adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/59245883-c54c-4072-b07f-6a00950d210f.json

311 lines
12 KiB
JSON
Raw Permalink Normal View History

chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
{
"type": "bundle",
"id": "bundle--59245883-c54c-4072-b07f-6a00950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-05-23T15:43:15.000Z",
"modified": "2017-05-23T15:43:15.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "grouping",
"spec_version": "2.1",
"id": "grouping--59245883-c54c-4072-b07f-6a00950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-05-23T15:43:15.000Z",
"modified": "2017-05-23T15:43:15.000Z",
"name": "Password-protected docs 2017-05-23 : Ursnif 2002 - \"C John Doe\" - \"ab1_c23def4lg56hi#78j.docx\"",
"context": "suspicious-activity",
"object_refs": [
"indicator--59245893-31c8-42b2-b8c0-c159950d210f",
"indicator--5924588d-a82c-4ebd-9de1-6bfa950d210f",
"indicator--5924588f-347c-421e-9bef-46cf950d210f",
"indicator--59245892-06a8-4a29-a872-6b79950d210f",
"indicator--59245885-37f4-45e5-a504-180d950d210f",
"indicator--59245888-0318-4f98-a9b3-c150950d210f",
"indicator--59245889-bc34-4517-abf1-9198950d210f",
"indicator--5924588a-94bc-4917-88c9-69b6950d210f",
"indicator--5924588b-3584-454d-a6c9-c154950d210f",
"indicator--5924588c-02bc-4e47-b456-c153950d210f",
"indicator--59245884-3dc8-4d88-b419-c14e950d210f"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--59245893-31c8-42b2-b8c0-c159950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-05-23T15:43:15.000Z",
"modified": "2017-05-23T15:43:15.000Z",
"pattern": "[url:value = 'advisedhtdisclaimerth.ru']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-05-23T15:43:15Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5924588d-a82c-4ebd-9de1-6bfa950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-05-23T15:43:09.000Z",
"modified": "2017-05-23T15:43:09.000Z",
"pattern": "[url:value = 'http://www.php.net/license/3_0.txt']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-05-23T15:43:09Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5924588f-347c-421e-9bef-46cf950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-05-23T15:43:11.000Z",
"modified": "2017-05-23T15:43:11.000Z",
"pattern": "[domain-name:value = 'www.php.net']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-05-23T15:43:11Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"hostname\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--59245892-06a8-4a29-a872-6b79950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-05-23T15:43:14.000Z",
"modified": "2017-05-23T15:43:14.000Z",
"description": "www.php.net",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '82.100.240.32']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-05-23T15:43:14Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--59245885-37f4-45e5-a504-180d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-05-23T15:43:01.000Z",
"modified": "2017-05-23T15:43:01.000Z",
"pattern": "[file:hashes.MD5 = '12ffff6f269599e64c1f9ae1a4d7661c']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-05-23T15:43:01Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Artifacts dropped"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Artifacts dropped\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--59245888-0318-4f98-a9b3-c150950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-05-23T15:43:04.000Z",
"modified": "2017-05-23T15:43:04.000Z",
"pattern": "[url:value = 'http://kosbal.uv.ro/main.txt']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-05-23T15:43:04Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--59245889-bc34-4517-abf1-9198950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-05-23T15:43:05.000Z",
"modified": "2017-05-23T15:43:05.000Z",
"pattern": "[domain-name:value = 'kosbal.uv.ro']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-05-23T15:43:05Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"hostname\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5924588a-94bc-4917-88c9-69b6950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-05-23T15:43:06.000Z",
"modified": "2017-05-23T15:43:06.000Z",
"description": "kosbal.uv.ro",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '91.216.151.56']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-05-23T15:43:06Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5924588b-3584-454d-a6c9-c154950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-05-23T15:43:07.000Z",
"modified": "2017-05-23T15:43:07.000Z",
"pattern": "[url:value = 'http://91.210.166.177/un.jpg']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-05-23T15:43:07Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5924588c-02bc-4e47-b456-c153950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-05-23T15:43:08.000Z",
"modified": "2017-05-23T15:43:08.000Z",
"pattern": "[domain-name:value = '91.210.166.177']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-05-23T15:43:08Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"hostname\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--59245884-3dc8-4d88-b419-c14e950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-05-23T15:43:00.000Z",
"modified": "2017-05-23T15:43:00.000Z",
"pattern": "[file:hashes.MD5 = '21ecba6d854567d63f59258a49ed0d91']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-05-23T15:43:00Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Artifacts dropped"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Artifacts dropped\"",
"misp:to_ids=\"True\""
]
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue Copy permalink