546 lines
22 KiB
JSON
546 lines
22 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--57b5ac3c-6780-4f9c-8734-4e8e950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:46:44.000Z",
|
||
|
|
"modified": "2016-08-18T12:46:44.000Z",
|
||
|
|
"name": "CthulhuSPRL.be",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--57b5ac3c-6780-4f9c-8734-4e8e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:46:44.000Z",
|
||
|
|
"modified": "2016-08-18T12:46:44.000Z",
|
||
|
|
"name": "Pivot on Shakti domains via PassiveTotal",
|
||
|
|
"published": "2016-09-25T20:38:49Z",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--57b5ac6f-628c-4b6f-9bcf-445e950d210f",
|
||
|
|
"indicator--57b5ac70-d848-4f01-aa99-4100950d210f",
|
||
|
|
"indicator--57b5ac70-6ad0-481e-8a39-4115950d210f",
|
||
|
|
"indicator--57b5acb1-70ac-42a5-bfb2-45b6950d210f",
|
||
|
|
"indicator--57b5acb1-9950-4cba-8e0d-4cd9950d210f",
|
||
|
|
"observed-data--57b5acc4-52d8-4d3f-b20e-4f80950d210f",
|
||
|
|
"url--57b5acc4-52d8-4d3f-b20e-4f80950d210f",
|
||
|
|
"observed-data--57b5acc5-90d8-4621-9865-4c62950d210f",
|
||
|
|
"url--57b5acc5-90d8-4621-9865-4c62950d210f",
|
||
|
|
"observed-data--57b5acc5-ae28-4018-a456-46e9950d210f",
|
||
|
|
"url--57b5acc5-ae28-4018-a456-46e9950d210f",
|
||
|
|
"indicator--57b5ad06-6fac-48b8-a9c1-4a5c950d210f",
|
||
|
|
"indicator--57b5ad06-d48c-4c0f-9242-49e7950d210f",
|
||
|
|
"indicator--57b5ad07-cf60-4e7d-8642-4eff950d210f",
|
||
|
|
"indicator--57b5ad07-d8f0-4963-863e-49c2950d210f",
|
||
|
|
"indicator--57b5ae0d-ccc4-4f28-a8f4-416c950d210f",
|
||
|
|
"indicator--57b5ae0e-aa34-45bb-b65e-4e0c950d210f",
|
||
|
|
"indicator--57b5af9f-9690-4580-9523-498e950d210f",
|
||
|
|
"indicator--57b5afa3-7a48-4ad0-adb6-4f89950d210f",
|
||
|
|
"indicator--57b5afa5-f608-4de6-847b-46b6950d210f",
|
||
|
|
"indicator--57b5afa1-8bc0-41ca-9e83-43a1950d210f",
|
||
|
|
"indicator--57b5afa3-6868-4472-ba6e-4094950d210f",
|
||
|
|
"indicator--57b5afa6-038c-410e-8420-469e950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"OSINT"
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5ac6f-628c-4b6f-9bcf-445e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:39:11.000Z",
|
||
|
|
"modified": "2016-08-18T12:39:11.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'securedesignus.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:39:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5ac70-d848-4f01-aa99-4100950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:39:12.000Z",
|
||
|
|
"modified": "2016-08-18T12:39:12.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'securedesignuk.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:39:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5ac70-6ad0-481e-8a39-4115950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:39:12.000Z",
|
||
|
|
"modified": "2016-08-18T12:39:12.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'web4solution.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:39:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5acb1-70ac-42a5-bfb2-45b6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:40:17.000Z",
|
||
|
|
"modified": "2016-08-18T12:40:17.000Z",
|
||
|
|
"description": "Linked to web4solutions with hashes from Emerging Threats (Proofpoint)",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b1380af637b4011e674644e0a1a53a64']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:40:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5acb1-9950-4cba-8e0d-4cd9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:40:17.000Z",
|
||
|
|
"modified": "2016-08-18T12:40:17.000Z",
|
||
|
|
"description": "Linked to web4solutions with hashes from Emerging Threats (Proofpoint)",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2a794573f69c2c81db408f792a7c616b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:40:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--57b5acc4-52d8-4d3f-b20e-4f80950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:40:36.000Z",
|
||
|
|
"modified": "2016-08-18T12:40:36.000Z",
|
||
|
|
"first_observed": "2016-08-18T12:40:36Z",
|
||
|
|
"last_observed": "2016-08-18T12:40:36Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--57b5acc4-52d8-4d3f-b20e-4f80950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--57b5acc4-52d8-4d3f-b20e-4f80950d210f",
|
||
|
|
"value": "https://www.passivetotal.org/passive/web4solution.net"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--57b5acc5-90d8-4621-9865-4c62950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:40:37.000Z",
|
||
|
|
"modified": "2016-08-18T12:40:37.000Z",
|
||
|
|
"first_observed": "2016-08-18T12:40:37Z",
|
||
|
|
"last_observed": "2016-08-18T12:40:37Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--57b5acc5-90d8-4621-9865-4c62950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--57b5acc5-90d8-4621-9865-4c62950d210f",
|
||
|
|
"value": "https://www.passivetotal.org/passive/securedesignus.com"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--57b5acc5-ae28-4018-a456-46e9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:40:37.000Z",
|
||
|
|
"modified": "2016-08-18T12:40:37.000Z",
|
||
|
|
"first_observed": "2016-08-18T12:40:37Z",
|
||
|
|
"last_observed": "2016-08-18T12:40:37Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--57b5acc5-ae28-4018-a456-46e9950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--57b5acc5-ae28-4018-a456-46e9950d210f",
|
||
|
|
"value": "https://www.passivetotal.org/passive/securedesignuk.com"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5ad06-6fac-48b8-a9c1-4a5c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:41:42.000Z",
|
||
|
|
"modified": "2016-08-18T12:41:42.000Z",
|
||
|
|
"description": "Linked to securedesignus.com with hashes from Emerging Threat (Proofpoint)",
|
||
|
|
"pattern": "[file:hashes.MD5 = '255057ba7f3bb62abd5963e42e5fd897']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:41:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5ad06-d48c-4c0f-9242-49e7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:41:42.000Z",
|
||
|
|
"modified": "2016-08-18T12:41:42.000Z",
|
||
|
|
"description": "Linked to securedesignus.com with hashes from Emerging Threat (Proofpoint)",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0b3b8b25054165da8cf7dc300ca6dbba']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:41:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5ad07-cf60-4e7d-8642-4eff950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:41:43.000Z",
|
||
|
|
"modified": "2016-08-18T12:41:43.000Z",
|
||
|
|
"description": "Linked to securedesignus.com with hashes from Emerging Threat (Proofpoint)",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ffcc6e02d39f7c6f52a1b58eca30bd8f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:41:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5ad07-d8f0-4963-863e-49c2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:41:43.000Z",
|
||
|
|
"modified": "2016-08-18T12:41:43.000Z",
|
||
|
|
"description": "Linked to securedesignus.com with hashes from Emerging Threat (Proofpoint)",
|
||
|
|
"pattern": "[file:hashes.MD5 = '41ef9f2385136ac53bd7e602b1cf6826']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:41:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5ae0d-ccc4-4f28-a8f4-416c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:46:44.000Z",
|
||
|
|
"modified": "2016-08-18T12:46:44.000Z",
|
||
|
|
"description": "Linked to securedesignuk.com with hashes from Emerging threat (Proofpoint)",
|
||
|
|
"pattern": "[file:hashes.MD5 = '35ae59f3408671463546ef39bd92c901']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:46:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5ae0e-aa34-45bb-b65e-4e0c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:46:31.000Z",
|
||
|
|
"modified": "2016-08-18T12:46:31.000Z",
|
||
|
|
"description": "Linked to securedesignuk.com with hashes from Emerging threat (Proofpoint)",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b961d3b27aad49be1a57cf674df88a04']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:46:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5af9f-9690-4580-9523-498e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:52:47.000Z",
|
||
|
|
"modified": "2016-08-18T12:52:47.000Z",
|
||
|
|
"description": "Automatically added (via b1380af637b4011e674644e0a1a53a64)",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4297e2c5cae19ffbcf475234e0867bad826fc1bf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:52:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5afa3-7a48-4ad0-adb6-4f89950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:52:51.000Z",
|
||
|
|
"modified": "2016-08-18T12:52:51.000Z",
|
||
|
|
"description": "Automatically added (via 2a794573f69c2c81db408f792a7c616b)",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7a21bc3ce6bc2338a5abee83fd8a6bec7220ce3f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:52:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5afa5-f608-4de6-847b-46b6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:52:53.000Z",
|
||
|
|
"modified": "2016-08-18T12:52:53.000Z",
|
||
|
|
"description": "Automatically added (via 255057ba7f3bb62abd5963e42e5fd897)",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2d09ceee0e303f4e7a2678f8c6cff7071e50012b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:52:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5afa1-8bc0-41ca-9e83-43a1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:52:49.000Z",
|
||
|
|
"modified": "2016-08-18T12:52:49.000Z",
|
||
|
|
"description": "Automatically added (via b1380af637b4011e674644e0a1a53a64)",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd6d64c61dada8b5ccfa970356057a6c2c7697f084922744c5a2e29aff079647b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:52:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5afa3-6868-4472-ba6e-4094950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:52:51.000Z",
|
||
|
|
"modified": "2016-08-18T12:52:51.000Z",
|
||
|
|
"description": "Automatically added (via 2a794573f69c2c81db408f792a7c616b)",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8d7cbf2ad674118cf1aea4d98cd6d345d2c7b8875ec95f5141c80b588bd2b6f5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:52:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5afa6-038c-410e-8420-469e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:52:54.000Z",
|
||
|
|
"modified": "2016-08-18T12:52:54.000Z",
|
||
|
|
"description": "Automatically added (via 255057ba7f3bb62abd5963e42e5fd897)",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c03dc46fb6f01e9a1bcee445378b62b49f008c88cc531e41f2fd095ddac42816']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:52:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|