adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/58d90481-e090-4900-96f4-600b950d210f.json

317 lines
15 KiB
JSON
Raw Permalink Normal View History

chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
{
"type": "bundle",
"id": "bundle--58d90481-e090-4900-96f4-600b950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-27T12:28:37.000Z",
"modified": "2017-03-27T12:28:37.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--58d90481-e090-4900-96f4-600b950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-27T12:28:37.000Z",
"modified": "2017-03-27T12:28:37.000Z",
"name": "OSINT - APT29 Domain Fronting With TOR",
"published": "2017-03-27T12:30:34Z",
"object_refs": [
"observed-data--58d90497-a81c-4c9f-87d0-3aaf950d210f",
"url--58d90497-a81c-4c9f-87d0-3aaf950d210f",
"x-misp-attribute--58d904a9-fb94-4c81-b632-4f57950d210f",
"indicator--58d90505-9ab4-447e-9655-63e8950d210f",
"indicator--58d90507-2bd8-4734-b5f2-63e8950d210f",
"indicator--58d90556-766c-4ebb-bc85-63e9950d210f",
"indicator--58d9057e-7978-4a64-99fa-450502de0b81",
"indicator--58d90580-401c-4457-9ebc-406c02de0b81",
"observed-data--58d90581-c7c4-4ee8-b11d-4f4302de0b81",
"url--58d90581-c7c4-4ee8-b11d-4f4302de0b81",
"indicator--58d90583-8c60-4205-b7fc-4fca02de0b81",
"indicator--58d90585-3618-42a4-8f86-4d3c02de0b81",
"observed-data--58d90587-45d0-4b86-99a1-4f9402de0b81",
"url--58d90587-45d0-4b86-99a1-4f9402de0b81"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"misp-galaxy:threat-actor=\"APT 29\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--58d90497-a81c-4c9f-87d0-3aaf950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-27T12:28:37.000Z",
"modified": "2017-03-27T12:28:37.000Z",
"first_observed": "2017-03-27T12:28:37Z",
"last_observed": "2017-03-27T12:28:37Z",
"number_observed": 1,
"object_refs": [
"url--58d90497-a81c-4c9f-87d0-3aaf950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\"",
"osint:source-type=\"blog-post\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--58d90497-a81c-4c9f-87d0-3aaf950d210f",
"value": "https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_frontin.html"
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--58d904a9-fb94-4c81-b632-4f57950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-27T12:28:37.000Z",
"modified": "2017-03-27T12:28:37.000Z",
"labels": [
"misp:type=\"text\"",
"misp:category=\"External analysis\"",
"osint:source-type=\"blog-post\""
],
"x_misp_category": "External analysis",
"x_misp_type": "text",
"x_misp_value": "Mandiant has observed Russian nation-state attackers APT29 employing domain fronting techniques for stealthy backdoor access to victim environments for at least two years. There has been considerable discussion about domain fronting following the release of a paper detailing these techniques. Domain fronting provides outbound network connections that are indistinguishable from legitimate requests for popular websites.\r\n\r\nAPT29 has used The Onion Router (TOR) and the TOR domain fronting plugin meek to create a hidden, encrypted network tunnel that appeared to connect to Google services over TLS. This tunnel provided the attacker remote access to the host system using the Terminal Services (TS), NetBIOS, and Server Message Block (SMB) services, while appearing to be traffic to legitimate websites. The attackers also leveraged a common Windows exploit to access a privileged command shell without authenticating.\r\n\r\nWe first discussed APT29\u00e2\u20ac\u2122s use of these techniques as part of our \u00e2\u20ac\u0153No Easy Breach\u00e2\u20ac\u009d talk at DerbyCon 6.0. For additional details on how we first identified this backdoor, and the epic investigation it was part of, see the slides and presentation."
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58d90505-9ab4-447e-9655-63e8950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-27T12:28:37.000Z",
"modified": "2017-03-27T12:28:37.000Z",
"description": "googleService.exe the primary TOR executable, responsible for establishing and maintaining encrypted proxy connections.",
"pattern": "[file:hashes.SHA256 = 'fe744a5b2d07de396a8b3fe97155fc64e350b76d88db36c619cd941279987dc5']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-03-27T12:28:37Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58d90507-2bd8-4734-b5f2-63e8950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-27T12:28:37.000Z",
"modified": "2017-03-27T12:28:37.000Z",
"description": "GoogleUpdate.exe - the meek-client plugin, which obfuscates the TOR connection.",
"pattern": "[file:hashes.SHA256 = '2f39dee2ee608e39917cc022d9aae399959e967a2dd70d83b81785a98bd9ed36']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-03-27T12:28:37Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58d90556-766c-4ebb-bc85-63e9950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-27T12:28:37.000Z",
"modified": "2017-03-27T12:28:37.000Z",
"description": "Bridge traffic using the meek plugin to https://meek-reflect.appspot.com and obfuscate HTTPS and DNS requests to appear destined for www.google.com",
"pattern": "[url:value = 'https://meek-reflect.appspot.com']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-03-27T12:28:37Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58d9057e-7978-4a64-99fa-450502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-27T12:28:46.000Z",
"modified": "2017-03-27T12:28:46.000Z",
"description": "GoogleUpdate.exe - the meek-client plugin, which obfuscates the TOR connection. - Xchecked via VT: 2f39dee2ee608e39917cc022d9aae399959e967a2dd70d83b81785a98bd9ed36",
"pattern": "[file:hashes.SHA1 = '57e2f0fdc2566f11af661dc02e989dd65132a3f4']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-03-27T12:28:46Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58d90580-401c-4457-9ebc-406c02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-27T12:28:48.000Z",
"modified": "2017-03-27T12:28:48.000Z",
"description": "GoogleUpdate.exe - the meek-client plugin, which obfuscates the TOR connection. - Xchecked via VT: 2f39dee2ee608e39917cc022d9aae399959e967a2dd70d83b81785a98bd9ed36",
"pattern": "[file:hashes.MD5 = '31b3069cef380b4bf85e75a8885bcee8']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-03-27T12:28:48Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--58d90581-c7c4-4ee8-b11d-4f4302de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-27T12:28:49.000Z",
"modified": "2017-03-27T12:28:49.000Z",
"first_observed": "2017-03-27T12:28:49Z",
"last_observed": "2017-03-27T12:28:49Z",
"number_observed": 1,
"object_refs": [
"url--58d90581-c7c4-4ee8-b11d-4f4302de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--58d90581-c7c4-4ee8-b11d-4f4302de0b81",
"value": "https://www.virustotal.com/file/2f39dee2ee608e39917cc022d9aae399959e967a2dd70d83b81785a98bd9ed36/analysis/1490381093/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58d90583-8c60-4205-b7fc-4fca02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-27T12:28:51.000Z",
"modified": "2017-03-27T12:28:51.000Z",
"description": "googleService.exe the primary TOR executable, responsible for establishing and maintaining encrypted proxy connections. - Xchecked via VT: fe744a5b2d07de396a8b3fe97155fc64e350b76d88db36c619cd941279987dc5",
"pattern": "[file:hashes.SHA1 = '6842243f5a41f66a81b85ee524c3cfc7ace10da8']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-03-27T12:28:51Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58d90585-3618-42a4-8f86-4d3c02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-27T12:28:53.000Z",
"modified": "2017-03-27T12:28:53.000Z",
"description": "googleService.exe the primary TOR executable, responsible for establishing and maintaining encrypted proxy connections. - Xchecked via VT: fe744a5b2d07de396a8b3fe97155fc64e350b76d88db36c619cd941279987dc5",
"pattern": "[file:hashes.MD5 = '628d4f33bd604203d25dbc6a5bb35b90']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-03-27T12:28:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--58d90587-45d0-4b86-99a1-4f9402de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-27T12:28:55.000Z",
"modified": "2017-03-27T12:28:55.000Z",
"first_observed": "2017-03-27T12:28:55Z",
"last_observed": "2017-03-27T12:28:55Z",
"number_observed": 1,
"object_refs": [
"url--58d90587-45d0-4b86-99a1-4f9402de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--58d90587-45d0-4b86-99a1-4f9402de0b81",
"value": "https://www.virustotal.com/file/fe744a5b2d07de396a8b3fe97155fc64e350b76d88db36c619cd941279987dc5/analysis/1490588868/"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue Copy permalink