143.51']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c3-608c-4c88-b777-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:55.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:55.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '85.67.136.58']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c3-e260-4649-beef-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:55.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:55.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '86.104.102.58']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c4-6ce8-4bdc-afdb-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:56.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:56.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '86.122.26.35']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c4-92a0-4845-9f5a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:56.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:56.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '86.98.150.148']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c4-61f0-42f2-a520-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:56.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:56.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '86.98.83.109']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c5-19a4-4308-9ff9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:57.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:57.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '86.99.36.109']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c5-c714-4c8d-b507-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:57.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:57.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '86.99.46.8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c5-9fa0-445a-942d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:57.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:57.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '86.99.8.2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c6-3740-4ca6-86e0-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:58.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:58.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '87.126.212.199']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c6-8f80-47dd-8357-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:58.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:58.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '88.156.137.172']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c6-3de4-4527-ab31-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:58.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:58.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '89.136.146.93']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c7-af78-4a1c-adcd-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:59.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:59.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '89.136.193.85']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c7-12a4-403e-a2cb-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:59.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:59.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '89.137.157.77']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c7-4e64-451c-b3c4-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:41:59.000Z",
|
||
|
|
"modified": "2016-04-14T07:41:59.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '89.137.245.200']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:41:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c8-1c5c-43c1-bd79-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:00.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:00.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '89.191.138.109']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c8-ad0c-49d4-a0a2-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:00.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:00.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '89.205.22.170']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c8-061c-479e-9c74-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:00.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:00.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '89.25.24.132']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c9-8cc4-4a11-9105-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:01.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:01.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '89.253.151.56']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c9-884c-49c7-acde-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:01.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:01.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '89.44.244.34']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49c9-3518-4535-bce7-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:01.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:01.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '90.154.241.199']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49ca-8ef0-4ddd-b432-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:02.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:02.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '90.170.161.178']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49ca-e908-41f9-939a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:02.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:02.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '91.104.126.103']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49ca-86f4-4dfd-804b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:02.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:02.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '91.140.21.112']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49cb-f34c-4615-809b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:03.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:03.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '91.99.229.210']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49cb-17e4-4a4c-b5b7-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:03.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:03.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '92.55.108.180']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49cb-0340-4739-8400-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:03.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:03.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '92.84.80.116']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49cc-35c4-4467-9a4a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:04.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:04.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '93.102.163.20']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49cc-e5b0-43e6-a07b-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:04.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:04.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '93.122.136.9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49cc-0d54-4923-9e72-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:04.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:04.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '93.211.138.110']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49cd-4c5c-4f83-9e11-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:05.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:05.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '93.43.96.171']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49cd-3cbc-4815-bab8-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:05.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:05.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '93.47.220.97']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49cd-2ae0-431d-ac02-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:05.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:05.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '94.79.121.180']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49ce-d7c4-4c6a-811a-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:06.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:06.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '94.98.195.250']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49ce-5348-4ffe-95f9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:06.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:06.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '94.98.220.250']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49ce-48c4-40e9-a73f-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:06.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:06.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '94.99.67.244']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49cf-6624-470e-b0ba-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:07.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:07.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '95.159.72.199']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49cf-82e8-4715-8612-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:07.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:07.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '95.159.83.108']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49cf-d3cc-499f-bd12-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:07.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:07.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '95.17.33.7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49d0-34d0-4fc1-891d-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:08.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:08.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '95.180.166.84']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49d0-fcf4-4f43-bd56-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:08.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:08.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '95.180.214.157']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49d0-ca9c-48ee-b7b3-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:08.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:08.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '95.42.237.208']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49d1-763c-42c1-96b9-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:09.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:09.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '95.70.194.144']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49d1-d250-426b-9b1e-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:09.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:09.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '95.77.239.71']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f49d1-4b74-4bbe-9da4-96e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T07:42:09.000Z",
|
||
|
|
"modified": "2016-04-14T07:42:09.000Z",
|
||
|
|
"description": "spambot (originating SMTP connection)",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '95.91.212.127']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T07:42:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f518b-1c54-45ef-8423-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:07.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:07.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAORBjkiU+YGABkcAAADkAAAgABwAZGVlZTUzM2M4YzJhYzNmNTVjYTYzMWZmMDA4NTk4OTVVVAkAA4tRD1eLUQ9XdXgLAAEEIQAAAAQhAAAAAEd7fap19BLArLwLaejm9DLBkzGLh1RSGD8eS7Xee09/gPvo7oUYSb8CCDmnnOPfoKfq3w2BRjoeBbotthND9S16eYFUb+Ulwus1eHrTE2fP6v0oC0cwQ5QhLO8fMADghkC8Ac+WsHC2tFCMWLoBsaEKB26tpoXstFYaoc8630MwM6jFC72yjC41rP670DDqBiVm1oETqF0VpLgsYBEUfGhCroiA7cy0+wlM/5DKdaIqBkxcGDNhcCpKbah2Mw5uitPtVt3+lifWSp64gcCO3USqXv6nXN4NaN2V7kdemqS+64XHWmQsGLGZKFs3tPaZesPyPeSaE0JycSLkinhq6nCg1Cm+7m/N4RHGZFUwt7SiVB0vZc77Ud/bkLgeShpLSmARRG7a0aqYNVVq6C2DEwwVAGsCWNJ/l/EMgS2/y1duJga7VyM8dZrcC6f8bmMYyAesgsozECyBRmSfGlYBYH4QcKcSVY52zyifZbMFvxebN+Ysx/Zw9DVVkckZ6ZXum1XEHX5bXRwkii3k98TlqA8VVB8D0sqkJ+76I97BzNisnV4P/mIGYuhKs+JtVaOkQLrOPY+2MQk2xujP+7WClH/07v2KZx8z29eQok4Owft9Ixrwssqe0ITrkwP6bN2cnRcA3Kanv1JloqULNSPGbwrdKIZQtQy39HYnr5FTnUPfoprSQiSjz+Enkuk/GZscWGxccUMJxhWA2jAS35DML68ygba6ywhKCYw7uMtiATXIC5lo8XS9aDeM2aqfitJtrCA6/tHeh4p0YiRNmCmX/ElNTVfj31sbAIWl3weiXO7qgQdqwEXMf5oG1Assia5wPvH++pnRiI5fzf/sd25sZLIRvH2ihDjN/h5XBBHEVznxZ9Kyv6xI/jhaFaEwR5zh/g61fAtIXC7ZGdRsL72/1ZgUyWhtD3yjeDJocBhmcqmInpc3M1yUJuJnwx+6GIyndJtscJk5l9W9BR84RlE8Sin7cI9touBhgaiMTFdRmB2iiySHjqqF2cJCga1N2uMumXlGfS6dtTeOEKjggsN3Qj4w+Vn2as4AnmvQUimhYl6fQlQXISTcUoyzLmsQ5pxgeq3UZvDtWUIzMLASj6+stHkFfV3agIq8zar6F0Zqcrc9khWFsfnfOHnGlo94tUlvOl+bmzNwluPrtIqHDKbKBoQUgfD+W3ReMYXetH6UEQyOrKi6TQRBokWZSx2DzcJ7eMEaoou8nw7Nz2lrQ68N3J09RREMUkEVG0tWa0R/NfGDiIfK5bckLohPIzJGhlw59zlR7ow9Kzxj59CF9ys91FQAUNb/jAIe5bm0dEMAHQzgxtug8hYFBSEKSoMtEob61Tmq0YohXdtDBSpV9PFQYhPogyxv+ITlbIM1W9BKGXJoTFf80wAdLheLVaxotnKK75FszYD/k+IQJs4uoPDbbrDK/8epZkEUKxTtRPeT00DUxRDnXPQXYYJQauGQaq854gmMzECvh7Ld814/hcKfEpAFUYLgbVWAmOCf/ZwYmpUUnidtjVk2sGqewS6H51PIF1+4OcJaDMZoU+MsWMpafRGX38+8RX3ajpZg8uDBH3ZbYU8F8ZJl8I8hS7+9Z+WfpyMzAdvr0JGY8ArWbB7NqQ2bQsJIOenRPIqkUA0Eo20iPrtUdU0YHPesbnTwJu0YUGpfH6KpJ+fjvxyAa9OaMGGq9G+PI4Y/nE9vZRqGeUYNTplcB2RKCsPbWHIRMyIDNICxR2IdNY7q1n/mrfYHiEwt89umoFPn42KHWwqRYNmPbjbL4F0HibllgPyyDRbRZ3dfO/Ecnz0B/OrvFYRPRX2cqYIIwIPKHifip8hdZkMwvleV5j4INEk//l6g+wIwbiAYf6tY92C3r1yU9Ph48pTXFa2UxNYUO8d9dAbrggUIMh/ojnGk/j0ob0XTyewIpC+CjHF/WCMu0RRXX2PmxrDzDyoT+ZdFQBp+jD4YWzBVC5e/ReiistHRlyQEwD5g9ZIYlIwjjHVmuHyZpAJjE4cFKULz/aspqoxgK+bmj1B1e+wVLVmajYY/a9XdXmWxJRKZ6pqg2x1gRGrz+H6D7H2SMQhuLuoSG0QwJRCPQLWYXPIedEyyCHB2QY7WU5Yq5MSRco6dKNMZTUVcvsTDWaqSUariLzsrj+6n4kYNAYUCnz6hiSEPx91LnxCeI0n+gwPCcG68ndZEdhrIBHaaquCDHTwqlsUc7595MyiBsrgsDqSTw/1k/OfaAJR8U4jUT9I3G3TRmWwA9IvLiquDjwnvfiR5PWIuWolUTfEp9X1tV/YjAYxvE4gD/QhpnuZFBqXc3VyNlVo/CjWCCM9iOJThsDJJhNvTyVbS80ONmTaqVbeGplgFyQOExfp2DQP3DS68pkiCEDXZ4XYotEWa22Eg8qhAhR8t/9OmQVigzmwo4dqSrMQVPCg5lwGCUyAnUXn/2eMI7L0z0h8z4rv6WDuPUc7v0dKi23661lFtjMeUia7KDTpR/HIfXbHlhjYEYVmJVaGa9DmxRs5GO7gBT2P3+H5yv0HRqPgxl21NN4uxeTHgRjqLZixMv0kxHHRHCA0tNiKsMRBh+rfYTQViVP0zdjzBw3Ot6mzsZf0YmpNwG7GXCv6KUqL95HvvrzFj0sH+P/uEiAzvrE6qtsHQTMA68CioqFN9/GbY8BlzlFzlCyWPjhqyFSqLOe5bqdc3nszfiWL5YFXLExntWlmbap6jbQw6dhUf115+ju/yLT1dtDiU1KMkYkdvKk5zeEgu+w8EFXvGTHh9r00l0otnjiPOvEwU74u2R5wveeoUGkGQW92qcoxH4G2jmBA7qWtLoPbhq4l+cxn/QIZcIgqEIFqvSrcbelPnvFaV/a1DuMR8TrDJoo5qP5JV7D4w+2CtOAYS4nMypHd00Ca52HqSzI3K4MlnUZ7blTo6Bn3mbHh78lvt+l8Usfzdccd8yKVASRdpHpZV/wf1EW03BaP/wRVkwFoBUDQtfHGn08Hz2HH1GjAv1/NRxBMGR9vYnE557XYbSLjGU6hWLXV2izVSsCVMUjBXVipgxwsq+8LLvOhTRAjqOoQMcTDT0hEZsaGFWs7kFqhPLvSH6QUGua1jReX64tUNdtKiT5Xu4UzAOf8PTENKGW7hvzAh1GP69Oc845ONE1gXdBy/Znw8P2LdYvHL9CWMp+ylgiUE5JvtOrjqvH/XJ1e1f/1oAqXEamqRpJ4TEDianeHveo0hV44ELWe6Y8IOqluZd93YynCAuPcvEb+bywSC0ZixEsrz9YcJFG6yhuW0ISfFwgmFcLClirmAOwf1pJjrT2U2op+m0bOde8+HKrKwaO8EW1VpZV34WUm9ZsSggW4MECubzivWeQQGYEW6uy365k4Uiqbe0DcPg+inz9MjG4csZrEMeFWHqw6vGvTSxF21SSU8CchPNnWC4r3qk9XjuQNv2gC/gx+JdkVR8/QCilQ9nk8kb7IEU/d8CFNgc3DvKnlAMg9u5lF9jQMt5TsMYMAL10rW8j5oqwetgdCvkoFe1nqDALmL1Dp2i5AKB9YqECaEVrM6O4XuQB3jYzTEZHWe/2owXFeG4UhKz7e0gPCMAyt1n/FWjkFye/4jRB9TMCf78YwT7hP39kpZAZx3PwIpcMxXiX4/M3vwStQ6NY8VnFYRTg/fxlsDUBPxEL+skPUFdj5WIq8drCWsEMbP1YmAmig2IR4ufeLrC1CTi3phY+HYZalOoYnUCyPciGq4a1Mrs4SqfDwfIy8OPOfKbRSYIACtQk7ec+vaX0HTByFy1KkseKj/8lNxfqcPH+XqmvHsePsM/kc35Dru4sStddVJSB5W59kQSZV3bWJTci9VQTRCmuGiLx6H77rI57KzUGMFtZpPZKiTFbfsKRIerCbnHYwQ8QzuAXeFflY39iMKY378kEVAv9SBO4ro0aSnzB
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"malware-sample\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f518c-d700-4365-ac93-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:08.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:08.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC0548616357481523620009.rtf' AND file:hashes.SHA1 = 'f4b0035bcb74d05bd5be09013e6a06c3d25a7582']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f518c-b5cc-4472-b6e1-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:08.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:08.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC0548616357481523620009.rtf' AND file:hashes.SHA256 = '2d69af5207965591dde4116a886388af791f5992e242348d10b001e7409a13d3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f518d-f9fc-45e6-ad15-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:09.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:09.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAOVBjkhfHyliBkcAAADkAAAgABwAMTljNDk4YTBmODQ2OWI2ZDIyNDYwODM0ODZhM2Q2ZjJVVAkAA41RD1eNUQ9XdXgLAAEEIQAAAAQhAAAAA7XNV5O2Jpz0NdtCKgPT6iIvKv9JckcmRupb10jDMw5FT2CFDCSq497+C6aYUZd+WEVUIY+YKtfOGx/AZGgxVy3MpoEAflk6fB3Fb1hR+y0cPxrWuhXbeZhj+L9jVHq+xbun8qwCx7DnhUOOFnUdPdpKuWzkIFxYRxM5qBKWmvV41TN8nFl73Bzh8x2jsoJqH7D2AhLhdm1+qe7Z3wjSNezp02z5yBT8FdqB8r0JYHkkyc/3XhATVX249tInyddci2w6C7MAD3kf+WH5bHVx3PhthdYtNiO5+vljprxHLDR26lN+Tla79+lAGO4oO4KQFA9EDgxPAjgCguSfxm5UcGO3qqr6TdYjnD/uQrnzgbiKBGiNn8/Gznr0Rzatkdj7GSjl89xKgwfJOXrL+/3bXLUE0zRIsz/3rAv1QCFkMQfZM7SrL2b9xgxLDjlgBFFzIWcqb0JBvw2DAL3Je6tPmCbsOE0/9MombpRFsJCzA7Ryt0m/sScw8sMEF6nnNgvEINRE0pJWyaUps/60S20KioY30tGF+Dh8IRq5tWBuQaIKdF5OctiFvyuZt4bfZcP1zgDZBWQG6pqjEURCZxhXwl3HKgtJvRH35JuejyTpPbrQHE9RMHBbdAaDXFgW17tcIQurx9EYgdKTB6jLvm4GqmZjut3AAT02mVAzwq2BiTrwQNnQRhYzd49KfWw1I6u+rW++XfppIrzXHRkBkhWnUJBX3vxpb0ozZVvbL0v7kczyIEs8e2HtFgHCKmQ0/vqJ5gD7M+KxQ1C7ZU7yLkfXncbMbOHTBmuTT+RyYIKw/516LmcR8RO18rpd216MCP6VkVBpYHu/+i5g5Eq4LI52Uij3UVn7+w1kkUqlRHy37CuppPKpeToc/LPSTaeC/dGRXzF57t4p5/z/XDq7UiLn1c4KpGheLXCyrZRwNpsi6cXiKp0gjmK74eQ3BL7BVI2N5+xllCe1rnOhPzPbK/OJq4oJZCWAwBnRVJG9FBGHLd0OWM57IjnOVTj8yGcH0dSvIwbbzqfShUfs5LOWxii/3iYbXjR1qfOeB4Izkb/M4ozF6tRYU46NsJIyEIY1W6F/P3toVFmKy8URa69R2ZMOubG4YS4nogxIw5Xs/cFPmCefvvHyKqhCtA6Ib0F0QZNJs41J2GK1CAfgLt2rrjMMOIyh3wzyq9jxst3yaRZwk6WpR+Pq789gM5/MkwIkTe+rZm6GDUXg2Q0SJQKjsuyC3BI8869wLfzL9peOBhot/U+MLvtU9UCf66QNdl7ijyhDmoQICr8MAG2n00AtuN2sUbwY5KkvQvO1RjLukm4j7vTAjgw63d/9Pk+mXvFijXvTC+86fHqJODjmUjAbzzy7Zi033A6NEWD5C3+EzfnbYbyqAemEtEHgj/bCfWCgJUkEu7VTA1kpmt52H1A1qrLkiYemRtHrnifmpmMfiAij7MgXuzm120XfhfmhR0fgxfCeF9is9rEd/dB+hTNSQQZtuh09uqy9KGO/MaOlMNlDwkPkvSlFmQQ72RmRQsyUXLsQjEPYhMMr5CA5L8CwKVuMF7kto+1Eu2bcXJNDapo2nfpyQgiKynfkvGggz6/eyMrs9sP2EPR2KHXkOWJxR9QAYm6hzCo10TRff+/uCA2txDhVmX9Yg9pFq/k1RqWocso83+LKgZOkqxrz74892Sm86ZmivW51ck/DpLGrnzeenAAYBQBH4GREIPd8o1ZBs4TXBwO/LKsB8BbOZxWRngLFaPpghRWkZn3/X+d78f77V1NH0sU1BWVf2G9X7nba6n9ggNb39sBMHFKzQhKRFFryF7SZEXAU37RoyW0NIprl51vZSHlOFd0YB44bJL9KXMxwOJ2/Rmp+QA27tFcNDlTI2pmCuEe0kqiw1R/OZxEHHkAy4seMi8ITFw3pCi1rZtij9eC00KZgrhxG0cby4rGqKzds5MosqRJI+ejXcjK1bqhmDoErsqgNP8aFpDliBWc0M4wtD9nt3hVg2KvFSEM6B46V20Rh8c36ATB18PE2u6nDxyiJiEs17WGpAgS5S9KhiBhmWbsMwwmg4gOlVDbVI+eiuSTXdlXeZf5M6N4jr1N6v6ep1sLTFxXHhd15yXRcmYb6mbfDZP23XfBPDDcAo0tk3eR5RgnooZHaaeNwl8Nb5JicZo7QC+j96Q1UBv++62OkqH4BukdFlUXqRDIiXvyPu96S8nw4iphFOVPYyDCEdX/8gAAS3KoM0Dj9OjXQsg/mZOK8OoLMrhpyBblQF/j2YOGNUFLRvVr7vZ+O7PqRVwn1AbIdKR8D+RsMvzKweO/l033zWRm5A095u+EOskdMmtmCq1ugttxu2W1NkkSXFt0loQkbfQYT3pwgIDBDrmWuP2BWkqyo5NMaqQKJOWDW4ofjmyYehZ/eLYAYaGvmuoQFEzFvLPTqTmjbhDFj0jyzrB8ufKNDWqlbijPonWRzqV6yixzFl44twWEHLY5GjCpL7Zy+W71uE1vEHh5AhFjkhjBWvFZxgLkv79UvGPu8cslA69mULi57dQm2ZGuZ0sOmrHpQj1dwbrcN+cMHWMk7fQuljz/x1o40tpYxFFGntFIOY8r1qA++VUD5BmYcOlpPD3H3Cy8f4TSwuruaUkgxffvmwnNgY3rVRPzHkIYyM6xApCViUok8SkaAIDFPZNcTae6uGeJqutbxQN8froImxGI59HUh620BdC2YhR5RWAvaDyjKbQQklZw9WTcWNZSX/oKg/4spxw6I4tWr5dmafzzKu78h+7YoiennnGjpk/l3QpBdgHCEvZ6gzmzC+4CGbb5tVRpGmlVoMOE/2lc2Golj/KuFWrySqnT+BeJFjIvLXMMemiiB3JXWVUis04psupILlEtcApuU7UuBv1edg7x7liLYEfmY9iFVCJ7dKDiSsSb0BGTbhdJavkewroCz/NZ5NWE9MUK6C8q0qn72d8a9Ip8NWzXbpw+OjyAayRf1Xkc6bEpoSjY44e+Ibc686drwf77F6XlbcPeOElIXBPYHHI7fCZHg7Av/xWqzdLG/sttQ98D0ekn1xvelZ1Hg7aTrHczYvGssVvAwdqIdvXA79FEeyR/lJlRFKs/74+fcajVxWzSQGAQm8GAUOnIfAXzSfH7P1YAzhFpzI6jB9+G/a4C/+NRVUysOgD6Zoak8I3qZLMxuFIa1DKa81WBVJsONOS1jbDmNG3zK0DrhAGzHEMkptkuEzqTbhjfv2IRta1vRFD3gzVAghCZtpHwqHZV6iIE9K10lhFIi1KHIao43U8HuNFLg8Ewq8ekMN+CVt/2OQ4LIyDvRYkxgN6SI6Pdo9uxAQ0nInk+4AV2DEKDBbmf2wzXdrqoBmq+gmSYM+AujPLb6de43k5FraEB37mCc6v/9FC1GStsGgVjdSmSuvLvZyvcu//KpZ+fwv+36cN53mkM3yU40qfBdWg/898UzQsZ/rwJmtjFpN4pIHYsOehw4jZ740fmzevF031GRJzfr49l/xDjmlcL+3wXzd+MyJIPkKmDyrAlXVzpD578WcG7cCLlTFaPRXY583EaDH7Di2vNL4Yzw+eszQqla7uN+xqELZ1SrfuKDg+NNTnFy5H+5WjA6J5AJ/P/R0I9qQsn9R3eX+LwtVSsCLcgV+tLEQv4UNiUUVw8+2y2xzY3/dcYUCICQV7HF0WdwqYIms8JV8V5X4TrqcF9IVSL12WBJmWwtfCmKrXrbhZttYBBjB5R/pR+cb6XnBmY5tazUYgj36YTMZbMDKePNh90fDVDQz25mwqI/g85vAZWEqjaER5qygeuY2uwKXJ8iz3mreGTevvIgEZQ77+Y9OOKgBjkDyusdkGsT1F727boJjxuIBkzVzS3X8DW7JVtA73TVpS6zOlDR3l2WekdEy7su/0lYf4jSGDhJ9CUyK8odU1qUdM/uh8
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"malware-sample\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f518e-24f0-48f6-acbb-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:10.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:10.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC000917028231182.rtf' AND file:hashes.SHA1 = 'c36882538a03f7f126f8cda22762bdcad7bc0580']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f518f-cfa8-41a1-aa00-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:11.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:11.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC000917028231182.rtf' AND file:hashes.SHA256 = '4a29a1839f07f42052d737c4498fd08559f755400aebc4b33f9b7d043e747bd4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f518f-6b78-4697-9e9e-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:11.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:11.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAOZBjkiGOElsB0cAAADkAAAgABwAMTM3ZDg1MzYyZDQ2YmEzN2RjNDE4NWZhZTdjZmZhNDVVVAkAA49RD1ePUQ9XdXgLAAEEIQAAAAQhAAAAYMnUgHLpGFHyT+jWh1BAqPQ9jGiw85hi5pgNPivDETJjI5FRwZJHwy3VcsVZCy63X+kL2COzrpcPfrAaXjWvF5Y2INguXbT6ypJeFzz8Ona7DNlIU0OzT1n/i2A7ZHPfaWsKSZ6Xc019KHQg4IBHIAm7RhTTRkDKZbcABjd+jNhOxZU7QV9nKpfpe4yDFK8ESEVfq3dMreGNTvGjQxCB1okq6qvP+oX4MnXYxYjZEl6fdgbK1xzvn14NpC6SeHlSU1kgVb0YVuCnyEE2lwXw2VtvJtb9EGxuysljFBeISOI7oOPqJPATxxhbh106f9jr/x0N9Ejdbp/S7kTtxGYveDe/JcMoubd7hKD/685jbq5Us+vQjOZsmZ4OUvcLkvOw1w5BXC+CO7T1Kq5hECaCIYL9/r1A5lVdg9K16GLOqFhmvNxhibWyu817u6JUZVCkIsnYG/jOtBoRHTZ5OQZoX/ROHVE4sxjiGO3oYloNX3mb8dnGes50HtxY1FGERF093FCsqWwqKt4aQz/PEKhrZfwT4dluYptDBaREU0Dastifg6ONv/HSwOadBPhW0k83NzjPshFcRcj7ZZrby0JxB+Dds4RUslrpYAEfBM9u0kDT9c/F7oy/KvbVkuOzLcB7FifXraveCb6hDn2M8q8DUCKs0y9FKNpC67cPm8/OYph8vlZLKDl6AgTYTz4JC8qetjTL1SiqHUIEfm5+32uXMqGBX+3sa8vVuAmtAwSco0WwENm9kYMtAMRoolSVJtcomzqTuZ2qrNe4a+vijK6F/6bD7HMM27okHdkfvXnBdxcR+Vj9HJtrCvdmcJRvUC1jNMkG57iy0NBvILreoLh+LOyr3H06Zx7CxTI2XxCCowiHMwF8ozFZUgklsqBBFOd0yM40C8ZvMWxwLKt4+76e/i6gkcayWaiqlc3Lnp84sJWkC1iJgYGTW9ZsuwqHv+941P3Fj3otAidlPtzScWJjZpLFBv6/x0tAxCcT0xEcMiZ1Na49/wNur4H3gZsP/WISquQmHmXxzXJRYNlAGp/QIasANNyWtLxQhMYU6TWustRCcUnbtLRDSc4AP9GC8ySegg+OA8oNv8WMczNRa/88mw9dUtBshYlrA6KJoh28uc1VXQ6vao3apLK2BDYFhtZzH8OdUohoBR18bTzrAY+YthWZKYtjQK5YfDuHyZW/ohtmjLyyzQyXcjts4Yhd8lEVLU43ZsIJXn2u0of5i4WPeFEYjkvadRRCa8692OkhapGbIQlSAUOJT2AwW35/P3sdbBWOY3J1PB410AFxsbFA8GAxtNmTreX8RUzY/J/Bq8mDXsgunOcUNvpjc7rHxOFso7Uh+qA0GsJWRFDsVVbH4zAgP/mSLBdP3pGJxyQJpdPOlRjoo6BmC6E2IQO5ro4OnZxKrW226/yLEdQTCwKI7D4SaM2ZZgXWzNN2n1dLvwSTbQ9XwrasUFRslfMKMy5pbjA6+UAyT5g/97DRPRDq+XyVzC7fFIwXJoC61Zn2WFbLdfB9whGTFcHEl1jgD77tCS4Rn10RO0NKqwb54+B5ZlrRpEx0BIA+hHykZQpVrQvwSLRGXJwsvgF4RQE3q9YQT9PE+Yhx8/h/aFeahs+8OyukrU6TBqdh9HRmo3lekSlvhSTZrUT5H3fmDJU7W3HkstEMkgIO/Ln2qsfjaDOgGKY1iPiKlazg+H+s/WMwbqUNgh+IFYSt7fqyTGrSpljLSDo2/2ubNN6mhdL35zHd4YQonBflMZikl4BF9afQNKhsMWiRn3nCI9cYvfkPeGIElqCHtuxIPWDxIVUT2LkjRe3m/aRuHvWkuyCy4WtZczFuwyNBWKAn0fFWml1/Lmq4zE31gvF9hCOUytfBc8cDVpl/umf6Y1ksqPxhX0dDNTs1CuyDohTTgrpUw7SNty0WnPJCTIdltdcWi4JFsgjsdP4IHfIsLuGPIqMLRVCzIYcb5scB/JKKejLKET91np9dGm9j8fLtfrPnYfpVte1O/zuHSYHJLaJRJh5Am/EqMJpyBrHrQJAaaVtQhHvHosH3fQT+U4liC2fdHkMHuyVPZIJt59mRaqAV8jSdR48tBrdA7VyhvkDzPkgY29QIhBTGquOqazD/jeV1ZjNon0nhy/wve5oY/HxnAOiU+5QhwI+/qtk2vtNtozN3r0L6Yr7xP+vAMeVPCHe41J91sEPpeMFivwtfGEjb6JKTL+lW8I2cTRxWX+6wo0hrsTC2xow8ezZNzvNwscRpYJPmSDbkSooS46aB2D6Y2DtaNDklHWiMzMbCWIgva1jiZfuKrYLVACw1+sH3L6IkuJ4r32veBGDB7kp4PK/fwQ1YnBbXytvsQKcBz+TxL2/kbu9mLlFzBYe0vndMBtVLSQlby+AxNN2jTOVj7ThCd3bLvynaQ1mMQfPNuP4vFUEbTCRc7UCeQFfev9uZeDgKi5ovuT7WU+r5iU1I8vyPoTHvI33mLNi9h/09b/yAFyIqpt2XXYQyIr5w1n9CIKLVyTbJPEMh7PDTuHkiw3sL/XY1dUFnHbycVYfhdTBK9sVlN3vTXXBZqHi7iM70XRn9hY5Ot0arxflJBzKfMCwhjo1IZrIq5WR7B2QXOP9DeM3VvR2cC6IX1FEGaInG+H2Gh3FumsP1kfKGDKnymQFYKdxzpTbRQvLbfBgWTcLYEBLVAU6PdDeScDeSVlrepzhf10ENuvgDniskzK9lfwz6s6XOur0nyEGcWKSb+cGYz+63cMYp9YRrjfGIL/wsDe0MQVDeRFiL1onQxkXo4kIGcoc1USQljIxfoI9LIFcu2eipmNV5PFEKu3Tx4NojZOvRmXgvsr5v1Y9eMZYkDzDmF+gqnZA4M+FSnU5cHn4tAOjpN310Hj4GZgfiTW6rtNE8L0T47beiFQ/sSFENDWBCXIQTpaNyQ2ib0DbSa4GPAqafEUW8BUor5AA4CTsxr04fGBTyL0gCoxlGffwKw6RzwZB5PVcycvbQz8l1ID8SWutmfPE0Vp/I2daVQsTF/pweNN/WrOf9muhaDlrZrquUM1RvgyelorBuOY4AWsHQ0+PGm6uzA/Y4Jz7fF40USqc3XaKMcSElHKv8AbHOipGrRj9bkcTiphKAk92fXFQDrgebuaWelDzv+88nVu6sTkrNtZ31IJR/LlN/hwQHoIdjfaB5pWkgqJkZzm7cMitZ9QO1x7BBR37z7+bVMUKgbwW4tXDAG3OnvCd4vQgOo2YU2ivFIMkKuG7lp2wiyOgpSKa7IL+2R3dgNYu/44kYu95kjBea8FzkFMdPA4eSO2JBDzhEKeSreKGDkgJwPhO4LSEAay489TWEAvR5njrYpJcpY0hCuB9UHAMTDL7iYpL7X1a+AIGRs4bBxnyP+9DCHzsjjew0F+aGD6b/dIhGEY3wOwWaTlaFeTBu3FTaqL/dUf8s1HM44dOejNwrBbBeDi4VFM1VgjbB5TnoXWjPWyFHhdw7ucRIcvEN4kTZpKz1o/WrbI2JuHQjSGOFKYLi/bjDfnV9IBAgA7PUlRzgqXMoCBwlBP0lf/bTYTDztFU7SlkJQnO0DClcqIrTlr1k2w64bhd6CpQGEXb3RoyFtiYPoeInK/SN7pGSGWS3Emf0jbo6rHihdCCvR82F7vXgeLgJR7qcU4gvDxerR/0VC3KgjRxanZEkT4xNOBFmiqd8HXoL7WMmITsmTK0s/0tzi/cCuf4lGr0/a428jcr+HVxAhSX0xb886c0XAMeK6lRA3oKe8BOE0JHiHJDS5XjNaQ59/jKu9DFom2Iz5c+kfdY/Hbrkr7bA1CIPnxfamw9ryadNKa2EBo5GitkjVOL387yeMn+Davq2HscsYOcJuD8Je9brb0FtMwg+sB6yNHe+49zZml1boJMoFCJQeTEQ2iKKA+msNqBoZ4QIt3VZtGmmo9
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"malware-sample\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f5190-a664-4b4e-b3d3-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:12.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:12.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC01572953028666.rtf' AND file:hashes.SHA1 = 'ed23a7cb2395917fe07a7169f13acbc31ed85ac9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f5190-ae50-4516-98b0-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:12.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:12.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC01572953028666.rtf' AND file:hashes.SHA256 = '57e1e391251f2131e1778ddd202763ae5c44f3e591e5de367163c010dbc7d190']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f5191-ed80-49bf-b0f0-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:13.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:13.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAOdBjkgNQ1llBkcAAADkAAAgABwAZTY0ODUzYTcxZDFhZjRhMzgxMzQxZmJhMGYzZmM5MjZVVAkAA5FRD1eRUQ9XdXgLAAEEIQAAAAQhAAAAA+wJS6byIutEPKIBZmX2eBRtLseutLnwIGLq/cXUbigdumc+WmoAB4QWAtq1C72FnzRiijeu9UDGd1kayKd1ZKTFvzeZUNWRotsNCagJOZ2s18uIUNHsSPnazSzByX3wra09XTL9/KttF0vnu+jUkzEzmu8gxBlgaZV6aSRfTHJsDnDizsp6pInGero5vV/oMBZtt8mUrUnsHrkBxIrixipX1QgIKpxueU4fTdPgMfATmP50kz7ekC9kxWSxVaqTLo5v2PcoZjyTdzji/DmoKTUzaesw1zkbFUqAaVve1bWjAoAvnyRnJwpua0dHdBAH9iYD/B2/A4dN3onV4IS1s+lI29oiMedqLlx11Uu9fMt5IcSu8o8UgwKPe224u/kYlgKSgNvFqIK1KEanNSM+WYt/oSFR/tsbM5QBRrwgO7eef0yd2R1++XfBCC8zcPVe/GB/lDQtgI1MbSNPaPWchDccZfko0GggZ/NmNsuc2id9/1Ri6wfatEiTqwKXYfrNs6uxBnxMqOZgYcupUrqbulZIeCB3VVW4455IrcE5awdvnCPi34Zp8ChSW2/ELxRGgkCvxzqtlZOoxIv/pONf/MxZA6zuw7z4B9hoImoNdTXDQwgO5MAJAPQskJqeOZYwGlHEZ/7/y/CmRkQWBEEpkRadjaKXecPFgg/4daoxOeHT4IrQr4jYAjxzu9aZLNOIk+eBV8tKuSJuBE/T2k70On3zutt/4zFG71IWl4ap5+cN7956B/2lxHwOVXR5Dx/fgciXrB1G5F3GF4ONpamTQjhXexwxxk4kZbiV9nKsy+/FGydUAuhct3pzlcLKSg+bDTnGAdCaEtmfJjgIOAfCrT0SazBNjRdURYzQlmUpkRLL6hM2pcHb6ToFEYqag275Po6FTnKiUr75L51RdWMGFEbyZhqvRf14kohEC5DUI21HOkYXEo01XJccEixuj1kmrnKK1Ue88Bt/XDnMXbbkeThN4CmI0tvVRDPpyJhTWgFq4qH6TSZW5jcjG/c7Dx3rBK43POtObfJCf/GV/wd83h15YgGve5AIVBIBddfZ0bIXVFDsZS6FEcYdRO0OttnKZxfMDF1aXiPoc389oVIVQJcJM0qve62Ini8YYBZmMct9e74xC0cO40a/T2YIC9/AXAuVcDQwU1RfQlOS4nu6BeaIyjrAuWVKjFa8inqNv8Pj0gJuVM9+Eg7+eaLsuH9zodT2Pme+E+jpO1f6klM7gd2zNJfIdcBbebs3vudwOfC6fOwnsRPUiHA4SBqWe0jKXHSMXEdGCr6uNoqCpRkqRx+1EydRit1cffXsocyw4AREfh7tDZWy8YLrYkXUsaqoaXGTTLjvddeOWP+DPTXoGiWAcvrshxzKEONlozOFuunuAN2nFpqpKLuQE3CXGoAEhGSs/pW1JlK8oNvCCnNjo5k6ceLJdrQOAX7p7JdIOf9k3IiekHcD0sQni6yzgKkrpk/USzobJaa9wsHxg76nbJPtLvTgRUDWqOUEt7bG7R+vkUmKjGeAEQuH5J2TrBk9xzch1NA6yYvFTkomGwU8fSe0/KnUurYGEu1Fhb+xjiUNg96L5/1BCuO9E3HDsofe5Hh7Zh9jrphMwK65imPQxvk2bkDkDOOLi8SGn1ZX/HtKQWcgf/RxNBrJgsgyaI0XF41Q6xBy+6RPfIfZf/5oOumJDqqs+NoNylFhXCQdlDI/OtQipCbUz/x+o0MviF76DvkLmSr+ZE4H7K0GdU8fl8uKtxE8trQ5JzB0Ikt+zbgZainTBUCiXCMgcBDm3ye3809vf2/RZbwZYOS1eqoJXX5+QYLzu57rOtTzMXLsDAHBwxWRomrWyK8mULsjX2JsJYOtfIbzi0YTsKWxVdCaQI+AeIB5uUv7xSsgYq616ubRvD+g9hW+OI8b0jVpcfqc3b8DZnMzpodHItUGWLalAiTK+uAFI/creMHg+W2AqmB1op3v44/Qi1dRIixuZSC8YIiRTQosx2Zf+lrNOzkuYvE48tvmwzLAykSDeiBLK+4RUDMQKOT9qmqk06n5AbCrwYaqvn3XiIyEZL1Hjx60a8UARuxEQ289wQjLixlZfN9l/nyHu/UiQOFDZUMbJ7oh4WyUsS1Jww3nbZu2B9hiRyOncXfs2xU88gr0R2OpxekXsClUHhTw32GOKLSAZLWs8X3vIHJlVgyGvFKxBG1nwF35PqntmQJ/3+r6sCYw3ccGed3OJqh6CjUpzr+xStCiNW0oRyWXcnn6tfVGD8O2wBa6ObdbD4w3hQsXY4lG10e6RejB1LIP+rdvKKzx65tZK+3wDzZFBTO3Yn9+qTtyj/8VsFLcLGx/+03eOvtfnTzWJlYSTUlJYTUrCB8fJZvR5RXf7rczagCFcLRPP0Eg+IKY7jfx/Oq1W8ZGq8H7+bKkwtfCSDzsODNoIHxEuIV7PVGfUowzrKbFPAWrvTsOxfUx+mlnXBb/6ai3DP/v2zFmDQ05E1nsp1ZCUL4wUBLTTw1GxLWQGdBiXRNwkFeC6zmR+Fn46OLd/HY6d5ixDKODTLZDvZ6xn82DAmTYrFXkPCneAlFPjupc3PdvLh+Us1fir2+OMH8KThEXTv3M6HrIg8QTTkClG9A7EQpce5SeScROsA80jNt74Ewv/SbuA9dXENESmJKIfGlXkq3KP5LknBH7P9OdOd3QfmQHkPLOWbf23iz7vICwUrSp/k0m2wccaiZys1YcKMIg0ruxgL4wdBSoCdAmIEBiqPpsJ/JDp9iTOln3nPJL0r4ojoCOCCgwNc4cpJ1pAyirQWqJG0M8BBx7/j5P38Oezpo7v1i7Rt3oxKO68GCN0juNbae/o5Qw8urQrT5t9JvX+zY52qdG9IID29Rumsx83QinqivlcA6/5PnKfp8K7ZWb1tD/VGU58EAdc3Tj7KNK3U4G5DtsJ0ldP2H2JBeFqfndQYNFDu1gzQ88HaYaQaHE4QWJ7XxFH++8PX08wmuVIvKjqCrlKDNE7XoowgWK+Paq/D09+SxXwZksx0Rwq9aVYngQ3+ulclltf4WdoUpiLO4FpTQ8xofpepl2ilB+QM/aaByxKltG71o0H8OufPLnGpSH2vIrE8+9xSShiWe5+EytMpiprIXBfoNLsSPh7oIda/VXtC6491WHmGa2iJhDfK8qlwjfx9WtN7dfXEDoTBgLjG99zrV1lQ6l2dr70SN5IziNZ50LEbukasoZeWPZG8TPBWz536fLuMWzurvWnSpg6ipbywCYmyUtnLdIrAM9h4xoEwmePa1NdD3yJi0VsLwQIWtUyuFvw5yb3rAl50aUc2nMv5Vm81lM9svg3gW1COCOnBzUwtyS1erSFsKDNjqIY7r40WSUHskrt9iwFZTssV9ZIuS15Ksn8+Myp8zgsW6G9fnPJiIkjqWdlb7AK7ii5FzwSsiTUz1J3cONMOmiEifS/qBfcBI0WAHL/zD7ZgMqfrhbc+ln0Blw0ILH+0tDI7jSHlB0NrmP3HQttNaKjFhTUx2lmbS08c+pCv8Z37M+gmNZQQtN2uYYog7vCvo1uQYLd68T9r0f5eColsSb0CO41E0RQ2z4AbiS0o4AJGU3+iRAcNJoQirnmhh9fOntNV5RNlGNcngugH9I9xLSHOOXkQr/o0AgwSKnPai29JV1sAThiMMdE5ykqJcX8XUfLYAc+MV7Sze68bJhWtlasEv612rPCeopQ6x7ygbjxcppZ0NCXLQpjeF4vimfLGeq8PQGznWiC0180YBA8V43H3PUj6cV7lnxNAl+pXFfvKzxgcDBIrOlPBW4IXMQjDHd6VxXyGtHT+xFyV4o14XZ8ro3g6EYhnuwiKkdGDqPzLTQQa3oAfh3NyG8VeBYJKJvGUSqeNKVVN1fZDl2usWMv46So571LLxftiTNnuLCwM4iUgYhsuFdfTMQDm
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"malware-sample\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f5192-ddd0-461c-a26d-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:14.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:14.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC001777735933754.rtf' AND file:hashes.SHA1 = '1b2b988d2b49e92471b96a3daa4950eba5b595bb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f5192-3d18-478d-9aad-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:14.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:14.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC001777735933754.rtf' AND file:hashes.SHA256 = 'ea9bf2253c6bfac50eaf51df4a5c032c2941c93ad386ed8ce955e29c8829a767']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f5193-5f08-4eca-ae8e-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:15.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:15.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAOhBjkhMVzZwBkcAAADkAAAgABwAOTZjZWE5MzhjMDM4Yjg1MzAxYmFlOGU4ZmI3MTM1MTJVVAkAA5NRD1eTUQ9XdXgLAAEEIQAAAAQhAAAAdXVQA0x4PFIR4X0vgbq2vKKevFBRuTmFOT/V4M553i4PCSnUdoK7+J9H/Ovuao7PI2ItlA8Oj1H9DSCtATffTLxFXU3TFc2KTqEUz0Rwczl4EQ9v+PiDKuAeX/3YNnchk5kYJQf9aLV8ypRz2SYKfLcP4yOSV915LPLs+eoiukULYtSdOxqQz57VaWzveyuIDYd+sdYUIghvMPvGoh4hYL5MVQZPdgjKZXiTUSdXOyZIAF7uQnitjg3MemCn6RVuvzAXwGdOu8HEogUEXYFVHaE2aeaiD6Vb39vxcPsKym7siUnXWN7MChkzudCQORC/n6AdHHsN0fWmi0IZYZZzTb6E6AV69vY2beh8xcWcvzH+YsxIPLsZ42cSYybgdE/5XoDxDR+yAcCMC7lR9Mzl+OHr57K9nYUXx2x+GFsjgUbz8YFtSHl+9rW8tbyqzGugxGjeW+yB/09+3WGJmws1BEgeY/vquzi+Syncih3knjfrN6e0dPfnoHpoftPQPH/cp+QH1aOCDODGGn2QW5CFEFH8PFOzuFpA+ydknPyJhwcOeekUm8owzCNxsQbPvo8ZsmjsO9lRJi41VtUoO7S6xrNZzcOSn0o5qsuaGiyTa6uHMy8wVxQc0cNa/gFIzs6/73qBb9DANObik9MgWzbageN7vENXWTJLqC/2zhgQ9YFilQBJjO25VZYHvWBhG/rq6tra7b60TidsnMkmXlBP9YkqNkkVD0/pXcOdxhO+lAyPfBESr7FzghStCgT/HBx9Ndx7Lb0AUpaKYkIsuQEmrc0P2n5eVWck583FxDLp2E75u4hpD6oVkKtqXB80efcbfUuDYXLw+Wlhtmn/p6sqUPHF7BW952Cp6Jugu+/hlU3odDoDYMhbkvhy1ljICcMjrVs3vyN0L/iPlRHw7bXX7DUfgHjRbhHF9PYYBcpo7q0HDIMgKQBZqQGVIdLM6xwnfXBMq66WOco6aVhB73manQ7MDZWMlDq6OteQtP35dIXhDXcYgEWx1V0I0hkYWOI8uncsQthRXAgtAGR5XWRiUg7Xg2nMkhdp63bMi9feHHSTJMgDBsXSYcfaE1farDEEqD8G9pwF1svdwfpLGVqK5dIFSHo2wWAwGG0ix73WR18OO6BxROaIsF6nO9Lx9BhWPkkksML8KxBrI8Cj5jySQ+uhD5DZrdLiD4um5gWAFGZuQznRtqZW4ADpo+PPmwqe7lJIJuyHmmxSjXzXdECu5jpC3dLlH/xvWftfgk4R16pIEy6YUYtYNQMI2Q4nVfFN0MYjMKM2iJuzw9K6ys39h73ZU301ssY8/m6uZMZRxqtT0BdH887oL7hAzptsJAEo8coe1qzXeQ/6hRukAwDmgMQwL1uyw1sy7mtSXzjORuxf5EQ4JaoAIvWJpa0XmLTpSibmIeraWjYkqy8fTVYP85HB6zrqMG5lW1Kw38n12o7VIfXait3sCTvkeZCMRUZ+V/x53O/M5HnjIfeo1gN/N5FEtMryt+ZLPX48rX29Bk2+/RK/hMIVdJTiQIaZInqg6XNSTt1YZnHXqViLKypvQHF+S9xGiLMSQn5f38hDqlkidBq5lDo1m/wuYwkJw9A0XZtd2HaRPLBbveNGdCUuMHTR9duaV9pY/bPN1vmjb0arUQ9OE2wv6EGt94FaqAri7wmlRZehVVfEHdHH1knnPQCV6tbqh+Yr448GG+F6Sfy1/0p+EV2i6LEVH58RRtWKAxf817QyMEfGObte+GXd8DXoum9lLy4mgEezFL9KPljHuY+5LSzShXNuZ+gmnduYC/8fQwdD4UPXQv66lqdhY863lnmusEJEZDdg6oTnUeCLt68IYzw9oJSPsguPQfdg+Fj0WSXvSeRqEETSSa5h8eJV6s4+qfvbT4hq3WO8rh9seoTZopjQ/ee8nFTEW7Bpzm0zTZ0GRpSg9UxHCNaklC1WD5upTH9uZUZ13IkBl2LGgDJoqjB5Vjl+NmYX1c8FzldMQEleT/iZjtys3ldme0gnjOb1oxowCGtZK4oL9W5zuq0j85XppVNKlhg7r/jy2W1tnXeXtGRIb4G6B3+hvflFNKQH4kTUNGTxDH0UqS2LYpvuFyd4722DUjpdsCOvpYiBBEDmGDXvJE0YOAYS9hJrG6rNj2pU+C6E9ahSnW/HlAtem/SPTrU3mmJAbbiKFoV2mgr9Zatf6eUbAyQYALFMJ0cJN/u1TqJxqr8nZlaW6gA/kdmcJhW4nJ3ia+/Re620pp9XXW8gxtUalE+LNVgiJbueBLjMS0mF2VgFN6T4dx7V199yIjrw23ALLqkRHdNkFC3ugLOGJGmEjjehdRL/+Wnc4MMgU5n9+3z8UFyEmRtt9rUzT6vmOnfN65STposYy+7g9s9GLrGj6BJwAbgrggsRjROkPlFPtNZfEQjbGCB8ziRc/PrZOcASQfpOTb0F9aiUo5Utjfvq3CpKcZpTH7k+xybtcnj9V6mrM0+X1id7CIuh/yI0CM9uJg92cc0XTROkYCq6ydIJmg0gQ5CUONZota84qrrmdGaVxl8A+4uBwlPEqPbj1Jx5OiM9AaxYA2P2geJhzTxOI15NiFJovOXpvFXkH6HEOg6b/U4S5xQBtne4WucwPk/KDwQLOjx3Q+KMaYQ6HdHSdx/f2mwnCoDS2kVwS3A9gv0VVd/BPAFvasbwfxc5TYlrmgxgte81/OqrTKi0ebFvbxNvtW0mO+n+j2ASf5OZ7Emmz9Wrkx1noSDQzfoTH0+SjlXUE6fZFrf4ClNj4ahEKZPmKUVlKMEekb1TLI8WNvgJiWRTKbtGapG2AXXMedsWiGVB37Zgc5Ul0PwrdKQNhg4WL7DACwx1s2bZYC4ZUdXEoRjOU2VBpeVEYdjAYcLOHqXJhArrt15R8nI559RjZy3Fu/o6PC6ixIsYxeyoKHET7ZXvIdI/veaIQp1852bzxh6k1HI0u3BfteWjh9PBw/oe9PC9mSKdog1J33e5dqcHk4tgFS9YpGpiJRk38o4QeyXvvrdSImuvy3RuQmC5adRgWZEOWxbu7vbA7uQKNAjdiDnVvFlL5meqT9pTAQJ30lHGk5xXCVQKiW+cCMhRbw83iy8v5XxymSYF2paUpZanR1Fqvan6BW5pSYcE3PHUH7eJ+n6bJHQr5MCRQO87Wo+qERC9BsRmgtMe/pWZ14zL2SDHATUmPYG9VkdOKfKY6gPQBd8Pzx+4AxiI+ubRJ4vRPJO+oq5H6AQZTO3oztHy74xDuDJP/Q2W4OyztR3Cff+19Ev6nMhbmasqPuh+o2b7NZcH2yD+AWyoh5bgbibftROW+lib2unuNoR9M341Jwc4cUgxWUwaPs1qIPnus0ACi2zeYxfeaHBeeK5eMqIteSMBTL/aM+sTYSKCJUSYNbJRjarSul/TNY5cITJzunrXyv9wX6+XBSUYG5TRvNRZmkchbaoyDzea0TC9x4iWBfikR8tDb6Ry8Q1LSa7l+qZH5ASwsjF4C7xDQu8Jdg32oks65o051HUVE7x+JgopJzgH/GdVcrm17PkFGpCFsTtNipg31iSrJ5rG2yZLLlVgNjq3QmnZnnhl9kdZ34ynQP0AoDS3xBR9WfLhvZvXeGliTuOHK95DbJJdrryJaDcjF9HzLiagTY+GncuwPd1z7ZyH+zU5dJRWkKylFxwx8zEfMRhsaI0KePJlmv7DwmrU6370l76Tk/c4bHD3/JSQaNBF7/yqKKWO7Sv+xPZjm8eSwZB8yDROZQphnr02PpWfx8S6vpNcQOULqV9ieap4TTPqxPFOFoV0vME+gNN/gU1r6jhdgt387cd4Z301v1KehxRQP5O1LujhDudcX64yNMsXAso46c3qZvCzJ2/g/GXWPFtcPwrgv1wMPilrPWa5Q73VeCx696SssiwJgmJiibr8tDrrG72dGN4b4i
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"malware-sample\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f5194-c62c-4660-86d0-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:16.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:16.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC006594849756593.rtf' AND file:hashes.SHA1 = '68c08f00fddff1dc6effc1d773cb3a6f327a97c9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f5195-09a0-4a11-ac48-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:16.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:16.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC006594849756593.rtf' AND file:hashes.SHA256 = '6a7d941fd298ed853eb80f87e83e21523cee25f2cc7be288622b8339e6085e8e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f5195-1e50-43c1-875f-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:17.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:17.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAOlBjkgT//s8BkcAAADkAAAgABwANDA2ZTEzZGNkMjljOTY3YjYyNDIzZGI5MjM2NjU1MjFVVAkAA5VRD1eVUQ9XdXgLAAEEIQAAAAQhAAAA5GBEoxS3sh1N9bjrRBWB/9ct4PMNnosoFnjSTs62vmqwqXayVl3ypMoTHdxGN/UWuTZ4vzGCAYia1t3ArBlfa3iwbWrvBCyzf3OXF1/cIMrvscdaLzmqdMuf6Bbgt5NYnlji+MUrW90C1ow8Zi2ciokeUh04wwENdwG0CIT6h9/knXxVMqrqSXUbQA0Yfw1c4zPPH/EcvSkyyNh3kju/VgUmoh5h/zS0spFcHvCTTwEO1vvQsanJXKRYaScbunprajgj788awGWg4/ein0nGkEjRBIaASQGrOmgoHUPZ0UtRvg1xyOL5IwKKknSR6rrPNSKFMW5H1wiIQssM7YNHYgSuxhPiDst4ACIGlffgfeinsp/UzOC4bbhhJS9WlBj5JhtWTTlJvaQS3RxuHMriM0Olphnhphm8vl2+dGlK+lxkfm1Gr6aZ0t+4fjQetrjkwNAFVXh2x7WTHjNzAwcxIXVEFny1gCGz/Ij381hRqtNEPQtEYvKNOkvPRpkTzyLwPHjvaN+N8wqBqjWTQbm+0NfXV9tvOJzOzGsxLcYJutVi2YruURDU8hQPUFpLIYq+NEw58rN+Q9xbKkuGACiIOQ/7K4GB5UVQ9SMESn/kQkPAb5M4U0Y3rQq3fXFlpnkoOG4O+C6qhYPC9LcyA6BarLXAglxV1kHzdp0nzRQ0daOX0s3x03GOCG9uQ4JBqdt94SoFiF9qk8krYAdS9YFXGq9j2kVPIwRp7ELCAMKs5TPKOLgJ2o/TP1FrZkbrbD/iMl0Hrd7s9+kR/NWjhR7zFDMz1IkrGHqsdztydqLQIT0wi4Z1vD9Mdwg6w6pWExc6NjZ1BelZVTkg4YD3h06FhSEIvcAx/HTZCV8iXTGo8bVd6GgwIQ6vJr2L/NJclfLkKyx3F4kHKDYlPNgY4cIzkH/8bvNjpjQ2NJqK/OfDHd6eVpQjJRHrYdKdne0S2OAKsj2poIqZjKC7EnXwBDUjiEHYFJVqCUUpzKuF6xkyWwJGLTJe0m3pvETLBbZ9Ejz58Sb1JFI0sodJoCp2eHyu/sIXQ0JrD3BWWAS7UGXYKj8ky1dFlN2AGkdPNNPgi/g2sZyN/a/eU7qgrSifSyh8jzSh+pmxPY2v9C1tmuC8xQulIJU8zms7k4ky6iUebbjE88aufnRSCBfzL4s2I+vmBQiuJksRa+KnxMT0Zq/8KqZ0u1y/fBzt72ArweNd+p1N3AzaViyL5nhtd0TRp99iV8XRVvv1uQqvHBAZm+K1AowFz1E7nK2dZbWuuMZNx7LjjCsikpGYAZZhzPYW+btOIj4+z1a3y8pMulNhN/wVntXm6wI1JOTFdX3dGh1oZdyRi/tsE0/0PW5EWae3zkcgsUjQjbHKjDSZBcL0/PPF7FoFtR/xKbozgEP8ku2Pwi4XQOdOuVnoCaqG4gPdvRydAjRDenQQvu4nNAdZN8zrLLj/q9Rf2Wv6pkB3+wkiunaiCh4Jp7c9Yn9fD/1RgZJPKZZGKifLg6q9A0N6xXTE0pAbckkgvfDmySC2eh+zpjy9pvRZxF3LJlasizDk4373aMSE15pvMCodkiDC+91MyRG4DvdiTQ4K3/yDmf5KQrtIAIfVQ2c9Y3RBzKUGzZKBHNUnUnbcDxpNIaxUSPTVtYV/8E4//+vZf849d+HZz1d5NFbMAQg7R/fBCSO3+n2Spos3F+1ziqgoahAH1RmoihQinIDtW6ZRmD8fmVP4oSK3PWPV/QAbTaBRngBihSnaibf9WQpUd84DElr28UorOxX93zbx/kh86KQLzEfo2/CBPJtz4LOUyMdiBU0q+Cm+jyMKHR+053lITTuddc/XQ1S2ogCq4TSRYGGuvb5SvrD9XNnU8w1n4Vd9tgLFCMqvq3V/T59BGsvpL3VI9V2+MAXWg10UN8SFxCZ3izrZdSSOT0MsubeiRHRI0+74rW9WHQcroXqB7XrJoqNgdkuR6PTmLNYFtRVTbhzGvwxeAHTvJQs5vJbJF6cucMHwBGZ10jzavSEaVtYhBICD/lBz9AFJ5uXS1QramQMl1cbpoYvAxAA2ntetmeQC5dn5RbffnjVkPonTpV7ueoRSYPUqqlVO4JQjjglAWjee7PD+Ivc49I6LgpeBAuG75Lz/cHf3DjC1X0BukZiwS2bZaVZW11QBa4ZeAYdGTH/IL1gMC3vz2xS6B2L0L4U8QPcyGrdgrqe825OEfsV/RwpdGUY30wDI462sYGRlVfpTeB2aSV0leW0qEBGhZ1ERtrPvqKydzPQmPM2aMrcFn/6cJwnG+TutbAsMez4kUejLZX8Ti8lWmkS8Ook3ERkCp/US63v5k6Hf1cRIy647eKgKZfh1Atw9anys9j4ZYU1Qh2VWMYPG36QN0OH6l5E9804hQOTeAiCsWpATCvMtnlmKIiFW7iU9okQ2j+Z51T5Kt0nUsSnlyZmVZLDuoT+qQUPKwFezVGtm6m8CDkp4ks+A7CwHuMMEjRuJA8XdnWKma5rvNTZR4lrGeF+tFNj/SwOpctVJa7mULzDSVuIVoecH+DbxW6u/eEC5gTUmVOp09+RajGw2whcXnNILU6Dj9R6BUttgDv/fW0WBAJOyApBpFCuFwNTUSK4q+JMKjo1mRpijQccr0AodQ2x5NVf8kfzpzusukIlF84IuPMqJ913bX2+gLCNiaWig+ReJZFV0k/xkPr79KvtTvbstWjCaKz+vHL6tLquxdKJ5gYM3FNVve6qad1hk8eYc/TQQkDPQQfAdTEQdlSf744TvD1GeBpn1BuslgVMTCTlZfB/rFF6EVQlnQaQM7tslaxw1F3wX/+2i9rjQs00vQSEgXbM/w2P6r6jSad8Y/0AR5xJ4XXaSULbaRffFsiIRHk+LF5uDIscWcfj3HFIwEw1XOxEEh++dEntHaxq+KjNLQ5Wdi1o8Y25DW1/1vqA5DIF7WJN8xqdUz3YVj/5+kKbvDvFLKznfkz8LT4GQV/9Om5+jmlsrw1rzCK6AYgRFBRkJDcH0wuQpqXm5Witbzmj6Xw1usHz8fXfIfLPPo6YpU22LEbz/fbd4fn/t7yzFyUAh70X5F1/nP43NS8HgCi0UrcM1rNO2HWK82PrUUYcyPqKy2NiAXRhxQkXCooSdyImz253T24Pzqd58kMK2oXbHMBjs5vP1fPutwZY5YCkHkwL+5goQXm7txWqUwjPBlGcHYsQX52eDqq1LvHMPIB7gxkgJoBo7/XuVj6R7ectbyP3oVdHoaniWfDKnpzkH2T64/SdwG9v7+ekK47mhrHlOwt0wqmNQ2k7g0LiZYaE6aBowa+45OQvJePoK0n/KeQ+Nljqcj42gx9DZIrkxNc4xAfPeaa2+Qp/jEqOPW9ZlN5QpS1wuGz+qiH6ub/M5ycTj4ertk1IrfgJEoYV7t6UuSXwgz0dS3BSXdR3rqVVUFAbfUfRyno3jQDmIkJH4chfvyuGxUTXq4ckUc96YnDswdUqirMqrG5sSjacMN6SIqF56Ij8MFUpk11BtbuPcmoRPmRTz1zZjktpU4QoGaNV1S9F28Ab1KM1+PhaLxC+Z853GKMMPCKfJa38GH1hlvbPaAeOCU2dq6xVm46OcEROFLMHY3AXX8I2svoFiun7gQXQfuOeqNkdea+LuDrz7mA97fROlJCslP8TBkdznLHlJK5hVGAk9pgrDycQB3ltvxqP8c8hHBxcIpTE51tJukQrzZgOhBus6YAt88AkMVvF64s9JGxuk0sKGe3eSUlnvSNRJL5rSENMIrOwalBJ12CR6BBKjW3voIEo734/0NB0A/6+JVgo4Qh2KVChLx2nTcyVtf8ZS77u/Ztx+eRSfc5cxamDPisU6Ej2NCG5dh377ueBLsjfOdBn3Fq8hzWo/n14mgeO7778Ar1TWMLFIEbvIkhQmaJdccNY/9PqBmh4/vbTCXN
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"malware-sample\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f5196-f424-48a5-8f8a-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:18.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:18.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC12062836176051.rtf' AND file:hashes.SHA1 = 'e4fca205a52d1f62810365948da80447b72e3fa1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f5196-4fc4-4ddb-a80c-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:18.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:18.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC12062836176051.rtf' AND file:hashes.SHA256 = '4b4942b7e02bbbfd1c06307d55d69a40c8357a7472531ba1f4bc1035a6b2cf3a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f5197-1f20-4cb9-a93e-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:19.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:19.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAOpBjkhv8qmpBkcAAADkAAAgABwAOWZhODI5NzdlZjdmZjg0Yjg5MmE0NzgxOTcxOTliMjRVVAkAA5dRD1eXUQ9XdXgLAAEEIQAAAAQhAAAAdXVQA0x4PFIR4X8AVPhjN1cDUdGW9yS78ySQXid4Pz8RP1ZtdaHCZnpwMiPwSaxW+5SE3IT77JVwXSPLrQLZJUIXuB0OIZLw2uZNPLufDamr8wJ5FhC+0sqs2U/gO3X5aXITZhpBPnQhSIond4ldwOCX0N1hac9FBy3VIrmx+VPDxVDN8hi5/nUy4LlbGM+eabhyiHrTg4YBhe+oCamwrx3OkUnN6m6VL5AnjNkK4uC2J9QrjGp1mQWgwCRV7qnrccyzVCXj0luPm3J2c3YjQ2iG/dRIo9PZSPslXoPF2nrJ4o9zR+CxHyo8J3CSBaUliDxW94zfH5LGNGwaj8xoPha/fZy8MaNEHwtd2mkfO4Kb723+nlm/+2tLXjy7bVGvnntDz48lfMNk4UJ6BDxVmcQebihZ5EbSG0q3Wff0hI0RU4EqweXIuNxLSscLyqSFG9yvSydxGCXxhkcXAeuJK/UN7kF1Y1HHMoIfsOosM1bnFNBCPPu5PmXkldyS3k028LqG/1L40BSdlAXs08TrI550Gotaz5nW1bSJnfG7xJE+9EwCr6fq4TWcgg8DxFbpvX6BamTHabTgtYufajXX+mIKkFDFJaIhkarjTjjrt3HhGJah4buijExaPsnmjtfbrdMPvOyAj6AHK2yj9dajCaTQ/iTYrDXB48NA6wuMhQGwsg0z7hd3p7vn40RqXhnd+0XhA3aG5j70wi5KlEsEawr7TKaxcBi2eOECRH1kPT+2Fk/XvqGiqljR/dqbiesjS9UPbkaIXBO8QxlXVf4tXl16ifgmg0gAtPiLPal9HK64IsZgTSD36PcYCNDppIbSOxaOwOMs4WXJ+3REcu2rlBlsj5s0CjMkR3EREp/olytVisJW8CpCTdWBP7+bJEf+kRBfgrSZYx55SETbqimpBtCjmC/p3c3MTwnaR1eanFgzTxlJJkjI1imUtIllzwbqLzTKxDjw0Dx5+DW59rws27UtyQl8tei4T+CRutF9WlQWHBZv5G1OMt1+rkaHygsCofy4VCUlU1nLBmkMvylGJmubeE1DFoUbnk0S7i1HtDJvKcaE4f6WZVILQNcmEkh6smYrKrb/BfQNRfU6QXRi/BIew0mPbM9bW/MW3RI/h5rknYFZIV+mEIQjF/jz3rv3ynuKgMGGiahXC3HQHzc2dOJQQlr8EjUwrG+POS5Y7jeXPxSrdERgMaDUnibQ8lwHS8vHV5eGJGC0RLoxSVztXBc520pxZ632ceDlT4p5lPZmFeDgjJ4xLCeXAE1OE8REkCqknWhdbv27XasvoNHkcGogUXKJ0MMOl2OmBpCC91VET27T74ZaE3/ojN3NO+kWKQ2Iljdn7q+f2nfCMWTSWRzq0wJ521R3FKqlfF3WBR9Kn/XvP0Bwbz9SyL9Z/PJltstUjYrqhSH8x5Xc57T3l4FG3OoFmBYUYziAjbgcYYORky9JFu31uOdYNXbSqoY1uqtgK9mhseUyPnOtILCL6PyeLvByudDGBZ2eZDFbLzqfn8VXCBZKwxW5N+aPklT4lubZXejRUYrSEepWxxwqL7bcP5y1XiAD4e2JDxft1WFb0G/7QJXQu3AqtMfknxZMrZ+dOkqPbmVUEjoIVjiz5HPehYoiMpN8Bkr1psVdIWyX8YdNbkfndhtzx3ubYOzsWUt1w2PZ7GtsEtGn90O8jN4HANwtUc5HqHfSKou7cDrmi6JHZvvfrWUtRZrUHWF+uYQjDWU09t05M46ZwXdDAa4lgRBYHRzN/tYxn/Myb7YcdZgBIhH7nuAMEd3rE8+/pypdswo5e6sWsUl+R8jr3Y9BJ7DjwnpM6ofIfDPx4RGvVOcgY2qEJ35MZOupJfDd18H+zND86fijThsrTDu2x/xq0GmbLf62xK8NIxR6OQQqgboSNgf+3JQWKQqq0DKv2RAYoDQ3s5E6CFweG27sgsVCeMbwDjDtdGk79sSbuYWzh85fxJj+6s0DvEmiuQJRSWuI5Ey0m0+E2DpZqcnnRLYLlrY0cHsDoatejSkqSdDnB4IY6ElTEh9Jlt2bXRIpklRcjTaOzsjEX1/dJ9qY6hKDQ4rdYknsyguAvSN9ykiJ/xXlfVy0uFar2ZWFLOYhfd68IIoNuZUR8K7wAXGsmh5I1+B5wAZgywQPC2ZFoYCHtb/WZOANl6P1PdfhjPC/UPewBJT0Mucp4bVZbiyl5Z08TZb1hblcXU0eaCZYLSJYatr+LJWphx4ctO32DAp84U6OWiPTdeyTlVfpI57WvzJhNB9fxbI3LpuGlHEq6cpVsjJq4fqTc+4HcdwSlNvriTgFsu5pR2V+QWrMZMOrG6HmLpHpG2LCeSr8QnIVrr/biUF8UPyGi2QWWyN+fnNdG8qbk/PTfkvnrPHP1uhb7OcoGgUWTxKrVekLK+1YLnUOXX/IUMaRV3vrXxMa2/yE2LI81L876c6zXAx2pl6C4pOir6+oTE36Y6ZhIiHrkriMlHc5RKvZH+ZrJw0CcEgRpLJMrj2+OIZ+L/jNYhmUfbjPSNKmD9SXFATkraT9t4dsokiNfCswTY8WdhOUdeeRjKEsJYpI8FnPbOOA0v7IpS7hWoo7D7Sn2kq0hUqzeXT77supN5hGb9EUTUxtip3M0M0vNnUT6RQooppV03nZ9EfHCILEq/6YXzF9eY4Ifwh4RidJEQq2WdjrhlSuIXHto5X5Lf+/UUB1+CoTi6yGVT+Ini/qjXLzFSrJzn3a9nCl38vA2ubJZlhbMOh4o8iTtboUjhndNcS+phcx4z4PZ7DzFS9bNMmIpt3mZR5qpwkR/DLCyaTXX6aYggUXN0mVJbMIR9EkdpA1fNxIjidf1pRe3MKx7ePF0CnPR4A77Zey/Ls3mkW+J5ttHjs+GJCpB08tUeQwnSFPRHUeuZw6iXthqGeW4a0IT/FPYdB6aQVqKkGQIUAaRfF7HEcAOahU2KVwAK/GLwCrcDKnMNrHqYvvO1sLB7fbOMvp9UPY4P2M38j5hys+B+ncqYz2LFqqprCgCuRk2Q8HqEM9CKFaJMkUO7Dmry2Scx7uhcyXwprKnuzdELVOQrzq6jQmRksQYMwh+U/xblQqPSmhDRdGYLD53PYN27aYYanA/FzrsvU4kklLVKrYMaYq462wss/PovAfRCKRJidIqiDQfnCvXesce2HR54UlNZwSp3O0VLAFkQoon5ONgHbhBFBbgO/zG3nDr1WcwCU6mGFzZGUoOiUy5Dxofclan8JOHfLl8GHM1HFssedCsgt5JTIUHBp8yN1f52Dz+CAwwYY0pL2CH2pU771j6yYbw8VPQf8+hbUMKlN/WPQeqdubZnPs3Rl1qzHdOvw006HxJrwMqE3uDtkz0ksYVpSW+Jb9RBlPpbDalnN0f3u2w+EPKwYBx1yzFDAaVKnubocEUKM3uFqR9Dvqkz70sFh3ZRG6gcmNRtjW5IBdt/liG2nK97qLYBchjVIMxUhHArdzUcVqViL2+BAgurMzUvWdMp6gJkraRWYFXhUy9MGVxuIXu/IyYaSE7k3k3Y5/nSa0p+5g7aVOsT1EuHrx8AqzafLEHCsiT8aCr9G/djJhuV+5iP0w7jniXUwmTkhoZZVLXnkgEeUoEWmZMYWFKw8jqrwAWXGRz3NeHAK606aEUANdtoqJ8R1j+W4xQLv1XB9vtO6ONYKcHzL5T6HeO53kEXytLqZ6J8tYyNCSu/IXm2ct5LfBBV4TIBQZJ47KKZWNsQofzkBawmr6l+6HhzshHBjrdfQEq7oyAsvUGRK3p1e5UTcb571ysKzPvgr5mc8/Ze27dcnneB+LMv3xi+ZZ/iYgbXnJFUZzF/UQwHuInJNmxrX1mP++9EHA/aySh+JArATKYoYj9NCax8ZGeWqPj+La2h4HVrDQVbbS5D1j4fpUyh33kH1blOUMuuzApCoudG
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"malware-sample\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f5198-5d80-4b20-84b6-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:20.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:20.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC0017794330543788.rtf' AND file:hashes.SHA1 = '670ab886eb41be24352cfc801985d01eb244fc8d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f5198-9b8c-4704-9a3a-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:20.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:20.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC0017794330543788.rtf' AND file:hashes.SHA256 = '78c9910509b497794c233cb400ba2a665e0efb1cdb21939c05ae8c5bacab159e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f5199-5790-47d6-b2d1-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:21.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:21.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAOtBjkgUEgp6BkcAAADkAAAgABwAYjg2ODNhZTAyZDA2NjAzNDQxNzNhM2E0NjYyZDk3ZDRVVAkAA5lRD1eZUQ9XdXgLAAEEIQAAAAQhAAAAA+wJS6byIutEPK7cZtzg3/GueiDkbtXlYvhRXMqFJa8wp+14mcNqaSAL+xDTbbncHrlLP717/RHWKrJIc4Kl089YY7trKMqnMvWDIl2hlDN+uIOR/dKKkVsQYTyR6GtMbsdY0cWIoioGJyPKcaIVwkVI3lBqRZVwKRVxYX4sWxBetoJfhggomU61VHz7qdmZyObmWCR6zkoZDQCIKM6MDGRbGzILM9KBSSe7s68RMA0M9yNAOUmbMJrGPGhN3s/APJij47qkwvjL458270a5EXcQXVm0LgNSeQf+0P0kYhx6GR+DgUGgfiBt3d1gddwB64bumM6/LxCeAwpLtcQOh68Ffcu5ZkOaz+Mk/g1RSXgMqXV8hfvrF3Oor1e/MF8QUZBqbCI86VCu4k9HibX6Dc+pXoh1f3eg9dYLVdEbaE6Fx7U6sbg1HodobkEIySweKjO6mkjOgtBpjMEXVRBJCMjm9lucrRDEZwMsweBcGfVr15UZgeqoAflvrGYFXaxtC8/D3X2oEa2oTVH+UjtXpXZMCPWiv9YO2Jka3CyGdYxA1btSPAtBFqqizDv+q9cYkF0cnMWrhdfb5HlA9W3RrxJ0J/JMVmR4lUQzuanPEkRiVbAbsDC9gDw/y7m8eRVJB76FOVNT/ObdPmW+V2ZRLaspRGdh6nvV63zyCRRLM45EYKxgTVLefDZrm0AN6iqfiO8OLqZDoYobH29HKBZSYq4DJm7YBVSk+e68tXs75sKGVmQNH6oXghN1K+a5Eio0XgUro0Hrr83JSjo+cjVaVei5U7gVsgf3s1+EHnYxv6wKq+80UXjgjzuAy7+gbdiNWHrX2o3x5jGZzbbSViySluTjEWKezuND3oRjc/ubLvD78iIm+AJE5cB1fCZhORcxW1CBJAb2iMg1BfST2XozRXfgA7arZ/MxPa1Rkt3UHYg9PM3/+SDkPOfXY23Z/F2Gm3h397/ha2hzwlY4a6NSxSEqPWecsWsLMjBZU0hKmpuoqIhXywHOJurbOHl02tP+XHzg0VHgwSQ37k+9bmX5mK+bLpTGgZPGaksWsvx7x1ueJTDhm1MG2laL3CJQPSmoxuz1bbgLLUKxiVogo6pES0P4WPDwy6l2f1Bmsq+fMJdWIPSttk+1VyF9rCXK3BKl9KZbK6heyVJo1OU4KXRLQ67NDVakPA2AjoydDAv0ewU+14ZjcJzf3NlROSqPH6SiQkwvrsPR62+TJ2LQ3Urb4Sl3dfGdYEosb4ZEM4ovctU30dsSooJMzwOZMbvvrazWInB0KGnALFZbkxNX/nNe6aiInEFszCC8Hgr9CTuP2V4xGeA8cnZzQlDUvjgKOn7SzB4Sy2obHj79ZW3Q/H6OcxZFLn10NUoQ5K7TM4SAX0gJViK/1jtZY8x3hO1JUQ4Phn3GV5K9XrjFbvlPc3LUo89fM0uHUXMNP5bH+mhjXrPoc6XPw1J4T9uS9G4RBwwnUrz5hycYgSwDlZ4XvbjCLbRi7Opmf5tHPd67DZHj7y75rjisGD8Eb47vfGDAs5hUBRAeJnZ9lKGxJHlj55Y9BstHNV84Vux+L4KxRlY73xDu6cIexy1Yse5CO8rIPZQyrG009Uhtz9jKnvcgeNnc45GxF6bI8Qtg2a28qZtaaYrXA3DdUBnGq2D6tdYk4Yv9xnWsorcL8n2z7D+1JXX6bbEV6ncYuV8ytJ0ZRdcuEr+5pDj8XVdQxenqb8fwMX/meJrcWyxc8M1SBVBDDixAs+tp0gdCc/RFr+yeF6btln2dvvqw3OoXqawb/qgsQyRNn4okrFdxFdlMh5rn+PeUNCuowCcoeZinUZb1V7AbD3EzbwSpEHsTFG0JPhYdMRNKEgFSq3xRGoaskvptvYhGDeBK0G4pKvBpDptNiXfQw++48TYM4Kq6+5VM1Ff8SNkiaQoqL2GgqucCxmIvdmZUHBpVkzxmx1BWyuFCIGuc/Kofp6PDhlyBgaVH3kL49zvEnsAN8O3+nAUbFuh2NBg8F5fGaOc7MMvp5ijk0mHnYb3DPPgPIBCGBu5uhIeapi5wSU5KWL4fAft6wMcxVRkpVblKINdistQN/xTvbQ1Ue0+XmSUo31zU92eKL/KE5loPwHgoxNrNVL9yZCsfvwkmaJRImhBFK0Z3dJyKDiwWFEOypH/Y+V6wHssbRVQQXK0pibZ+gTvk9qs9xHXjbREIn5msDiUNzN1adn5t908P8tqYVdUVjx27HMOyhM50j+v/Ba9xNR7md8hxzkk1AdZb8TKWVvD0rK8Iz7qxRhBiWXYDMYsX9fF9fcndeOZ8Wd3LvoEZbfG6Ecq0+ZDR0UWAbYEzNTbuV5sbPAagvLEoKJL7euCWGfFpxwB3mbB83MW5KrKCikSi/mz0rcQqfQifyD7HEubPTkYiVI0BrAfUwy4eh5elTfQVGCHNZBPzuHFVzhMWAD5VDWmb+4BT4iTL3zHlCGzLbFA/uijFofwqkktDhePkUE7pWiP+mXq0EPUQ6dZjU4TRbiLMvjuJGF+vGB0H99gWtBBZnuDnyRh7Y8STEMf4UvPmUaln875NgCFY4La49vQsX6wkuNtdl6ZivQJhXBP2+BtTlfZUUyKvnL5qHWX/IbwcO4pTBF/YIh/SM28SGXsE75lYfQbWge78h9Jl3Hf+zKI+1erFCI+/WK9loDWHuNbEB+5SXzaVMjVx9J9EsEjhx6Ku3yKTW5Wp0fWwtTvobiXNZ3MCSpXAn8rT8xsaJNnsGTpX1IkLHGvzUeUBreUojnfXlLyNW3A0WzDzEXb+ZLdPb6mTqJT6UbOTvJB5Feqfy82wD3i6JoRJE3CoY0I4Zi0HNzo8NTvjCXjX/aPXQ3TDcgCcpJEd0RZY6IX48mzxLqWiVAL496ADzZhKSkM6ZbPo7Am0jy4wD3/GZnrrDq6hsNMWmtYTktN3DOrkNFp7KnKyga7HHm51XMrpN9/fmBaFdNGb8yfDHnf+PWLYdDZkZPwcP1RFUPNmzXDrEiahYW/iBMh+kD3Fhk6engJdrRmtmXpu0+y7Xrh9+TNuaLLWoOscSgnystz9OoivMAJg+GRMd+YRIgi2J6fnagMF/2eAkkEnlgGmkxFCIM4cQ/rsRiRUEzSyBmHHfQq33tWGdeliOvjuBF3ZlTghaBjG/QdSj2EHlXAB1j4DJGfNwqlVWUN2trF0dBPBLH1kB8UizjHwtwOYRnBSMZiBCGeWiLF5laKhW20RnDd/jogYkh6B3TNHS6JMNan2xyg2P73G9ZrLb1908ujZrIhQRUotIdNGCvXREgOfORDRgbHtIsqmyxzCeWfRJW2ebbNzWOB7Rrf7GYxzVKhuvACtKXxdkXtHWUpuOw8/POI9V7p4LdOM3u7ImJc8aDOQOKzet5oyaxxle3LLjTUQ4VgKW6uQbLhgiBBYEVg+pGN1PVdz4IGtrMoF12bpGX3+W8UNcWIpP4/ZPKifGLdo49twxqL5wBljMo3Jz4ZoAwtj6zopfnxtw3AeM83hvAQP3+gn4IrV3/ebG+39zmlZl5sUHm/wv5Y5f8b4ieqI+yI7ZnKnjuGYIfUnP49peiC6YY+8RoyrX1XC4XoMFRKVWlzFKdXA3QzXThoefC8vLRDHflzqx3qRIa13G90VR2scy6ZHGUeHKZdhVFKJ5bAfky7i3fA02mN70vbfVuiT3qYhH2n44fOmxkpp3un+TLYy/Wj8ZaIp8NrCO15pCSqa4kBs0voK7csvV4gxIGijZkFQBhJXTUpZ6aZfAQWaL96/Exss7Z8/L9TZ4XKe6ySepN2Kftk01XRmWGGbegpXohnOTFaZauUI+j+CQUXIQyugD3q1z65I50odK/s0uSPRo3/kNmQcll2OPImCTqcXDtxp6jZpf75okF5EwPVoTkPRPxWNWkm/ntdFztnZbf+pekE/Ykz5rapCOE
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"malware-sample\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f519a-1538-4ba7-a115-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:22.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:22.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC0049594291466354.rtf' AND file:hashes.SHA1 = '35ba5eff028964c73ba0ac6e932c0f4224e51376']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f519a-fd4c-4e67-86e1-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:22.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:22.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC0049594291466354.rtf' AND file:hashes.SHA256 = 'b56aa11f6ace57f642302cb0f2a3944b9e6a6009d1d858d897653bc832112b17']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f519b-898c-419b-a448-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:23.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:23.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAOxBjkhKVD/wBkcAAADkAAAgABwAZTdiYWI3MzY2MDFlMTkzZWM2OGYyM2U4NjE0OWZmZGNVVAkAA5tRD1ebUQ9XdXgLAAEEIQAAAAQhAAAAYMnUgHLpGFHyT+Juk/rXAlmRX6mZP1jPmyak4xk0rVIi7yndYiC+BFjaiQnzhfMjo1SvWaN8qnlzqk8y7VcbfGhrt9LsGSsFHo2C1dNa07v8Ma6ObOTuagguS36vGmFzlYsW20vidtZ6RjYtIMIlKw8abe+FiTWV4xYFJFM6kaCsXvP2qxYQ2JTMG8LVgCzf3klPwtGGxQqUtpmkQRkSNeXvyYpY3w9JFNCIwKyqx0bnz0U3fpTg9aUqakH+WYi3oGa+bg3b6mHphaJcXr8pgEjkc3k0uOEzUu5sLpJdL7dUE1uuzfjA/tdkUn8iAcKbtNcsNDzBsCgejBQr7p9nlYoUZ+1fDBoqUCFWZeaWd5FWwOQcES+LhCmnAcnjBzVEWSrhIaQIkQnRogL8plFrhwEiZx2eZgjCmysa3uA1F+yZ2VoRGUtAGagTWd0F03KSReN3QN/7+kryHQe+8Af1EVnkDRfu5RGIvnFgZ9Vkvrnq65STNelZyKAvhm9coM6lBvR6W59cxSy9NFYB0KkRJav7eGIGZ42fJRd4n2IoyMRH1z2szoJ/uRf2nkY0xkYxDOIW2swNcb+MI00aedEjSyAhwiI82oVsM9KMYR7wiQWRumblTCq/YsBHSWI4FLRN0A2Wtn1+GTIAaapD3K0Fmlxdx52cE/NzLKEeWX/pIi2YeSl776cfX6JH/P60i4QBOpOH2e11xdJeP+/8hHEdTHnsvIEeeVapA1achlnt5+MT/nb26Tz1/yunERVmN94mZDADwx9dSi3+GMi8OyMoxzPgG5AoR3Lyd5RCIYbbDvCNdXS8bfPk+5GnPWSv7AuZLkdXhUzMKJD20qJLldtFrBd4VxtBd4A3ZpbHVhaqNXjmOnR6UYDb6BZAtmGmH7LjfrdEdR9r2LXQORQt7IHN8qo9pioMoU9J8K8CkrFbHa+/0Y9PnWpwbhZhu0oDMaOGKpC7b69XzNy3I0JEeqE5LZfJ7KLOqOtVdQqHixrD0i8UlPoYmEein/6AnYxf/2zAnnnz7DgzQPdvZdT3Ifb+TeqrUnIk/V4lUKkqvdvd+xD3MXdMg5ALpToYmTidSBmzUMyV6A7vWjbvvStj7BuGO83JnmT9EgZS1ZVIJeLyNz7lHnPDTk/9D358wBgJcctAQa9iMyJDdwl/H8YFxJFqkq+sHPQeZ0EOqgM0jUzsZ11/LpKdvzUROGsgfB75Ld2Ykl4JNSSwSY8eWeBbnZJl259/itV/ssiEhaCpXMgGfodT8BbClz7Z4FnGPhMPVd2mFLMOAIqyDrRiVMH6Py9zJ4UoKCZMtJjvISMQ/kquXdRNTpDeXwLFhXbrX9WDzGhwiP1MEniQtMIAiCBXfB8FUfh97+BH8Q88e6waEwBVWDia0CbbVT/wQmnJ4b94B0yE3U4RBqDKRYiN+p6Rq9EUU9nqaGs+gSVOlFVxDIn1qDsEjeMzJxyTaKBk4TDMNxfbBwzBB5R4Vwc7GcQLmTPTiNvJBGjpyDmAc1dU9UYX99ZGBS8A0strrOy0zPvQwqCcvU3cV/KjIrx5aPDkvZbvxgQjxV2Zf3NBekfICV5ca03Qy5eEOdXOYH/rUrteDmB4aEX6a8JTaTeOcxnN9hY5Bo37QUBZFYZeC0P9f/+NWauDAxpCYkVvdCkQw9lraJnbhy4pa3+/+PTxdf99oNBrX1uDach3Eh4b/8ZKfHFHnWgicHHF/TknpEHvNodGjEbjn1yhpI4Co1kNlWEYekQF+KPBAfRL4mQ2MPFm2MXNMVm3aNuWI87sP1+CVU/+51WzxGl+/ZmBQAyJPjHALGqvq52cxO/U+3FziJVDTVNwNtdz8V1+Dkfma3Wo9GiAc7XlBdpyG+1LhfTPf8hG4HR/BosA29nI2bHZFVVEWwZGq3Pu3KuNNExeYswf7hVS4QJM30lgioxiwJt19oCIDvdszWA3mHUZuxjrV8FDCGSErr4tI4MnxAdFi+2J2twlr0KqSfNtlVU+ApS3HBdtDhuuivBhGdoZfr+lvS4gDQRNOfdtxg6B+MFgjuQpd0jcWz+3LQTjblTkzgU0aFaLOSJh83fLyPefnla8C9tuxxIRyVOGeebisGtF5acWJhKWcGvsesMGBbGTMWmi8kaenmniwHH+SAk48QGu+pJPtbnNGX3d+0x633OaDgZBHHxxJNBzE3uipsNkLLFRkU2ct5dsHKqzsoykDFpOluhlefDznHXVVCZL/BW4qT5pFPWW9uzwJtUKi2nlXf5Uh858qXbg5g8eyOkI3ABJhMC6stbrItRfSrEle/smpJz6P46ijCcJ1X88fvjs8Vr2tipNYFScH92TDsuJVKL4NB/zGKR9+O8fjrRa8Q9begZtv5fu7byAHqgYEiUVuZWZg1nXDI9wURHN6BZ4XJDBv2TYWhPbqG1UjoSGkR31ugSEUeU+YBPiGCoNcGDVy3eoz0i6cn2K5IWBWnZ96OAjOE9DrCMfQpfjBL74obs0dz6UBA3kOjX2TbiIRe5dHGwIRCuOZWQW8j3cI5tdZBJNFaobTis/jo/5trecAOPRsZMzZ66ngfY5FL9KMAbv0oA9CeK7mtmQMuzrlubTj2B4YktQn/OpKnMbO+wwmfpTeopR3lnfhCwwfleIpvjpoIpkaWnpqxU7AFmTAlrGJr/HZgXrxSQNgbOJcmmRZF4ZNr8/CncsFQmalz5ZyI3uhpGxOZC0eowFmM6jk3CdbJSk4bS58DXhrDZQq/tKUB/9XAfeTP+XpBrf3gU5cZPRWtMyFtr5A98lkbZqJR7aLVAZWpnxREsqt/eyjcrO3/C6XPCX4kEUx51CPGyYk3dnCNLzjCN6N4ncNpSFC68aMsOvnCnF8oUb+HYdQ2OOEUs0z2ztInejfFVQhdmNnEumKxtTd+jtdqL2n2aUvcLGZBRLi/a5l31g3UGTwvxy1MtbVQ9sriLWGxDSnVR9FiXldTW3Gl12sVHap3zyxSyOknmObN7ImGyMin9QnodWSUmrS2qG0KLosbg+veV+L2ZsLwy1STpmdHOS2Tj5Q5a/O82xsEAHCqKmOMHTA0dTMVd09/XWS5L0g3M96Pw+s56mv37eYsI6Y/es/9/pK1HkdNm1bm87qfgxX04/JKPPKx3CE+pIC2/0S2IjPtGoRlyPTTuOSbqaiH2tNcmJ0OT5jbthz40QCdtydptdsgd2WHg5YUWJHjjrvVm3+msgoMjpS7fDaef+hWIESR9nQlJPheh1xf+FMpaf9jsrJ2CZBMZLHnSes+pNd69y4Xg4LWUHPCb8jqn9RspRVg0LQURBQVetJ7MYJg2QfiSAnxbrODrh7tfdYuXpAN0Kg/kqR9X4U6j9+yo3CfL23PdAaMNg67FNNiW0E1CJurIxRfvFrJNbRyVXlaI9MKEhBQ/lrzydNoU7tQy3LMym+M8R2WDJmoQzDVtIrsiBqDU0k4T1+J7S+U8jGEUIgq4qop14kOUKyliKBHFDTrIA13u+iYPNONOLRJTsWhKulFJ/10gE6FqYEio7E3qt67oPa3kRTVay8URxWcq8flG5ykrqjAMq6Q/Ho1ciZ9yaeoWN7LbZTJDNr6MYFOxuqt8KBESaPL/BJqK8oxydai7CHXIzDW63qcq8lDpxUX/b5+rTencUE+lidGbqUv6SukMmaGZD5arhUW1GIE7kgE3VpgHd4ccyaqaPrRHuCBvLPsuUTPWMEWp9BNart+oZf2Bzk6ssoRA/Px88/8nXCT/IWTdxCaymMD7kXmSwynwMbTupxE/LQgxq69Y4wOjPcfYaGzrDCa2cgrnsmi1dYV+EPoepGMeSbQQtF91Du8nJ/1VdsrSZ8UW4kNkU4Tzk2zUomLD9u3Oz0bJgNBkzDhNeNHaeNboYsndmgmQlDzWrUkDXWwGNWxuOD41cTNU6RLaX2thj17qCam9Yx+
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"malware-sample\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f519c-ded4-4bf4-8707-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:24.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:24.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC61282485464637.rtf' AND file:hashes.SHA1 = '216feffe48abc523daabbf0a0249462161894f83']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f519c-a400-4bdf-b9b8-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:24.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:24.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC61282485464637.rtf' AND file:hashes.SHA256 = '0883544cf28895789521e33706c9d2e3ddc9696d8b36cea2be65c344baa2c5e3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f519d-47d0-4352-9046-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:25.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:25.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAO1BjkiNV40xBkcAAADkAAAgABwAMzNhM2RmZGU5NjViNGVkMTVlZWQ0ODEzNzRjNGExMjZVVAkAA51RD1edUQ9XdXgLAAEEIQAAAAQhAAAAA7XNV5O2Jpz0NdOpL6FN1xdTZbc0edTfJ6TbXncaKSXlh+oWnFcMKIxDZRhYECE+xu3CEpJerVSU+2X3MW9BjKcOaMwbRsrTVwhNwlnJzikTVF/w7zM5VG+cY6GBQrCkggRLri+rd5cNOrXqnTUp1ZEBLsFrvOCjTC29kHrKeoBh7iUJsQf+mxt1DqyKZyMtkvPK5OihdP+VgFJ7w8UepvZkcjp2vJdp8Dg+9D1TBM5HMlaqvu4nmEWVQzkpGLxXwg5QMbXmjznZsTbbcCS0+YaI97vMSH3JFXUiKsO6HEcGhb0EBhdlc7sn8ih5BWlmSGTjPGDtZUyjNseF/cuT7wCPDXKQKVsdnX7EhO/riBmmVnCNSu8tdiUNDi5J6kHESPkJv6JeFMwTHccnjGcpDBvuB0XHHOICbXtvy0fK0RgZ3jsgLvO1gcitlXoB03vWiA0saN2JHI+vNKtHdb44RPJZX1g1uol1vTJ0NlOzdoCYlYWjfPd9dtcFiXPKm7Ov1WMtDEpI0jy9ynuJwWGglSX+soDPhEelIQXFRCJoOE9lAudxENyu8S6Ev9DtjFmVaOD1eg1z8jNdc9VOADUcB6LpekT3SyInTdA2nIqQD06qhThXhg50PMTmv7XVN911li0Km4zbddSMYY1aCPUfVSEfrjXWOl39Jm90ATuMNckh+J1leb/d0VTD74Ee54QpVlRglKsz+VDiIYJXGESquW9e4USRcPufEXJKCR45r9jOGcmdCuY0gPF8NGkG8x2GFMDJafF5f/F9vqk88aUHGpc1fQ9tFdc9GjlufgXQ9BmUDKO89ONz2TBcVKob5JYGgLkbwOI27vwaputy8uFpvY/iJHsi1ypfpSE11dhA6FCfn0G7s8hBC/pTudP1xC+xWK2iUQQnvZF5Fk1tXwtOmiMXonDTyaj4OG1lNpo6MzHEc0XCJg8rd1A7NarJGaB7RfXWl9D8fnuljrXm0HaRZVWv3oG31OwLyuriaodsqhNw8S9RuWlnkjmxDVpkNM/JIiSAD5LmWGP8BN0u9G8POKb12a3w5kfFBKAdAWVZHYxQcTyRukv2i4LrV1ndS2VLjVeTCFrccsomW41johx4Fxq5JjVmOpCkimOhn356Bm1iPJoCWbRJLPWuWgGXxgqKkq5UzRcbl59TuCEiR8MoVRlb89hBPniHP2zTmoDhJxfAwJaT51m/rRUl1PAa1D+QothhjkYRbUbAWlVCM/X3NJLsH7iCfS1INLTtieMz65jauGlBm0jDYZ5UdSqKYvSJ3XPOGSoxsuzRClNL9Cmy/83Yx1kbGOMSWK1/uxJvFi/OYRlizwygg9vRuknNFviu6adcj4e8QfCX0aaKxewYsedFTYp9sx3V5nRjTyA+FK+/20w5BN/UgHcXvnO9flxJfi9UNF0tdwyqSmK5RNjcx99UI/5pQ293EC6e5E/MvbyJLLVMkkEvABe6SqxpVeHUa7noQYteRynNs1ABPaIPH5pR/fN9epsbCFCVyVamUIKIU1dQCsWcQ4lfm7mfCokGce9HtqLYGe2huPPEZxNaF0Bfh+dbpk/hAbHZC9Nd5qIkssJCkHi3qwmC2z0QyDO49nrhv2FvjYphcPPuLN1DYI9xJJbUGULFU930QQor87RS6rGfdHjiq2yGOjH6iBpqxgD8h3mQWYl/hDFR0C9PzWY4YGfZYyTX47RBwtuC71GXbRiV/hbDDV1eyKrWHl2US/jcMS9I1PvJeI/BbNkvOe+Ltl3kWdu3tkmmLlqU83kn/RqvO7EQ5SUI/2jYSnZo/SS2EiGRbx95hwTO1GxS/d93wLuqJhdBEtgPuum74Pdcq8WdHEor3OslZLieKaPmLR6POw0UFJ47RKfQwmH/MLxSyeUNGUfB9Fr8t3OIAFE29TzKduqBfBiFTXUgY7+YSNsE5X8mUSb3kL7b0La+3+oY8M70IP3eNNNAgPPFB7IJ6gMh6DweDjSy3kyJQS1T6ngytIPFsE3adE07M+d7qAdjimoHvV5rkeUm1hCgrDNE+d/3QB0aw8VYzu7h/Td2Odo1ASveJ2FBXJ+pI4Z2x82RSYOL8A341DpoF3Tl/kMmSjW9cKz30R1lbpIL8GV5TmC1MQf9Kt02ONV0MIAsz3uiR5AaYvQ5B0qVnO9a/clKHePUIUS76rUS3wyVdqaS+1/2AB1ka2z/MHE9V0IiT8icjIixQNjEUqG1Pj9wF4H5qtWuD846wzyWo7+yk6h64EAcDwEZ9fFELAngUfK0f+7PryeVW/lmhbocbcPJlzMd4tA7F8bO/SSsaaxPXEg0WLlF66KrvGzC9+iOz4sxstFB+NH+BBhMk7jQlXIsNYtFPaetVwQRlvFoWUQ3wW+nbYT4hPpCWzE7ybmxjFPjmBuYMN6YqbYJUTTWdiMfYXf1811wshUyZRwr4HyFL4h3QSBlp1vACM1UzSxjG/ixOQvvRs52cOW9nhdJ7v9aTUNK877TYs5rt9gUVNwBtMFd1YnvjqXUUH9Bl6zwRp/FgG0UYdlQa/p/sEMA9Bs45l2DQyBlfbvhoF+1yoL+Gs0RT4QJAmza/ssI0sdifQfJbx5zV9OFeOlm19Fz6cOGDVaGlEnzFce/GRZNX9f0X4pCEAj9pTHztUBQCJfXsAHtMn2CUjQHQ1l9bgvRn9sa8zQ2uN/osIYzfLuLKylGXNydtFvhXZwZl2IT1zHCs0IQi8SYMb8ybnNwAgRl1KfoLMe6SaZO/z3VcSh2uVEvw5mOJ3eC4/P8ACI9xObcyNydEmUpS+/CvYpJrRIfyvJtHee3kXjDxNf1TWvXrKRlrPJggmW1W6AE8xREHLxvyLE6QCrjD8bl2VLmO7sdaTul98KVUgBp4JewqZTmhcNGe6eVm7X//BzlSTHJUN7kEQ2WUC/CUZuBOopUPZlUNdk6F8aF7GlIav3BOgD93IsA8hu/SxDFF+Y0MIB+KbCYrXjXt23L4T8kEzIbGlOsAH+L3rzeRwfEDqF93BD6OTempuyUbUinGCXBhjEGBsYp9jj8Xlh3Zt01CGfKrD+5Bj8dfQuaOZjjnYGe0H8/AwgOEISD3YGsm4nb+d5pMwMYMZLmaoFM/y8jeVZuSlerRrFIxEDblnCfCJs+qqGIzzv8T/IOJ7rRIbM/yEhmyWBAOc+eUHuZOzJQ7g5pr8e7QXJw1zYLmUv0Q9XVgWnDvUzjHaclQe+GtMp8/h58f+c+iePrEuvZK4/L5OA8Y892wlwo5t1olJmKiilbo439YQbhmnN0L8MezhPaXzURY2bWS4M8kSS0Az+ZR9VM3uj7fUqa0TW7Sy+zxR/mVifYuNaRPwDev37pbWkV4i2hDsz9B6waQA9f1wbXa44fv9bS4RfXvdbcFUiKVeuD3M5MMLNwZeDlHHtinq3UJ6tx8JuIMXV0onM6+uCysYWJYANF5kCThNH6nb6Jq+dCXwRj2xbHn/Umxd49HZpaiCOItvEJav9qQcJ/kCzwuv+EDqXG1ZDpcP6v/0W+6vBX7Ko3eKZLU5KZQn7hm0YfOdPE3IhvkX08YV1+BuYZJYShiqj9CFtVU79PITFxCGhu00bd7R+kmkwNUWo5QvoVSQFPIjgtmYDzHFKMF6izyZory0jPjYCXxVn7sznIQRaUEbFTE+qpdKH6edQDyyCa5/0caleyPjYJcwzlGDdJGbA0TDjTC4RSPn2CUawSPChOXEFFj3f3Ac08ZlzJJMImjqqr8nuvd40yzbcqhaWE80qTIGKSwNSB93zb6Vew+cEFRSk0DvfNh8R+kgZgTW+0OSZwY1rHd4skLHvCAYlRI8t2EbZaTQD7JKZvwyhjqDu1H0yKOldkZTBSIZhwzWDZ9YV/V6A0X4EDE+m0w9IYgpC+HBgRlAkSALpmjHWk3PzS2nZjJETo5QKPwajLOVGrZClE9p
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"malware-sample\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f519e-2dfc-4e7a-8d7b-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:26.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:26.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC4243802853832402.rtf' AND file:hashes.SHA1 = '5a0db571dd1e4d5cf41604b9048a02475aed5ed5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f519e-42f8-4eb3-92ed-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:26.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:26.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC4243802853832402.rtf' AND file:hashes.SHA256 = 'c7522d14033d237b95b02e53fb9d44ddb85eec2cc2a8a07924f6dd622f3fbd60']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f519f-aa80-4b70-b23b-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:27.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:27.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAO5BjkiwPqGYBkcAAADkAAAgABwANTIwOGU3NWJjYTkzNWVmMDA0Yjc2OTRlMTVjZDA2YjhVVAkAA59RD1efUQ9XdXgLAAEEIQAAAAQhAAAAYMnUgHLpGFHyT+DBWU7Gd3+eRNb3JsLI45+kuw7b1iRKV3dPN+bngXmXnWqmFodfmW0WORDjikpGR599+crEtu+iV8gySuQfZP/zW7qV4RR5C6WMeDE/mfGTRP+HzVlNi+fZ94gA4WHaAiAofbL3FFXdchqP9vQfoXUoo53IF/jgSeis3TdE3pAfURVCHgcf+nE26hxXBoG701emfl0W7vmyGvx8MUMhiGI7t1TGKzc5++cTbb3cnzDV8M+itKKyWFV5R/RGZ+xnjmWp/yWKX5AdXp90v4NO72v/wyLLlS8ov5rI3lufdVCzdQcl8VObC0Zm2qd0SzE/9OWS8WDcV0cdWUii9IL7ftAiQD0CD6Ai5gnfkPhzjI41+dsKMLcydqo0+TL3mj0UZ2rpfxRBY5N40RGNNH5fcEjoXc7ixt5POfJ9U3001hIDDgzOUP2kYpE2SZBZ9ScDOgk5W5yowtwmHW6F1dJ3s2fTIAH37B/OCZC58oP5Wnn0jhgXTzBk3b0BW/nnZvEF/ce8/XUbe97JKQYsPKWgihMh1vvDh9sjP8/cJSCdcUQRx5waxgf2sQZnFLr2QWTuenAP0R+0FtYPIlyA/ochCyctkZF9ptcW8Eut9IiADyXszEyNCuLWUiigJoj3oJpyS3azEMR/7NYEMfGeqSFBJOciNtod8Ch1fho9wAb9EV/kuoLNrSlm06awTm5OccnpXDYFaLb1tMq3IbVfH6M7RYranbgt8AqimllH9BQ0US4EzYp8qaxyJsFZRe3eEslznsZdSyh6gss3LKdUhGs0fa+V9+SSSf0x2vdNnllEOqWmc08NOF2s5/VBbFhAk5Y8D4GjM7fHtO6Nt1dXZovcWPRILf3iJOxP8Zt8ite1yuVz99JUk5++0T9fdNN1igpNCBwPKqyewukMvPsDJSeG6TBYEiWoOJfIxhCoUuea6FlNhTRcmExO+vK/zRx4KOpcTXMZGWHl2dqR1pxiM6a1CIYU3Gm4kz19mkCE+emRyYhafsNsIuZDDHA3mi/tMGS0LkTwFSvR/p8ZNeZOgmVBk/v9a+1Yc2OLP0Ssv68EE/umNrBZmnrU4ovBvt3vF3LQ1gTg+8+VQMwUllgLoc+fbubxrunN2bN6rMTkpbjkkNWm8ji0mgn3SCimDi33rKGi2uupZCUxB1Ewn7saJnLTvEGEICRMDnKvJYCxl+0gPN2SC7+y6uA7Jl04z4N6yYc3STCLNl+pnOpJjQ3+ugUX93Mvx6q0l0y3Fsow1oFFZGuop+79QCsJ4iJKO4X4Csr1WsaGDDK9HcaHzF/TEet1pztjrY/07sScB+4GZXgeygDft3MQHAYl6JtKEozUsxBeNU2j4OPoNJ4izJmJRobtURdWE4StzYXKYVvjb5DuuZ6/mM4RxarPIO7iDCt5ttMO6CBI6kKLlWuJNvSMJ7/2kJ/mM2RPL9U+RstT+KTJn59GIKWL/TyfAtBtQHxsRWOwrLzfh1l5MpCL0Qn4HkP2KPEzlCyQw37s5xV3bn6zFeA6fy5ajiJyHIbRCMqhgwz9qA2dJG3l98G+Z/b/toMc8R0wf50FKAhwrYYFpGApYAS3VYMcKX0iuamJaVgSOoaHVypoO4Ke2Z5MfZu2/pytm6s5H79qoSVBuzn2fRa61QxWlkXu8XPOrPa1MMUnsD2a8ghkxN92Shecs0NVjLN7b3b0slM3KoacclIzElQDFOo/PKpkAulEBZeBEVPjGiiYJjC9eEll2Wf+LXWdJKC+KZn2cqkxs4cVT8UOcZtwp/3B0a8Rvn6SzUNbN9IDIa4X3HD+tooMnQ7cgsLYcKHycLggPpT1B70qPj1Z8OyLmeUbokZ1v9KafQa6Klpblug6Q6OR5slgUwU5M8BOHfieVv75eBwu2HX0v4Xq+DCjy/XcuOOSsqHGkUdEwA1ezVdvD7T8nXregAJh/gL2vNwiAJe1411tpyBLR8O1PWDvLbV3Xn8RyV3eD9ao4kL3X2H+Xzr01nYjZkmfJ5vWq1CX4JFMjfinfSzlEC4VBCW4EG1cIzJRUnXCIMADUUQhwGd2ldg0RpvefoG2YxsiRY0IXdZ5MlDgL61EGGU4ZE7Dy43ZtSdiSLd8WJ0iBMBxueT4BatavocbGQn12e8ctk8rmHCZX6d8gGUD7+Um5zFdB0ZrtJJz+VcnqMawjDyLn7f0uSZptaOfoJGK7z6nZKP3Y9cEk1qadPH+zjhvrMiyXKwkrTCGcho7guA1stpCISSnlAi6AwJ3039omrm2JsinFcUn7StoxoNWjTNwAzG0AW5sZf3g4AJbiNR22k7uBu+6O7bNtUSZJXdypFC5HzyTeigqEU4m2SkVSygs0AQKDHjWQ8m0BG5rd3nxHa98i28LD/UfJdB3xyurYUy1mTNCagr+U4/AgvusOPbdUQRPvZYYtk+N5NzM6AZ6nYhaa5D/+emnSwBrZRa7OGQgKxylsZ00OIAMLsIYi5l57vkgA8wePensfsHohBYjoANot1Xx3gupxPvuvOEMV5UAuvlVzfHKwQrlqTeaE6YGl9VNJXD18LKNPpb3gSbn6yeKnmNGmGg3dUGf79xnV17P5bR6p3DN3koHSIiuaVwBltm5uVlARCDDydDKa64LQ4Oz1SMWv/vujkTCuET78ZYCJnxJsvOnEXrPunyCyOSvX9E8L1+c3XFQIo5w7tk5z1/LPtW+5BaqKDF9duuOTz3ur7xyZOyZYRwXx1RbQYUTyUXvBaALurIzk9fzhJccouqsXq9ezhWXXxpfV8mfox/hSonnKA20F90PCu0dOyStc5krD1Ly4lFuCFSTSfGEYtxYa/8bdmgfFDz0d5uyf20thBhtqtobbeIqTDlKR4s9SsUZsg2DvVjTkCL05jmf35wRoX0hUZrja5hpbAoD8F212JXD5iaXH42210HILFi2palRLwPKbMUbpydvC29ae7y7UP6WCbjxe8ZLr1QrfqAtvEMg9lBUAixsCGfI8OEeO5JV6Lnr7R2ZftxI7juMNseQ94J/pPMkDaZ1ZhSSW3ZdGSy3EppkeAKNe7n470wycfvGFeAle4WLb2X0sQoRaABXM8sDqTJruwr+70eG+ZLPXNha9I/0QAP4aIoDj0kT+nCXNyvsWkKQW6pDnTQyWWQr9Ii3qb2p+bAnEPjztytvTiQNAQijU1zyekizc1uZ59Y5AwTC2YmiXVS/yCgZqP4BWmFEUYSAy29zsKBn9C9B/D3xqo/iWrkrt7RR6sBCWjy7KTW8S0SBzxJ0ltcNO+OfaUK5oByI1QrA4nMIDoIc96IKhlg77Ks9hQoYMWiWcFMhJtzgYBqzqHNsYn+3yOxApaSuUIaAjV8QndOC/LQ+O+E+/OclcXPxp8JH/1LPY1Y0FTfMwFjoZ5bx5id04ZoLEuvMKbygiNGwwUw4u2225H20a+C7OML4Ee/xFr7Tqz55Gm7SMgNel9jRZq9UBNI/ZxMsJmjNyLxPNK8Fys6gEZA6hk22WBDnw5E0YUynbYcwzwbKJeH28bpxjLN4ClWa1XGphc0W3uljyNSzZPySxWNgsD2sqx6sBzTH6XuImI9q7+Eyvt73r8N0BaXWexoMaYDy5iZmHZAN7aDd8cAKOfq7ENtFGaWNruGhhVDzuOpieXmPDBHxjBIpv827vJvxh5QaZoM2jRWnd7kuuhB9MxYNjkyCjqcaibxZe+OgdY4de3oXoIYJ1nQWlPIq9b1D7znO5bXojGeZ8pp6JUpRmqLelGTQO5KApxgqGC8ri75Bye562TX9oa0MnejLEaLoEfIczgJIwNqAvrKa3XBpY3Bxa0GDv+v2gwekOv4lT8o9B2E+t6Cn5mqCSTU+8Wn/Gfn1vNwhJJZc1VL29+1JJCmy6F7VKd4lWwNeC63DBV+IyxqRwYXbj+e35BGO5q4mticHDl
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"malware-sample\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f51a0-87dc-46b9-8a3b-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:28.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:28.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC16362739244285289.rtf' AND file:hashes.SHA1 = '70cac1d795c80e98cd48ef9db38322bf8949c4f7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f51a0-bc70-4c3c-bc5d-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:28.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:28.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC16362739244285289.rtf' AND file:hashes.SHA256 = '9fc73cea21b278bb3533287d1f405902f0ef77f32c98cb0932bb527d94e13589']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f51a1-99d4-4fe7-8e06-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:29.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:29.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAO9BjkimyJwZB0cAAADkAAAgABwAMmY5ZjhlMWFhY2Q1MDk3ZGQ4Y2ViZGZkYmI5MTVjZjBVVAkAA6FRD1ehUQ9XdXgLAAEEIQAAAAQhAAAAwt/bMbWO7RDdz3LEMOJUShlrTw1Ii0MtlG0XUhAOl2rzrNfTqDDq6GnMFPcyXlzJOlyc9oMm7Y5Auhvf3WIXqxnO7zTwaSvfGOjoEYNigN633aScCipYuK4QAO6hmU7nCTk7yuAKNYibbpV4wiVXywWNQ7Eu2iK/kOzhSqp3oziWkQbLyLlob+PvqXaxxOF1DotUoiAdTT8SuYax4rprqvSUb7ezWJBdqPDduae/xFPOBp3arK9UZJ1VbIOt8d+X4PWFi2SP1UzWVjvX0cGnXKei5sGqR6q1c8038iQJjc16KB6xXr+Sek9Uv2LF6UwnnhOew7j2dAs+Ngttwv83Y/PqF4If35TkFwdJ2ET92IHypTKB9GROgfpbW9RLopf3eHYfIz1BafooEhXneJ0Wj8MPyTGXc0a4XAFe8WWhQh0Mr+hZ9UzU9Ut5GktApm5rPW76iFmW+KTWo+8QAxDAjNc4wQkK5f9BJNf77GCS7asElE/ZLmmTyliJdOwTLq+xINK14Or+snWbc2fNR0HHc0fGnLq2mNLOkHd03N/q1fpMSKidVQYFdJjH6JlsPyqwH8HF1INdehemDp9o6ZBAXOCrCGgN02ogtM2Z/9Sj/1HT13M55sM+v/wVAHA/DJMUWVciiEVNJFaeuM9asUpzO7t2eODBWnE1ZTt468W+U3tWDF9EAchY+vd1/8xn3BAWBW3IIY4YwU/ANGOVh3gNJAgGE3DOg9J9bYt4XtMA0EAuHwGHF6LRYk/W4w16mvHKcoHBGLBgcm3euP99ogzb2W/YLL+6gEY6T09dIAZhFyHfvC0sdS0NQyYBwJiwEVO53B17Zx4J69cYkaX5j8mKvpmfI7JL+ttDJJnX7AX66/xf/cCZ4j+1YwIDhKf9oi3uHIl0/YmixtNS+CMyBOsKTKePZzzK1ITgzWD+K043kV95Sev9VJeLYkS2QudYCo8yMrt98R/kGVgOmGLJL3kWsvTfqBwEYEoNyoYJeZPb1TvOVg61BJfUIfgmQjieKRiak+eC0zkjAPyB/monITOcXK9jbmmQEubyl6LNjhuStjqdraBVI59oeclq0IM0hBJMqyGCNtNdPZKow9CVzMyBJcvWyDizyssHrfTbojKIc2mlzcgccEUJW5PirV5TSNWB+Yed/QA+WoIW1yiGJa9yvLLPu3OgYmA1T9VwJ+zR3aaaSu1ZIZWxizlCUUw2zvNnm0eO56rU/+PuPADzLSbDiXcQMlWvgdLQpKUEhuMd9GLVTWxHvVCmsA4jTv2RUaIG1f+cScX9g+Q8l46A5NHtOAeBm0gUA+SrZUWVMySqVuFtPVZxp1E1p+6A6tNs//7BNPF1Q8t0Hv2uYKpnjK6V4k2POZOHa2KFo/JoYC7oSzcV2SRI90jgWoSNwwnONKwCf86+TeqjuYgukm4C/O+MvLkn4AcQRZFJed8/IkGQDVH/DwWN4ftUIiCGkVf7/CztMyQUp4aRQjw54jB+td3GSRQbt76jbpga2uSbwjfFEmBZNV0nWsSkkNEhrWkVhHA94nYxQNEW7ltazyLzXFsIzcE/boh3xeOFVQg5fL7wqvtUFoln43g8qD8SYHRocD2tEhw/6Nswj2i4KoL2V203WSCUX/qSsJAjHFTiyU4az/QymONNyh6XginPdQFyzSLjQhrIaOhPxCQ/8g6oWrr1YqjDfteoxCmCZv0/3d2x4d+q8KKkerab7958M/ithUX1M02iwWd11uiWty85fdFqvv9fGAmkj+DLpBr2UX5HyNOlE7FgPd61Bluj+nFUDb+BTH5hUzEU77ecXydlPAvLiSqFRQpYSWM1ql5Ep1hyN6FJ1fzQlEk8vnaTj9liqthWBZuvbOligRq1N8z0VHtAMWaYT9nYn8HFZHmebLsWjQV6L62U5Kb/3z9N3aBo3GO2TkEheXpJjlNHC7vjVia5ByPb7xsee0/x4I8Zm451DBbWE2fMmk1apamx+5/S20n7eiVBUbGyPMGd8zkU8Xgo1ydP2S/FKOSuk/P9qPjv+/TYfAByn5AOn4OEzKcZ6OsgZkbFjZ3HB0VHmSVkLnb5GSp1rqNkoZ1wG2cAq86KRwb0qQzIvOqqV1ln5yw0iSaCvw3uYvLKHaOYwOuiHU1v67jyWwzcSSEBP5hNVw8xcH7PnugYX1/iz+XrXSaTR0Irexy7UgebBxT2orMXAVC2pnPRmlkDTMYo4Aov/jM6NUN4zwJEZ1qhxTevP3n3ELQsXuDmZbTR39eHfSuluYm9ulbtBBE7VQBpfFpFSTUrpj7UOXGKaRQprJOgam6amouUtOB2S7ZdPL8BzduDBMn57tRTGo8TqrQoAv6zcoAtAnV3tgx+U8NahJQbR/wI3ormbPOn61Fta907BsTEEpQfCe7YC/lpevPobUFfaFgBYle9Uku4IgHSOhfWzasTmZqxDxo1wce23zxNR6uhyuh99Ke8CyYhk3hn0JXEhKyHE69jfg64gVPtTWnFJcyzaxKfKOFLBmKi/nDWI+4wTPNtVbtFCY0uxInK1z0aQlHuP3XcMmn9whlhmHNTgwbPZf/OuXFni0+ozX6y7dRlyULs2pRTRA6Y0xa9fOKgOUuKKqNCV130V3h3QiStu6D1/vHMWPQaUrmfacDngTNN5pz3lgy2AlVdGfGFp73DPp0Z377/hI8ZNB5Ma2Bpd4R6cz1KhMO1MIot1KL5kh4OWSlnpqpgWxcYlLpvqNfBePqQHay8VBaC4/ntgO94a4MhMb72UzQY+Tja1Yt0sA0vKIHXMcO08sGGEFq6wSI65GJJqib+mhyejxo6R1L2XqxHXoDA8AfZXDLKfLw56homIN+u0ZyRsxsL5/k1iJ/Qf/vbAXPgXAodjfD2CA3/ZZmPK8zmXDI+T4cwB/8xygk727nUUn7VegYk4nxJNdPeMI4Z7z7EuYUwtARsV0OP+GvqfQjLAhH8AFkOUmcdrv8ocLQZIQM2h02/fHwziwsGpzmGkY98JXsqTfxSQdZpfo+qY3Mfvt2k0Syv94NMHeyyywEqBaGTdudKdDeEFk+xT6aqoSoADps0Vvj6As+6l9VVlhqss00f+IBSCkB2QNRCAIeNkFS634XxE3IVVFX05Zu0AoqGDpDGshqSmM5KQD6os2SvWx917sE7+0+avOyhEwSUDpVMWobRKHGjAD1bawm91CSKGr+6TKnsE9sK7fDqfDbV1Gzq0+asy+wwbk3Dsc6WOc/3wkPeIBocbb9sUjrTJC9fbnUz6zRmt2RCGD9/vgbB7WDD/rSut9F//S+9ALuAX76GGxdSLlTS1NbPKPk/Z7SAh/K+NcXeQr1LMXM8g7z5Q64LAWU+sc7mB9H29LH/2yRUO7rU199A9RUkO4rS1tOmFPhztQp1cPfmB34whVv6DIzVQjtKtv3HEbAWdyIXW3/h3vt/3CWsyBhzAwP94+MxOveD70W+WaTGLNwa8BxR/KAbSNVpG1gMn+t2Tlp8cR1m57ty7ChzevdgXWFl9/J7BNBJcziaKk7me47Y/sT27CnlKL/nZYW7Hu7RAxBnF1EXwzxI86XLLJncNhD4gArqmLTN+W/Le4jm9y7RQjNNunGsnt0jrJNfGIrVr7fGNy3Z+LB/gGus8ifpmcMmBeL6WeMLRqrKfhpF3hJYhbaCi9WgGKAoB5KNByFVyu21ysWolGIKNNpDKlgz2oNjDCAbhJIcKn4c13kHPDpr+eHDpvYeYsPCX9IN9jnEeNLt9HR2CF2Eu6u8Y9p6lP5XeHGiUo1rVxfMbwhcp0IzGPJmnKx1ODb6v0HTUT9HQaXngEG2jcB3wbXRKjdxQHnH67cFoKzrjNbzInF8Wa6viMjtPSiZkZ6ApJyMjHOKsYuPqidraX9i8cD+P1JwpLBzwOJq44TvqR6/HBnOadFly3fg8pMlxHn6DsktEz
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"malware-sample\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f51a2-bfe0-4d7c-bb6b-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:30.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:30.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC00818462473972130170.rtf' AND file:hashes.SHA1 = 'bec689bf89b3c37cfb91cff182bae96ff38d00e7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f51a2-4d3c-47de-97dc-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:30.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:30.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC00818462473972130170.rtf' AND file:hashes.SHA256 = 'a9a959362202574eb35e7d72969583b23c298ca35e4d96b92816b282fb0baab3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f51a3-1390-4062-acdb-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:31.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:31.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAPBBjkjBFTdRB0cAAADkAAAgABwANjIwNWJhODJiZWU0NTViNjdlZjVjMTZiZDRlNzRmZjZVVAkAA6NRD1ejUQ9XdXgLAAEEIQAAAAQhAAAAWxocD7LyC9jJpRMxh/ypzu+r287QjCCVlJqLwot9XZwHNsCnjTHBS7JiS/iXDTnqVYGcdwkdOPnK2tX+fXnSjJW92FxrRWcndjUI37vjEMIr18zspNczP3NNZ/ngUhaNKNwDZNKgipxLqy/X4gsL6TIZgqrKNaCImziNWnqluEaS5u8ZePJDSjgLXiNyOdB5kAJ/XuKEzgomG5xEZ56rizCIflmqG14h8NNSYJp5wLtwz4Y529TFAEsRgs28Ge9F3mZPaI0A61FWetbmRYv+0a10qZhFdEPhpWF7O6Op46h8GU0fa7km1wtiNxMm776CWbeWHZP3S0VY+NpqraaKwe/4tu3X7Pas2Cco3q5xRWa6co9dAa2uJUd/Ra2Yu2+RosBw3cQ6M6uAiDkMXGhcGfY4Y1T6yAJmBYsyG0L0MtNfprUHJ63mAC92qzzCU1iCZKuTPDlRzVMHyovMnF1cEtolNarYmDlhgtU7E3jaxpLMsqmLuXzS5/+nXVswYcl0ap82QA5JwyfZ0BfS4h9VrP08VNitHeeNf9ble7MjPEIM/DYTef3YsJXHE78SeTScMOwoiJLsc4tt/RS6p5Pudz62/hZaGy0AqaUma3rx8rp5Qs1FHDsLX5/5PQv/KJg02nOYZIJY/S7c6gSmNhK9fXbKc44K3M+piQLvBMjbsarN3ALgR0F7UXgpA26sWOkjVZn6jt/3n+F8p8Q1rJvDrDOIhTdgmUKEGofAxZarHHNsk/qcKrEqondBqq+J1oxHMBr63mYzm4ZLZvZfIJGSpfxT3+oyEJbsH7p1heXuRt022svY7D7JmePDV6+dosI+275FJvlLjYZjLo8UG+7mdooXMOZOaxRzSsYHNj0swTw9MsCtBCOj4i3OwbTdey8eq3au46o2rNF9wSHKSdQY+SohTQ1WOnWO2E2TRs19xfx3KBJ2FqDl+cdRw5dlgxFaOLlvom3rMSuoLAXGbrrKpCRDSn1Rj8UDGD9nuUkfp6o+7Sza2VC2CnkeqxAroaU4gXpYGW44jL+7L5b2hDn8VLCmFeEDxeDt5PfkuuB3hDG4GWQ13hPOqLtH6t3pHGCsIcvuyVHP/OdBcTtEQwCvXV/xRjkSNCk6d6N9cYmUKZE4oaEUyqGc14lj78q9ZmFO5o1a8jy0x9lW231LNZrX2oa3bRr+2fap4Dar5tu1lrs14WPCKpJ3PwVv2qMYqYDXmWuGnj2slStgWEmbNc5fUtUf9kuvwAmV97E7nU2SHyXmL+kT4JU12qg8p8+2BT3cWZyVRS2PC+cMOgE5JlaJOGJ8Bem8R+XakPBwwQkhTC9jOmWsZ4n1OkGYUVRptEUbtN6Q0CG4wGe4BuFzQg4ZcVWiT5MWE542gw6a0DqhoDIglZTzDQ1+EZGMLPV0R9Wy62XGNLh9nTCCUqjvYf5/fjXiXjmzZ3lQmh2l8chePPgOOAHU3R/uswDDQfrTAXGujQuJYtg9raAHLmZRSMfRY7kKhKtSp8zX5F14k3dhZVgd5VFl5UzEQlswNuJIG4i477NUH1vVAuQJ9iNzaD9NJkjstCISgHsFnaxi51GKdHKl1hHkMMg8optuiDCr6bIV2EwDydcT3fi+5K/TDyaeMoDFT8LnJPUeGtFkeEY27WUHy56hSTvi5X2LDb72G5Q+gZL7iIDWg1Y5rd6kT5c+Y/VOlq+1s//EuKoGL1Ol17SXP1u8SJm0CaI3+sXO6cQroQfYsLlpXBPME/3iy/fLAsmbNGIe9n2vV9GJMsapUkhNMelpTEN+u1XnvvVh+pTa5e9ANK6Hsasr50ZWIQxFg7aCguI9MYYbV2j4QhYkMM3O20iK9YGhbQ+A9tIFy+mDR9atv/o9Z7gaG41JFDUru1SeTVXyHwWIEypTb4qIkkxmObfPiXaSqNsRV+TXrwaPM+7quCEUDyCr2YDrilDZAj+EZ2s2xG7UGUuCSLFD4Xajrk5ihIdYTPO0/21gEOy6BkpyAln9EXP84Id1P3iZuK1APDn2dCMx5r+VDiv9HH13O0OPIeaj9zsuukO+NUky2kWQy/4BHAvZw4+nuetFfhOWFCwBzQn5dWbwbvxfds2TvKrsMCxHveJyBhSYvpQ67VHc7o6tUlhl68CpCASlwmpQSHIfZgoKjkmm2tAIwSkhSKB8on4slg5dm9MuYUdTRqyUU4KTCPK1RofZYMyOa+7XB3T97q2n8buYlqkp1mL2coENzlcWeQzHBRqwvp9xNb9v93GExKgpnyomRymNkULE8U5tAiqevJoO4SggXNyQwSmAF1R0APrVlXegQYWnaGM+Ovms40JluG+0W00rE8FQOCw/VahrF1Kj5YP6LNq79jUQrpubiY+/gSMRppQ/+JPjZOehSDCXAb0nQv00pa+NreCMGmbYKquMon1CwVLEwtkXUlV/SCmHDUQ0gmob5OU+LnV4pnqedYJkbh3FweoMjVxAw5fUrBA7nlVeSj4ZwvlqeyaO3//2bG6gg2ukXz28s/QNoombzQ5MByZYGsY+EQLKFk/JQU3xlpxvdFoiWm424g0DVA+cU3/OtMZ8g80OiQHn9NJQPne2INyfIuo/iK/mO13OSux17HBqcX6dXrmLiwD8zZBmzDROjczOZjwcGKOs9VWFe2YqcX/n+M+e7hxxs4EXG2bRJwkHj+3hOQHe7z7b+awn+PXcdSRQHYBsDaABufW5DNm+yc0qf/HBPho/ofu/GVlowCCFt5v2Y91ClsQEaoGocHaN4HKQVOj2Aq4zobZGjwv/DMwiC1ZkTH0xJNG7iLTh8Ufkh49Dkh1vlE2Yn7WHpo8OzYzUGpOClEFsL0gcT/3v3mGPqOffQMVkLK31MXh2JnAF4hDA2zAg1JRDE0wV7/WNMvcrPsNLGfuW8YgEWsr1eVMvj5jgs4u65NLqoWo8vh5UipwdvkkaWhRQAySRpoTVasYjLLqsdPz1wiMuEn/hRP7G6Xsag1eOfZ/hhJBIF9hGe6C5Oc/qtlmE3Cfi5IY+y1+fTeDVXsbDZA3nzqSBO0kZPWlmjz/Ube1aFPrYCtuVMWMotoARmWZdSP9Ok6hhKig7J3ku7ZriQjVTG6K+yRxSkg70/XwywxbhAxFPPKvvBKPWoolCRWiJbCUoBrLDwYSggun3lY0UCAfHDFKBqJjqICYnY8wKcE/qjSlBohVH9AtDp4i+sHufNLHFSBcWoLTMXFZjnQPnPkekfU2Fyxrsnve7YlY6Wa+WXNbXIhTsstQNQTXgrX1ql2sUssaKcrePO5AeQnr5XtpS+OIQyq0cU+PiFmU0al9NrrcpNR95jvqvGyXrpCueRK9co6TyGHfQxlG3twn8VLFKHvMro9PYwInh3s8QiqGi0a3A3Mu9dKEgRDHOssZZwyN8Kzesobl/RddE7inTTAwxe+EMEp8mldB6c6h914VJefPzEFNj85JS6LxG2NbSkWOSUidqvXjcQiT9O1vGCbh+9D7NEnH0teo8axs2i1FVJmdRCYxwloWRBgTOtdk1jf1jGk1FxDhWd5qiW7jWPhuOXHz00Xlfu3WQBb4+GhoLNwD6M5g1jb6wV+wGBhjOvWuB2GOUYq2iqebmoW/JONP2d8NxvMAi8eZ83BPz/I9p0uUY8GNSjHpmUhCc9VwyhrrapG5dloaXgrvhOfEHubXAZt9y+LrqOkmSJIZ35yly4wFaEqXJ8FAW60RiutBX70i2Unh8bThTHi3P1hyaaawlLxaVN/KQRPkIsNMBxAA/Nt30lxoqxaHw7c06vnDU5beRxtjupt6wccoSDVsg7MoEolBWtZ3HeJEqYrvTKAJzuGJtEbCK/KQKYV3G3nFFEEC5S6VFBLNvjU5LwyOfVGvwI3xdbhi6KBccbuAfD723AsA320/M9iIaRR0Ctd0vCbiVQ0wo8nH4JMbnnLvog9MMBL
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"malware-sample\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f51a4-37a4-4205-bee4-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:32.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:32.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC01188434592731188372.rtf' AND file:hashes.SHA1 = 'bf73c33a35099a2300c9fa855dc83fd03d6fc3d2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f51a4-1180-452a-ad94-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:32.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:32.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC01188434592731188372.rtf' AND file:hashes.SHA256 = 'a3d68a1861196849df4f323f7363ee6c00a2232d10fb0fb9acbf071f23f4b131']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f51a5-420c-458a-aad0-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:33.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:33.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAPFBjkip1gOoBkcAAADkAAAgABwAMmUzNjI1MWM1YzIyOWJhYjQxMTdhYTQ5YzllZmMyOWVVVAkAA6VRD1elUQ9XdXgLAAEEIQAAAAQhAAAAZ0aUw1tac2xtdFQbc6TlOaXzjVbPNbVkQNXGbtnbsCzO/+CP/DGOzVYt7L79joe63d8Q/26mGABrLXmUzctlaST6wAzyJrpD1WwD4yCEgYGBsGCRfkvAi6HlyDzCFG8qkdXN/khU1WRFPd8CTIFkQIBTeOq8BOGdVK8nQnh1Noa2wVU9+NEM75WdVY3gmJsIJ0EkZicEHgajPfGdC68SCbMtFB4HElEy0YubrUUNIwDTncO1P+yUiknkprf4KIdHLEp7M+FCOTcNxx5NJ7MMN7lYr8fZZDw4KGagm5mCq6UWf/90Dq5O3ybigVhecHa5ODgRul0B8oG7enq0VcgesErjDR8G1ewMWd8m7Tn/9dASY8Fm3BVIqGGehkMP1Ck6xrPfsSKEaFunau3aRuentkvB1klCEDyQJZ1+ybjuf6/qX9jKxPNKWe0foQF85aiu7GRrKDV+XLmVkYGggDAfYJnQ86i5THv/Wtd4dTy15C2ABsIFB8AjE8y2YXJtAi+hbwVFkbuehEnvLTzO0Fpfowmk8vHONoGjwRsmlhEkMafDMavsU6BbGcuVfFzmy8RjHn2yxq3/mvDu3vxrfByfr3v3x1pMmuLEhsspTI4NUnzMvqFPQtsnZf8m8DlqHlbI+yVBUWyP9VSeZFpia2Mrr69bQXhqVCyyeD0Ba3gM5qD88WEujfW/X9Mdlzbu1zNCkQbelHb5mS6G8N0MZJfyOTzthwuFquzzyEPsKW+32zKLmRdR+2V7ctvHjNgvxMF3JEbZqL4oXNpUNlljONGXskWy7kSVGcksONIV9duVzdZywV1Cp3LW13ZkN5tBwMMHygX59/Z3RjG5veop7t+GO/YwvHmjtZIZMXnET+JHK7cR9Qo8bRFVWbKuJJCwZ5QW24tGoAjXOloLlt4D/fSLDlCTu0XUH8a7fMbDjkXDPZ5j5pQLCulhDWnHOZCx5n/VAyjNTamDKS6vmFpJAJRWGUzEFkNhrQ/SYcpM2fCuX5U+dRPyQcXlaLlcK36wouWoj7mtFzsmBm7qFeujgM4MoUGhBwotSRibX9WaxMglZdGd1bPmzthsRui0g6fghJVywCbfEua0fhekFjbGUIBf0lN6xIgmy8E1+34DywLpV4neZvaV+N4bB7z6ZOp/S7UABZgWbqkVk3jWTYt3uXXFkfTTHetv942DxxXDUFyL5WIYXihHnch+cDSr2nqEwI8ZAnL5o7xe2m8xgS1cw0tkSxgkgr3zgEZj6D8Q9tbkQi/L6OdCial4CIpOizRVAY2225AgycJWiayL/v0Kym4ZbepaTNUdu+AUdOPMv8siFE7ikNXMLxuoj8SRrvkMIMyh9x0XWM9lPq2ri/QjeBqvDUdkY8DbcG0SZGWXc9lKFZ6VJCbIXt0F/GZ9vnKasdxJkmGP8cvYuQpH6ddYE7b+IjMme2uwFcJLPJSujYE8YefXY+hbEFlv7vSgAa6ITTMjke1rhI/y3eZ/VO9Qsq5C0fE4vEA1kjhIOSY3FklWUXgAsiPZbv9Lg86mTg4VRkMv9ms5HfuFo+Xs14DSRAhJXYCkOxS/wvEZxHXOweEDC3HR6W+cMsw1K6odCr/qyPj6RSc21aiSL7h5B6ojhNA1EErn5DtRXQHnxMGqX4YlT6S4xKM68bq/XckJieoL2KgDekpmTkainr8ztfGk/ZWxpa5c7phtxyXsIjpkvn/5dmQ4Z4ge+fLMNRpQIiUJ1dyTfTNwo9nXhBJi/FkD5bBCDemMvHhYUpLO6LdOov123Ai1j/ddVtOqCd8iGn4MR94LaVh21hXptbzMSN2aoVusCGXJs/O/+EFSrYw5eyeU+LDknjGWbhO5Gzyo2xEmggHWHUrR+CoiSr2azqdqy8R8BsJrBRSqA5bjon1vus9POJpRdGE3ge0gpVyPSr7JLooju81hlUr+GM00ICArGPdxQ5s66nBzOZ9xRmFmLXvCyBsRLUBlR092zpubbHrTch8tvKdCrFpJnavSKmipsDBTNVdLASJqO04LAOK0OZm7lpHsO2uDmpqJsZClj1xhDKLPUqtLvgduWt1ve7jNiH8dDCKvdJwSeK0+8WEFS7YACxVQG59upOL8+bqTmTxaBPbZu9eL5dWGyZS4sHkoZ0Tcc2Zc1GCee5k2XfeqoU6GPz2sDhG7jCEz9rACMw9S+mzodRh/glsdRzW94viDj8OBD1qLBioDbSO6bZpjn+T99O99/Zag7ZxSS+a7Fts2S0f/E1pJk5LmGa8cNK2Q/klPK9H8P1G4mSOnT5vhQxK0ftqcfqoAz/uvi0lPGJZZ9plL2rkLpMgbQXNAVs5QdtAkNhsk5VANpIhGSsCUgYJGtdbe1lzSERYlEURLdnlfnHTIz7PaMKHezCn5kw7dV5qQcBGzMEX7ahDj52ULDQtDBCOa3O32qojtv+Q1Zm7L+E/C2RLeuRu4qnM4vUBsUaXyXbtdz//jY+u9KF4dU+c7Yval+q3K288Hxc/6MEog6QNc9bdgsYR0UwCeIuPbf1iIVedVxnvQkHxtj+z7xl0wtDazljR5cxhHtXd/rSY0xCVOxOpEa4GU0JGLMQrltjTPR+Dhq92jwCqI0ehbw536hT+aIlD96MdBff5XruW2jWFGt8OLr/UbCSbYjhFxLO6ofDiz/76K2A4yG05e6X55coRFF4Q42BIm8y1SYmBGVHjqH4m9UGXgnNPOw6/VXD+hPrl6+6G4uOSDXCSTp90eaKuD0Lr5BITL32VSV9IGB7+sc6cevRR8kRPwQFlqhUktq86i/ahqHXUnpOeKaerIeWENdWfeZp2f0KgB27kKRjhwMi1RVTknadLtepXHEfzXH2hGH+cPS4o1wFmmbaROrif28tVVyukOIl88rCTCm/xGy0/BQQXiBHvOACpWJk2l765oiHNMcD0TEZL5GHEe/NMEl/aLvY0LcwvpLGw4TnTNrbON18OU/2Xn8imBzPvdwina1x/ZU6VMszCERKfjyEnxlOv7/deLQE4oQEs2EataYCqxb6mgLE78t5rCYT3967mOmuF/Q8gw49Foe1PMcmHHC8VtTZxWT0DMeH3KVRihMtvnyofnDmOvVcbA0vvXJ8QbJazvZdHe5RdDwiMj4odJcvKVDIbW8qzVmJd2iqYSK9npWn/qA90/NNVH4ydD4S7MUv5EWsU7h8j3XvqK+x3F5Gqb/zJPpHpJHu0XW9FOhL+Dv9sb9pVTdGOdf8kLQ3IUkKdoHsyO3vh9SVz8hu67uXM2wR0qRowLF0dBnywC9jpqYRmE9Md5q/81Hj2+Vv3dyufVr8SW3jIaegPvwcCytiaZ/eW2EcsrsYuZlxHN/qCyfpt+Ij1MU7sZ2dLhbu4cbVJwigB+qmxO69pwqeELDeyzJBqyAQ6xswwYgijmirEpeAei8tUZa+/Sgre1GeKiCGlEQBP1Zkwrn3rH6FB4sBobbUASrJ2DG1n7JWwmJrlxMevWNqNXTzeYvlfJLRJ8VXofRJVRBGysDNwfH1ztL6vd48NPqSREM/3Kv0EeVw2VHvoS8YSc/FlLiK2/7oq8YVKVm24quoU39KH4dSh5/jOu2pSgNjAk3SBSD8ZRCMSTif1+8H1yf9NV3Zl4fjw9d5YxNM/ab/7jID35GLTK+WQQ9OjzoAqsXASVmJnTpsChP6ef2FqHRTysdjL8K75BhxFwjSZm7ePyAncJsKmSO3RU9gcEaaKQXyFYvEXmruYGeyRIMLmjX+XfDoUVv/N3oMDLIDqFm+cFV6lGIvvqzOxNzmPmuE+BfTe4JCQTVitmPEevQOW6Ck48aOMduPQ1BwWHdq/iifEtcP5dWi7fNcGG2M6Z5fXSU2DHJ5+mQdAZ3kL3q9IzY89N4LNl+PZOcnmacBg+ytLYiFDHBJjxRi5SvkP/0XKFcZjxXRAdOQchdjxNE3936m
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"malware-sample\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f51a6-d7c8-457a-8672-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:34.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:34.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC01366151563189497417.rtf' AND file:hashes.SHA1 = '94b6c919b6041d92e5ed967ef9c47172aa2a36c0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f51a6-99e8-4ae3-9b58-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:34.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:34.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC01366151563189497417.rtf' AND file:hashes.SHA256 = '7fe0b7daba06a42f2aba4a51398187eb08ccdb8c6d2341e32825c3f01c1ff018']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f51a7-db28-4bbf-a4be-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:35.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:35.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAPJBjkhHHXAPBkcAAADkAAAgABwAYzA0ZmEzMmY5ZDIyM2NlMjJiOGQ4OTM2NTVkOTM5NDlVVAkAA6dRD1enUQ9XdXgLAAEEIQAAAAQhAAAAWxocD7LyC9jJpRGNPwBD0dkUWHS7S1vbka0RX0bg/I9QtPjWkxxsrSgemadWRud/mltKOM7TUGqkgB5t02mckjTrkKOIB8XDuQ88NZeHOLz6H3ojmkexqkA5TcbUMWM1uvgo1VNBtgl40GUHomXrHl+02kYlpjkH7hcdbCw+s/PSrZrDcg8VRN2PmwP4nSGQ9+bHKyArn1NCyliRi+yTRteadATGLSWY78bDwPRgD9S2NjInJn+mDsI4pt5M6BHByA9tq5ZzqmJJPJQkR3K6qTzCeTHhMuEjHDW+ykX+TwLVhkFxX7BQWywTT6uXcgzFMt2/GhEFI22RiEhb67aLVsJZjDJ1vKYhQC+zYCpWy2+CqoDCow6Hw1/o846GQy3hP5q6oFhqWUGFar9KKqWpFfU88TCy4yDGtrb1YVb4o6OApNI7IkI5x+fI1MG//noBDAx5IWUn1eb4EKdXa1CYdWo5jQwXb+jB5MoK+LkeIC+zwOfIrCaGNwiK1uiphAk13h19VMTHuguDzUsxj/p768hEYA4k+POUiIPQ/FyxVWVF4LO52/iLNSRi13HKl+Tb0GaLoE3huhxDImKd0S+W9vQRdty7HNE0lEsgU5b+ootLw5UpTt/SDT2wxQw7yCz5UbCnDKxI5XnlhvCmjgyVuCFD2YJdL+Xo6Pe/t3HykO3LvGsegsfP1pNZyRJyNHHEOQgyu9SpWx6zyPuNiWUU8RcPzrvHBAwXlcmJr2MburoKfEF9VtiEb6aZtr2CdhXtLpJaqavOL4gRyY4tKIB1WewtptOKjNoH9Snoir4eXLVltZiaeHt676JN07M4MXVMNLWlfezPilUX/oRFszB7KhHUX+Ns1mrUvTr/4tOA4lp+wwOjfMwoPrqLN9Gh+bblUUSWMRUOW9tNmkRLtcPyqDpkp6QlvhYnCRa7WYtva3lQP15vr/A90lLjtuHg5/3EgMzdL/aTimyTDjk5H9d7ZNY3/4c8LM9xZfN8AU+Cj2YAqdmFUf4BrQM5QOEUavr57+Q9fN2w8SSHIGjvIHmvDVBSFSIjCK3V6JUKvF9M+XpBkmt78XgwQCwNyyZ4RVrRGDU0L8tSO9h92HgUMnN9z7KiSMq0IdBxandDzY2ZS4lzwaL8azEhPHpZ6e6LwTLwUwD8Y4d9sB4gkg+s5HFjW52xyRm+qapTIV6dKiSAJ3o1isACk8dWwvBtQSgbwChdBsoqht3psX8Pbkli6MuEkxGsdlb+vAfFn7OoiD86aFZ0uTggtxbw0nEa8av05bAQpVKupHXjC+MfNSy7szaF6/n4zcMAfLhYpnNLrvKtcgJupHaZ3zM7k2M1xdgCz3nZvzu3YRqdBeyns5VkTXuPPc5qiJToDF8bIZCMDnMRiTP/HQErqD531qwOIUwQyAJgmYqIvLQMAj7zRP3evY9xFSKE2+BhGbb/1v4pp0A4iRyyChBkQfKAfB16fXnma+S1jDnjdATKtUvTlfZojqVlz/0wusM8KRKMHIWtSAPzIfVxDzaLjxToKTaeSEmFiwjbiAfRwZA/DEjiVwH35l7bhSRpD8oNSPvsqJbUqomqoG/glfPo1JXiWK81Xkh5zXqWeRCmZTf9Cs3FVe3NMqnV+vw693EgI1bAkvBlXFdvyjgj7hGRdV2Fn9NaMN1TjoxxOpu7x+jhD3Z+UFo+30fSf+TlzTFUhXMi6NvmiqZNGMnethG3/bZvj31hofTIIacQeLhJNfJUFjy3caqmYTXDxgcV2osKrcHroJeh7iWVcYtZl6pRncn9lq5QqiboH29lj++/Ans8ISmliJrAgjOiWZwIH14hN4Mld3Xer0REK3tQSVIHdrx6pRB1nBori3MCtDoSzBjCCqxviE+ZEtcxvfoigD81bzmif5M5IQ7JEBK5PtB1zUnxosTgGTZWSzOiEYmq8B2RdybWF3Vu20xcsgJUrYPR1RRKRAdMBTpkBCgiPQSggc8Iy2pkZcoikx8Bd+e6UHeci9jlyIGWZfAkSl6GBOMaW+lr1Q8GDIdXvKmIsA7i3OQXIts8hS5wWSeWfXFVc41fQg+5K4KVWwikKiWL8ZESrAy/yUp8r/aG4Uo8bOimBi47jfKwuZAiPboSRuoq9ZaqzzjIYN83BtkkeNYHbsKdqlh9doEalVKAAETa7lNAoYHitpxfOLE6HhglLX3W+0IGENZTixVx5fN9GOAOTUTCxrgVS52+U4ZBaeACbxHxf+7ia79ED5tPcLK10U8CjuuyXQm2D9Vcf4K5IS7Y9kWDcO5pOpZtorAixZl8KTwZpOttVZ9VuHgv6JlrF7G6xQPex3M79sLM3dk+dlKTMHDxEKyWgs4dBxI2reg6MT95HTmjP2aoM34pd9PSRgJibZQgH6YflEPgylvzo2ZpDJFtSv6CW+RXUj1eCIKy/s0hiUnIq1hKrHodu0/cglKdN4zmuaUxrdUFi7nXuYPAvHr6PEniXFyTWnriQS2IO/mYzn2ow6yRVBw6vI5pbjWNYGzhtOZH6441awPhDPeOCS3r20AH2tMwNDr51vOHAhPJdn9YGwymvXqENn0RUf17jvogYL8vEVYt5WJ+1Wvj28FhXMQk7Z1+6TJceLgf2tEZISlKORen18TdnfCnmiLhyMHUMUHR2wmltwlAWguSDZIo3JzN4LdQmHKlxhs2M7Bhf/PPD2/WlLjkvGhGaUi0eHoRX2BEZo/0FNCKuojzdTIy68yhLJjjRcWsgENaEdYazOiTY6Tf4xE52OU629gDae8HRfPvPRZjmWw6gH+75DX3RXqbldLSLFLxzqhWwuqjHhBC+goOeSNn0WfpgfKqvH2k+gwaSeI30+Cp2l1TNEsVgHy8bVy0F0ZIjHRH8e+fsAu9JdFN65nI/erC7Csf48tvUIqfO5TLZ46fbFVhP9QjBUw7+ycVf7AqGotmIY41whcLVF3Oa63BjvzrBZWoraUaP2Wck5iRJ6PrdnIGvEJQlraKr8NSaQ9Ubc6XbcC6Ept3ddcVz8ypDgLxO9ai+zKrWMzzYbojfr3I/+T5MeRr1c8CR6WR1k6sh6Va080C0F19wUqMdf8HVcuF8NwUiVgpkUB21jfGcWJ0p4oM3OpaeeR+MehtXD8SvXajM0THg+qUCmFnO4rX2ek4wiVxWnVML5QB1ZWBdnKc3CR774T9FWzEbKjx6X4nbVjRrFRpXEohpxk+IwHV4HzVVy74vPa2o0GCfTiteTLDJXrqTqhfajY69Vr8MrDiy9DD7fgiUT/cAqwc6veTIQ1iMYmLq8CuaihR/3RSf8vL6csD0SdEJr5AXschQAdPcbjant3wOr9plW9gbcLVN3LI+UVQtHoEUlhYJ+328Q/AMUz4UiGBiwgwDTQ92urC0dxzw1pldIhHQ0t11QebZcpA1yE91QNP966MliiCADsLAdH16w558Y0AWniANAEYZVKdu2HSUoa0MD9zo8ZZjEu2p/obKEe3LEKCC/fb03/+OwPCRvwZYXzdOk1v9eeeEUduRtIbPuR/1B93Kr2gsipHSbU42H4hgfzC1Vm4QLhkAo5yz1bSdwAn14XSc48yXfxBIlU0UVRnzh4dWEFbAeKSbosRL+B/WeEhUstuRGBGEcKkV70ZxML6wNS16KwA29kKXIvR2F1g4kVsG8k+Go+Ik9W6OskP2MKlXaBb3a5As1A2mP090VWEXqcSRMKsZ8wS0VK45dgwanAaH0Og7P4anFHQnBeTnkjGGPVmfjsXC9neFnBChnu3QfoSSb6Tr8ec884rT5/AyAeQsrVLjs6llOraAQYouxEGLAaY0vV5qZTiSep+xSBdbHtpYO5AOa81S4qC4nAhz6uJHnJW1vLKyKfsQpfd3TPDNkfOgk+tEk2MvUnVu3+0MyuxWW8DFG077Tj/IdfeMd6YCyQMNUIBBU3AJ9nKq1W0bd
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"malware-sample\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f51a8-5140-4470-aba3-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:36.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:36.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC01742301536579303942.rtf' AND file:hashes.SHA1 = 'dfcc37e481be25e582bbccdc83fa20e263413ea5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f51a9-8220-490d-8a86-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:37.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:37.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC01742301536579303942.rtf' AND file:hashes.SHA256 = 'c4b4584098c04bb84ce639a23e43ff97c97397a474707d7c193ecb2fedef700e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f51a9-1b08-4ee2-a20b-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:37.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:37.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAPNBjkg/HACLBkcAAADkAAAgABwAMzY0YmYyODNhMzMzZjg4YTg3YmVjY2M3NDdhYjExZjlVVAkAA6lRD1epUQ9XdXgLAAEEIQAAAAQhAAAAwt/bMbWO7RDdz25iOGVkDM5jBFvSICNCK1sO9YLHMiC68/8h/6rqKydV+Jm1bHpc02kr0+ya2E+DdKt3zdUVNuJ4yhgAaKb2EEohGs5XOwYCSCVNKYf9dMgr9JlExXtNxRffXsP9Ulq3Kc0SbagYd9+4fserBSHSX06NzAQ3gzPTOBeC9PRtKn7uz1VjuOFgP+oXHyfaoEF35qZdzVfhgYyFEvrYSJpAxSwL7vRUbqahWB39EBvZf/hVw8T4gaXg2KcOi6Qjxq/tO8Rr28GH9zwB4QihgEWAqVaxlJnnq9cxs1xNczAS+yEZngicT3dsQeY21a79n2hZo4lVKyqsRsRIJ6IZZGifrLaOwyuvaJqZSXH89GQA5WLQNjnrRb3x3fjKblCEJuNmbuh1xQsr4jIaE6lcXPKFrktZ4DCURZ+8VaO71oz6D1BhxyrVJsTawrqFTip8ykuuFgv5Yj+HfXr3HnC3NT70CeiRCGS7xAxlOxm36V92Xyi3bsy+YHq1LOKnuisruGm7nruVy+lLMzA3ULWKuv292E6eCVDL4gr7IuJ8mdv60TiU4ldW5aq5q3y3X2SPdlk4rPj4XbvPaSf0q+SoTyk/GDOCRRjMf8yt+bZ3wfZktpKsXiJU5y8bdqlRHztUjCm4JUPrQndnHtNoKyX8/Qu30qS8TKnqmGejBB0VGdmTfbDKSYWd5au5g769QU2yGqfKlU+5H97lC/+88xFeMqGxATblo7+0ERmQK9ZRwDrDpVWIWe4r4UnToUEZVTexc1CmlgwLp5W1eMiJmYae3FCvo6gwKu/w86ovA85pNiB3ySg06xpZ7DiJrVt6fpy9RmQ+DVtnGj9692QUOUcYpydjl9XD+WuL/uLKPZn1Bn52kBNu6v7DQXVH85f3LbNuy48hVeovAbdiKN3Z8RLQ2MdSjGw+Skvj2+u7mJ29f/CHRTUEYY56WDbjAM16wQ0nhagcO02TPjkizY86vuBiDSeW96blJ+KGPdrrL9hVHHTQ0KBM0FrKKB5Jib2DfVF2IGwHIn5NjrERn7FDzu7cWjkzQGy8cgtKIkAagU8MJ5kP9CRnB+Mc6bZhejQbaE1sxIu8kOsGPHhg95ZJAd6IpJlKpdcK8yCODb1rdBKUuG/AKCUL1iOa9kESIsd7iMpldzlmC7CZRRz5UPMue1rxhHuV715ou684Hq/AYey2aT/tixCwpC4/fNu7T2KdaMZ7Y522rOgkTKZXSTOSq3uWVFVnJeBz8eY2Dc54VC43Nhm05NntBNW6yP5480T5M3e7e0y75HnJ/plX+rQ56sz/ACEZG25PjSIqe8mfqgFm1S9Tw2a673eFQDkDQM7Ovc+9+dZ6jabNPsdt+MwZeDjbBBeOX5wNbKlhtAsblcQWoxSrpTPkfYgoQ7/jLFHeV8SstDfcdfl8y+3myNKzt3WAXdvNCneqKmgyXaBPSh9W3qrZr6tCZDP9McNLahOXnEJijbWAVmk4dCl1vCbNUH7MFFez/JcVe/VbK2tQLg7SN/ofW3snxjYuLr8kPHnGjnwpWugJ9K2LzWZ+YwnOD39k7QwwSDNsibwAElYmuCffgJBMgu0UCepKZMkR8ZeupZiaRbfDFn1g3wZB4hS1MrzdaigXCN0TWBVQfU3Lmfxqn1K2p2AUa9MmXmdpWw6Cp56EvVJPpdJCt7/XwfMoWdej4v03QUDY3kDW3CrxTWYaxJKY732n9LNlmm9uC5VWG6onjAfFM92t0NzqRpiZ5tVLrNq2zynX+fztEmY0AakqumBNwOqfZv+fiD/uDKMyPmCIcHAEmAdqdcG1iAPtEe4i4qEvH4vd+C2WQ5ECCvV2cz+4mWzlgaoyAZy8N1KrJSc9uXBNU3UHYryLrzlBbYqFIx+OAIMqi75R+dPoR+L9Z8i0LbcGC5nUJvdolS74v/lyu/0zPo4eenDIIkvbdos80IwwPaKHacomKV5QZd+wLzRVRSt0n3e21EIbJp5j1zuStyiUwnMnveHQLHG+mAUHo5syWn6V99qcch1vd2pAcE+uO1S6Fd3HKFOZVjFsBbRP2jGq1Ygm6ootVtrY38G2PJMjtHX3p6nhZfCyreQnYrue0wyex/cTpaRsQz28/iCZ/1KUqnGfU6ro1LCSumlWW583DXhbH8rQZ25M3pBSniOtcbWmyicWpSwVuDHDbYQb2r887cQw7Xm4ViaxAKx08IX5N3kip1dxLL8vXcAlaGgS/DXngZEOiRrxVDn4PygyLaY7UX9l3EOTE89RUX4HbxAr11vjzI3Y64WjT8d5HElExFkUvELqr/Ge2TkP+qJBP0d6Qa79SZI9uBtugrdqzcbjWL8h/IspU2kzOGCYDIYn3hyLuo69SZL8H3ijO5gNPgQogrCZGl19CStWFYo0rHtvGs6EZLXGBrmZDgsSOEERWCQtQcbl4eGTbRvdiDi6Yljjs4CcBHzdNQvpxKckfYQ5x3iENJZrRS1a5QKiwaEtWYcjG7CqaQtwqfnI9y4DwIADrC0le8eMyOheU6hD1gcHtRRAkFnHqMrJ2XVs/d371VfWApBx9sfIi3WvQnCeq7eyZ7ClBXLnTcNA/LtYABpXcL9eyPSzcibyd0AMmJAC3OyGgmvo16Su/6KHSkjcA+K5kGg09zGiOFtGo9p1MP4HAmkvgQ5X1/wPD08FtJtVu4FB8UvBNLQlu3JY6BsrrPVo/4vTrTBwZfdwFox+lq3S61jRvSU/3LItDMUjVuj4wi8/K4cMmVtBVPytU1KHYhtIvDdzfgm9wDTVENBNjIGg94fYssfMOYtCrPKZn7x4OTtHqIjK+gbIGS/nDoC/j7Ilk3Q9ZDvxZUbohseRRQ+m0PxJ7sfNh3+HgF8If+ngthDa9m9gNjkU+9ceYFJ45jx9J0IsQUbm3MOOGekQYi2fPuAjtFxrCQh4EqYVcbEkNL+TBAMVvjzGlzV5a3P5X/VlpqxDH4G1/A/CVS4lRDRn9ZzkpulHFDVwms+u3GNfsMORGdlUOd5M6lCCNxZu3VmOG2nENouJiPyOYvsCA18xMYw0ro+2/Mjgg8c0UoSXdSISy/Q3yiAkQx6EKwWD7pb4/y8gcdVKv2DyETEUHr2Wws1YrwNyBPeS1MTUlg1VuXzBgBZT0Q2wlNHZuCZ1+KtV9rnGkj2g7p51zwJ1/9lyUFkq1PllvJ18qkXvr27S+YL6e0JpMLQTyIkjNWVbUhn0q4FuGXzhC9SoZxwNqvjSBF+EmmgPevT1/5/fjXCmnEs4tfPU4M//H6CAtzuNFdkbv5a2L7SWnXiuypurzDmlx2CEF9TXvSCslzSVPUYG1bZ4fggSapGqrqhVzRWWY6Dx1u4gKgmgOudmXA50RXFCo0wBSbtvqjvaXRIxjEN0z0rZLBhkpGvalnDHW3L6MZkMfegMjaLHHkz/nQnrH7SC0TJlPNB0e5LqvR3DpFaRMRG246to4S11lgf1FQkyKLSnANDZYuMO9nFqPXDbhdTLkz+VEanR6k+oYj9C9uszWgXtN2XSqlUP/wM9zTwBONtlZdV0jhaVOTRAeLXYBY39hh4pzFAS9qzPCKx3cSPjVY12okNOxQhjoKlVHGq0FgVWDSQbmachcMmaU4YifkxhmF4qDXRXfRXQWpRctY+5LXfbpNM8rXYeHDdKoES8PHeHaQv9PW4K9oE9oVjneNUKUBYRN3tPqFFeGhINCOdNN02i0Hu9bs0J0m7Y9yY5lbEMPbfNo3qFZnGwmtOR9OsiMm65qIGKzjYZ5pSGyVXqHhlTdIZ3+q4DFBb6GLPpXpYZlIxjlqeNUU8c1DfJR44xRPcTakuBmXf4c3AimZZbOhut+jR+R4Ald/tsNZdlzSAC4x/SzA4oXUrAkqTSPLOSzFEtWCZzfk86hZzVzRzTSDpBW1W2zSbp7wmOxmV5Jot4PY
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"malware-sample\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f51aa-360c-469f-91b1-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:38.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:38.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC1459523838999051861307.rtf' AND file:hashes.SHA1 = 'a54f3671f8e5d10499f5404b2b96a5873dd190ee']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f51aa-2c10-40d9-9419-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:38.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:38.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC1459523838999051861307.rtf' AND file:hashes.SHA256 = '14fac84a4b887fb160cc11e358bf4934d545f5a2cc77bfcd009270e275f1f4b5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f51ab-e184-400d-bbdb-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:39.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:39.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAPRBjkhg9V1/BkcAAADkAAAgABwANDIzMjQwNzMzZWY4OTc4MWZhOGNiNTBjZWQ5ZDMwZmVVVAkAA6tRD1erUQ9XdXgLAAEEIQAAAAQhAAAAsvD1r+mLCjIxoGzpwDi3JFq1u698/cAvTfWlmK67lFwo6pb6/SAQ3we930qN9Uj/6ani2/8S8uSh8XnoVYhjySNVFIRwUntLe6SuVdVFzzhbEtZdFdu+ufWJVnOzQr1TfcgE5s4/kC9CHKaY30WN0OET6nUo59M712l+TXUCkZNo4+wOFv0J1umGOii4lrmcx11oD1dSULMuTh/it9erkHAUDMag+oYxDVcyIUhkn3echnVEQFPEdUeMnOlNPyNXDQ1WBlud6ATEckiQDNg+07ENfTTTKwdNrGP21A2wgRWcuwZlizUaUFBCAifynkICh9Al334wmRmW78IG2u9bYixp1J47CCK623CCOdDyieclKlJ3Vjt0azQqYZ7n+Uo69Q45DQypnh4wGD98BhUbv+Wl1/DAZ49ez3hcnrZINZphdyQ26xsiJhXPur2h7rl9jZgPLg7pFLW/PG0I4WajQmHIISWB3kRqwuKauw7XdE27cerg7T6KAa+9asFBidrboOzvODVIeRtdp7aCZRsr+/r6zA0zkVa2U8H6g75ScYgnJiwY1Iqz2YBo3pp1X01cWbJPshreITeXGtbzCd+qY2FRp5EEPUR5kQiFldfJvcXPbFD/ExyrUMDAO5v0FoUs5+CorNFbSko5/jPKjISo+JuXfYEF1ShoOwcGZDMVbFOShYaFcckohEWrOT903Z8fufmkuqUaGOXvaCpIOOvJi22D1xAVxEq5jXtEPxd0zZmijl7urL3kEK5OnepYjyLTLwAH5Rc2mLsz98Gmk/pyLyPuj8rVRAUFJKmATSfMT8lgQULNlN8XD0dfY3OGa5K/Pmfo2gqgA5jWG8eaFkPoVCalMQMVwvTf2PmaMH1KVngs/yagSrGo/JzXnl8MRMxuGUHtzEHUEzBxK5tsdyPX1wRE9kDWURRIWaHQUubpNxT58/QSn5gn/0exRqEXB+o/Gnf6L6yyruQTpAlESZ5UZfHNbVdZ4bx0ptR7X7+o5leRC+HJpkGEuEeCVBQnFFTTZ1yhPbLNryuJSmAYVtHgo8d3CwVb/yg8UPgqISvtJj4UzG+vfkHMwyh16v35X1WQsrF9kPwKbmgW1Ly3AwbVTlXBYB8/sGDRmgmuUPwVcHPdLDcYlmu6PxTyDVvPT/semwlnXsZM2xmQ05YW0bFEPd//gPt7HmyTzW9+RjOH6m6LYyEOaac3DlDZtqlGYXVOxrx7dsDi03usVYVO/jw/aR4Qii6DZ8pDQOvzkcGb9Anoq/lnXgu/+YN0WWY5E7qjafbvB4yXsM2aGVkSum5MwsKyEC5lx8zG7jRlpIKgL5h02OQnOal970HWvDc7rdoetDCpfHXARMLA/6+uJBr/z45XHfdnUxwb5emwotjCmPZH6iitsxrN4EuJzABUMD2gxoyB7uTZErw2jseMwXQyOkM6+YINTIvw4co5SGQwoDPT97WlQJnculUKUulMBeqhtljtJp9bNU0d+ffjMOy2/7HcQIk27EHGTzfS8a4YrenBvh0TO+AI566PpH/bacAVb9ypr04FtEXE5BSJrWK3D+6eDV0E8UMHvn6Psvb9s71HxjwzEJzrewdqirSPmed9AAqS6oKy24BhsvMIGqyYPdJcWWyOiEstTQbFifC2Ck1Z/QfjjSiM+wtg4IAFkap4ae0YQdg2LsIIbxzQGW2MWBasQ2S3Zj2FCW4rUhcYnknFE6TyDSeqLHjo6dSp+KyKjOfdGt5OD9AgM7qgWrSaA+wKITQck26CKuVMVidz9Mz2nPLsrc6qDcyOxTIzIhwrq7Nmc67p+Ldn5F9APzZdQgninEb6eS04PEswQv+JHUBSidpFYvsx05s/1SByKG58NyPQT6u2P8wlMmapMXs+ZCD/OSHwd6M9STDkCCxBR2SdKZ1XMYjJsgr4VBnORbGBMxXQD3ug1S55xOnWQAZxYdFjHb86XYkwxX19Eq8AE7m9/AOs33YD2lIR3CFlzueUqcVZWI020P/O2rexDX5SI0cwGb4qXWYA7OLicMvjzD1oXOvYmXSWRJFAXuHufI2ea3ohb7r0PaO/QluBiL6yJUwsXl0pzp9RxDkouz4ZdgIyyKIqqx7GI0ephKrg0kG6U3yX7DZqCfy9Gd2lqrJDMg5eLvYMtQCoap1efac61ZRgYvHmKAAsTJgw6m+f91gSYD4xwyzrTFmIBlYb5ZwUJyhMglT5ndfjSgxe/IW9RfF75mUeW3DZpfRX4BGDYKA4lokVzcLiU+h+b8W+ynh/khbj29mLz4U8n6mIuIMRLjzOmjJqds/mg6c0IjMobLftG2nEHA+49S/DnU3m4IsuNam/sVUOy2ZDliACf7Bjq31sIlvib+gUNc5d1qMi2G3WWZjnL38DD/7lmLu8VxeZHqJNotd5gYOxULanPXx0bOK5N6mWOefYpc3xVZW+4v71dk68UYyMwF+UY5ELiHb7GEn0iBBbjiHQ9SiUgWJ/TyTqQ1kItmBVFU6XLW9a6crYYSspkD3LagOXjjQzjS+EODrhrdurvVPFBAC5LzhzzLUeASXEj34opkPBFo1Oovm1mdU6szUfVUj31XsG7kaTbzqE+qj1orT7AhqgJW7yDvcEVo+Lv4awreFLJAnNUblP7EaKsaol0sciEAti7VmuUvIsx/YLVHxpGjAc8eEY0IYsrc79SinCxYPNdBfbUHwLeCTA394+8KNrrOih0Ftc/TBCMhXwf51c/uqWRM3TiRdjKLy+vZC1JcJcFp/r8bFM0WLQbME2hypvfS58+TBXcHaKLyvaCVdO0WyFm3lI44dBM7sS+QgY0sajjf7Rfduty38O4YlDR0o2PpmguS+PXwE64vK/8KzuJbn2qsxv/PsfqxyxkkRT1qXmIEvw85LOjtne+wXVrOqvCJMKPusTFAsl49QoSKfyFRBhfr6cHu2BIJBDu4z0EN5MbOVohg70AKz1/PL50+eIh3qtAA2X+4/jr8bcy5sZgB0rD8cHaI20mByiQGnFp9SIQdW3nFNJUVkrjHVa4D0vHM3ZplywscODItrTV1HGc844UGKXbKOWybI4L929jEQpXiEcKaTx9uflvN+slHuJ81TBWqJOGvKt66FBF/MPCY3vcTYyWq1bJ4lTRdXpeqY+Xel1Ozync1kUq88fjpzmteWnnZDroyxM8Wsnd+6LLdqtOFYU6woMsR8PshvoKUplLID+SsMwh6nR50tjarglhnNggqw8crMR/gvOK67kMCVG/C0kV4x17drawZGcoKJQJCxC9RfN3WLfMh2fRJ/7mHw1/7rBQC83iWaSamk0xW1EYChSQmCBHTufSc2/eRlj6mmWeMTw8HzzLpj1HlX1cHyVwrad44Fd5ACF3BUz2gowXPoNciCyrc93kp7KaURa5gPE34V2lVJofdRaFdKDMD1AynjAzm6QRARU2EhN6/ChfkSqMHnjAk6IxmoIgd/wKjq2H1G9ZcBHkxnvC99lzfr3vuw9K6iscGtv0xy5dXRkq7zDtJX7tC2Id59xaG6DCulNq6uDrKlezMtfYPd4S0iL28m0hrQqoU5RjYHcXxdWZ8QTtCOyHTIvbasVM2yZC74Bc4pOklFa05kCWTraB/QBYkUnj2F5Oj41WVxYXHlbOWw1TOre0qMZ705eOIvTIuusm4QP6c2YgWOBu2uFW2WbAaRSlRycLcWV7+KTegP5DdWqwMgOraueUjb2GqK+ibkjC7PcUw+X0uqxtaQQFuSEADdc1UGw8aphGeKwXmum3Tzw2vW9s6liGhKkqZyOOoJsqVEKFbihKpRkh74ULzzM4mWxWos81npwSA7XZvpqqddCHw617Ewtz0ZTFa8VnDlIS5bM9FA8hKzVifKokKl6pLh2jI/Tg290lY89uwAK4sLUOlg8DEuiPl1Pxrn7R3Yv9H+x+x6+MaJ0AsIMlW
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"malware-sample\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f51ac-640c-445d-8ec3-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:40.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:40.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC03053348971603437700.rtf' AND file:hashes.SHA1 = 'eabecd4643f0cdc7177f04c034cc77485935cfb0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f51ac-b188-4f69-a57b-96eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:15:40.000Z",
|
||
|
|
"modified": "2016-04-14T08:15:40.000Z",
|
||
|
|
"description": "unique sample",
|
||
|
|
"pattern": "[file:name = 'DOC03053348971603437700.rtf' AND file:hashes.SHA256 = 'a545abc1866b06d5dff47bd40637c08f2aa20acdcb9a068a409eac1bd22cb649']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:15:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f5afc-f418-44b9-aacf-a269950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:55:24.000Z",
|
||
|
|
"modified": "2016-04-14T08:55:24.000Z",
|
||
|
|
"description": "Imported via the freetext import.",
|
||
|
|
"pattern": "[url:value = 'http://onlineaccess.bleutree.us/catalog/wp-login.php']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:55:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--570f5afc-7694-47b2-b5e9-a269950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T08:55:24.000Z",
|
||
|
|
"modified": "2016-04-14T08:55:24.000Z",
|
||
|
|
"description": "Imported via the freetext import.",
|
||
|
|
"pattern": "[domain-name:value = 'onlineaccess.bleutree.us']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-14T08:55:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--570f5c34-6584-4644-be96-a51d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T09:00:36.000Z",
|
||
|
|
"modified": "2016-04-14T09:00:36.000Z",
|
||
|
|
"first_observed": "2016-04-14T09:00:36Z",
|
||
|
|
"last_observed": "2016-04-14T09:00:36Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--570f5c34-6584-4644-be96-a51d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--570f5c34-6584-4644-be96-a51d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/a545abc1866b06d5dff47bd40637c08f2aa20acdcb9a068a409eac1bd22cb649/analysis/1460613869/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--570f5c34-32d0-464c-9834-a51d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T09:00:36.000Z",
|
||
|
|
"modified": "2016-04-14T09:00:36.000Z",
|
||
|
|
"first_observed": "2016-04-14T09:00:36Z",
|
||
|
|
"last_observed": "2016-04-14T09:00:36Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--570f5c34-32d0-464c-9834-a51d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--570f5c34-32d0-464c-9834-a51d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/14fac84a4b887fb160cc11e358bf4934d545f5a2cc77bfcd009270e275f1f4b5/analysis/1460618173/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--570f5c35-1148-4918-bf3d-a51d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T09:00:37.000Z",
|
||
|
|
"modified": "2016-04-14T09:00:37.000Z",
|
||
|
|
"first_observed": "2016-04-14T09:00:37Z",
|
||
|
|
"last_observed": "2016-04-14T09:00:37Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--570f5c35-1148-4918-bf3d-a51d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--570f5c35-1148-4918-bf3d-a51d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/c4b4584098c04bb84ce639a23e43ff97c97397a474707d7c193ecb2fedef700e/analysis/1460624018/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--570f5c35-0eb8-467f-a613-a51d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T09:00:37.000Z",
|
||
|
|
"modified": "2016-04-14T09:00:37.000Z",
|
||
|
|
"first_observed": "2016-04-14T09:00:37Z",
|
||
|
|
"last_observed": "2016-04-14T09:00:37Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--570f5c35-0eb8-467f-a613-a51d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--570f5c35-0eb8-467f-a613-a51d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/7fe0b7daba06a42f2aba4a51398187eb08ccdb8c6d2341e32825c3f01c1ff018/analysis/1460621581/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--570f5c35-50d4-4005-a9d8-a51d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T09:00:37.000Z",
|
||
|
|
"modified": "2016-04-14T09:00:37.000Z",
|
||
|
|
"first_observed": "2016-04-14T09:00:37Z",
|
||
|
|
"last_observed": "2016-04-14T09:00:37Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--570f5c35-50d4-4005-a9d8-a51d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--570f5c35-50d4-4005-a9d8-a51d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/a3d68a1861196849df4f323f7363ee6c00a2232d10fb0fb9acbf071f23f4b131/analysis/1460613866/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--570f5c36-5088-458a-aa1a-a51d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T09:00:38.000Z",
|
||
|
|
"modified": "2016-04-14T09:00:38.000Z",
|
||
|
|
"first_observed": "2016-04-14T09:00:38Z",
|
||
|
|
"last_observed": "2016-04-14T09:00:38Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--570f5c36-5088-458a-aa1a-a51d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--570f5c36-5088-458a-aa1a-a51d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/a9a959362202574eb35e7d72969583b23c298ca35e4d96b92816b282fb0baab3/analysis/1460615333/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--570f5c36-7c3c-4b06-b386-a51d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T09:00:38.000Z",
|
||
|
|
"modified": "2016-04-14T09:00:38.000Z",
|
||
|
|
"first_observed": "2016-04-14T09:00:38Z",
|
||
|
|
"last_observed": "2016-04-14T09:00:38Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--570f5c36-7c3c-4b06-b386-a51d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--570f5c36-7c3c-4b06-b386-a51d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/9fc73cea21b278bb3533287d1f405902f0ef77f32c98cb0932bb527d94e13589/analysis/1460605969/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--570f5c36-a1dc-4320-a627-a51d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T09:00:38.000Z",
|
||
|
|
"modified": "2016-04-14T09:00:38.000Z",
|
||
|
|
"first_observed": "2016-04-14T09:00:38Z",
|
||
|
|
"last_observed": "2016-04-14T09:00:38Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--570f5c36-a1dc-4320-a627-a51d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--570f5c36-a1dc-4320-a627-a51d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/c7522d14033d237b95b02e53fb9d44ddb85eec2cc2a8a07924f6dd622f3fbd60/analysis/1460614770/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--570f5c37-57fc-49fe-ae68-a51d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T09:00:39.000Z",
|
||
|
|
"modified": "2016-04-14T09:00:39.000Z",
|
||
|
|
"first_observed": "2016-04-14T09:00:39Z",
|
||
|
|
"last_observed": "2016-04-14T09:00:39Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--570f5c37-57fc-49fe-ae68-a51d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--570f5c37-57fc-49fe-ae68-a51d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/0883544cf28895789521e33706c9d2e3ddc9696d8b36cea2be65c344baa2c5e3/analysis/1460619843/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--570f5c37-0714-4ea3-8993-a51d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T09:00:39.000Z",
|
||
|
|
"modified": "2016-04-14T09:00:39.000Z",
|
||
|
|
"first_observed": "2016-04-14T09:00:39Z",
|
||
|
|
"last_observed": "2016-04-14T09:00:39Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--570f5c37-0714-4ea3-8993-a51d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--570f5c37-0714-4ea3-8993-a51d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/b56aa11f6ace57f642302cb0f2a3944b9e6a6009d1d858d897653bc832112b17/analysis/1460613955/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--570f5c37-ef64-4c43-bb2f-a51d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T09:00:39.000Z",
|
||
|
|
"modified": "2016-04-14T09:00:39.000Z",
|
||
|
|
"first_observed": "2016-04-14T09:00:39Z",
|
||
|
|
"last_observed": "2016-04-14T09:00:39Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--570f5c37-ef64-4c43-bb2f-a51d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--570f5c37-ef64-4c43-bb2f-a51d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/78c9910509b497794c233cb400ba2a665e0efb1cdb21939c05ae8c5bacab159e/analysis/1460624039/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--570f5c38-8014-444f-ac7e-a51d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T09:00:40.000Z",
|
||
|
|
"modified": "2016-04-14T09:00:40.000Z",
|
||
|
|
"first_observed": "2016-04-14T09:00:40Z",
|
||
|
|
"last_observed": "2016-04-14T09:00:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--570f5c38-8014-444f-ac7e-a51d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--570f5c38-8014-444f-ac7e-a51d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/4b4942b7e02bbbfd1c06307d55d69a40c8357a7472531ba1f4bc1035a6b2cf3a/analysis/1460621995/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--570f5c38-9e54-4db9-aaa1-a51d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T09:00:40.000Z",
|
||
|
|
"modified": "2016-04-14T09:00:40.000Z",
|
||
|
|
"first_observed": "2016-04-14T09:00:40Z",
|
||
|
|
"last_observed": "2016-04-14T09:00:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--570f5c38-9e54-4db9-aaa1-a51d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--570f5c38-9e54-4db9-aaa1-a51d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/6a7d941fd298ed853eb80f87e83e21523cee25f2cc7be288622b8339e6085e8e/analysis/1460617731/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--570f5c38-17c0-4eb6-8e4d-a51d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T09:00:40.000Z",
|
||
|
|
"modified": "2016-04-14T09:00:40.000Z",
|
||
|
|
"first_observed": "2016-04-14T09:00:40Z",
|
||
|
|
"last_observed": "2016-04-14T09:00:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--570f5c38-17c0-4eb6-8e4d-a51d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--570f5c38-17c0-4eb6-8e4d-a51d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/ea9bf2253c6bfac50eaf51df4a5c032c2941c93ad386ed8ce955e29c8829a767/analysis/1460622377/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--570f5c39-6000-4192-b569-a51d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T09:00:41.000Z",
|
||
|
|
"modified": "2016-04-14T09:00:41.000Z",
|
||
|
|
"first_observed": "2016-04-14T09:00:41Z",
|
||
|
|
"last_observed": "2016-04-14T09:00:41Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--570f5c39-6000-4192-b569-a51d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--570f5c39-6000-4192-b569-a51d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/57e1e391251f2131e1778ddd202763ae5c44f3e591e5de367163c010dbc7d190/analysis/1460621041/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--570f5c39-fc64-4d34-93db-a51d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T09:00:41.000Z",
|
||
|
|
"modified": "2016-04-14T09:00:41.000Z",
|
||
|
|
"first_observed": "2016-04-14T09:00:41Z",
|
||
|
|
"last_observed": "2016-04-14T09:00:41Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--570f5c39-fc64-4d34-93db-a51d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--570f5c39-fc64-4d34-93db-a51d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/4a29a1839f07f42052d737c4498fd08559f755400aebc4b33f9b7d043e747bd4/analysis/1460621444/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--570f5c39-fc70-417d-9a75-a51d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-14T09:00:41.000Z",
|
||
|
|
"modified": "2016-04-14T09:00:41.000Z",
|
||
|
|
"first_observed": "2016-04-14T09:00:41Z",
|
||
|
|
"last_observed": "2016-04-14T09:00:41Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--570f5c39-fc70-417d-9a75-a51d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--570f5c39-fc70-417d-9a75-a51d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/2d69af5207965591dde4116a886388af791f5992e242348d10b001e7409a13d3/analysis/1460619223/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|