249 lines
8.2 KiB
JSON
249 lines
8.2 KiB
JSON
|
{
|
||
|
|
"Event": {
|
||
|
|
"analysis": "2",
|
||
|
|
"date": "2016-08-18",
|
||
|
|
"extends_uuid": "",
|
||
|
|
"info": "Pivot on Shakti domains via PassiveTotal",
|
||
|
|
"publish_timestamp": "1474835929",
|
||
|
|
"published": true,
|
||
|
|
"threat_level_id": "3",
|
||
|
|
"timestamp": "1471524404",
|
||
|
|
"uuid": "57b5ac3c-6780-4f9c-8734-4e8e950d210f",
|
||
|
|
"Orgc": {
|
||
|
|
"name": "CthulhuSPRL.be",
|
||
|
|
"uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
|
||
|
|
},
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#ffffff",
|
||
|
|
"name": "tlp:white"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#ffffff",
|
||
|
|
"name": "OSINT"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1471523951",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "57b5ac6f-628c-4b6f-9bcf-445e950d210f",
|
||
|
|
"value": "securedesignus.com"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1471523952",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "57b5ac70-d848-4f01-aa99-4100950d210f",
|
||
|
|
"value": "securedesignuk.com"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1471523952",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "57b5ac70-6ad0-481e-8a39-4115950d210f",
|
||
|
|
"value": "web4solution.net"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Artifacts dropped",
|
||
|
|
"comment": "Linked to web4solutions with hashes from Emerging Threats (Proofpoint)",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1471524017",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "md5",
|
||
|
|
"uuid": "57b5acb1-70ac-42a5-bfb2-45b6950d210f",
|
||
|
|
"value": "b1380af637b4011e674644e0a1a53a64"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Artifacts dropped",
|
||
|
|
"comment": "Linked to web4solutions with hashes from Emerging Threats (Proofpoint)",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1471524017",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "md5",
|
||
|
|
"uuid": "57b5acb1-9950-4cba-8e0d-4cd9950d210f",
|
||
|
|
"value": "2a794573f69c2c81db408f792a7c616b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "External analysis",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1471524036",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "link",
|
||
|
|
"uuid": "57b5acc4-52d8-4d3f-b20e-4f80950d210f",
|
||
|
|
"value": "https://www.passivetotal.org/passive/web4solution.net"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "External analysis",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1471524037",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "link",
|
||
|
|
"uuid": "57b5acc5-90d8-4621-9865-4c62950d210f",
|
||
|
|
"value": "https://www.passivetotal.org/passive/securedesignus.com"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "External analysis",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1471524037",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "link",
|
||
|
|
"uuid": "57b5acc5-ae28-4018-a456-46e9950d210f",
|
||
|
|
"value": "https://www.passivetotal.org/passive/securedesignuk.com"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Artifacts dropped",
|
||
|
|
"comment": "Linked to securedesignus.com with hashes from Emerging Threat (Proofpoint)",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1471524102",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "md5",
|
||
|
|
"uuid": "57b5ad06-6fac-48b8-a9c1-4a5c950d210f",
|
||
|
|
"value": "255057ba7f3bb62abd5963e42e5fd897"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Artifacts dropped",
|
||
|
|
"comment": "Linked to securedesignus.com with hashes from Emerging Threat (Proofpoint)",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1471524102",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "md5",
|
||
|
|
"uuid": "57b5ad06-d48c-4c0f-9242-49e7950d210f",
|
||
|
|
"value": "0b3b8b25054165da8cf7dc300ca6dbba"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Artifacts dropped",
|
||
|
|
"comment": "Linked to securedesignus.com with hashes from Emerging Threat (Proofpoint)",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1471524103",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "md5",
|
||
|
|
"uuid": "57b5ad07-cf60-4e7d-8642-4eff950d210f",
|
||
|
|
"value": "ffcc6e02d39f7c6f52a1b58eca30bd8f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Artifacts dropped",
|
||
|
|
"comment": "Linked to securedesignus.com with hashes from Emerging Threat (Proofpoint)",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1471524103",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "md5",
|
||
|
|
"uuid": "57b5ad07-d8f0-4963-863e-49c2950d210f",
|
||
|
|
"value": "41ef9f2385136ac53bd7e602b1cf6826"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Artifacts dropped",
|
||
|
|
"comment": "Linked to securedesignuk.com with hashes from Emerging threat (Proofpoint)",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1471524404",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "md5",
|
||
|
|
"uuid": "57b5ae0d-ccc4-4f28-a8f4-416c950d210f",
|
||
|
|
"value": "35ae59f3408671463546ef39bd92c901"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Artifacts dropped",
|
||
|
|
"comment": "Linked to securedesignuk.com with hashes from Emerging threat (Proofpoint)",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1471524391",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "md5",
|
||
|
|
"uuid": "57b5ae0e-aa34-45bb-b65e-4e0c950d210f",
|
||
|
|
"value": "b961d3b27aad49be1a57cf674df88a04"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Artifacts dropped",
|
||
|
|
"comment": "Automatically added (via b1380af637b4011e674644e0a1a53a64)",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1471524767",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha1",
|
||
|
|
"uuid": "57b5af9f-9690-4580-9523-498e950d210f",
|
||
|
|
"value": "4297e2c5cae19ffbcf475234e0867bad826fc1bf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Artifacts dropped",
|
||
|
|
"comment": "Automatically added (via 2a794573f69c2c81db408f792a7c616b)",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1471524771",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha1",
|
||
|
|
"uuid": "57b5afa3-7a48-4ad0-adb6-4f89950d210f",
|
||
|
|
"value": "7a21bc3ce6bc2338a5abee83fd8a6bec7220ce3f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Artifacts dropped",
|
||
|
|
"comment": "Automatically added (via 255057ba7f3bb62abd5963e42e5fd897)",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1471524773",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha1",
|
||
|
|
"uuid": "57b5afa5-f608-4de6-847b-46b6950d210f",
|
||
|
|
"value": "2d09ceee0e303f4e7a2678f8c6cff7071e50012b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Artifacts dropped",
|
||
|
|
"comment": "Automatically added (via b1380af637b4011e674644e0a1a53a64)",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1471524769",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "57b5afa1-8bc0-41ca-9e83-43a1950d210f",
|
||
|
|
"value": "d6d64c61dada8b5ccfa970356057a6c2c7697f084922744c5a2e29aff079647b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Artifacts dropped",
|
||
|
|
"comment": "Automatically added (via 2a794573f69c2c81db408f792a7c616b)",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1471524771",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "57b5afa3-6868-4472-ba6e-4094950d210f",
|
||
|
|
"value": "8d7cbf2ad674118cf1aea4d98cd6d345d2c7b8875ec95f5141c80b588bd2b6f5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Artifacts dropped",
|
||
|
|
"comment": "Automatically added (via 255057ba7f3bb62abd5963e42e5fd897)",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1471524774",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "57b5afa6-038c-410e-8420-469e950d210f",
|
||
|
|
"value": "c03dc46fb6f01e9a1bcee445378b62b49f008c88cc531e41f2fd095ddac42816"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|