278 lines
14 KiB
JSON
278 lines
14 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--f811ccb3-5724-4ff4-a920-36d81100e7b8",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--56024f6c-da70-4584-b689-48ef950d210f",
|
||
|
|
"created": "2022-08-03T09:57:40.000Z",
|
||
|
|
"modified": "2022-08-03T09:57:40.000Z",
|
||
|
|
"name": "BSK",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--f811ccb3-5724-4ff4-a920-36d81100e7b8",
|
||
|
|
"created_by_ref": "identity--56024f6c-da70-4584-b689-48ef950d210f",
|
||
|
|
"created": "2022-08-03T09:57:40.000Z",
|
||
|
|
"modified": "2022-08-03T09:57:40.000Z",
|
||
|
|
"name": "Github Repo Compromise Domain MyJino RU",
|
||
|
|
"published": "2022-08-03T10:55:14Z",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--0ea045af-c19c-4dc9-8aba-51bdb8643a74",
|
||
|
|
"x-misp-object--afdb4f8e-08ca-4beb-b105-c91605eb5513",
|
||
|
|
"indicator--62e6afb6-4237-41f9-8be7-986c83f038fa",
|
||
|
|
"indicator--284f1a37-a166-4b5b-b5b3-4a1e41bae212",
|
||
|
|
"indicator--18ab09f0-b623-40df-8920-eadfbcb0d5e0",
|
||
|
|
"indicator--9d47dc79-72a0-457a-af87-022323dd74c9",
|
||
|
|
"relationship--540593eb-ffab-4b3b-9dc5-ea275070f133"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"",
|
||
|
|
"osint:source-type=\"microblog-post\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--0ea045af-c19c-4dc9-8aba-51bdb8643a74",
|
||
|
|
"created_by_ref": "identity--56024f6c-da70-4584-b689-48ef950d210f",
|
||
|
|
"created": "2022-08-03T07:52:19.000Z",
|
||
|
|
"modified": "2022-08-03T07:52:19.000Z",
|
||
|
|
"description": "C2 domain",
|
||
|
|
"pattern": "[domain-name:value = 'ovz1.j19544519.pr46m.vps.myjino.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-08-03T07:52:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--afdb4f8e-08ca-4beb-b105-c91605eb5513",
|
||
|
|
"created_by_ref": "identity--56024f6c-da70-4584-b689-48ef950d210f",
|
||
|
|
"created": "2022-08-03T09:53:52.000Z",
|
||
|
|
"modified": "2022-08-03T09:53:52.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"passive-dns\"",
|
||
|
|
"misp:meta-category=\"network\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "rdata",
|
||
|
|
"value": "195.161.41.221",
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "Result from a rrset lookup on DNSDB about the hostname: ovz1.j19544519.pr46m.vps.myjino.ru",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "84fd5844-44f6-49b4-ae39-9a77413b8152"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "counter",
|
||
|
|
"object_relation": "count",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "Result from a rrset lookup on DNSDB about the hostname: ovz1.j19544519.pr46m.vps.myjino.ru",
|
||
|
|
"uuid": "517487e4-8ecf-4023-9601-cdeae8d5178e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "time_first",
|
||
|
|
"value": "2022-07-28T11:22:53+00:00",
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "Result from a rrset lookup on DNSDB about the hostname: ovz1.j19544519.pr46m.vps.myjino.ru",
|
||
|
|
"uuid": "64322d63-ac27-458a-8e57-3f9b7215b163"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "time_last",
|
||
|
|
"value": "2022-08-03T06:19:30+00:00",
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "Result from a rrset lookup on DNSDB about the hostname: ovz1.j19544519.pr46m.vps.myjino.ru",
|
||
|
|
"uuid": "d5b73acf-82da-4d12-ad2f-557ee481435c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "rrname",
|
||
|
|
"value": "ovz1.j19544519.pr46m.vps.myjino.ru.",
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "Result from a rrset lookup on DNSDB about the hostname: ovz1.j19544519.pr46m.vps.myjino.ru",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "411cb6d9-2de2-45fe-8858-b31f98e52ce0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "rrtype",
|
||
|
|
"value": "A",
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "Result from a rrset lookup on DNSDB about the hostname: ovz1.j19544519.pr46m.vps.myjino.ru",
|
||
|
|
"uuid": "ceaec1aa-ea20-46c9-aa26-6e526cc58e4c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "domain",
|
||
|
|
"object_relation": "bailiwick",
|
||
|
|
"value": "myjino.ru",
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "Result from a rrset lookup on DNSDB about the hostname: ovz1.j19544519.pr46m.vps.myjino.ru",
|
||
|
|
"uuid": "1e73df86-ce7c-445d-9dfa-7c84158a46f6"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_comment": "ovz1.j19544519.pr46m.vps.myjino.ru: Enriched via the farsight_passivedns module",
|
||
|
|
"x_misp_meta_category": "network",
|
||
|
|
"x_misp_name": "passive-dns"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--62e6afb6-4237-41f9-8be7-986c83f038fa",
|
||
|
|
"created_by_ref": "identity--56024f6c-da70-4584-b689-48ef950d210f",
|
||
|
|
"created": "2022-08-03T09:34:25.000Z",
|
||
|
|
"modified": "2022-08-03T09:34:25.000Z",
|
||
|
|
"name": "MAL_Github_Repo_Compromise_MyJino_Ru_Aug22",
|
||
|
|
"pattern": "rule MAL_Github_Repo_Compromise_MyJino_Ru_Aug22 {\r\n meta:\r\n description = \\\\\"Detects URL mentioned in report on compromised Github repositories in August 2022\\\\\"\r\n author = \\\\\"Florian Roth\\\\\"\r\n reference = \\\\\"https://twitter.com/stephenlacy/status/1554697077430505473\\\\\"\r\n date = \\\\\"2022-08-03\\\\\"\r\n score = 90\r\n strings:\r\n $x1 = \\\\\"curl http://ovz1.j19544519.pr46m.vps.myjino.ru\\\\\" ascii wide\r\n $x2 = \\\\\"http__.Post(\\\\\\\\\"http://ovz1.j19544519.pr46m.vps.myjino.ru\\\\\" ascii wide\r\n condition:\r\n 1 of them\r\n}",
|
||
|
|
"pattern_type": "yara",
|
||
|
|
"valid_from": "2022-08-03T09:34:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "misc"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"yara\"",
|
||
|
|
"misp:meta-category=\"misc\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_context": "all"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--284f1a37-a166-4b5b-b5b3-4a1e41bae212",
|
||
|
|
"created_by_ref": "identity--56024f6c-da70-4584-b689-48ef950d210f",
|
||
|
|
"created": "2022-08-03T09:53:16.000Z",
|
||
|
|
"modified": "2022-08-03T09:53:16.000Z",
|
||
|
|
"name": "Github Repo Compromise Domain MyJino RU",
|
||
|
|
"description": "Detects connections to the host used in a big repository compromise discovered in August 2022",
|
||
|
|
"pattern": "title: Github Repo Compromise Domain MyJino RU\r\nid: 3a9f4c77-8e2e-45eb-abc1-4754f670d3a9\r\nstatus: test\r\ndescription: Detects connections to the host used in a big repository compromise discovered in August 2022\r\nreferences:\r\n - https://twitter.com/stephenlacy/status/1554697077430505473\r\ndate: 2022/08/03\r\nauthor: Florian Roth\r\nlogsource:\r\n category: network_connection\r\n product: windows\r\ndetection:\r\n selection:\r\n Initiated: \\'true\\'\r\n DestinationHostname: \\'ovz1.j19544519.pr46m.vps.myjino.ru\\'\r\n condition: selection\r\nfalsepositives:\r\n - Users looking up that domain after reading the report (unlikely)\r\nlevel: high",
|
||
|
|
"pattern_type": "sigma",
|
||
|
|
"valid_from": "2022-08-03T09:53:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "misc"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"sigma\"",
|
||
|
|
"misp:meta-category=\"misc\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"external_references": [
|
||
|
|
{
|
||
|
|
"source_name": "url",
|
||
|
|
"url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/rules/windows/network_connection/net_connection_win_github_myjino_ru.yml"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_context": [
|
||
|
|
"dns",
|
||
|
|
"network"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--18ab09f0-b623-40df-8920-eadfbcb0d5e0",
|
||
|
|
"created_by_ref": "identity--56024f6c-da70-4584-b689-48ef950d210f",
|
||
|
|
"created": "2022-08-03T09:55:47.000Z",
|
||
|
|
"modified": "2022-08-03T09:55:47.000Z",
|
||
|
|
"name": "Github Repo Compromise Domain MyJino RU",
|
||
|
|
"pattern": "title: Github Repo Compromise Domain MyJino RU\r\nid: 242e0911-294a-44ea-a54e-7eea97aa2622\r\nstatus: test\r\ndescription: Detects connections to the host used in a big repository compromise discovered in August 2022\r\nreferences:\r\n - https://twitter.com/stephenlacy/status/1554697077430505473\r\ndate: 2022/08/03\r\nauthor: Florian Roth\r\nlogsource:\r\n product: linux\r\n category: network_connection\r\ndetection:\r\n selection:\r\n DestinationHostname: \\'ovz1.j19544519.pr46m.vps.myjino.ru\\'\r\n condition: selection\r\nfalsepositives:\r\n - Users looking up that domain after reading the report (unlikely)\r\nlevel: high",
|
||
|
|
"pattern_type": "sigma",
|
||
|
|
"valid_from": "2022-08-03T09:55:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "misc"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"sigma\"",
|
||
|
|
"misp:meta-category=\"misc\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"external_references": [
|
||
|
|
{
|
||
|
|
"source_name": "url",
|
||
|
|
"url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/rules/linux/network_connection/net_connection_github_myjino_ru.yml"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_context": [
|
||
|
|
"dns",
|
||
|
|
"network"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--9d47dc79-72a0-457a-af87-022323dd74c9",
|
||
|
|
"created_by_ref": "identity--56024f6c-da70-4584-b689-48ef950d210f",
|
||
|
|
"created": "2022-08-03T09:57:13.000Z",
|
||
|
|
"modified": "2022-08-03T09:57:13.000Z",
|
||
|
|
"name": "DNS Lookup Github Repo Compromise Domain MyJino RU",
|
||
|
|
"pattern": "title: DNS Lookup Github Repo Compromise Domain MyJino RU\r\nid: 6b0dd2e4-13ff-4eff-b79b-4444fad43644\r\nstatus: test\r\ndescription: Detects connections to the host used in a big repository compromise discovered in August 2022\r\nreferences:\r\n - https://twitter.com/stephenlacy/status/1554697077430505473\r\ndate: 2022/08/03\r\nauthor: Florian Roth\r\nlogsource:\r\n category: dns\r\ndetection:\r\n selection:\r\n query: \\'ovz1.j19544519.pr46m.vps.myjino.ru\\'\r\n condition: selection\r\nfalsepositives:\r\n - Users looking up that domain after reading the report (unlikely)\r\n - Web proxy or other security device DNS lookups of the domain\r\nlevel: high",
|
||
|
|
"pattern_type": "sigma",
|
||
|
|
"valid_from": "2022-08-03T09:57:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "misc"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"sigma\"",
|
||
|
|
"misp:meta-category=\"misc\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_context": "dns"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--540593eb-ffab-4b3b-9dc5-ea275070f133",
|
||
|
|
"created": "2022-08-03T09:30:47.000Z",
|
||
|
|
"modified": "2022-08-03T09:30:47.000Z",
|
||
|
|
"relationship_type": "related-to",
|
||
|
|
"source_ref": "x-misp-object--afdb4f8e-08ca-4beb-b105-c91605eb5513",
|
||
|
|
"target_ref": "indicator--0ea045af-c19c-4dc9-8aba-51bdb8643a74"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|