313 lines
14 KiB
JSON
313 lines
14 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--5afafce0-0598-4ca0-b52a-41f4950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-05-15T15:42:30.000Z",
|
||
|
|
"modified": "2018-05-15T15:42:30.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--5afafce0-0598-4ca0-b52a-41f4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-05-15T15:42:30.000Z",
|
||
|
|
"modified": "2018-05-15T15:42:30.000Z",
|
||
|
|
"name": "OSINT - A tale of two zero-days",
|
||
|
|
"published": "2018-05-15T15:43:01Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--5afafcef-4ebc-4561-bcd3-4ec7950d210f",
|
||
|
|
"url--5afafcef-4ebc-4561-bcd3-4ec7950d210f",
|
||
|
|
"x-misp-attribute--5afafd04-9874-4fb6-afa8-3556950d210f",
|
||
|
|
"vulnerability--5afafd25-5ed0-4e07-8d1e-4572950d210f",
|
||
|
|
"vulnerability--5afafd37-b6d8-48ea-9226-4e32950d210f",
|
||
|
|
"indicator--5afafd4a-8f80-4711-8ec3-4fb0950d210f",
|
||
|
|
"indicator--5afafd4b-48e8-4271-98d2-477b950d210f",
|
||
|
|
"observed-data--5afaffce-12b8-41cf-8ce1-434a950d210f",
|
||
|
|
"url--5afaffce-12b8-41cf-8ce1-434a950d210f",
|
||
|
|
"observed-data--5afaffe3-f688-4ddb-ad6b-4d54950d210f",
|
||
|
|
"url--5afaffe3-f688-4ddb-ad6b-4d54950d210f",
|
||
|
|
"x-misp-object--e1aaf6c9-d880-4111-ae8c-e18bacfa93e3",
|
||
|
|
"x-misp-object--8e273621-4ed2-4eab-8afa-c8332486d797",
|
||
|
|
"x-misp-object--87e5d719-47c0-48f7-a306-167eae1963bf",
|
||
|
|
"x-misp-object--55b2aaba-335d-46dc-95ba-5460b43332fd",
|
||
|
|
"relationship--d90c3022-61a8-4684-8eb9-676f92b01873",
|
||
|
|
"relationship--351cc740-b483-4602-a4cd-3ccfb9628e06"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"osint:source-type=\"blog-post\"",
|
||
|
|
"osint:certainty=\"75\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5afafcef-4ebc-4561-bcd3-4ec7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-05-15T15:29:51.000Z",
|
||
|
|
"modified": "2018-05-15T15:29:51.000Z",
|
||
|
|
"first_observed": "2018-05-15T15:29:51Z",
|
||
|
|
"last_observed": "2018-05-15T15:29:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5afafcef-4ebc-4561-bcd3-4ec7950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5afafcef-4ebc-4561-bcd3-4ec7950d210f",
|
||
|
|
"value": "https://www.welivesecurity.com/2018/05/15/tale-two-zero-days/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--5afafd04-9874-4fb6-afa8-3556950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-05-15T15:30:12.000Z",
|
||
|
|
"modified": "2018-05-15T15:30:12.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Late in March 2018, ESET researchers identified an interesting malicious PDF sample. A closer look revealed that the sample exploits two previously unknown vulnerabilities: a remote-code execution vulnerability in Adobe Reader and a privilege escalation vulnerability in Microsoft Windows.\r\n\r\nThe use of the combined vulnerabilities is extremely powerful, as it allows an attacker to execute arbitrary code with the highest possible privileges on the vulnerable target, and with only the most minimal of user interaction. APT groups regularly use such combinations to perform their attacks, such as in the Sednit campaign from last year.\r\n\r\nOnce the PDF sample was discovered, ESET contacted and worked together with the Microsoft Security Response Center, Windows Defender ATP research team, and Adobe Product Security Incident Response Team as they fixed these bugs."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "vulnerability",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "vulnerability--5afafd25-5ed0-4e07-8d1e-4572950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-05-15T15:30:45.000Z",
|
||
|
|
"modified": "2018-05-15T15:30:45.000Z",
|
||
|
|
"name": "CVE-2018-4990",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"vulnerability\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Exploitation of Vulnerability - T1068\""
|
||
|
|
],
|
||
|
|
"external_references": [
|
||
|
|
{
|
||
|
|
"source_name": "cve",
|
||
|
|
"external_id": "CVE-2018-4990"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "vulnerability",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "vulnerability--5afafd37-b6d8-48ea-9226-4e32950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-05-15T15:31:03.000Z",
|
||
|
|
"modified": "2018-05-15T15:31:03.000Z",
|
||
|
|
"name": "CVE-2018-8120",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"vulnerability\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Exploitation of Vulnerability - T1068\""
|
||
|
|
],
|
||
|
|
"external_references": [
|
||
|
|
{
|
||
|
|
"source_name": "cve",
|
||
|
|
"external_id": "CVE-2018-8120"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5afafd4a-8f80-4711-8ec3-4fb0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-05-15T15:31:22.000Z",
|
||
|
|
"modified": "2018-05-15T15:31:22.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c82cfead292eeca601d3cf82c8c5340cb579d1c6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-05-15T15:31:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5afafd4b-48e8-4271-98d2-477b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-05-15T15:31:23.000Z",
|
||
|
|
"modified": "2018-05-15T15:31:23.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0d3f335ccca4575593054446f5f219eba6cd93fe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-05-15T15:31:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5afaffce-12b8-41cf-8ce1-434a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-05-15T15:42:06.000Z",
|
||
|
|
"modified": "2018-05-15T15:42:06.000Z",
|
||
|
|
"first_observed": "2018-05-15T15:42:06Z",
|
||
|
|
"last_observed": "2018-05-15T15:42:06Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5afaffce-12b8-41cf-8ce1-434a950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5afaffce-12b8-41cf-8ce1-434a950d210f",
|
||
|
|
"value": "http://www.ivanlef0u.tuxfamily.org/?p=86"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5afaffe3-f688-4ddb-ad6b-4d54950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-05-15T15:42:27.000Z",
|
||
|
|
"modified": "2018-05-15T15:42:27.000Z",
|
||
|
|
"first_observed": "2018-05-15T15:42:27Z",
|
||
|
|
"last_observed": "2018-05-15T15:42:27Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5afaffe3-f688-4ddb-ad6b-4d54950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5afaffe3-f688-4ddb-ad6b-4d54950d210f",
|
||
|
|
"value": "http://j00ru.vexillium.org/?p=290"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--e1aaf6c9-d880-4111-ae8c-e18bacfa93e3",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-05-15T15:32:38.000Z",
|
||
|
|
"modified": "2018-05-15T15:32:38.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "file"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--8e273621-4ed2-4eab-8afa-c8332486d797",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-05-15T15:32:36.000Z",
|
||
|
|
"modified": "2018-05-15T15:32:36.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--87e5d719-47c0-48f7-a306-167eae1963bf",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-05-15T15:32:40.000Z",
|
||
|
|
"modified": "2018-05-15T15:32:40.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "file"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--55b2aaba-335d-46dc-95ba-5460b43332fd",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-05-15T15:32:38.000Z",
|
||
|
|
"modified": "2018-05-15T15:32:38.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--d90c3022-61a8-4684-8eb9-676f92b01873",
|
||
|
|
"created": "2018-05-15T15:32:39.000Z",
|
||
|
|
"modified": "2018-05-15T15:32:39.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "x-misp-object--e1aaf6c9-d880-4111-ae8c-e18bacfa93e3",
|
||
|
|
"target_ref": "x-misp-object--8e273621-4ed2-4eab-8afa-c8332486d797"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--351cc740-b483-4602-a4cd-3ccfb9628e06",
|
||
|
|
"created": "2018-05-15T15:32:39.000Z",
|
||
|
|
"modified": "2018-05-15T15:32:39.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "x-misp-object--87e5d719-47c0-48f7-a306-167eae1963bf",
|
||
|
|
"target_ref": "x-misp-object--55b2aaba-335d-46dc-95ba-5460b43332fd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|