adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/f2049d65-5315-4c37-9bbb-900c9b851204.json

455 lines
19 KiB
JSON
Raw Normal View History

chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
{
"type": "bundle",
"id": "bundle--f2049d65-5315-4c37-9bbb-900c9b851204",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-01-19T08:20:21.000Z",
"modified": "2023-01-19T08:20:21.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--f2049d65-5315-4c37-9bbb-900c9b851204",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-01-19T08:20:21.000Z",
"modified": "2023-01-19T08:20:21.000Z",
"name": "OSINT - CircleCI incident report for January 4, 2023 security incident",
"published": "2023-01-19T08:21:21Z",
"object_refs": [
"indicator--5eab642e-d3a5-4170-9aff-770721ce1f01",
"indicator--b0894935-86e3-49fe-99ee-767f8c551d84",
"indicator--9c1bc6dc-e391-46f5-bf31-dc501e06ddfb",
"indicator--9ad02845-5cfb-4494-89b4-1c3795e3d5bb",
"indicator--fc6531ee-17f5-4f4e-94d8-25b1b355b14f",
"indicator--4f008530-bf04-458c-98fc-5b45a6ae66db",
"indicator--268efcdc-a235-4ef2-a421-b66d0b9b0e7f",
"indicator--41b9f351-1bb3-4d8f-af7c-c018c050702b",
"indicator--4d7b64e3-6e7c-4275-b082-8b80534015c9",
"indicator--af9d8894-d05a-46d1-bfe6-8b478b30371a",
"indicator--89f779a8-ac43-46cf-bf35-adae33af9936",
"indicator--486b2d2f-12bd-4741-ae46-5838f798a10a",
"indicator--31150471-744f-47e5-9da9-9eceaac53ca4",
"indicator--5b6801c1-e72e-4841-b908-fefce6cdf8cf",
"indicator--413ee0ee-1509-4d44-bddd-9bde85e92562",
"x-misp-object--852a38c1-d1b2-43c3-8781-23b8de71e1a1"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"misp-galaxy:mitre-attack-pattern=\"SSH - T1021.004\"",
"type:OSINT",
"osint:lifetime=\"perpetual\"",
"osint:certainty=\"50\"",
"tlp:clear"
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5eab642e-d3a5-4170-9aff-770721ce1f01",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-01-19T08:14:59.000Z",
"modified": "2023-01-19T08:14:59.000Z",
"description": "Malicious files to search for and remove:",
"pattern": "[file:hashes.SHA256 = '8913e38592228adc067d82f66c150d87004ec946e579d4a00c53b61444ff35bf']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-01-19T08:14:59Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--b0894935-86e3-49fe-99ee-767f8c551d84",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-01-19T08:14:47.000Z",
"modified": "2023-01-19T08:14:47.000Z",
"description": "Malicious files to search for and remove:",
"pattern": "[file:name = '/private/tmp/.svx856.log']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-01-19T08:14:47Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--9c1bc6dc-e391-46f5-bf31-dc501e06ddfb",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-01-19T08:16:06.000Z",
"modified": "2023-01-19T08:16:06.000Z",
"description": "Malicious files to search for and remove:",
"pattern": "[file:name = '/private/tmp/.ptslog']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-01-19T08:16:06Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--9ad02845-5cfb-4494-89b4-1c3795e3d5bb",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-01-19T08:16:33.000Z",
"modified": "2023-01-19T08:16:33.000Z",
"description": "Review GitHub audit log files for unexpected commands such as:",
"pattern": "[windows-registry-key:key = 'repo.download_zip']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-01-19T08:16:33Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Artifacts dropped"
}
],
"labels": [
"misp:type=\"regkey\"",
"misp:category=\"Artifacts dropped\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--fc6531ee-17f5-4f4e-94d8-25b1b355b14f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-01-19T08:11:57.000Z",
"modified": "2023-01-19T08:11:57.000Z",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '178.249.214.10']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-01-19T08:11:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--4f008530-bf04-458c-98fc-5b45a6ae66db",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-01-19T08:16:13.000Z",
"modified": "2023-01-19T08:16:13.000Z",
"description": "Malicious files to search for and remove:",
"pattern": "[file:name = 'PTX-Player.dmg']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-01-19T08:16:13Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--268efcdc-a235-4ef2-a421-b66d0b9b0e7f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-01-19T08:11:57.000Z",
"modified": "2023-01-19T08:11:57.000Z",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '178.249.214.25']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-01-19T08:11:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--41b9f351-1bb3-4d8f-af7c-c018c050702b",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-01-19T08:11:57.000Z",
"modified": "2023-01-19T08:11:57.000Z",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '111.90.149.55']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-01-19T08:11:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--4d7b64e3-6e7c-4275-b082-8b80534015c9",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-01-19T08:11:57.000Z",
"modified": "2023-01-19T08:11:57.000Z",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '188.68.229.52']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-01-19T08:11:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--af9d8894-d05a-46d1-bfe6-8b478b30371a",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-01-19T08:11:57.000Z",
"modified": "2023-01-19T08:11:57.000Z",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '72.18.132.58']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-01-19T08:11:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--89f779a8-ac43-46cf-bf35-adae33af9936",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-01-19T08:11:57.000Z",
"modified": "2023-01-19T08:11:57.000Z",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '89.36.78.135']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-01-19T08:11:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--486b2d2f-12bd-4741-ae46-5838f798a10a",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-01-19T08:11:57.000Z",
"modified": "2023-01-19T08:11:57.000Z",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '89.36.78.109']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-01-19T08:11:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--31150471-744f-47e5-9da9-9eceaac53ca4",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-01-19T08:14:13.000Z",
"modified": "2023-01-19T08:14:13.000Z",
"description": "Block the following domain",
"pattern": "[domain-name:value = 'potrax.com']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-01-19T08:14:13Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b6801c1-e72e-4841-b908-fefce6cdf8cf",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-01-19T08:11:57.000Z",
"modified": "2023-01-19T08:11:57.000Z",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '89.36.78.75']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-01-19T08:11:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--413ee0ee-1509-4d44-bddd-9bde85e92562",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-01-19T08:14:36.000Z",
"modified": "2023-01-19T08:14:36.000Z",
"description": "Malicious files to search for and remove:",
"pattern": "[domain-name:value = 'ptx.app']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-01-19T08:14:36Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--852a38c1-d1b2-43c3-8781-23b8de71e1a1",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-01-19T08:10:25.000Z",
"modified": "2023-01-19T08:10:25.000Z",
"labels": [
"misp:name=\"report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "link",
"object_relation": "link",
"value": "https://circleci.com/blog/jan-4-2023-incident-report/",
"category": "External analysis",
"uuid": "c342b42b-b831-4dd3-b01b-f496ec048e8b"
},
{
"type": "text",
"object_relation": "summary",
"value": "On January 4, 2023, we alerted customers to a security incident. Today, we want to share with you what happened, what we\u2019ve learned, and what our plans are to continuously improve our security posture for the future.\r\n\r\nWe would like to thank our customers for your attention to rotating and revoking secrets, and apologize for any disruption this incident may have caused to your work. We encourage customers who have yet to take action to do so in order to prevent unauthorized access to third-party systems and stores. Additionally, we want to thank our customers and our community for your patience while we have been conducting a thorough investigation. In aiming for responsible disclosure, we have done our best to balance speed in sharing information with maintaining the integrity of our investigation.",
"category": "Other",
"uuid": "2a8dc7bd-ec90-49b3-bfda-2117bd548733"
},
{
"type": "text",
"object_relation": "type",
"value": "Report",
"category": "Other",
"uuid": "7d775b15-8637-4e98-a4bc-bd74a19ce591"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "report"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue Copy permalink