2023-04-21 14:44:17 +00:00
|
|
|
{
|
|
|
|
|
"type": "bundle",
|
|
|
|
|
"id": "bundle--5bf26acf-d95c-4892-a05d-4db5950d210f",
|
|
|
|
|
"objects": [
|
|
|
|
|
{
|
|
|
|
|
"type": "identity",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2018-11-19T14:25:46.000Z",
|
|
|
|
|
"modified": "2018-11-19T14:25:46.000Z",
|
|
|
|
|
"name": "CIRCL",
|
|
|
|
|
"identity_class": "organization"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "report",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "report--5bf26acf-d95c-4892-a05d-4db5950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2018-11-19T14:25:46.000Z",
|
|
|
|
|
"modified": "2018-11-19T14:25:46.000Z",
|
|
|
|
|
"name": "OSINT - CozyBear \u00e2\u20ac\u201c In from the Cold?",
|
|
|
|
|
"published": "2018-11-19T14:25:52Z",
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"observed-data--5bf26c6f-d748-499e-a651-40e3950d210f",
|
|
|
|
|
"url--5bf26c6f-d748-499e-a651-40e3950d210f",
|
|
|
|
|
"indicator--5bf27aea-d798-4848-88f8-43a7950d210f",
|
|
|
|
|
"indicator--5bf26eb3-588c-479a-8c42-48b6950d210f",
|
|
|
|
|
"indicator--5bf26f31-11ec-4a5b-aea4-4fee950d210f",
|
|
|
|
|
"indicator--5bf26f43-b2c0-4102-8ba0-472a950d210f",
|
|
|
|
|
"indicator--5bf27326-3988-4648-8349-48a8950d210f",
|
|
|
|
|
"indicator--5bf27381-7984-4244-933f-402b950d210f",
|
|
|
|
|
"indicator--5bf27c25-d538-45b8-be16-44f0950d210f",
|
|
|
|
|
"indicator--f815afa9-6251-4258-af1c-d3c6354478f9",
|
|
|
|
|
"x-misp-object--13b82a46-f0a2-4216-b6ff-f15d7e5aa85f",
|
|
|
|
|
"indicator--6c5c8753-80c8-496e-8f41-0c72d76ceceb",
|
|
|
|
|
"x-misp-object--4c234bd0-9fb2-4f60-9e0f-971e8746024d",
|
2023-12-14 14:30:15 +00:00
|
|
|
"relationship--1d81b278-1f76-4c71-8b9e-d3622b617a13",
|
|
|
|
|
"relationship--3101a513-b090-48c5-9a1f-11d7261f368b"
|
2023-04-21 14:44:17 +00:00
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"Threat-Report",
|
|
|
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
|
|
|
"misp-galaxy:threat-actor=\"APT 29\"",
|
|
|
|
|
"misp-galaxy:mitre-intrusion-set=\"APT29\"",
|
|
|
|
|
"misp-galaxy:mitre-malware=\"CozyCar\"",
|
|
|
|
|
"misp-galaxy:mitre-enterprise-attack-intrusion-set=\"APT29 - G0016\"",
|
|
|
|
|
"misp-galaxy:mitre-enterprise-attack-malware=\"CozyCar\"",
|
|
|
|
|
"misp-galaxy:malpedia=\"Cobalt Strike\"",
|
|
|
|
|
"misp-galaxy:rat=\"Cobalt Strike\"",
|
|
|
|
|
"misp-galaxy:mitre-enterprise-attack-tool=\"Cobalt Strike\"",
|
|
|
|
|
"misp-galaxy:mitre-enterprise-attack-tool=\"Cobalt Strike - S0154\"",
|
|
|
|
|
"misp-galaxy:mitre-tool=\"Cobalt Strike\"",
|
|
|
|
|
"circl:incident-classification=\"phishing\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5bf26c6f-d748-499e-a651-40e3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2018-11-19T07:56:20.000Z",
|
|
|
|
|
"modified": "2018-11-19T07:56:20.000Z",
|
|
|
|
|
"first_observed": "2018-11-19T07:56:20Z",
|
|
|
|
|
"last_observed": "2018-11-19T07:56:20Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5bf26c6f-d748-499e-a651-40e3950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\"",
|
|
|
|
|
"osint:source-type=\"blog-post\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5bf26c6f-d748-499e-a651-40e3950d210f",
|
|
|
|
|
"value": "https://pylos.co/2018/11/18/cozybear-in-from-the-cold/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5bf27aea-d798-4848-88f8-43a7950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2018-11-19T08:57:14.000Z",
|
|
|
|
|
"modified": "2018-11-19T08:57:14.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'pandorasong.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2018-11-19T08:57:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5bf26eb3-588c-479a-8c42-48b6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2018-11-19T08:05:07.000Z",
|
|
|
|
|
"modified": "2018-11-19T08:05:07.000Z",
|
|
|
|
|
"description": "mail server",
|
|
|
|
|
"pattern": "[domain-name:value = 'mx1.era.citon.com' AND domain-name:resolves_to_refs[*].value = '216.251.161.198']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2018-11-19T08:05:07Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "network"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:name=\"domain-ip\"",
|
|
|
|
|
"misp:meta-category=\"network\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5bf26f31-11ec-4a5b-aea4-4fee950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2018-11-19T08:07:47.000Z",
|
|
|
|
|
"modified": "2018-11-19T08:07:47.000Z",
|
|
|
|
|
"pattern": "[file:name = 'ds7002.lnk' AND file:x_misp_state = 'Malicious']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2018-11-19T08:07:47Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "file"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:name=\"file\"",
|
|
|
|
|
"misp:meta-category=\"file\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5bf26f43-b2c0-4102-8ba0-472a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2018-11-19T08:07:58.000Z",
|
|
|
|
|
"modified": "2018-11-19T08:07:58.000Z",
|
|
|
|
|
"pattern": "[file:name = 'cyzfc.dat' AND file:x_misp_state = 'Malicious']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2018-11-19T08:07:58Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "file"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:name=\"file\"",
|
|
|
|
|
"misp:meta-category=\"file\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5bf27326-3988-4648-8349-48a8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2018-11-19T08:24:06.000Z",
|
|
|
|
|
"modified": "2018-11-19T08:24:06.000Z",
|
|
|
|
|
"pattern": "[file:name = '7486-the-shocking-truth-about-election-rigging-in-america.rtf.lnk' AND file:x_misp_state = 'Malicious']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2018-11-19T08:24:06Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "file"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:name=\"file\"",
|
|
|
|
|
"misp:meta-category=\"file\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5bf27381-7984-4244-933f-402b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2018-11-19T08:25:37.000Z",
|
|
|
|
|
"modified": "2018-11-19T08:25:37.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '2cea2a1f53dac3f4fff156eacc2ecc8e98b1a64f0f5b5ee1c42c69d9a226c55c' AND file:x_misp_state = 'Malicious']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2018-11-19T08:25:37Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "file"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:name=\"file\"",
|
|
|
|
|
"misp:meta-category=\"file\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5bf27c25-d538-45b8-be16-44f0950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2018-11-19T09:02:29.000Z",
|
|
|
|
|
"modified": "2018-11-19T09:02:29.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'b77ff307ea74a3ab41c92036aea4a049b3c2e69b12a857d26910e535544dfb05' AND file:x_misp_state = 'Malicious']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2018-11-19T09:02:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "file"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:name=\"file\"",
|
|
|
|
|
"misp:meta-category=\"file\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--f815afa9-6251-4258-af1c-d3c6354478f9",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2018-11-19T14:25:30.000Z",
|
|
|
|
|
"modified": "2018-11-19T14:25:30.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '16bbc967a8b6a365871a05c74a4f345b' AND file:hashes.SHA1 = '9858d5cb2a6614be3c48e33911bf9f7978b441bf' AND file:hashes.SHA256 = 'b77ff307ea74a3ab41c92036aea4a049b3c2e69b12a857d26910e535544dfb05']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2018-11-19T14:25:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "file"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:name=\"file\"",
|
|
|
|
|
"misp:meta-category=\"file\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-object",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-object--13b82a46-f0a2-4216-b6ff-f15d7e5aa85f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2018-11-19T14:25:31.000Z",
|
|
|
|
|
"modified": "2018-11-19T14:25:31.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:name=\"virustotal-report\"",
|
|
|
|
|
"misp:meta-category=\"misc\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_attributes": [
|
|
|
|
|
{
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"value": "2018-11-19T03:46:22",
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"uuid": "17a08ecf-8c7a-44f0-8d62-5610b7f6016b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "link",
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"value": "https://www.virustotal.com/file/b77ff307ea74a3ab41c92036aea4a049b3c2e69b12a857d26910e535544dfb05/analysis/1542599182/",
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"uuid": "fe091e77-2656-44c2-9dba-067a12240376"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "text",
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"value": "38/65",
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"uuid": "38131c5b-7a1f-432f-ae28-1d344e1b044e"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"x_misp_meta_category": "misc",
|
|
|
|
|
"x_misp_name": "virustotal-report"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--6c5c8753-80c8-496e-8f41-0c72d76ceceb",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2018-11-19T14:25:32.000Z",
|
|
|
|
|
"modified": "2018-11-19T14:25:32.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '6ed0020b0851fb71d5b0076f4ee95f3c' AND file:hashes.SHA1 = 'e431261c63f94a174a1308defccc674dabbe3609' AND file:hashes.SHA256 = '2cea2a1f53dac3f4fff156eacc2ecc8e98b1a64f0f5b5ee1c42c69d9a226c55c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2018-11-19T14:25:32Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "file"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:name=\"file\"",
|
|
|
|
|
"misp:meta-category=\"file\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-object",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-object--4c234bd0-9fb2-4f60-9e0f-971e8746024d",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2018-11-19T14:25:34.000Z",
|
|
|
|
|
"modified": "2018-11-19T14:25:34.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:name=\"virustotal-report\"",
|
|
|
|
|
"misp:meta-category=\"misc\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_attributes": [
|
|
|
|
|
{
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"value": "2018-11-19T03:14:57",
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"uuid": "fb3ad0e4-c955-44af-93d8-874ab7cd17bd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "link",
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"value": "https://www.virustotal.com/file/2cea2a1f53dac3f4fff156eacc2ecc8e98b1a64f0f5b5ee1c42c69d9a226c55c/analysis/1542597297/",
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"uuid": "5f7203c2-d42b-46a5-88da-090e96f40841"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "text",
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"value": "22/55",
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"uuid": "c1f98fdf-637c-4e0e-be43-b1e622dfe8cd"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"x_misp_meta_category": "misc",
|
|
|
|
|
"x_misp_name": "virustotal-report"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "relationship",
|
|
|
|
|
"spec_version": "2.1",
|
2023-12-14 14:30:15 +00:00
|
|
|
"id": "relationship--1d81b278-1f76-4c71-8b9e-d3622b617a13",
|
2023-04-21 14:44:17 +00:00
|
|
|
"created": "2018-11-19T08:07:46.000Z",
|
|
|
|
|
"modified": "2018-11-19T08:07:46.000Z",
|
|
|
|
|
"relationship_type": "dropped",
|
|
|
|
|
"source_ref": "indicator--5bf26f31-11ec-4a5b-aea4-4fee950d210f",
|
|
|
|
|
"target_ref": "indicator--5bf26f43-b2c0-4102-8ba0-472a950d210f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "relationship",
|
|
|
|
|
"spec_version": "2.1",
|
2023-12-14 14:30:15 +00:00
|
|
|
"id": "relationship--3101a513-b090-48c5-9a1f-11d7261f368b",
|
2023-04-21 14:44:17 +00:00
|
|
|
"created": "2018-11-19T08:07:57.000Z",
|
|
|
|
|
"modified": "2018-11-19T08:07:57.000Z",
|
|
|
|
|
"relationship_type": "dropped-by",
|
|
|
|
|
"source_ref": "indicator--5bf26f43-b2c0-4102-8ba0-472a950d210f",
|
|
|
|
|
"target_ref": "indicator--5bf26f31-11ec-4a5b-aea4-4fee950d210f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "marking-definition",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
|
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
|
|
|
"definition_type": "tlp",
|
|
|
|
|
"name": "TLP:WHITE",
|
|
|
|
|
"definition": {
|
|
|
|
|
"tlp": "white"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
