657 lines
26 KiB
JSON
657 lines
26 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--5e38d6d4-7d88-40ab-8313-4db80a0a020f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T03:02:31.000Z",
|
||
|
|
"modified": "2020-02-04T03:02:31.000Z",
|
||
|
|
"name": "laskowski-tech.com",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--5e38d6d4-7d88-40ab-8313-4db80a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T03:02:31.000Z",
|
||
|
|
"modified": "2020-02-04T03:02:31.000Z",
|
||
|
|
"name": "Updating: Tracking Powershell Empire C2 via Urlscan",
|
||
|
|
"published": "2020-02-04T03:03:11Z",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--5e38d884-a9f8-4f6a-addf-4dbc0a0a020f",
|
||
|
|
"indicator--5e38d89e-730c-46dd-9a84-4dba0a0a020f",
|
||
|
|
"indicator--5e38d8c5-75f8-421b-9ff6-45500a0a020f",
|
||
|
|
"indicator--5e38d8e9-87d0-470e-b526-4dba0a0a020f",
|
||
|
|
"indicator--5e38d917-fca8-47c0-8664-447c0a0a020f",
|
||
|
|
"indicator--5e38d93f-6364-4d78-9375-4d9a0a0a020f",
|
||
|
|
"indicator--5e38d96f-ed58-4208-99ff-4db80a0a020f",
|
||
|
|
"indicator--5e38d982-ca10-45a5-9e82-4ab00a0a020f",
|
||
|
|
"indicator--5e38d99c-da60-4aff-9656-42f20a0a020f",
|
||
|
|
"indicator--5e38d9b0-312c-4b67-8cce-4e180a0a020f",
|
||
|
|
"indicator--5e38da2b-11d4-4821-97a1-4dbc0a0a020f",
|
||
|
|
"indicator--5e38da52-c9fc-48ef-ad16-4f9a0a0a020f",
|
||
|
|
"indicator--5e38dab6-5a90-4dad-90b7-4dbe0a0a020f",
|
||
|
|
"indicator--5e38dad8-dc10-4645-8ef0-42960a0a020f",
|
||
|
|
"indicator--5e38db7a-cfa0-42e5-a1ab-4db80a0a020f",
|
||
|
|
"indicator--5e38dba2-15dc-4574-af0b-418b0a0a020f",
|
||
|
|
"indicator--5e38dbea-5224-4bb2-81cd-49c70a0a020f",
|
||
|
|
"indicator--5e38dc10-07ec-4d75-a5f5-4db80a0a020f",
|
||
|
|
"indicator--5e38dc48-57a8-4fa8-b333-4dfc0a0a020f",
|
||
|
|
"indicator--5e38dc64-48b8-45da-bf4c-4db80a0a020f",
|
||
|
|
"indicator--5e38dc8c-66fc-4338-9747-4dbe0a0a020f",
|
||
|
|
"indicator--5e38dca6-4644-4508-8a3a-4eef0a0a020f",
|
||
|
|
"observed-data--5e38dd01-18f0-4378-a084-4d9a0a0a020f",
|
||
|
|
"url--5e38dd01-18f0-4378-a084-4d9a0a0a020f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"Powershell Empire",
|
||
|
|
"Source:Urlscan.io",
|
||
|
|
"Threat Source:OSINT",
|
||
|
|
"type:OSINT"
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e38d884-a9f8-4f6a-addf-4dbc0a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T02:57:47.000Z",
|
||
|
|
"modified": "2020-02-04T02:57:47.000Z",
|
||
|
|
"description": "azershop.org",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '37.220.0.54']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-12-23T00:00:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Powershell Empire",
|
||
|
|
"kill-chain:Command and Control"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e38d89e-730c-46dd-9a84-4dba0a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T02:57:50.000Z",
|
||
|
|
"modified": "2020-02-04T02:57:50.000Z",
|
||
|
|
"pattern": "[url:value = 'https://azershop.org:443']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-12-23T00:00:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Powershell Empire",
|
||
|
|
"kill-chain:Command and Control"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e38d8c5-75f8-421b-9ff6-45500a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T02:57:20.000Z",
|
||
|
|
"modified": "2020-02-04T02:57:20.000Z",
|
||
|
|
"pattern": "[url:value = 'https://virtualofficeroom.com:443']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-27T00:00:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Powershell Empire",
|
||
|
|
"kill-chain:Command and Control"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e38d8e9-87d0-470e-b526-4dba0a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T02:56:23.000Z",
|
||
|
|
"modified": "2020-02-04T02:56:23.000Z",
|
||
|
|
"description": "virtualofficeroom.com",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.165.168.226']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-27T00:00:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Powershell Empire",
|
||
|
|
"kill-chain:Command and Control"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e38d917-fca8-47c0-8664-447c0a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T02:56:18.000Z",
|
||
|
|
"modified": "2020-02-04T02:56:18.000Z",
|
||
|
|
"pattern": "[url:value = 'https://officestorage.org:443']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-27T00:00:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Powershell Empire",
|
||
|
|
"kill-chain:Command and Control"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e38d93f-6364-4d78-9375-4d9a0a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T02:58:49.000Z",
|
||
|
|
"modified": "2020-02-04T02:58:49.000Z",
|
||
|
|
"description": "officestorage.org",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.245.84.106']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-27T00:00:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Powershell Empire",
|
||
|
|
"kill-chain:Command and Control"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e38d96f-ed58-4208-99ff-4db80a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T02:54:02.000Z",
|
||
|
|
"modified": "2020-02-04T02:54:02.000Z",
|
||
|
|
"pattern": "[url:value = 'https://194.99.22.145/']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-12-12T00:00:00Z",
|
||
|
|
"valid_until": "2020-01-27T00:00:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Powershell Empire",
|
||
|
|
"kill-chain:Command and Control"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e38d982-ca10-45a5-9e82-4ab00a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T02:54:02.000Z",
|
||
|
|
"modified": "2020-02-04T02:54:02.000Z",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '194.99.22.145']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-12-12T00:00:00Z",
|
||
|
|
"valid_until": "2020-01-27T00:00:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Powershell Empire",
|
||
|
|
"kill-chain:Command and Control"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e38d99c-da60-4aff-9656-42f20a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T02:57:22.000Z",
|
||
|
|
"modified": "2020-02-04T02:57:22.000Z",
|
||
|
|
"pattern": "[url:value = 'http://23.83.133.15:333/']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-27T00:00:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Powershell Empire",
|
||
|
|
"kill-chain:Command and Control"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e38d9b0-312c-4b67-8cce-4e180a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T02:57:59.000Z",
|
||
|
|
"modified": "2020-02-04T02:57:59.000Z",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '23.83.133.15']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-27T00:00:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Powershell Empire",
|
||
|
|
"kill-chain:Command and Control"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e38da2b-11d4-4821-97a1-4dbc0a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T02:56:47.000Z",
|
||
|
|
"modified": "2020-02-04T02:56:47.000Z",
|
||
|
|
"pattern": "[url:value = 'https://updateinfoapps.com/']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-20T00:00:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Powershell Empire",
|
||
|
|
"kill-chain:Command and Control"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e38da52-c9fc-48ef-ad16-4f9a0a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T02:56:51.000Z",
|
||
|
|
"modified": "2020-02-04T02:56:51.000Z",
|
||
|
|
"description": "updateinfoapps.com",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '45.61.139.40']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-20T00:00:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Powershell Empire",
|
||
|
|
"kill-chain:Command and Control"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e38dab6-5a90-4dad-90b7-4dbe0a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T02:57:26.000Z",
|
||
|
|
"modified": "2020-02-04T02:57:26.000Z",
|
||
|
|
"pattern": "[url:value = 'https://www.microsoft-lync.cf/']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-15T00:00:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Powershell Empire",
|
||
|
|
"kill-chain:Command and Control"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e38dad8-dc10-4645-8ef0-42960a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T02:57:28.000Z",
|
||
|
|
"modified": "2020-02-04T02:57:28.000Z",
|
||
|
|
"description": "www.microsoft-lync.cf",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '54.229.88.99']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-15T00:00:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Powershell Empire",
|
||
|
|
"kill-chain:Command and Control"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e38db7a-cfa0-42e5-a1ab-4db80a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T02:57:33.000Z",
|
||
|
|
"modified": "2020-02-04T02:57:33.000Z",
|
||
|
|
"pattern": "[url:value = 'https://cdnupdate2.ddns.net/']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-09T00:00:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Powershell Empire",
|
||
|
|
"kill-chain:Command and Control"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e38dba2-15dc-4574-af0b-418b0a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T02:57:35.000Z",
|
||
|
|
"modified": "2020-02-04T02:57:35.000Z",
|
||
|
|
"description": "cdnupdate2.ddns.net",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '149.28.128.67']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-09T00:00:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Powershell Empire",
|
||
|
|
"kill-chain:Command and Control"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e38dbea-5224-4bb2-81cd-49c70a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T02:57:38.000Z",
|
||
|
|
"modified": "2020-02-04T02:57:38.000Z",
|
||
|
|
"pattern": "[url:value = 'http://securityinsiderblogs.com/']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-08T00:00:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Powershell Empire",
|
||
|
|
"kill-chain:Command and Control"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e38dc10-07ec-4d75-a5f5-4db80a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T02:57:41.000Z",
|
||
|
|
"modified": "2020-02-04T02:57:41.000Z",
|
||
|
|
"description": "securityinsiderblogs.com",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '155.138.238.182']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-08T00:00:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Powershell Empire",
|
||
|
|
"kill-chain:Command and Control"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e38dc48-57a8-4fa8-b333-4dfc0a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T02:57:08.000Z",
|
||
|
|
"modified": "2020-02-04T02:57:08.000Z",
|
||
|
|
"pattern": "[url:value = 'https://bankingadvice.net:443']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-31T00:00:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Powershell Empire",
|
||
|
|
"kill-chain:Command and Control"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e38dc64-48b8-45da-bf4c-4db80a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T02:57:14.000Z",
|
||
|
|
"modified": "2020-02-04T02:57:14.000Z",
|
||
|
|
"description": "bankingadvice.net",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '23.101.118.20']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-31T00:00:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Powershell Empire",
|
||
|
|
"kill-chain:Command and Control"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e38dc8c-66fc-4338-9747-4dbe0a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T02:56:37.000Z",
|
||
|
|
"modified": "2020-02-04T02:56:37.000Z",
|
||
|
|
"pattern": "[url:value = 'http://23.83.133.137:443/']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-27T00:00:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Powershell Empire",
|
||
|
|
"kill-chain:Command and Control"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5e38dca6-4644-4508-8a3a-4eef0a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T02:56:41.000Z",
|
||
|
|
"modified": "2020-02-04T02:56:41.000Z",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '23.83.133.137']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2020-01-27T00:00:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"Powershell Empire",
|
||
|
|
"kill-chain:Command and Control"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5e38dd01-18f0-4378-a084-4d9a0a0a020f",
|
||
|
|
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
|
||
|
|
"created": "2020-02-04T02:58:43.000Z",
|
||
|
|
"modified": "2020-02-04T02:58:43.000Z",
|
||
|
|
"first_observed": "2020-01-27T05:00:00Z",
|
||
|
|
"last_observed": "2020-01-28T05:00:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5e38dd01-18f0-4378-a084-4d9a0a0a020f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"Support Tool\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5e38dd01-18f0-4378-a084-4d9a0a0a020f",
|
||
|
|
"value": "https://urlscan.io/search/#hash%3Ab8c892fbb49921529be6f6ce17685c31724f76959111b28f39e39dc299b8acaf%20"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|