2023-04-21 13:25:09 +00:00
|
|
|
{
|
2023-06-14 17:31:25 +00:00
|
|
|
"type": "bundle",
|
|
|
|
|
"id": "bundle--56580480-2738-4888-98be-b742950d210b",
|
|
|
|
|
"objects": [
|
|
|
|
|
{
|
|
|
|
|
"type": "identity",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T08:16:15.000Z",
|
|
|
|
|
"modified": "2015-11-27T08:16:15.000Z",
|
|
|
|
|
"name": "CthulhuSPRL.be",
|
|
|
|
|
"identity_class": "organization"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "report",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "report--56580480-2738-4888-98be-b742950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T08:16:15.000Z",
|
|
|
|
|
"modified": "2015-11-27T08:16:15.000Z",
|
|
|
|
|
"name": "OSINT Expansion on APT-28 - Evolving Threats: dissection of a Cyber-Espionage attack",
|
|
|
|
|
"published": "2016-07-11T14:11:38Z",
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"x-misp-attribute--565804a4-6bc8-4dbb-88c4-4b02950d210b",
|
|
|
|
|
"x-misp-attribute--565804a4-5b60-4e42-a2db-4a6c950d210b",
|
|
|
|
|
"x-misp-attribute--565804a5-7c14-4b8f-8ad5-40cc950d210b",
|
|
|
|
|
"indicator--565804d5-38bc-4e6e-9cc0-b791950d210b",
|
|
|
|
|
"indicator--565804d6-aa04-48b1-99ee-b791950d210b",
|
|
|
|
|
"indicator--565804d6-f130-4582-8c10-b791950d210b",
|
|
|
|
|
"indicator--565804d7-4408-4786-b006-b791950d210b",
|
|
|
|
|
"indicator--565804d7-d8f4-4eba-a35a-b791950d210b",
|
|
|
|
|
"indicator--565804d8-a4fc-4721-8b3a-b791950d210b",
|
|
|
|
|
"indicator--565804d8-e720-4012-b480-b791950d210b",
|
|
|
|
|
"indicator--565804d9-6174-41e1-a430-b791950d210b",
|
|
|
|
|
"indicator--565804d9-df2c-490e-95fb-b791950d210b",
|
|
|
|
|
"indicator--565804da-08a8-40f5-9bd1-b791950d210b",
|
|
|
|
|
"indicator--565804da-f894-4f3d-8fed-b791950d210b",
|
|
|
|
|
"observed-data--5658050b-9fe8-45be-bf50-b742950d210b",
|
|
|
|
|
"url--5658050b-9fe8-45be-bf50-b742950d210b",
|
|
|
|
|
"observed-data--5658050c-3aec-4100-b938-b742950d210b",
|
|
|
|
|
"url--5658050c-3aec-4100-b938-b742950d210b",
|
|
|
|
|
"indicator--565805ba-f6fc-43db-90bb-b376950d210b",
|
|
|
|
|
"indicator--565805bc-f64c-4cc5-b5a3-b376950d210b",
|
|
|
|
|
"indicator--565805bc-10fc-4f47-a3a9-b376950d210b",
|
|
|
|
|
"indicator--565805bd-6630-4743-ba10-b376950d210b",
|
|
|
|
|
"indicator--565805bd-4320-414c-9afd-b376950d210b",
|
|
|
|
|
"x-misp-attribute--56581095-fba8-4c69-bd27-b376950d210b",
|
|
|
|
|
"x-misp-attribute--565810e0-b624-4b74-9335-401f950d210b",
|
|
|
|
|
"indicator--5658114d-bc94-4a40-8080-485d950d210b",
|
|
|
|
|
"indicator--5658114e-9a4c-4fac-92a3-4868950d210b",
|
|
|
|
|
"indicator--5658114e-1b48-4304-87ec-4fc9950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"Threat-Report",
|
|
|
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
|
|
|
"type:OSINT"
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--565804a4-6bc8-4dbb-88c4-4b02950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T07:22:12.000Z",
|
|
|
|
|
"modified": "2015-11-27T07:22:12.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"text\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "External analysis",
|
|
|
|
|
"x_misp_type": "text",
|
|
|
|
|
"x_misp_value": "APT28"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--565804a4-5b60-4e42-a2db-4a6c950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T07:22:12.000Z",
|
|
|
|
|
"modified": "2015-11-27T07:22:12.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"text\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "External analysis",
|
|
|
|
|
"x_misp_type": "text",
|
|
|
|
|
"x_misp_value": "Sednit"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--565804a5-7c14-4b8f-8ad5-40cc950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T07:22:13.000Z",
|
|
|
|
|
"modified": "2015-11-27T07:22:13.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"text\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "External analysis",
|
|
|
|
|
"x_misp_type": "text",
|
|
|
|
|
"x_misp_value": "Sofacy"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--565804d5-38bc-4e6e-9cc0-b791950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T07:23:01.000Z",
|
|
|
|
|
"modified": "2015-11-27T07:23:01.000Z",
|
|
|
|
|
"description": "CnC list paragraph",
|
|
|
|
|
"pattern": "[domain-name:value = 'microsofthelpcenter.info']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-11-27T07:23:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--565804d6-aa04-48b1-99ee-b791950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T07:23:02.000Z",
|
|
|
|
|
"modified": "2015-11-27T07:23:02.000Z",
|
|
|
|
|
"description": "CnC list paragraph",
|
|
|
|
|
"pattern": "[domain-name:value = '1oo7.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-11-27T07:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--565804d6-f130-4582-8c10-b791950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T07:23:02.000Z",
|
|
|
|
|
"modified": "2015-11-27T07:23:02.000Z",
|
|
|
|
|
"description": "CnC list paragraph",
|
|
|
|
|
"pattern": "[domain-name:value = 'microsoftdriver.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-11-27T07:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--565804d7-4408-4786-b006-b791950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T07:23:03.000Z",
|
|
|
|
|
"modified": "2015-11-27T07:23:03.000Z",
|
|
|
|
|
"description": "CnC list paragraph",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '198.105.125.74']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-11-27T07:23:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--565804d7-d8f4-4eba-a35a-b791950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T07:23:03.000Z",
|
|
|
|
|
"modified": "2015-11-27T07:23:03.000Z",
|
|
|
|
|
"description": "CnC list paragraph",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '66.172.12.133']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-11-27T07:23:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--565804d8-a4fc-4721-8b3a-b791950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T07:23:04.000Z",
|
|
|
|
|
"modified": "2015-11-27T07:23:04.000Z",
|
|
|
|
|
"description": "CnC list paragraph",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '45.64.105.23']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-11-27T07:23:04Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--565804d8-e720-4012-b480-b791950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T07:23:04.000Z",
|
|
|
|
|
"modified": "2015-11-27T07:23:04.000Z",
|
|
|
|
|
"description": "CnC list paragraph",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '176.31.112.10']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-11-27T07:23:04Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--565804d9-6174-41e1-a430-b791950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T07:23:05.000Z",
|
|
|
|
|
"modified": "2015-11-27T07:23:05.000Z",
|
|
|
|
|
"description": "CnC list paragraph",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '176.31.96.178']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-11-27T07:23:05Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--565804d9-df2c-490e-95fb-b791950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T07:23:05.000Z",
|
|
|
|
|
"modified": "2015-11-27T07:23:05.000Z",
|
|
|
|
|
"description": "CnC list paragraph",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '87.236.215.13']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-11-27T07:23:05Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--565804da-08a8-40f5-9bd1-b791950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T07:23:06.000Z",
|
|
|
|
|
"modified": "2015-11-27T07:23:06.000Z",
|
|
|
|
|
"description": "CnC list paragraph",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '46.19.138.66']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-11-27T07:23:06Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--565804da-f894-4f3d-8fed-b791950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T07:23:06.000Z",
|
|
|
|
|
"modified": "2015-11-27T07:23:06.000Z",
|
|
|
|
|
"description": "CnC list paragraph",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.199.171.58']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-11-27T07:23:06Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5658050b-9fe8-45be-bf50-b742950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T07:23:55.000Z",
|
|
|
|
|
"modified": "2015-11-27T07:23:55.000Z",
|
|
|
|
|
"first_observed": "2015-11-27T07:23:55Z",
|
|
|
|
|
"last_observed": "2015-11-27T07:23:55Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5658050b-9fe8-45be-bf50-b742950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5658050b-9fe8-45be-bf50-b742950d210b",
|
|
|
|
|
"value": "http://www.rsaconference.com/writable/presentations/file_upload/cct-w08_evolving-threats-dissection-of-a-cyber-espionage-attack.pdf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5658050c-3aec-4100-b938-b742950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T07:23:56.000Z",
|
|
|
|
|
"modified": "2015-11-27T07:23:56.000Z",
|
|
|
|
|
"first_observed": "2015-11-27T07:23:56Z",
|
|
|
|
|
"last_observed": "2015-11-27T07:23:56Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5658050c-3aec-4100-b938-b742950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5658050c-3aec-4100-b938-b742950d210b",
|
|
|
|
|
"value": "https://github.com/gasgas4/APTnotes/blob/master/2015/2015.11.04_Evolving_Threats/cct-w08_evolving-threats-dissection-of-a-cyber-espionage-attack.pdf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--565805ba-f6fc-43db-90bb-b376950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T07:26:50.000Z",
|
|
|
|
|
"modified": "2015-11-27T07:26:50.000Z",
|
|
|
|
|
"description": "Combing through screenshots",
|
|
|
|
|
"pattern": "[domain-name:value = 'militaryexponews.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-11-27T07:26:50Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--565805bc-f64c-4cc5-b5a3-b376950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T07:26:52.000Z",
|
|
|
|
|
"modified": "2015-11-27T07:26:52.000Z",
|
|
|
|
|
"description": "Combing through screenshots",
|
|
|
|
|
"pattern": "[domain-name:value = 'irwing.org']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-11-27T07:26:52Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--565805bc-10fc-4f47-a3a9-b376950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T07:26:52.000Z",
|
|
|
|
|
"modified": "2015-11-27T07:26:52.000Z",
|
|
|
|
|
"description": "Combing through screenshots",
|
|
|
|
|
"pattern": "[domain-name:value = 'eservicesystems.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-11-27T07:26:52Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--565805bd-6630-4743-ba10-b376950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T07:26:53.000Z",
|
|
|
|
|
"modified": "2015-11-27T07:26:53.000Z",
|
|
|
|
|
"description": "Combing through screenshots",
|
|
|
|
|
"pattern": "[domain-name:value = 'windowsappstore.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-11-27T07:26:53Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--565805bd-4320-414c-9afd-b376950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T07:26:53.000Z",
|
|
|
|
|
"modified": "2015-11-27T07:26:53.000Z",
|
|
|
|
|
"description": "Combing through screenshots",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '131.72.136.10']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-11-27T07:26:53Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--56581095-fba8-4c69-bd27-b376950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T08:13:09.000Z",
|
|
|
|
|
"modified": "2015-11-27T08:13:09.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"comment\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "External analysis",
|
|
|
|
|
"x_misp_type": "comment",
|
|
|
|
|
"x_misp_value": "Additional IOCs found combing through screenshots & using threatCrowd.org"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--565810e0-b624-4b74-9335-401f950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T08:14:24.000Z",
|
|
|
|
|
"modified": "2015-11-27T08:14:24.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"comment\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "Network activity",
|
|
|
|
|
"x_misp_type": "comment",
|
|
|
|
|
"x_misp_value": "GET to URLs containing the follwoing tokens: /find/?itwm= &from= &utm= &oprnd= &from=\r\nPOST to URLs containing the follwoing tokens: /open/?ags= &ags= &oprnd= &channel= &itwm="
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5658114d-bc94-4a40-8080-485d950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T08:16:13.000Z",
|
|
|
|
|
"modified": "2015-11-27T08:16:13.000Z",
|
|
|
|
|
"description": "Resolution of domain irwing.org",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '204.12.244.58']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-11-27T08:16:13Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5658114e-9a4c-4fac-92a3-4868950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T08:16:14.000Z",
|
|
|
|
|
"modified": "2015-11-27T08:16:14.000Z",
|
|
|
|
|
"description": "Resolution of domain irwing.org",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '104.200.17.202']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-11-27T08:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5658114e-1b48-4304-87ec-4fc9950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-11-27T08:16:14.000Z",
|
|
|
|
|
"modified": "2015-11-27T08:16:14.000Z",
|
|
|
|
|
"description": "Resolution of domain irwing.org",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '104.200.17.53']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-11-27T08:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "marking-definition",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da",
|
|
|
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
|
|
|
"definition_type": "tlp",
|
|
|
|
|
"name": "TLP:GREEN",
|
|
|
|
|
"definition": {
|
|
|
|
|
"tlp": "green"
|
|
|
|
|
}
|
|
|
|
|
}
|
2023-04-21 13:25:09 +00:00
|
|
|
]
|
|
|
|
|
}
|
