799 lines
33 KiB
JSON
799 lines
33 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--5cd499b7-5584-4d95-864b-d56f950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-22T08:38:39.000Z",
|
||
|
|
"modified": "2019-05-22T08:38:39.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "grouping",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "grouping--5cd499b7-5584-4d95-864b-d56f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-22T08:38:39.000Z",
|
||
|
|
"modified": "2019-05-22T08:38:39.000Z",
|
||
|
|
"name": "OSINT - Attacks Exploiting Sharepoint CVE-2019-0604",
|
||
|
|
"context": "suspicious-activity",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--5cd499ee-7528-4e01-aa5e-d56e950d210f",
|
||
|
|
"indicator--5cd499ef-1030-43e0-a68d-d56e950d210f",
|
||
|
|
"vulnerability--5cd499ef-010c-4a5d-9651-d56e950d210f",
|
||
|
|
"indicator--5cd499ef-2f3c-4b66-b04c-d56e950d210f",
|
||
|
|
"indicator--5cd499ef-8628-440e-ad75-d56e950d210f",
|
||
|
|
"indicator--5cd499ef-9890-4768-b187-d56e950d210f",
|
||
|
|
"indicator--5cd499ef-c598-4e87-ad5e-d56e950d210f",
|
||
|
|
"indicator--5cd499ef-9654-4a61-9d18-d56e950d210f",
|
||
|
|
"indicator--5cd499ef-3d64-4c66-bd11-d56e950d210f",
|
||
|
|
"indicator--5cd499ef-6a48-4090-b7b9-d56e950d210f",
|
||
|
|
"indicator--5cd499ef-650c-43da-88db-d56e950d210f",
|
||
|
|
"indicator--5cd499ef-169c-42b5-9cd5-d56e950d210f",
|
||
|
|
"indicator--5cd499ef-8230-4cfc-af74-d56e950d210f",
|
||
|
|
"indicator--5cd499ef-f948-41d2-ba99-d56e950d210f",
|
||
|
|
"indicator--5cd499ef-9004-4e76-8feb-d56e950d210f",
|
||
|
|
"indicator--5cd499ef-766c-45ad-8c52-d56e950d210f",
|
||
|
|
"indicator--5cd499ef-4510-4da0-b0db-d56e950d210f",
|
||
|
|
"indicator--5cd499ef-f65c-4426-97c8-d56e950d210f",
|
||
|
|
"indicator--5cd499ef-b020-4f85-98a7-d56e950d210f",
|
||
|
|
"observed-data--5cd49a89-1424-4418-93a9-47cf950d210f",
|
||
|
|
"url--5cd49a89-1424-4418-93a9-47cf950d210f",
|
||
|
|
"observed-data--5cd49a89-f5c0-4980-bfa0-4068950d210f",
|
||
|
|
"url--5cd49a89-f5c0-4980-bfa0-4068950d210f",
|
||
|
|
"observed-data--5cd49a89-adf4-4ea8-a16a-4713950d210f",
|
||
|
|
"url--5cd49a89-adf4-4ea8-a16a-4713950d210f",
|
||
|
|
"observed-data--5cd49a9a-6b20-4905-99ed-f9fa950d210f",
|
||
|
|
"url--5cd49a9a-6b20-4905-99ed-f9fa950d210f",
|
||
|
|
"indicator--5cd91b97-f1e4-431f-8ba7-56a6950d210f",
|
||
|
|
"indicator--5cd917a1-4898-4142-a317-b753950d210f",
|
||
|
|
"indicator--2e08e347-2a12-4a0f-b4f0-5fd161d71eb0",
|
||
|
|
"x-misp-object--2ee4ba30-9841-4fbf-acd0-286bac9c6b35",
|
||
|
|
"indicator--23a2b779-9b25-4053-8780-5dc66bead631",
|
||
|
|
"x-misp-object--f804ed11-1310-477c-ba77-83745ec66f57",
|
||
|
|
"relationship--06a4305b-4025-4ca4-a08a-25f6435f313d",
|
||
|
|
"relationship--2fd69ff0-f179-4d0a-84ca-dff0d90b0e1a"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"type:OSINT",
|
||
|
|
"osint:lifetime=\"perpetual\"",
|
||
|
|
"osint:certainty=\"50\"",
|
||
|
|
"misp-galaxy:mitre-malware=\"China Chopper\"",
|
||
|
|
"misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd499ee-7528-4e01-aa5e-d56e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:21:50.000Z",
|
||
|
|
"modified": "2019-05-09T21:21:50.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'vision2030.tk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-09T21:21:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd499ef-1030-43e0-a68d-d56e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:21:51.000Z",
|
||
|
|
"modified": "2019-05-09T21:21:51.000Z",
|
||
|
|
"pattern": "[url:value = 'https://vision2030.tk/static/googleupdate.xn--txt-9o0a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-09T21:21:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "vulnerability",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "vulnerability--5cd499ef-010c-4a5d-9651-d56e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:21:51.000Z",
|
||
|
|
"modified": "2019-05-09T21:21:51.000Z",
|
||
|
|
"name": "CVE-2019-0604",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"vulnerability\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"external_references": [
|
||
|
|
{
|
||
|
|
"source_name": "cve",
|
||
|
|
"external_id": "CVE-2019-0604"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd499ef-2f3c-4b66-b04c-d56e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:21:51.000Z",
|
||
|
|
"modified": "2019-05-09T21:21:51.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c63f425d96365d906604b1529611eefe5524432545a7977ebe2ac8c79f90ad7e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-09T21:21:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd499ef-8628-440e-ad75-d56e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:21:51.000Z",
|
||
|
|
"modified": "2019-05-09T21:21:51.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '198ee041e8f3eb12a19bc321f86ccb88']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-09T21:21:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd499ef-9890-4768-b187-d56e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:21:51.000Z",
|
||
|
|
"modified": "2019-05-09T21:21:51.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ee583451c832b07d8f2b4d6b8dd36ccb280ff421']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-09T21:21:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd499ef-c598-4e87-ad5e-d56e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:21:51.000Z",
|
||
|
|
"modified": "2019-05-09T21:21:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'vision2030.cf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-09T21:21:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd499ef-9654-4a61-9d18-d56e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:21:51.000Z",
|
||
|
|
"modified": "2019-05-09T21:21:51.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '05108ac3c3d708977f2d679bfa6d2eaf63b371e66428018a68efce4b6a45b4b4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-09T21:21:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd499ef-3d64-4c66-bd11-d56e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:21:51.000Z",
|
||
|
|
"modified": "2019-05-09T21:21:51.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b560c3b9b672f42a005bdeae79eb91dfb0dec8dc04bea51f38731692bc995688']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-09T21:21:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd499ef-6a48-4090-b7b9-d56e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:21:51.000Z",
|
||
|
|
"modified": "2019-05-09T21:21:51.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7d6812947e7eafa8a4cce84b531f8077f7434dbed4ccdaca64225d1b6a0e8604']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-09T21:21:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd499ef-650c-43da-88db-d56e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:21:51.000Z",
|
||
|
|
"modified": "2019-05-09T21:21:51.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0eebeef32a8f676a1717f134f114c8bd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-09T21:21:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd499ef-169c-42b5-9cd5-d56e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:21:51.000Z",
|
||
|
|
"modified": "2019-05-09T21:21:51.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b814532d73c7e5ffd1a2533adc6cfcf8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-09T21:21:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd499ef-8230-4cfc-af74-d56e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:21:51.000Z",
|
||
|
|
"modified": "2019-05-09T21:21:51.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '708544104809ef2776ddc56e04d27ab1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-09T21:21:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd499ef-f948-41d2-ba99-d56e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:21:51.000Z",
|
||
|
|
"modified": "2019-05-09T21:21:51.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f0fb0f7553390f203669e53abc16b15e729e5c6f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-09T21:21:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd499ef-9004-4e76-8feb-d56e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:21:51.000Z",
|
||
|
|
"modified": "2019-05-09T21:21:51.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'dc8e7b7de41cac9ded920c41b272c885e1aec279']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-09T21:21:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd499ef-766c-45ad-8c52-d56e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:21:51.000Z",
|
||
|
|
"modified": "2019-05-09T21:21:51.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4c3b262b4134366ad0a67b1a2d6378da428d712b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-09T21:21:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd499ef-4510-4da0-b0db-d56e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:21:51.000Z",
|
||
|
|
"modified": "2019-05-09T21:21:51.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'fafe395967d2ec8022c2c91815b231ee08143031']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-09T21:21:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd499ef-f65c-4426-97c8-d56e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:21:51.000Z",
|
||
|
|
"modified": "2019-05-09T21:21:51.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ce1ef0f88530bb51de8d20c83252fa0f0ff55bc7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-09T21:21:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd499ef-b020-4f85-98a7-d56e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:21:51.000Z",
|
||
|
|
"modified": "2019-05-09T21:21:51.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2e4b7c022329e5c21e47d55e8916f6af852aabbbd1798f9e16985f22a8056646']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-09T21:21:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5cd49a89-1424-4418-93a9-47cf950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:24:25.000Z",
|
||
|
|
"modified": "2019-05-09T21:24:25.000Z",
|
||
|
|
"first_observed": "2019-05-09T21:24:25Z",
|
||
|
|
"last_observed": "2019-05-09T21:24:25Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5cd49a89-1424-4418-93a9-47cf950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5cd49a89-1424-4418-93a9-47cf950d210f",
|
||
|
|
"value": "https://cyber.gc.ca/fr/avis/maliciel-china-chopper-affectant-les-serveurs-sharepoint"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5cd49a89-f5c0-4980-bfa0-4068950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:24:25.000Z",
|
||
|
|
"modified": "2019-05-09T21:24:25.000Z",
|
||
|
|
"first_observed": "2019-05-09T21:24:25Z",
|
||
|
|
"last_observed": "2019-05-09T21:24:25Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5cd49a89-f5c0-4980-bfa0-4068950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5cd49a89-f5c0-4980-bfa0-4068950d210f",
|
||
|
|
"value": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5cd49a89-adf4-4ea8-a16a-4713950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:24:25.000Z",
|
||
|
|
"modified": "2019-05-09T21:24:25.000Z",
|
||
|
|
"first_observed": "2019-05-09T21:24:25Z",
|
||
|
|
"last_observed": "2019-05-09T21:24:25Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5cd49a89-adf4-4ea8-a16a-4713950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5cd49a89-adf4-4ea8-a16a-4713950d210f",
|
||
|
|
"value": "https://pastebin.com/bUFPhucz"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5cd49a9a-6b20-4905-99ed-f9fa950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:24:42.000Z",
|
||
|
|
"modified": "2019-05-09T21:24:42.000Z",
|
||
|
|
"first_observed": "2019-05-09T21:24:42Z",
|
||
|
|
"last_observed": "2019-05-09T21:24:42Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5cd49a9a-6b20-4905-99ed-f9fa950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5cd49a9a-6b20-4905-99ed-f9fa950d210f",
|
||
|
|
"value": "https://otx.alienvault.com/pulse/5cd3f89df12b501c477a6fba"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd91b97-f1e4-431f-8ba7-56a6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-13T07:24:07.000Z",
|
||
|
|
"modified": "2019-05-13T07:24:07.000Z",
|
||
|
|
"pattern": "[rule alienvault_webshells_asp : Webshells { \r\n meta: \r\n author = \"AlienVault Labs\" \r\n info = \"Generic detections for possible PHP Web-Shells\" \r\n strings: \r\n $sa = \"<%eval request(\" nocase wide ascii \r\n $sb = \"Server.CreateObject(\\\"WSCRIPT.SHELL\\\")\" nocase wide ascii \r\n $sc = \"Eval(Request(\" nocase wide ascii \r\n $sd = \"ExecuteGlobal(StrReverse\" nocase wide ascii \r\n $se = \"<%eval(Request.Item[\" nocase wide ascii \r\n condition: \r\n any of them\r\n}]",
|
||
|
|
"pattern_type": "yara",
|
||
|
|
"valid_from": "2019-05-13T07:24:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"yara\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cd917a1-4898-4142-a317-b753950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-13T07:07:13.000Z",
|
||
|
|
"modified": "2019-05-13T07:07:13.000Z",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '114.25.219.100']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-13T07:07:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--2e08e347-2a12-4a0f-b4f0-5fd161d71eb0",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:22:35.000Z",
|
||
|
|
"modified": "2019-05-09T21:22:35.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b814532d73c7e5ffd1a2533adc6cfcf8' AND file:hashes.SHA1 = 'dc8e7b7de41cac9ded920c41b272c885e1aec279' AND file:hashes.SHA256 = '05108ac3c3d708977f2d679bfa6d2eaf63b371e66428018a68efce4b6a45b4b4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-09T21:22:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--2ee4ba30-9841-4fbf-acd0-286bac9c6b35",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:22:35.000Z",
|
||
|
|
"modified": "2019-05-09T21:22:35.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-05-09 20:57:27",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c2763120-8f7b-49cb-b159-6787c01b99bb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/05108ac3c3d708977f2d679bfa6d2eaf63b371e66428018a68efce4b6a45b4b4/analysis/1557435447/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "939cef4e-14e2-4e83-8544-63aa27e6deef"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "5/59",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "c84c63bd-e491-45e8-aa8c-7340da2e7cde"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--23a2b779-9b25-4053-8780-5dc66bead631",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:22:36.000Z",
|
||
|
|
"modified": "2019-05-09T21:22:36.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '198ee041e8f3eb12a19bc321f86ccb88' AND file:hashes.SHA1 = 'ee583451c832b07d8f2b4d6b8dd36ccb280ff421' AND file:hashes.SHA256 = 'c63f425d96365d906604b1529611eefe5524432545a7977ebe2ac8c79f90ad7e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-09T21:22:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--f804ed11-1310-477c-ba77-83745ec66f57",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-09T21:22:37.000Z",
|
||
|
|
"modified": "2019-05-09T21:22:37.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-04-09 09:15:29",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2fa0e40a-0a4d-4b3c-a36b-64e661e70c2d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/c63f425d96365d906604b1529611eefe5524432545a7977ebe2ac8c79f90ad7e/analysis/1554801329/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "12c3d385-2e80-4a3f-905e-0e581e972522"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "13/72",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "d8ba684b-7f6f-4c9c-8b11-b7511de95177"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--06a4305b-4025-4ca4-a08a-25f6435f313d",
|
||
|
|
"created": "2019-05-09T21:22:37.000Z",
|
||
|
|
"modified": "2019-05-09T21:22:37.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--2e08e347-2a12-4a0f-b4f0-5fd161d71eb0",
|
||
|
|
"target_ref": "x-misp-object--2ee4ba30-9841-4fbf-acd0-286bac9c6b35"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--2fd69ff0-f179-4d0a-84ca-dff0d90b0e1a",
|
||
|
|
"created": "2019-05-09T21:22:37.000Z",
|
||
|
|
"modified": "2019-05-09T21:22:37.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--23a2b779-9b25-4053-8780-5dc66bead631",
|
||
|
|
"target_ref": "x-misp-object--f804ed11-1310-477c-ba77-83745ec66f57"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|