500 lines
20 KiB
JSON
500 lines
20 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--5e2c4c13-1f64-4e4e-8165-4801950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f",
|
||
|
|
"created": "2020-01-31T07:35:51.000Z",
|
||
|
|
"modified": "2020-01-31T07:35:51.000Z",
|
||
|
|
"name": "wilbursecurity.com",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--5e2c4c13-1f64-4e4e-8165-4801950d210f",
|
||
|
|
"created_by_ref": "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f",
|
||
|
|
"created": "2020-01-31T07:35:51.000Z",
|
||
|
|
"modified": "2020-01-31T07:35:51.000Z",
|
||
|
|
"name": "Emotet/Trickbot",
|
||
|
|
"published": "2020-01-31T07:36:02Z",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--5e2c4de1-ac54-48d5-a37d-e9b4950d210f",
|
||
|
|
"indicator--5e2c4de1-d8f0-4c26-a183-e9b4950d210f",
|
||
|
|
"indicator--5e2c4dfa-7538-4f47-bdec-e9b4950d210f",
|
||
|
|
"indicator--5e2c5016-8b18-4d7a-9ec0-414b950d210f",
|
||
|
|
"indicator--5e2c5079-86ec-4f16-b647-75a9950d210f",
|
||
|
|
"indicator--5e2c536a-4134-427d-98d1-4eaf950d210f",
|
||
|
|
"indicator--5e2c5370-3918-40ec-8c2f-4a0a950d210f",
|
||
|
|
"indicator--5e2c5376-cd28-4e38-a0e7-48cc950d210f",
|
||
|
|
"indicator--5e2c5376-8478-43fc-8eac-42b2950d210f",
|
||
|
|
"indicator--5e2c5ac2-3588-439c-b693-43d8950d210f",
|
||
|
|
"indicator--5e2dac25-eda0-44f4-93d4-48af950d210f",
|
||
|
|
"indicator--5e2dac2a-0ae0-4120-a56e-4ea1950d210f",
|
||
|
|
"indicator--5e2dd390-a514-4790-8a1d-be6c950d210f",
|
||
|
|
"indicator--5e2dd532-a644-43e8-b03d-418c950d210f",
|
||
|
|
"indicator--5e2e3a1b-b21c-419a-a86e-4b42950d210f",
|
||
|
|
"observed-data--5e2e3a79-d648-4d6f-8375-83e8950d210f",
|
||
|
|
"network-traffic--5e2e3a79-d648-4d6f-8375-83e8950d210f",
|
||
|
|
"ipv4-addr--5e2e3a79-d648-4d6f-8375-83e8950d210f",
|
||
|
|
"x-misp-object--5e2c4ed1-e340-4765-a21f-75ba950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"Banker: TrickBot",
|
||
|
|
"malware:emotet"
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e2c4de1-ac54-48d5-a37d-e9b4950d210f",
|
||
|
|
"created_by_ref": "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f",
|
||
|
|
"created": "2020-01-25T14:32:49.000Z",
|
||
|
|
"modified": "2020-01-25T14:32:49.000Z",
|
||
|
|
"description": "Trickbot download and IEX via powershell",
|
||
|
|
"pattern": "[url:value = 'https://jomamba.best:80/adgvredgdz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-25T14:32:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e2c4de1-d8f0-4c26-a183-e9b4950d210f",
|
||
|
|
"created_by_ref": "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f",
|
||
|
|
"created": "2020-01-25T14:32:42.000Z",
|
||
|
|
"modified": "2020-01-25T14:32:42.000Z",
|
||
|
|
"description": "Trickbot download and IEX via powershell",
|
||
|
|
"pattern": "[url:value = 'http://144.202.114.147:80/aascx']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-25T14:32:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e2c4dfa-7538-4f47-bdec-e9b4950d210f",
|
||
|
|
"created_by_ref": "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f",
|
||
|
|
"created": "2020-01-25T14:32:14.000Z",
|
||
|
|
"modified": "2020-01-25T14:32:14.000Z",
|
||
|
|
"description": "Trickbot download and IEX via powershell",
|
||
|
|
"pattern": "[url:value = 'http://149.28.106.230/adsfjasktmsttyoatopoyamfkytasrdltoiqrttmcvbmltpatp']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-25T14:32:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e2c5016-8b18-4d7a-9ec0-414b950d210f",
|
||
|
|
"created_by_ref": "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f",
|
||
|
|
"created": "2020-01-25T14:26:30.000Z",
|
||
|
|
"modified": "2020-01-25T14:26:30.000Z",
|
||
|
|
"description": "C2 via powershell",
|
||
|
|
"pattern": "[url:value = '149.28.106.230.vultr.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-25T14:26:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e2c5079-86ec-4f16-b647-75a9950d210f",
|
||
|
|
"created_by_ref": "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f",
|
||
|
|
"created": "2020-01-25T14:28:09.000Z",
|
||
|
|
"modified": "2020-01-25T14:28:09.000Z",
|
||
|
|
"description": "C2 via Emotet",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '68.183.170.114']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-25T14:28:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e2c536a-4134-427d-98d1-4eaf950d210f",
|
||
|
|
"created_by_ref": "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f",
|
||
|
|
"created": "2020-01-25T14:40:42.000Z",
|
||
|
|
"modified": "2020-01-25T14:40:42.000Z",
|
||
|
|
"description": "Trickbot connected to this domain",
|
||
|
|
"pattern": "[domain-name:value = '2cdajlnnwxfylth4.onion']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-25T14:40:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e2c5370-3918-40ec-8c2f-4a0a950d210f",
|
||
|
|
"created_by_ref": "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f",
|
||
|
|
"created": "2020-01-25T14:40:48.000Z",
|
||
|
|
"modified": "2020-01-25T14:40:48.000Z",
|
||
|
|
"description": "Trickbot connected to this domain",
|
||
|
|
"pattern": "[domain-name:value = 'myexternalip.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-25T14:40:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e2c5376-cd28-4e38-a0e7-48cc950d210f",
|
||
|
|
"created_by_ref": "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f",
|
||
|
|
"created": "2020-01-25T14:40:54.000Z",
|
||
|
|
"modified": "2020-01-25T14:40:54.000Z",
|
||
|
|
"description": "Trickbot connected to this domain",
|
||
|
|
"pattern": "[domain-name:value = 'chekfast.zennolab.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-25T14:40:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e2c5376-8478-43fc-8eac-42b2950d210f",
|
||
|
|
"created_by_ref": "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f",
|
||
|
|
"created": "2020-01-25T14:40:54.000Z",
|
||
|
|
"modified": "2020-01-25T14:40:54.000Z",
|
||
|
|
"description": "Trickbot connected to this domain",
|
||
|
|
"pattern": "[domain-name:value = 'api.ipify.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-25T14:40:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e2c5ac2-3588-439c-b693-43d8950d210f",
|
||
|
|
"created_by_ref": "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f",
|
||
|
|
"created": "2020-01-25T15:12:02.000Z",
|
||
|
|
"modified": "2020-01-25T15:12:02.000Z",
|
||
|
|
"description": "PowerView.ps1",
|
||
|
|
"pattern": "[url:value = 'https://qwe4dse4.com/hcxUr9dg.ps1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-25T15:12:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e2dac25-eda0-44f4-93d4-48af950d210f",
|
||
|
|
"created_by_ref": "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f",
|
||
|
|
"created": "2020-01-26T15:11:33.000Z",
|
||
|
|
"modified": "2020-01-26T15:11:33.000Z",
|
||
|
|
"description": "Trickbot download and IEX via powershell",
|
||
|
|
"pattern": "[url:value = 'http://207.148.30.186:80/asdkjbaskjnvscjshxhgbsxsanxrvsars']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-26T15:11:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e2dac2a-0ae0-4120-a56e-4ea1950d210f",
|
||
|
|
"created_by_ref": "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f",
|
||
|
|
"created": "2020-01-26T15:11:38.000Z",
|
||
|
|
"modified": "2020-01-26T15:11:38.000Z",
|
||
|
|
"description": "Trickbot download and IEX via powershell",
|
||
|
|
"pattern": "[url:value = 'http://155.138.202.17:80/aieutireuoitreuJHJksfhkjhewkkkqowJLKjswwoieuoepo']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-26T15:11:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e2dd390-a514-4790-8a1d-be6c950d210f",
|
||
|
|
"created_by_ref": "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f",
|
||
|
|
"created": "2020-01-26T17:59:44.000Z",
|
||
|
|
"modified": "2020-01-26T17:59:44.000Z",
|
||
|
|
"description": "Trickbot potential c2",
|
||
|
|
"pattern": "[url:value = 'https://updatewinlsass.com:80/afdgszfsbgrg']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-26T17:59:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e2dd532-a644-43e8-b03d-418c950d210f",
|
||
|
|
"created_by_ref": "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f",
|
||
|
|
"created": "2020-01-26T18:06:42.000Z",
|
||
|
|
"modified": "2020-01-26T18:06:42.000Z",
|
||
|
|
"description": "Trickbot PowerTrick",
|
||
|
|
"pattern": "[domain-name:value = 'updatewinlsass.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-26T18:06:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e2e3a1b-b21c-419a-a86e-4b42950d210f",
|
||
|
|
"created_by_ref": "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f",
|
||
|
|
"created": "2020-01-27T01:17:15.000Z",
|
||
|
|
"modified": "2020-01-27T01:17:15.000Z",
|
||
|
|
"description": "Trickbot download and IEX via powershell",
|
||
|
|
"pattern": "[url:value = 'https://koretycbeeb.com:80/lmjnbvgftyujkiu765678']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-27T01:17:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5e2e3a79-d648-4d6f-8375-83e8950d210f",
|
||
|
|
"created_by_ref": "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f",
|
||
|
|
"created": "2020-01-27T01:18:49.000Z",
|
||
|
|
"modified": "2020-01-27T01:18:49.000Z",
|
||
|
|
"first_observed": "2020-01-27T01:18:49Z",
|
||
|
|
"last_observed": "2020-01-27T01:18:49Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5e2e3a79-d648-4d6f-8375-83e8950d210f",
|
||
|
|
"ipv4-addr--5e2e3a79-d648-4d6f-8375-83e8950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5e2e3a79-d648-4d6f-8375-83e8950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--5e2e3a79-d648-4d6f-8375-83e8950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5e2e3a79-d648-4d6f-8375-83e8950d210f",
|
||
|
|
"value": "155.138.142.157"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--5e2c4ed1-e340-4765-a21f-75ba950d210f",
|
||
|
|
"created_by_ref": "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f",
|
||
|
|
"created": "2020-01-25T14:34:48.000Z",
|
||
|
|
"modified": "2020-01-25T14:34:48.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"shell-commands\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "shell-command",
|
||
|
|
"value": "nltest /domain_trusts /all_trusts",
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "Trickbot",
|
||
|
|
"uuid": "5e2c4ed1-17f8-4e56-8dbb-75ba950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "shell-command",
|
||
|
|
"value": "net view /all /domain",
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "Trickbot",
|
||
|
|
"uuid": "5e2c4ed8-3fec-42f4-99b8-75ba950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "shell-command",
|
||
|
|
"value": "net config workstation",
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "Trickbot",
|
||
|
|
"uuid": "5e2c4ede-6fc8-48fa-a7f7-75ba950d210f"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "shell-commands"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|