2023-04-21 14:44:17 +00:00
{
"type" : "bundle" ,
"id" : "bundle--a57a8551-4e22-44b9-a72d-fa8345532029" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2023-04-19T12:31:21.000Z" ,
"modified" : "2023-04-19T12:31:21.000Z" ,
"name" : "CIRCL" ,
"identity_class" : "organization"
} ,
{
"type" : "report" ,
"spec_version" : "2.1" ,
"id" : "report--a57a8551-4e22-44b9-a72d-fa8345532029" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2023-04-19T12:31:21.000Z" ,
"modified" : "2023-04-19T12:31:21.000Z" ,
"name" : "HALFRIG - Malware Analysis Report" ,
"published" : "2023-04-19T12:31:38Z" ,
"object_refs" : [
"x-misp-attribute--e7963e75-00ed-4542-8e3d-4d7bc73fee77" ,
"indicator--da0840d2-552d-4198-9f22-bb212dd53880" ,
"indicator--2295b11f-5b27-43ea-b152-f2f2b0580e8f" ,
"indicator--5ef9091e-b65c-4033-8136-878f4ddea0b5" ,
"indicator--a04f9dd8-a1c0-43d3-9b3b-bcfd9c95747b" ,
"x-misp-object--9a5c7967-ce23-4e98-956b-f1e09bc6f77b" ,
"indicator--fee5eb3a-c2dd-40ea-97ff-78d827b5848c" ,
"indicator--fad6bb9e-862f-428a-9ded-fe90217d1c18" ,
"indicator--b1dd9581-897d-4ac8-bd2f-98f30d601147" ,
"indicator--f7585879-72a8-4a51-a414-cdae1aa8947c" ,
"indicator--fab51584-fda0-4be9-88e2-d301c21dacd8" ,
"indicator--4e8ebc97-432e-48f6-af54-e6f1f4589a0d" ,
"indicator--09833510-9b3b-4e7f-974a-423e25b96e5b" ,
"x-misp-object--a6b876c3-c517-48a4-9b4e-0ae68492089a" ,
"x-misp-object--b3ddd480-33ba-462a-a783-98bc0315ba43" ,
"x-misp-object--6f954c43-b864-43ad-8579-5eda4026a3b7" ,
"x-misp-object--ad1e8e48-20db-488e-95fd-bb75b6f96293" ,
"x-misp-object--77bba20a-f103-402c-9fd6-40fd2641f7f9" ,
"x-misp-object--ca7257d8-9bdc-459e-9f7f-5cdeecbd549d" ,
2024-08-07 08:13:15 +00:00
"relationship--ec4189fd-008d-475f-86c1-7be1f77c8fd6" ,
"relationship--13c9fe19-2468-472c-ab31-df2c9c858482" ,
"relationship--b5be2a37-8495-4629-9b72-db5474f5062d" ,
"relationship--87c520b5-6db0-4066-92aa-b69d88bd8801" ,
"relationship--3610e65f-699d-4579-80e6-a638fa6dd0e8" ,
"relationship--dfafc639-e96b-44b4-8531-fb00386c723b" ,
"relationship--d4b70b5c-e62f-4213-814b-473316ece74f" ,
"relationship--20fcdc4c-dd77-4795-b62c-c5d86ff6466d" ,
"relationship--9efe82dd-6dcb-49dc-8516-0a1238bd648a" ,
"relationship--b1695970-3768-4954-aa9b-6ebca1dacea9" ,
"relationship--9c0c8e62-6302-414e-9bf6-484d308ee0a7" ,
"relationship--e056a23e-cb3a-498a-aaa5-d8d880ecc4a7" ,
"relationship--aa5f155f-b709-4d42-98c0-64aa7ffbaa34" ,
"relationship--69df291b-7787-47ce-9338-1e745667494d" ,
"relationship--61485395-b023-4652-becb-b3f19ff4fb18"
2023-04-21 14:44:17 +00:00
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"type:OSINT" ,
"osint:lifetime=\"perpetual\"" ,
"tlp:clear" ,
"misp-galaxy:tool=\"HALFRIG\"" ,
"misp-galaxy:mitre-attack-pattern=\"Virtual Private Server - T1583.003\"" ,
"misp-galaxy:mitre-attack-pattern=\"Compromise Infrastructure - T1584\"" ,
"misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"" ,
"misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"" ,
"misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"" ,
"misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"" ,
"misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"" ,
"misp-galaxy:mitre-attack-pattern=\"DLL Search Order Hijacking - T1574.001\"" ,
"misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"" ,
"misp-galaxy:mitre-attack-pattern=\"HTML Smuggling - T1027.006\"" ,
"misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"" ,
"misp-galaxy:mitre-attack-pattern=\"Mark-of-the-Web Bypass - T1553.005\"" ,
"admiralty-scale:source-reliability=\"a\"" ,
"estimative-language:confidence-in-analytic-judgment=\"high\"" ,
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"object_marking_refs" : [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--e7963e75-00ed-4542-8e3d-4d7bc73fee77" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2023-04-19T11:25:24.000Z" ,
"modified" : "2023-04-19T11:25:24.000Z" ,
"labels" : [
"misp:type=\"pattern-in-traffic\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
] ,
"x_misp_category" : "Network activity" ,
"x_misp_comment" : "Pattern-ENVYSCOUT backend fingerprint collector" ,
"x_misp_type" : "pattern-in-traffic" ,
"x_misp_value" : "sawabfoundation.net/p.php?ip=<IP>&ua=<USER_AGENT>"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--da0840d2-552d-4198-9f22-bb212dd53880" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2023-04-19T11:18:47.000Z" ,
"modified" : "2023-04-19T11:18:47.000Z" ,
"description" : "ENVYSCOUT" ,
"pattern" : "[url:value = 'sawabfoundation.net/note.html']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-04-19T11:18:47Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--2295b11f-5b27-43ea-b152-f2f2b0580e8f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2023-04-19T11:18:53.000Z" ,
"modified" : "2023-04-19T11:18:53.000Z" ,
"description" : "compromised hosting used for ENVYSCOUT" ,
"pattern" : "[domain-name:value = 'sawabfoundation.net']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-04-19T11:18:53Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ef9091e-b65c-4033-8136-878f4ddea0b5" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2023-04-19T11:18:59.000Z" ,
"modified" : "2023-04-19T11:18:59.000Z" ,
"description" : "CobaltStrike redirector" ,
"pattern" : "[domain-name:value = 'communitypowersports.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-04-19T11:18:59Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--a04f9dd8-a1c0-43d3-9b3b-bcfd9c95747b" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2023-04-19T11:19:05.000Z" ,
"modified" : "2023-04-19T11:19:05.000Z" ,
"description" : "Actual CobaltStrike C2" ,
"pattern" : "[domain-name:value = 'sanjosemotosport.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-04-19T11:19:05Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--9a5c7967-ce23-4e98-956b-f1e09bc6f77b" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2023-04-18T07:45:44.000Z" ,
"modified" : "2023-04-18T07:45:44.000Z" ,
"labels" : [
"misp:name=\"report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "link" ,
"object_relation" : "link" ,
"value" : "https://www.gov.pl/attachment/64193e8d-05e2-4cbf-bb4c-5f58da21fefb" ,
"category" : "External analysis" ,
"uuid" : "c5e93a26-3edb-468d-8231-548ab7518f30"
} ,
{
"type" : "text" ,
"object_relation" : "summary" ,
"value" : "HALFRIG is a stager for CobaltStrike Beacon that was used in an espionage campaign significantly\r\noverlapping with publicly described activity linked to the APT291 and NOBELIUM2 activity sets. HALFRIG\r\nhas significant code overlap with the QUARTERRIG and it is highly probable that it was developed\r\nby the same team." ,
"category" : "Other" ,
"uuid" : "4433e9c9-7e46-4bd1-a31b-31ec7fd42fe7"
} ,
{
"type" : "text" ,
"object_relation" : "type" ,
"value" : "Report" ,
"category" : "Other" ,
"uuid" : "a2b33d90-ff72-47d1-af81-a90215d00c96"
} ,
{
"type" : "attachment" ,
"object_relation" : "report-file" ,
"value" : "HALFRIG_.pdf" ,
"category" : "External analysis" ,
"uuid" : "acb1b478-874b-4e5d-adbe-54b25f38c80f" ,
"data" : " J V B E R i 0 x L j c N C i W 1 t b W 1 D Q o x I D A g b 2 J q D Q o 8 P C 9 U e X B l L 0 N h d G F s b 2 c v U G F n Z X M g M i A w I F I v T G F u Z y h l b i 1 V U y k g L 1 N 0 c n V j d F R y Z W V S b 290 I D E z N S A w I F I v T W F y a 0 l u Z m 88 P C 9 N Y X J r Z W Q g d H J 1 Z T 4 + L 0 1 l d G F k Y X R h I D E w N j Y g M C B S L 1 Z p Z X d l c l B y Z W Z l c m V u Y 2 V z I D E w N j c g M C B S P j 4 N C m V u Z G 9 i a g 0 K M i A w I G 9 i a g 0 K P D w v V H l w Z S 9 Q Y W d l c y 9 D b 3 V u d C A y M C 9 L a W R z W y A z I D A g U i A x N S A w I F I g M j Q g M C B S I D I 2 I D A g U i A y O S A w I F I g M z c g M C B S I D Q w I D A g U i A 0 M i A w I F I g N D M g M C B S I D Q 1 I D A g U i A 0 N i A w I F I g N D g g M C B S I D Q 5 I D A g U i A 1 M C A w I F I g N T I g M C B S I D U 0 I D A g U i A 1 N y A w I F I g N T g g M C B S I D Y w I D A g U i A x M z A g M C B S X S A + P g 0 K Z W 5 k b 2 J q D Q o z I D A g b 2 J q D Q o 8 P C 9 U e X B l L 1 B h Z 2 U v U G F y Z W 50 I D I g M C B S L 1 J l c 291 c m N l c z w 8 L 0 Z v b n Q 8 P C 9 G M S A 1 I D A g U i 9 G M i A 5 I D A g U i 9 G M y A x M S A w I F I v R j Q g M T M g M C B S P j 4 v R X h 0 R 1 N 0 Y X R l P D w v R 1 M 3 I D c g M C B S L 0 d T O C A 4 I D A g U j 4 + L 1 B y b 2 N T Z X R b L 1 B E R i 9 U Z X h 0 L 0 l t Y W d l Q i 9 J b W F n Z U M v S W 1 h Z 2 V J X S A + P i 9 N Z W R p Y U J v e F s g M C A w I D U 5 N S 4 z M i A 4 N D E u O T J d I C 9 D b 250 Z W 50 c y A 0 I D A g U i 9 H c m 91 c D w 8 L 1 R 5 c G U v R 3 J v d X A v U y 9 U c m F u c 3 B h c m V u Y 3 k v Q 1 M v R G V 2 a W N l U k d C P j 4 v V G F i c y 9 T L 1 N 0 c n V j d F B h c m V u d H M g M D 4 + D Q p l b m R v Y m o N C j Q g M C B v Y m o N C j w 8 L 0 Z p b H R l c i 9 G b G F 0 Z U R l Y 29 k Z S 9 M Z W 5 n d G g g M T A 1 N z 4 + D Q p z d H J l Y W 0 N C n i c v V h L b 9 s 4 E L 4 L 8 H / g a S E V M M 3 h m 4 u i g O u m a Y s G y M Y G 9 h D 0 o C a K a 8 D r p I q b w v + + M / K j s i X F j 6 j r g 2 C S Q 8033 w x n R u z 18 / n k L r 2 Z s 9 e v e / 35 P L 35 l t 2 y 697 o / u F L b 7 R 4 y H q X 6 X g y S + e T + 1 l v + O P r n K Y + Z O l t l r 95 w 96 + G 7 D v n U h w Q T / v H T D B T D B c S e Y 18 C B Z n n W i f 1 + x W S d 6 O + p E v f f A A L j Q b H T X i U h a M G A y O G 4 d c 8 H S x t F / K H c + d G z 8 i K 9 m 42 L k V 6 P z T n Q d s 6 S r 8 W H L f 76 w 0 a d O d I Y 6 / u l E L W B S I L m C M q Y C y g b B a f p Q l p 1 d D B j r X R L h F 4 O P 75 h o j 0 g n u J e a O S t o x x 7 Q F S B w G h D J w P B g a 4 F I w 709 G o h s H 4 i w X B / P i G o P i F K W u 8 C s t z z 4 o 4 H o 1 h m x 1 n G j j w Z i T g O i n g G i A 1 d H 47 D t 45 C e h 6 N x u F N x q F o Q x o c a E B 8 S g L i f g I k / J 6 D i 9 w n o + C o B G X + k 4 f k e i L 4 l i O A 9 t 6 E B 4 j 6 e w m k g N G q t 5 Q k z n F m h 4 M a 4 Y j U f l 0 d X B a 6 L d P o z z T P W n 6 X T x S O V i 0 n i 4 k d 2 l T 3 c 54 m K 5 y 8 q H B V 40 m i u z e H w 9 q b k U n H o L p G B l M 6 v A a G C b Y T T z U Q h D V 4 B 0 O T W 5 u 2 l p U G F M x t U S K w 0 t q R h S 8 w q Q e p w + l s n u n u 1 p v F P o 0 X 6 X g 532 M A 6 V F n X H s L B d k g p X E m z E M b a n a W V H d w D r X j h V 0 + K E q k V D 6 j N e q 5 D Y Z H V x Y R 2 X P v i x c p T 7 T e 6 C D e a M A E n A C P P c G 0 b v f F / W U H R 3 Z o Z T V 6 S F S + J o M L B 0 S Y s C G V K B m r v r N 9 d K 50 O Q 20 q 6 w b P H a 7 h 65 X / P Z y u 1 w E b R + + a P P A H E R L l J 0 B s Y l d V z w B Y C 6 d G j 3 J a u o b o K W d I Q m g M k x g W q M J q w T U W b Q t 8 e f y V w t h h X d j o l E F z I 9 F G D J z d N F Q 1 a t 1 H A f l T a c O d w Q Z E c + W Y x A Y t Y F B h o 1 j k e X q H o P W f l N 6 J 3 O f l h y t 93 + n F l g M J e q 50 I a j Q B v A U 0 r 9 L y B a w U l 912 O 5 N A Z L b b a Z R H F 3 t j O G 22 t 19 u p 8 k X R n P q P C x 9 P Z p W Q 9 x 5 h G L Y V f F C / a V R o u / K 1 X x R a A 0 e k v K J l B 7 a 6 B t m R u p u a 1 + l F w Q A Q U Z U 3 o U / + Z p v m C D + x + z R M f z D B u H f E J S B X 80 n G 6 L j 7 N k u X i T J S Z m w y x / K u Z x 2 C q f R g a O e a D B k L 18 u p b 5 F K H u 2 + q v d m 1 W 2 F L h 91 O D s r 0 2 + 3 Z t t p h 1 R J X 6 w R m 5 + 4 o e I w w D j m F z + b l l H g K Q 0 x s A 7 P B Q S 8 W 6 F a d W m k 4 D t w g G H H X 1 e E A x 966 z X / S s R C n f O c z O n q 4 d 0 A J d C C q G N d 7 q h m w n S 13 t I X s 3 V F Q v P J B C T w u q 5 p s E V H E 91 M e z + I C e y C f T 5 X X R r j 9 e B o F 0 Y 19 Z B 4 F R 7 a O y N 7 q 5 j q W Q q m 3 V y t B l Q r 31 e y 9 Z o G U n e M 19 T X p / A k 60 i 5 Z t p 1 Z D N C p t O A e / A F 5 q C d E N C m V u Z H N 0 c m V h b Q 0 K Z W 5 k b 2 J q D Q o 1 I D A g b 2 J q D Q o 8 P C 9 U e X B l L 0 Z v b n Q v U 3 V i d H l w Z S 9 U c n V l V H l w Z S 9 O Y W 1 l L 0 Y x L 0 J h c 2 V G b 250 L 0 J D R E V F R S t S Y W p k a G F u a S 1 S Z W d 1 b G F y L 0 V u Y 29 k a W 5 n L 1 d p b k F u c 2 l F b m N v Z G l u Z y 9 G b 250 R G V z Y 3 J p c H R v c i A 2 I D A g U i 9 G a X J z d E N o Y X I g M z I v T G F z d E N o Y X I g M T I y L 1 d p Z H R o c y A x M D Q 0 I D A g U j 4 + D Q p l b m R v Y m o N C j Y g M C B v Y m o N C j w 8 L 1 R 5 c G U v R m 9 u d E R l c 2 N y a X B 0 b 3 I v R m 9 u d E 5 h b W U v Q k N E R U V F K 1 J h a m R o Y W 5 p L V J l Z 3 V s Y X I v R m x h Z 3 M g M z I v S X R h b G l j Q W 5 n b G U g M C 9 B c 2 N l b n Q g O T M w L 0 R l c 2 N l b n Q g L T M 0 N i 9 D Y X B I Z W l n a H Q g O T M w L 0 F 2 Z 1 d p Z H R o I D Q 3 N y 9 N Y X h X a W R 0 a C A y N D M 2 L 0 Z v b n R X Z W l n a H Q g N D A w L 1 h I Z W l n a H Q g M j U w L 1 N 0 Z W 1 W I D Q 3 L 0 Z v b n R C Q m 94 W y A t N D E 2 I C 0 z N D Y g M j A y M C A 5 M z B d I C 9 G b 250 R m l s Z T I g M T A 0 M i A w I F I + P g 0 K Z W 5 k b 2 J q D Q o 3 I D A g b 2 J q D Q o 8 P C 9 U e X B l L 0 V 4 d E d T d G F 0 Z S 9 C T S 9 O b 3 J t Y W w v Y 2 E g M T 4 + D Q p l b m R v Y m o N C j g g M C B v Y m o N C j w 8 L 1 R 5 c G U v R X h 0 R 1 N 0 Y X R l L 0 J N L 0 5 v c m 1 h b C 9 D Q S A x P j 4 N C m V u Z G 9 i a g 0 K O S A w I G 9 i a g 0 K P D w v V H l w Z S 9 G b 250 L 1 N 1 Y n R 5 c G U v V H J 1 Z V R 5 c G U v T m F t Z S 9 G M i 9 C Y X N l R m 9 u d C 9 C Q 0 R G R U U r V m V y Z G F u Y S 1 C b 2 x k L 0 V u Y 29 k a W 5 n L 1 d p b k F u c 2 l F b m N v Z G l u Z y 9 G b 250 R G V z Y 3 J p c H R v c i A x M C A w I F I v R m l y c 3 R D a G F y I D M y L 0 x h c 3 R D a G F y I D M y L 1 d p Z H R o c y A x M D Q 1 I D A g U j 4 + D Q p l b m R v Y m o N C j E w I D A g b 2 J q D Q o 8 P C 9 U e X B l L 0 Z v b n R E Z X N j c m l w d G 9 y L 0 Z v b n R O Y W 1 l L 0 J D R E Z F R S t W Z X J k Y W 5 h L U J v b G Q v R m x h Z 3 M g M z I v S X R h b G l j Q W 5 n b G U g M C 9 B c 2 N l b n Q g M T A w N S 9 E Z X N j Z W 50 I C 0 y M D c v Q 2 F w S G V p Z 2 h 0 I D c 2 N S 9 B d m d X a W R 0 a C A 1 N j g v T W F 4 V 2 l k d G g g M j I 1 N y 9 G b 250 V 2 V p Z 2 h 0 I D c w M C 9 Y S G V p Z 2 h 0 I D I 1 M C 9 T d G V t V i A 1 N i 9 G b 250 Q k J v e F s g L T U 1 M C A t M j A 3 I D E 3 M D c g N z Y 1 X S A v R m 9 u d E Z p b G U y I D E w N D Y g M C B S P j 4 N C m V u Z G 9 i a g 0 K M T E g M C B v Y m o N C j w 8 L 1 R 5 c G U v R m 9 u d C 9 T d W J 0 e X B l L 1 R y d W V U e X B l L 0 5 h b W U v R j M v Q m F z Z U Z v b n Q v Q k N E R 0 V F K 1 J h a m R o Y W 5 p L V N l b W l C b 2 x k L 0 V u Y 29 k a W 5 n L 1 d p b k F u c 2 l F b m N v Z G l u Z y 9 G b 250 R G V z Y 3 J p c H R v c i A x M i A w I F I v R m l y c 3 R D a G F y I D M y L 0 x h c 3 R D a G F y I D E y M S 9 X a W R 0 a H M g M T A 1 M C A w I F I + P g 0 K Z W 5 k b 2 J q D Q o x M i A w I G 9 i a g 0 K P D w v V H l w Z S 9 G b 250 R G V z Y 3 J p c H R v c i 9 G b 250 T m F t Z S 9 C Q 0 R H R U U r U m F q Z G h h b m k t U 2 V t a U J v b G Q v R m x h Z 3 M g M z I v S X R h b G l j Q W 5 n b G U g M C 9 B c 2 N l b n Q g O T M w L 0 R l c 2 N l b n Q g L T M 0 N i 9 D Y X
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--fee5eb3a-c2dd-40ea-97ff-78d827b5848c" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2023-04-18T13:58:31.000Z" ,
"modified" : "2023-04-18T13:58:31.000Z" ,
"name" : "APT29_HALFRIG_OBFUSCATION" ,
"description" : "A rule that can be used to scan for HALFRIG" ,
"pattern" : "rule APT29_HALFRIG_OBFUSCATION\r\n{\r\nmeta:\r\ndescription = \\\\\"Detects obfuscation patterns used in HALFRIG. This rule wasn\\'t tested against large dataset, it should be used for threat hunting and not on services like VTI.\\\\\"\r\n\r\nstrings:\r\n\r\n// Decryption constants and decryption operation\r\n\r\n$ = {48 BB 0B 91 09 19 4D FD 9B F3 }\r\n\r\n\r\n$ = {4D 8D 40 01 48 8B CA 48 8B C2 48 C1 E9 38 48 83 C9 01 48 C1 E0 08 48 8B D1 48 33 D0}\r\n\r\n\r\n$ = {C7 05 [3] 00 F7 91 4D 01 }\r\n\r\n condition:\r\n\r\nuint16(0) == 0x5A4D\r\n\r\nand\r\n\r\nfilesize < 500KB\r\n\r\nand\r\n\r\nall of them\r\n}" ,
"pattern_type" : "yara" ,
2023-12-14 14:30:15 +00:00
"pattern_version" : "2.1" ,
2023-04-21 14:44:17 +00:00
"valid_from" : "2023-04-18T13:58:31Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "misc"
}
] ,
"labels" : [
"misp:name=\"yara\"" ,
"misp:meta-category=\"misc\"" ,
"misp:to_ids=\"True\""
] ,
"x_misp_reference" : "https://www.gov.pl/attachment/64193e8d-05e2-4cbf-bb4c-5f58da21fefb"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--fad6bb9e-862f-428a-9ded-fe90217d1c18" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2023-04-19T11:13:38.000Z" ,
"modified" : "2023-04-19T11:13:38.000Z" ,
"description" : "Legitimate binary used for loading malicious DLL" ,
"pattern" : "[file:hashes.MD5 = '83863beee3502e42ced7e4b6dacb9eac' AND file:hashes.SHA1 = 'd9d40cb3e2fe05cf223dc0b592a592c132340042' AND file:hashes.SHA256 = 'cb470d77087518ed7bc53ca624806c265ae2485d40ec212acc2559720940fb27' AND file:name = 'Note.exe' AND file:size = '1597000']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-04-19T11:13:38Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--b1dd9581-897d-4ac8-bd2f-98f30d601147" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2023-04-19T09:53:01.000Z" ,
"modified" : "2023-04-19T09:53:01.000Z" ,
"description" : "Virtual disc container" ,
"pattern" : "[file:hashes.MD5 = '0e5ed33778ee9c020aa067546384abcb' AND file:hashes.SHA1 = 'fbb482415f5312ed64b3a0ebee7fed5e6610c21a' AND file:hashes.SHA256 = 'd1455c42553fab54e78c874525c812aaefb1f3cc69f9c314649bd6e4e57b9fa9' AND file:name = 'Note.iso' AND file:size = '2688000']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-04-19T09:53:01Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--f7585879-72a8-4a51-a414-cdae1aa8947c" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2023-04-19T11:13:58.000Z" ,
"modified" : "2023-04-19T11:13:58.000Z" ,
"description" : "1st module" ,
"pattern" : "[file:hashes.MD5 = 'f532c0247b683de8936982e86876093b' AND file:hashes.SHA1 = 'f61e0d09be2fc81d6f325aa7041be6136a747c2d' AND file:hashes.SHA256 = 'ddf218e4e7ccd5e8bd502fb115d1e7fbfaa393fb7e0b3b9001168caebc771c50' AND file:name = 'AppvIsvSubsystems64.dll' AND file:size = '27000']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-04-19T11:13:58Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--fab51584-fda0-4be9-88e2-d301c21dacd8" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2023-04-19T11:14:12.000Z" ,
"modified" : "2023-04-19T11:14:12.000Z" ,
"description" : "2nd module\r\n" ,
"pattern" : "[file:hashes.MD5 = 'abc87df854f31725dd1d7231f6f07354' AND file:hashes.SHA1 = 'e418d37fdcf4c288884bfe744b416cbdb0243a9e' AND file:hashes.SHA256 = 'efeb7d9d0fabe464a32c4e33fe756d6ef7a9b369c0f1462b3dd573b6b667488e' AND file:name = 'msword.dll' AND file:size = '53000']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-04-19T11:14:12Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--4e8ebc97-432e-48f6-af54-e6f1f4589a0d" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2023-04-19T11:14:33.000Z" ,
"modified" : "2023-04-19T11:14:33.000Z" ,
"description" : "3rd module" ,
"pattern" : "[file:hashes.MD5 = '2ffaa8cbc7f0d21d03d3dd897d974dba' AND file:hashes.SHA1 = '6dff9a9f13300a5ce72a70d907ff7854599e990a' AND file:hashes.SHA256 = 'cfa65036aff012d7478694ea733e3e882cf8e18f336af5fba3ed2ef29160d45b' AND file:name = 'envsrv.dll' AND file:size = '56000']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-04-19T11:14:33Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--09833510-9b3b-4e7f-974a-423e25b96e5b" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2023-04-19T09:01:53.000Z" ,
"modified" : "2023-04-19T09:01:53.000Z" ,
"description" : "4 module (shellcode stager)" ,
"pattern" : "[file:hashes.MD5 = '5b6d8a474c556fe327004ed8a33edcdb' AND file:hashes.SHA1 = 'a677b6aa958fe02cac0730d36e8123648e02884f' AND file:hashes.SHA256 = '86edfd6c7a2fab8c50a372494e3d5b08c032cca754396f6e288d5d4c5738cb4c' AND file:name = 'mschost.dll' AND file:size = '391000']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-04-19T09:01:53Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--a6b876c3-c517-48a4-9b4e-0ae68492089a" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2023-04-19T09:02:52.000Z" ,
"modified" : "2023-04-19T09:02:52.000Z" ,
"labels" : [
"misp:name=\"process\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : "RunTimeBroker.exe" ,
"category" : "Other" ,
"uuid" : "074efb8b-4300-44e1-b81b-85c33a3f61f8"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "process"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--b3ddd480-33ba-462a-a783-98bc0315ba43" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2023-04-19T09:03:25.000Z" ,
"modified" : "2023-04-19T09:03:25.000Z" ,
"labels" : [
"misp:name=\"process\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : "TaskHostW.exe" ,
"category" : "Other" ,
"uuid" : "68894fb2-fa01-453b-9af5-015195c38906"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "process"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--6f954c43-b864-43ad-8579-5eda4026a3b7" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2023-04-19T09:04:02.000Z" ,
"modified" : "2023-04-19T09:04:02.000Z" ,
"labels" : [
"misp:name=\"process\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : "Svchost.exe" ,
"category" : "Other" ,
"uuid" : "8ea48407-6a1b-4233-a836-3d8c6783a85d"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "process"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--ad1e8e48-20db-488e-95fd-bb75b6f96293" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2023-04-19T09:05:04.000Z" ,
"modified" : "2023-04-19T09:05:04.000Z" ,
"labels" : [
"misp:name=\"process\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : "IpfHelper.exe" ,
"category" : "Other" ,
"uuid" : "6dccd3a5-bbd3-4d7a-9feb-5938f484bff7"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "process"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--77bba20a-f103-402c-9fd6-40fd2641f7f9" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2023-04-19T09:05:19.000Z" ,
"modified" : "2023-04-19T09:05:19.000Z" ,
"labels" : [
"misp:name=\"process\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : "SecurityHealthService.exe" ,
"category" : "Other" ,
"uuid" : "8ac9b619-8143-4553-9793-2728db1d3e9a"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "process"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--ca7257d8-9bdc-459e-9f7f-5cdeecbd549d" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2023-04-19T09:05:45.000Z" ,
"modified" : "2023-04-19T09:05:45.000Z" ,
"labels" : [
"misp:name=\"process\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : "ApplicationFrameHost.exe" ,
"category" : "Other" ,
"uuid" : "b30ddce2-82a8-46a9-838c-a019c2549d00"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "process"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-08-07 08:13:15 +00:00
"id" : "relationship--ec4189fd-008d-475f-86c1-7be1f77c8fd6" ,
2023-04-21 14:44:17 +00:00
"created" : "2023-04-19T11:13:38.000Z" ,
"modified" : "2023-04-19T11:13:38.000Z" ,
"relationship_type" : "followed-by" ,
"source_ref" : "indicator--fad6bb9e-862f-428a-9ded-fe90217d1c18" ,
"target_ref" : "indicator--f7585879-72a8-4a51-a414-cdae1aa8947c"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-08-07 08:13:15 +00:00
"id" : "relationship--13c9fe19-2468-472c-ab31-df2c9c858482" ,
2023-04-21 14:44:17 +00:00
"created" : "2023-04-19T09:51:50.000Z" ,
"modified" : "2023-04-19T09:51:50.000Z" ,
"relationship_type" : "contains" ,
"source_ref" : "indicator--b1dd9581-897d-4ac8-bd2f-98f30d601147" ,
"target_ref" : "indicator--fad6bb9e-862f-428a-9ded-fe90217d1c18"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-08-07 08:13:15 +00:00
"id" : "relationship--b5be2a37-8495-4629-9b72-db5474f5062d" ,
2023-04-21 14:44:17 +00:00
"created" : "2023-04-19T09:52:12.000Z" ,
"modified" : "2023-04-19T09:52:12.000Z" ,
"relationship_type" : "contains" ,
"source_ref" : "indicator--b1dd9581-897d-4ac8-bd2f-98f30d601147" ,
"target_ref" : "indicator--f7585879-72a8-4a51-a414-cdae1aa8947c"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-08-07 08:13:15 +00:00
"id" : "relationship--87c520b5-6db0-4066-92aa-b69d88bd8801" ,
2023-04-21 14:44:17 +00:00
"created" : "2023-04-19T09:52:30.000Z" ,
"modified" : "2023-04-19T09:52:30.000Z" ,
"relationship_type" : "contains" ,
"source_ref" : "indicator--b1dd9581-897d-4ac8-bd2f-98f30d601147" ,
"target_ref" : "indicator--fab51584-fda0-4be9-88e2-d301c21dacd8"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-08-07 08:13:15 +00:00
"id" : "relationship--3610e65f-699d-4579-80e6-a638fa6dd0e8" ,
2023-04-21 14:44:17 +00:00
"created" : "2023-04-19T09:52:46.000Z" ,
"modified" : "2023-04-19T09:52:46.000Z" ,
"relationship_type" : "contains" ,
"source_ref" : "indicator--b1dd9581-897d-4ac8-bd2f-98f30d601147" ,
"target_ref" : "indicator--4e8ebc97-432e-48f6-af54-e6f1f4589a0d"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-08-07 08:13:15 +00:00
"id" : "relationship--dfafc639-e96b-44b4-8531-fb00386c723b" ,
2023-04-21 14:44:17 +00:00
"created" : "2023-04-19T09:53:01.000Z" ,
"modified" : "2023-04-19T09:53:01.000Z" ,
"relationship_type" : "contains" ,
"source_ref" : "indicator--b1dd9581-897d-4ac8-bd2f-98f30d601147" ,
"target_ref" : "indicator--09833510-9b3b-4e7f-974a-423e25b96e5b"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-08-07 08:13:15 +00:00
"id" : "relationship--d4b70b5c-e62f-4213-814b-473316ece74f" ,
2023-04-21 14:44:17 +00:00
"created" : "2023-04-19T11:13:58.000Z" ,
"modified" : "2023-04-19T11:13:58.000Z" ,
"relationship_type" : "followed-by" ,
"source_ref" : "indicator--f7585879-72a8-4a51-a414-cdae1aa8947c" ,
"target_ref" : "indicator--fab51584-fda0-4be9-88e2-d301c21dacd8"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-08-07 08:13:15 +00:00
"id" : "relationship--20fcdc4c-dd77-4795-b62c-c5d86ff6466d" ,
2023-04-21 14:44:17 +00:00
"created" : "2023-04-19T11:14:12.000Z" ,
"modified" : "2023-04-19T11:14:12.000Z" ,
"relationship_type" : "followed-by" ,
"source_ref" : "indicator--fab51584-fda0-4be9-88e2-d301c21dacd8" ,
"target_ref" : "indicator--4e8ebc97-432e-48f6-af54-e6f1f4589a0d"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-08-07 08:13:15 +00:00
"id" : "relationship--9efe82dd-6dcb-49dc-8516-0a1238bd648a" ,
2023-04-21 14:44:17 +00:00
"created" : "2023-04-19T09:07:38.000Z" ,
"modified" : "2023-04-19T09:07:38.000Z" ,
"relationship_type" : "injected-into" ,
"source_ref" : "indicator--4e8ebc97-432e-48f6-af54-e6f1f4589a0d" ,
"target_ref" : "x-misp-object--a6b876c3-c517-48a4-9b4e-0ae68492089a"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-08-07 08:13:15 +00:00
"id" : "relationship--b1695970-3768-4954-aa9b-6ebca1dacea9" ,
2023-04-21 14:44:17 +00:00
"created" : "2023-04-19T09:07:48.000Z" ,
"modified" : "2023-04-19T09:07:48.000Z" ,
"relationship_type" : "injected-into" ,
"source_ref" : "indicator--4e8ebc97-432e-48f6-af54-e6f1f4589a0d" ,
"target_ref" : "x-misp-object--b3ddd480-33ba-462a-a783-98bc0315ba43"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-08-07 08:13:15 +00:00
"id" : "relationship--9c0c8e62-6302-414e-9bf6-484d308ee0a7" ,
2023-04-21 14:44:17 +00:00
"created" : "2023-04-19T09:08:16.000Z" ,
"modified" : "2023-04-19T09:08:16.000Z" ,
"relationship_type" : "injected-into" ,
"source_ref" : "indicator--4e8ebc97-432e-48f6-af54-e6f1f4589a0d" ,
"target_ref" : "x-misp-object--6f954c43-b864-43ad-8579-5eda4026a3b7"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-08-07 08:13:15 +00:00
"id" : "relationship--e056a23e-cb3a-498a-aaa5-d8d880ecc4a7" ,
2023-04-21 14:44:17 +00:00
"created" : "2023-04-19T09:08:30.000Z" ,
"modified" : "2023-04-19T09:08:30.000Z" ,
"relationship_type" : "injected-into" ,
"source_ref" : "indicator--4e8ebc97-432e-48f6-af54-e6f1f4589a0d" ,
"target_ref" : "x-misp-object--ad1e8e48-20db-488e-95fd-bb75b6f96293"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-08-07 08:13:15 +00:00
"id" : "relationship--aa5f155f-b709-4d42-98c0-64aa7ffbaa34" ,
2023-04-21 14:44:17 +00:00
"created" : "2023-04-19T09:08:55.000Z" ,
"modified" : "2023-04-19T09:08:55.000Z" ,
"relationship_type" : "injected-into" ,
"source_ref" : "indicator--4e8ebc97-432e-48f6-af54-e6f1f4589a0d" ,
"target_ref" : "x-misp-object--77bba20a-f103-402c-9fd6-40fd2641f7f9"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-08-07 08:13:15 +00:00
"id" : "relationship--69df291b-7787-47ce-9338-1e745667494d" ,
2023-04-21 14:44:17 +00:00
"created" : "2023-04-19T09:09:03.000Z" ,
"modified" : "2023-04-19T09:09:03.000Z" ,
"relationship_type" : "injected-into" ,
"source_ref" : "indicator--4e8ebc97-432e-48f6-af54-e6f1f4589a0d" ,
"target_ref" : "x-misp-object--ca7257d8-9bdc-459e-9f7f-5cdeecbd549d"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-08-07 08:13:15 +00:00
"id" : "relationship--61485395-b023-4652-becb-b3f19ff4fb18" ,
2023-04-21 14:44:17 +00:00
"created" : "2023-04-19T11:14:33.000Z" ,
"modified" : "2023-04-19T11:14:33.000Z" ,
"relationship_type" : "followed-by" ,
"source_ref" : "indicator--4e8ebc97-432e-48f6-af54-e6f1f4589a0d" ,
"target_ref" : "indicator--09833510-9b3b-4e7f-974a-423e25b96e5b"
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:WHITE" ,
"definition" : {
"tlp" : "white"
}
}
]
}
