592 lines
23 KiB
JSON
592 lines
23 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--5b608c59-6328-49e7-af04-22de0acd0835",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-07-31T16:29:51.000Z",
|
||
|
|
"modified": "2018-07-31T16:29:51.000Z",
|
||
|
|
"name": "Synovus Financial",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--5b608c59-6328-49e7-af04-22de0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-07-31T16:29:51.000Z",
|
||
|
|
"modified": "2018-07-31T16:29:51.000Z",
|
||
|
|
"name": "Massive Malvertising Campaign Discovered Attempting 40,000 Infections per Week",
|
||
|
|
"published": "2018-07-31T16:46:01Z",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--5b608ca3-d648-4d02-b6a0-348b0acd0835",
|
||
|
|
"indicator--5b608ca4-2634-4d52-9b44-348b0acd0835",
|
||
|
|
"indicator--5b608ca4-d300-4e8f-9abf-348b0acd0835",
|
||
|
|
"indicator--5b608ca4-4838-48a3-b48e-348b0acd0835",
|
||
|
|
"indicator--5b608ca4-bf88-4d3b-9cd9-348b0acd0835",
|
||
|
|
"indicator--5b608ca4-2934-4dd9-be94-348b0acd0835",
|
||
|
|
"indicator--5b608ca4-fa80-4dd0-bcec-348b0acd0835",
|
||
|
|
"indicator--5b608ca4-fa00-4baf-89fa-348b0acd0835",
|
||
|
|
"indicator--5b608ca4-10d4-4b8c-8c4e-348b0acd0835",
|
||
|
|
"observed-data--5b608d1e-38e0-4655-96d9-34a40acd0835",
|
||
|
|
"url--5b608d1e-38e0-4655-96d9-34a40acd0835",
|
||
|
|
"observed-data--5b608d1e-b7b0-4de5-9b0b-34a40acd0835",
|
||
|
|
"url--5b608d1e-b7b0-4de5-9b0b-34a40acd0835",
|
||
|
|
"observed-data--5b608d1e-ddd4-4b0a-b607-34a40acd0835",
|
||
|
|
"url--5b608d1e-ddd4-4b0a-b607-34a40acd0835",
|
||
|
|
"indicator--5b608dd0-447c-4175-8f9f-50ad0acd0835",
|
||
|
|
"indicator--5b608dd0-55fc-4a6c-bf3a-50ad0acd0835",
|
||
|
|
"indicator--5b608dd0-d3f4-4dd6-9314-50ad0acd0835",
|
||
|
|
"indicator--5b608dd0-2918-47f8-ad95-50ad0acd0835",
|
||
|
|
"indicator--5b608dd0-5f40-4ca5-8286-50ad0acd0835",
|
||
|
|
"indicator--5b608e12-d330-49ca-b308-5a480acd0835",
|
||
|
|
"indicator--5b608e13-4a8c-4cbd-adca-5a480acd0835",
|
||
|
|
"indicator--5b608e13-3b98-4ac9-9911-5a480acd0835",
|
||
|
|
"indicator--5b608e13-9d58-4d0a-a092-5a480acd0835"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"Malvertising"
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b608ca3-d648-4d02-b6a0-348b0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-07-31T16:21:55.000Z",
|
||
|
|
"modified": "2018-07-31T16:21:55.000Z",
|
||
|
|
"description": "malvertising",
|
||
|
|
"pattern": "[domain-name:value = 'exoclick.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-07-31T16:21:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Malvertising"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b608ca4-2634-4d52-9b44-348b0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-07-31T16:21:56.000Z",
|
||
|
|
"modified": "2018-07-31T16:21:56.000Z",
|
||
|
|
"description": "malvertising",
|
||
|
|
"pattern": "[domain-name:value = 'bestadbid.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-07-31T16:21:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Malvertising"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b608ca4-d300-4e8f-9abf-348b0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-07-31T16:21:56.000Z",
|
||
|
|
"modified": "2018-07-31T16:21:56.000Z",
|
||
|
|
"description": "malvertising",
|
||
|
|
"pattern": "[domain-name:value = 'junnify.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-07-31T16:21:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Malvertising"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b608ca4-4838-48a3-b48e-348b0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-07-31T16:21:56.000Z",
|
||
|
|
"modified": "2018-07-31T16:21:56.000Z",
|
||
|
|
"description": "malvertising",
|
||
|
|
"pattern": "[domain-name:value = 'bikinisgroup.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-07-31T16:21:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Malvertising"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b608ca4-bf88-4d3b-9cd9-348b0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-07-31T16:21:56.000Z",
|
||
|
|
"modified": "2018-07-31T16:21:56.000Z",
|
||
|
|
"description": "malvertising",
|
||
|
|
"pattern": "[domain-name:value = 'xml.pdn-1.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-07-31T16:21:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Malvertising"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b608ca4-2934-4dd9-be94-348b0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-07-31T16:21:56.000Z",
|
||
|
|
"modified": "2018-07-31T16:21:56.000Z",
|
||
|
|
"description": "malvertising",
|
||
|
|
"pattern": "[domain-name:value = 'xml.pdn-2.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-07-31T16:21:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Malvertising"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b608ca4-fa80-4dd0-bcec-348b0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-07-31T16:21:56.000Z",
|
||
|
|
"modified": "2018-07-31T16:21:56.000Z",
|
||
|
|
"description": "malvertising",
|
||
|
|
"pattern": "[domain-name:value = 'xml.pdn-3.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-07-31T16:21:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Malvertising"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b608ca4-fa00-4baf-89fa-348b0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-07-31T16:21:56.000Z",
|
||
|
|
"modified": "2018-07-31T16:21:56.000Z",
|
||
|
|
"description": "malvertising",
|
||
|
|
"pattern": "[domain-name:value = 'xml.pdn-4.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-07-31T16:21:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Malvertising"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b608ca4-10d4-4b8c-8c4e-348b0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-07-31T16:21:56.000Z",
|
||
|
|
"modified": "2018-07-31T16:21:56.000Z",
|
||
|
|
"description": "malvertising",
|
||
|
|
"pattern": "[domain-name:value = 'xml.pdn-5.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-07-31T16:21:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Malvertising"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5b608d1e-38e0-4655-96d9-34a40acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-07-31T16:23:58.000Z",
|
||
|
|
"modified": "2018-07-31T16:23:58.000Z",
|
||
|
|
"first_observed": "2018-07-31T16:23:58Z",
|
||
|
|
"last_observed": "2018-07-31T16:23:58Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5b608d1e-38e0-4655-96d9-34a40acd0835"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5b608d1e-38e0-4655-96d9-34a40acd0835",
|
||
|
|
"value": "https://research.checkpoint.com/malvertising-campaign-based-secrets-lies/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5b608d1e-b7b0-4de5-9b0b-34a40acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-07-31T16:23:58.000Z",
|
||
|
|
"modified": "2018-07-31T16:23:58.000Z",
|
||
|
|
"first_observed": "2018-07-31T16:23:58Z",
|
||
|
|
"last_observed": "2018-07-31T16:23:58Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5b608d1e-b7b0-4de5-9b0b-34a40acd0835"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5b608d1e-b7b0-4de5-9b0b-34a40acd0835",
|
||
|
|
"value": "https://www.bleepingcomputer.com/news/security/massive-malvertising-campaign-discovered-attempting-40-000-infections-per-week/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5b608d1e-ddd4-4b0a-b607-34a40acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-07-31T16:23:58.000Z",
|
||
|
|
"modified": "2018-07-31T16:23:58.000Z",
|
||
|
|
"first_observed": "2018-07-31T16:23:58Z",
|
||
|
|
"last_observed": "2018-07-31T16:23:58Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5b608d1e-ddd4-4b0a-b607-34a40acd0835"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5b608d1e-ddd4-4b0a-b607-34a40acd0835",
|
||
|
|
"value": "https://www.securityweek.com/advanced-malvertising-campaign-exploits-online-advertising-supply-chain"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b608dd0-447c-4175-8f9f-50ad0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-07-31T16:26:56.000Z",
|
||
|
|
"modified": "2018-07-31T16:26:56.000Z",
|
||
|
|
"description": "Malvertising",
|
||
|
|
"pattern": "[url:value = 'onclkds.com/afu.php?zoneid=1157984']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-07-31T16:26:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Malvertising"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b608dd0-55fc-4a6c-bf3a-50ad0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-07-31T16:26:56.000Z",
|
||
|
|
"modified": "2018-07-31T16:26:56.000Z",
|
||
|
|
"description": "Malvertising",
|
||
|
|
"pattern": "[url:value = 'www.cpm10.com/watch?key=fe0a93971e993f059d7a78bf2fa5117a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-07-31T16:26:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Malvertising"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b608dd0-d3f4-4dd6-9314-50ad0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-07-31T16:26:56.000Z",
|
||
|
|
"modified": "2018-07-31T16:26:56.000Z",
|
||
|
|
"description": "Malvertising",
|
||
|
|
"pattern": "[url:value = 'www.cpm20.com/watch?key=f9363dcc22f7f5fc89d5d6dcccb1e580']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-07-31T16:26:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Malvertising"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b608dd0-2918-47f8-ad95-50ad0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-07-31T16:26:56.000Z",
|
||
|
|
"modified": "2018-07-31T16:26:56.000Z",
|
||
|
|
"description": "Malvertising",
|
||
|
|
"pattern": "[url:value = 'www.hibids10.com/watch?key=789a4129e78c00008a47b36e23d65ea7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-07-31T16:26:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Malvertising"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b608dd0-5f40-4ca5-8286-50ad0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-07-31T16:26:56.000Z",
|
||
|
|
"modified": "2018-07-31T16:26:56.000Z",
|
||
|
|
"description": "Malvertising",
|
||
|
|
"pattern": "[url:value = 'www.sloi1.com/3hfnn2cne?key=789a4129e78c00008a47b36e23d65ea7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-07-31T16:26:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Malvertising"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b608e12-d330-49ca-b308-5a480acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-07-31T16:28:02.000Z",
|
||
|
|
"modified": "2018-07-31T16:28:02.000Z",
|
||
|
|
"description": "Malvertising",
|
||
|
|
"pattern": "[domain-name:value = 'onclkds.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-07-31T16:28:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Malvertising"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b608e13-4a8c-4cbd-adca-5a480acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-07-31T16:28:03.000Z",
|
||
|
|
"modified": "2018-07-31T16:28:03.000Z",
|
||
|
|
"description": "Malvertising",
|
||
|
|
"pattern": "[domain-name:value = 'cpm10.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-07-31T16:28:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Malvertising"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b608e13-3b98-4ac9-9911-5a480acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-07-31T16:28:03.000Z",
|
||
|
|
"modified": "2018-07-31T16:28:03.000Z",
|
||
|
|
"description": "Malvertising",
|
||
|
|
"pattern": "[domain-name:value = 'hibids10.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-07-31T16:28:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Malvertising"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b608e13-9d58-4d0a-a092-5a480acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-07-31T16:28:03.000Z",
|
||
|
|
"modified": "2018-07-31T16:28:03.000Z",
|
||
|
|
"description": "Malvertising",
|
||
|
|
"pattern": "[domain-name:value = 'sloi1.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-07-31T16:28:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Malvertising"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|