827 lines
36 KiB
JSON
827 lines
36 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--5cd14624-0b24-4386-85f5-4e5e950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-08T09:38:46.000Z",
|
||
|
|
"modified": "2019-05-08T09:38:46.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--5cd14624-0b24-4386-85f5-4e5e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-08T09:38:46.000Z",
|
||
|
|
"modified": "2019-05-08T09:38:46.000Z",
|
||
|
|
"name": "OSINT - CARBANAK Week - Fire Eye",
|
||
|
|
"published": "2019-05-08T11:22:43Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--5cd1464b-5c38-40b2-bab2-44a3950d210f",
|
||
|
|
"url--5cd1464b-5c38-40b2-bab2-44a3950d210f",
|
||
|
|
"observed-data--5cd1464b-f590-4342-96f5-4204950d210f",
|
||
|
|
"url--5cd1464b-f590-4342-96f5-4204950d210f",
|
||
|
|
"observed-data--5cd1464b-6008-4101-a704-4016950d210f",
|
||
|
|
"url--5cd1464b-6008-4101-a704-4016950d210f",
|
||
|
|
"observed-data--5cd1464b-b6f8-4ea7-bf52-4cc2950d210f",
|
||
|
|
"url--5cd1464b-b6f8-4ea7-bf52-4cc2950d210f",
|
||
|
|
"indicator--5cd18a3a-c808-4674-8acc-41f8950d210f",
|
||
|
|
"indicator--5cd18a3a-3210-4ab0-9d58-4e65950d210f",
|
||
|
|
"indicator--5cd18a3a-9b74-4426-838f-44e7950d210f",
|
||
|
|
"indicator--5cd18a3a-8f68-448a-83bf-40c8950d210f",
|
||
|
|
"indicator--5cd18a3a-6860-4dc8-a3f9-42c3950d210f",
|
||
|
|
"indicator--5cd18a3a-8a48-4dbf-886f-4ee9950d210f",
|
||
|
|
"indicator--5cd18a3a-e23c-4ee0-b712-465d950d210f",
|
||
|
|
"indicator--5cd18a3a-78d4-45fd-b116-411e950d210f",
|
||
|
|
"indicator--5cd18a3a-f414-49d6-b595-44b3950d210f",
|
||
|
|
"x-misp-attribute--5cd27588-6cbc-4373-a9d7-4e5d950d210f",
|
||
|
|
"observed-data--5cd28d32-4770-466b-b8c6-4655e387cbd9",
|
||
|
|
"network-traffic--5cd28d32-4770-466b-b8c6-4655e387cbd9",
|
||
|
|
"ipv4-addr--5cd28d32-4770-466b-b8c6-4655e387cbd9",
|
||
|
|
"observed-data--5cd28d35-7a48-4b05-b933-4fd2e387cbd9",
|
||
|
|
"network-traffic--5cd28d35-7a48-4b05-b933-4fd2e387cbd9",
|
||
|
|
"ipv4-addr--5cd28d35-7a48-4b05-b933-4fd2e387cbd9",
|
||
|
|
"indicator--5cd14a64-a478-4a1d-bcaa-4af8950d210f",
|
||
|
|
"indicator--5cd14f02-6a40-4948-8120-41b7950d210f",
|
||
|
|
"indicator--5cd14f7c-ed6c-4396-a8b8-48e9950d210f",
|
||
|
|
"indicator--5cd14fc8-cc7c-46e2-8498-456e950d210f",
|
||
|
|
"indicator--5cd15297-7048-4712-9572-4258950d210f",
|
||
|
|
"indicator--5cd152e1-b8a0-4bcf-9ea3-4ca4950d210f",
|
||
|
|
"indicator--5cd15d47-ed54-49b9-aeaa-4471950d210f",
|
||
|
|
"indicator--5cd15d6a-b964-4779-8f3a-43b5950d210f",
|
||
|
|
"indicator--5cd1837d-0694-4391-8cb9-364f950d210f",
|
||
|
|
"indicator--5cd18724-ce4c-410f-95db-b3d7950d210f",
|
||
|
|
"observed-data--5cd18771-bac0-47c3-9a8c-a966950d210f",
|
||
|
|
"network-traffic--5cd18771-bac0-47c3-9a8c-a966950d210f",
|
||
|
|
"ipv4-addr--5cd18771-9f18-4005-a613-a966950d210f",
|
||
|
|
"observed-data--5cd187b5-1eb8-474a-ae22-a97c950d210f",
|
||
|
|
"network-traffic--5cd187b5-1eb8-474a-ae22-a97c950d210f",
|
||
|
|
"ipv4-addr--5cd187b5-d93c-4c9a-9658-a97c950d210f",
|
||
|
|
"indicator--5cd189c9-dd18-4b41-9ad4-b3d7950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"misp-galaxy:malpedia=\"Carbanak\"",
|
||
|
|
"misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Carbanak - G0008\"",
|
||
|
|
"misp-galaxy:mitre-enterprise-attack-malware=\"Carbanak - S0030\"",
|
||
|
|
"misp-galaxy:mitre-enterprise-attack-relationship=\"FIN7 uses Carbanak\"",
|
||
|
|
"misp-galaxy:mitre-intrusion-set=\"Carbanak - G0008\"",
|
||
|
|
"misp-galaxy:mitre-malware=\"Carbanak - S0030\"",
|
||
|
|
"misp-galaxy:threat-actor=\"Anunak\"",
|
||
|
|
"misp-galaxy:mitre-enterprise-attack-intrusion-set=\"FIN7 - G0046\"",
|
||
|
|
"misp-galaxy:mitre-intrusion-set=\"FIN7\"",
|
||
|
|
"misp-galaxy:mitre-intrusion-set=\"FIN7 - G0046\"",
|
||
|
|
"ecsirt:intrusions=\"backdoor\"",
|
||
|
|
"veris:action:malware:variety=\"Backdoor\"",
|
||
|
|
"ms-caro-malware:malware-type=\"Backdoor\"",
|
||
|
|
"ms-caro-malware-full:malware-type=\"Backdoor\"",
|
||
|
|
"circl:incident-classification=\"malware\"",
|
||
|
|
"osint:source-type=\"blog-post\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5cd1464b-5c38-40b2-bab2-44a3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T08:48:11.000Z",
|
||
|
|
"modified": "2019-05-07T08:48:11.000Z",
|
||
|
|
"first_observed": "2019-05-07T08:48:11Z",
|
||
|
|
"last_observed": "2019-05-07T08:48:11Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5cd1464b-5c38-40b2-bab2-44a3950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5cd1464b-5c38-40b2-bab2-44a3950d210f",
|
||
|
|
"value": "https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-one-a-rare-occurrence.html"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5cd1464b-f590-4342-96f5-4204950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T08:48:11.000Z",
|
||
|
|
"modified": "2019-05-07T08:48:11.000Z",
|
||
|
|
"first_observed": "2019-05-07T08:48:11Z",
|
||
|
|
"last_observed": "2019-05-07T08:48:11Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5cd1464b-f590-4342-96f5-4204950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5cd1464b-f590-4342-96f5-4204950d210f",
|
||
|
|
"value": "https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-two-continuing-source-code-analysis.html"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5cd1464b-6008-4101-a704-4016950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T08:48:11.000Z",
|
||
|
|
"modified": "2019-05-07T08:48:11.000Z",
|
||
|
|
"first_observed": "2019-05-07T08:48:11Z",
|
||
|
|
"last_observed": "2019-05-07T08:48:11Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5cd1464b-6008-4101-a704-4016950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5cd1464b-6008-4101-a704-4016950d210f",
|
||
|
|
"value": "https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-three-behind-the-backdoor.html"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5cd1464b-b6f8-4ea7-bf52-4cc2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T08:48:11.000Z",
|
||
|
|
"modified": "2019-05-07T08:48:11.000Z",
|
||
|
|
"first_observed": "2019-05-07T08:48:11Z",
|
||
|
|
"last_observed": "2019-05-07T08:48:11Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5cd1464b-b6f8-4ea7-bf52-4cc2950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5cd1464b-b6f8-4ea7-bf52-4cc2950d210f",
|
||
|
|
"value": "https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-four-desktop-video-player.html"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd18a3a-c808-4674-8acc-41f8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T13:38:02.000Z",
|
||
|
|
"modified": "2019-05-07T13:38:02.000Z",
|
||
|
|
"description": "Status: Commented out - Threat Group Association: Earlier CARBANAK activity",
|
||
|
|
"pattern": "[domain-name:value = 'comixed.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-07T13:38:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd18a3a-3210-4ab0-9d58-4e65950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T13:38:02.000Z",
|
||
|
|
"modified": "2019-05-07T13:38:02.000Z",
|
||
|
|
"description": "Status: Commented out - Threat Group Association: Earlier CARBANAK activity",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '194.146.180.40']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-07T13:38:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd18a3a-9b74-4426-838f-44e7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T13:38:02.000Z",
|
||
|
|
"modified": "2019-05-07T13:38:02.000Z",
|
||
|
|
"description": "Status: Active",
|
||
|
|
"pattern": "[domain-name:value = 'aaaabbbbccccc.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-07T13:38:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd18a3a-8f68-448a-83bf-40c8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T13:38:02.000Z",
|
||
|
|
"modified": "2019-05-07T13:38:02.000Z",
|
||
|
|
"description": "Status: Commented out - Threat Group Association: FIN7",
|
||
|
|
"pattern": "[domain-name:value = 'stats10-google.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-07T13:38:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd18a3a-6860-4dc8-a3f9-42c3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T13:38:02.000Z",
|
||
|
|
"modified": "2019-05-07T13:38:02.000Z",
|
||
|
|
"description": "Status: Commented out",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '85.25.84.223']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-07T13:38:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd18a3a-8a48-4dbf-886f-4ee9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T13:38:02.000Z",
|
||
|
|
"modified": "2019-05-07T13:38:02.000Z",
|
||
|
|
"description": "Status: Active",
|
||
|
|
"pattern": "[domain-name:value = 'qwqreererwere.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-07T13:38:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd18a3a-e23c-4ee0-b712-465d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T13:38:02.000Z",
|
||
|
|
"modified": "2019-05-07T13:38:02.000Z",
|
||
|
|
"description": "Status: Commented out - Threat Group Association: Earlier CARBANAK activity",
|
||
|
|
"pattern": "[domain-name:value = 'akamai-technologies.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-07T13:38:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd18a3a-78d4-45fd-b116-411e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T13:38:02.000Z",
|
||
|
|
"modified": "2019-05-07T13:38:02.000Z",
|
||
|
|
"description": "Status: Compiled",
|
||
|
|
"pattern": "[domain-name:value = 'hhklhlkhkjhjkjk.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-07T13:38:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd18a3a-f414-49d6-b595-44b3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T13:38:02.000Z",
|
||
|
|
"modified": "2019-05-07T13:38:02.000Z",
|
||
|
|
"description": "Status: Compiled - Threat Group Association: DNS infrastructure overlap with later FIN7 associated POWERSOURCE activity",
|
||
|
|
"pattern": "[domain-name:value = 'aaa.stage.4463714.news.meteonovosti.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-07T13:38:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--5cd27588-6cbc-4373-a9d7-4e5d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-08T06:22:00.000Z",
|
||
|
|
"modified": "2019-05-08T06:22:00.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "CARBANAK is one of the most full-featured backdoors around. It was used to perpetrate millions of dollars in financial crimes, largely by the group we track as FIN7. In 2017, Tom Bennett and Barry Vengerik published Behind the CARBANAK Backdoor, which was the product of a deep and broad analysis of CARBANAK samples and FIN7 activity across several years. On the heels of that publication, our colleague Nick Carr uncovered a pair of RAR archives containing CARBANAK source code, builders, and other tools (both available in VirusTotal: kb3r1p and apwmie)."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5cd28d32-4770-466b-b8c6-4655e387cbd9",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-08T08:02:58.000Z",
|
||
|
|
"modified": "2019-05-08T08:02:58.000Z",
|
||
|
|
"first_observed": "2019-05-08T08:02:58Z",
|
||
|
|
"last_observed": "2019-05-08T08:02:58Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5cd28d32-4770-466b-b8c6-4655e387cbd9",
|
||
|
|
"ipv4-addr--5cd28d32-4770-466b-b8c6-4655e387cbd9"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5cd28d32-4770-466b-b8c6-4655e387cbd9",
|
||
|
|
"src_ref": "ipv4-addr--5cd28d32-4770-466b-b8c6-4655e387cbd9",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5cd28d32-4770-466b-b8c6-4655e387cbd9",
|
||
|
|
"value": "107.181.155.151"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5cd28d35-7a48-4b05-b933-4fd2e387cbd9",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-08T08:03:01.000Z",
|
||
|
|
"modified": "2019-05-08T08:03:01.000Z",
|
||
|
|
"first_observed": "2019-05-08T08:03:01Z",
|
||
|
|
"last_observed": "2019-05-08T08:03:01Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5cd28d35-7a48-4b05-b933-4fd2e387cbd9",
|
||
|
|
"ipv4-addr--5cd28d35-7a48-4b05-b933-4fd2e387cbd9"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5cd28d35-7a48-4b05-b933-4fd2e387cbd9",
|
||
|
|
"src_ref": "ipv4-addr--5cd28d35-7a48-4b05-b933-4fd2e387cbd9",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5cd28d35-7a48-4b05-b933-4fd2e387cbd9",
|
||
|
|
"value": "23.253.126.58"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd14a64-a478-4a1d-bcaa-4af8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T09:05:40.000Z",
|
||
|
|
"modified": "2019-05-07T09:05:40.000Z",
|
||
|
|
"pattern": "[(network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '104.193.252.151') AND (network-traffic:dst_ref.type = 'domain-name' AND network-traffic:dst_ref.value = 'vds2.system-host.net') AND network-traffic:dst_port = '443' AND network-traffic:end = '2019-04-26T14:49:12']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-07T09:05:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "network"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"ip-port\"",
|
||
|
|
"misp:meta-category=\"network\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd14f02-6a40-4948-8120-41b7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T09:25:22.000Z",
|
||
|
|
"modified": "2019-05-07T09:25:22.000Z",
|
||
|
|
"pattern": "[(network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.180.196.35') AND (network-traffic:dst_ref.type = 'domain-name' AND network-traffic:dst_ref.value = 'customer.clientshostname.com') AND network-traffic:dst_port = '443' AND network-traffic:end = '2019-04-24T07:44:30']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-07T09:25:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "network"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"ip-port\"",
|
||
|
|
"misp:meta-category=\"network\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd14f7c-ed6c-4396-a8b8-48e9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T09:27:24.000Z",
|
||
|
|
"modified": "2019-05-07T09:27:24.000Z",
|
||
|
|
"pattern": "[(network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '213.227.155.8') AND network-traffic:dst_port = '443' AND network-traffic:end = '2019-04-24T04:33:52']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-07T09:27:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "network"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"ip-port\"",
|
||
|
|
"misp:meta-category=\"network\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd14fc8-cc7c-46e2-8498-456e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T09:28:40.000Z",
|
||
|
|
"modified": "2019-05-07T09:28:40.000Z",
|
||
|
|
"pattern": "[(network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '94.156.133.69') AND network-traffic:dst_port = '443' AND network-traffic:end = '2018-11-15T10:27:07']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-07T09:28:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "network"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"ip-port\"",
|
||
|
|
"misp:meta-category=\"network\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd15297-7048-4712-9572-4258950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T09:40:39.000Z",
|
||
|
|
"modified": "2019-05-07T09:40:39.000Z",
|
||
|
|
"pattern": "[(network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.174.172.241') AND network-traffic:dst_port = '443' AND network-traffic:end = '2019-04-27T13:24:36']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-07T09:40:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "network"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"ip-port\"",
|
||
|
|
"misp:meta-category=\"network\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd152e1-b8a0-4bcf-9ea3-4ca4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T09:41:53.000Z",
|
||
|
|
"modified": "2019-05-07T09:41:53.000Z",
|
||
|
|
"pattern": "[(network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '109.230.199.227') AND network-traffic:dst_port = '443' AND network-traffic:end = '2019-04-27T13:24:36']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-07T09:41:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "network"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"ip-port\"",
|
||
|
|
"misp:meta-category=\"network\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd15d47-ed54-49b9-aeaa-4471950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T10:26:15.000Z",
|
||
|
|
"modified": "2019-05-07T10:26:15.000Z",
|
||
|
|
"description": "Status: Commented out",
|
||
|
|
"pattern": "[(network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '37.1.212.100') AND network-traffic:dst_port = '700']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-07T10:26:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "network"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"ip-port\"",
|
||
|
|
"misp:meta-category=\"network\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd15d6a-b964-4779-8f3a-43b5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T10:26:50.000Z",
|
||
|
|
"modified": "2019-05-07T10:26:50.000Z",
|
||
|
|
"description": "Status: Commented out - Threat Group Association: Earlier CARBANAK activity",
|
||
|
|
"pattern": "[(network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '188.138.98.105') AND network-traffic:dst_port = '710']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-07T10:26:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "network"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"ip-port\"",
|
||
|
|
"misp:meta-category=\"network\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd1837d-0694-4391-8cb9-364f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T13:09:17.000Z",
|
||
|
|
"modified": "2019-05-07T13:09:17.000Z",
|
||
|
|
"description": "Status: Commented out",
|
||
|
|
"pattern": "[(network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '80.84.49.50') AND network-traffic:dst_port = '443']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-07T13:09:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "network"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"ip-port\"",
|
||
|
|
"misp:meta-category=\"network\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd18724-ce4c-410f-95db-b3d7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T13:24:52.000Z",
|
||
|
|
"modified": "2019-05-07T13:24:52.000Z",
|
||
|
|
"description": "Status: Commented out",
|
||
|
|
"pattern": "[(network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '52.11.125.44') AND network-traffic:dst_port = '443']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-07T13:24:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "network"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"ip-port\"",
|
||
|
|
"misp:meta-category=\"network\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5cd18771-bac0-47c3-9a8c-a966950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T13:26:09.000Z",
|
||
|
|
"modified": "2019-05-07T13:26:09.000Z",
|
||
|
|
"first_observed": "2019-05-07T13:26:09Z",
|
||
|
|
"last_observed": "2019-05-07T13:26:09Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5cd18771-bac0-47c3-9a8c-a966950d210f",
|
||
|
|
"ipv4-addr--5cd18771-9f18-4005-a613-a966950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"ip-port\"",
|
||
|
|
"misp:meta-category=\"network\"",
|
||
|
|
"misp:to_ids=\"False\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5cd18771-bac0-47c3-9a8c-a966950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--5cd18771-9f18-4005-a613-a966950d210f",
|
||
|
|
"dst_port": 700,
|
||
|
|
"protocols": [
|
||
|
|
"ipv4"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5cd18771-9f18-4005-a613-a966950d210f",
|
||
|
|
"value": "192.168.0.100"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5cd187b5-1eb8-474a-ae22-a97c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T13:27:17.000Z",
|
||
|
|
"modified": "2019-05-07T13:27:17.000Z",
|
||
|
|
"first_observed": "2019-05-07T13:27:17Z",
|
||
|
|
"last_observed": "2019-05-07T13:27:17Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5cd187b5-1eb8-474a-ae22-a97c950d210f",
|
||
|
|
"ipv4-addr--5cd187b5-d93c-4c9a-9658-a97c950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"ip-port\"",
|
||
|
|
"misp:meta-category=\"network\"",
|
||
|
|
"misp:to_ids=\"False\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5cd187b5-1eb8-474a-ae22-a97c950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--5cd187b5-d93c-4c9a-9658-a97c950d210f",
|
||
|
|
"dst_port": 700,
|
||
|
|
"protocols": [
|
||
|
|
"ipv4"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5cd187b5-d93c-4c9a-9658-a97c950d210f",
|
||
|
|
"value": "192.168.0.100"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd189c9-dd18-4b41-9ad4-b3d7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-07T13:36:09.000Z",
|
||
|
|
"modified": "2019-05-07T13:36:09.000Z",
|
||
|
|
"description": "Status: Active - Threat Group Association: Earlier CARBANAK activity",
|
||
|
|
"pattern": "[(network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '193.203.48.23') AND network-traffic:dst_port = '800']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-07T13:36:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "network"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"ip-port\"",
|
||
|
|
"misp:meta-category=\"network\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|