8344 lines
No EOL
336 KiB
JSON
8344 lines
No EOL
336 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--5d13ce08-14f8-414c-a7d2-4cee02de0b81",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T20:04:13.000Z",
|
|
"modified": "2019-06-26T20:04:13.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--5d13ce08-14f8-414c-a7d2-4cee02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T20:04:13.000Z",
|
|
"modified": "2019-06-26T20:04:13.000Z",
|
|
"name": "An Analysis of Linux.Ngioweb Botnet",
|
|
"published": "2019-06-26T20:04:30Z",
|
|
"object_refs": [
|
|
"x-misp-attribute--5d13ce1a-6cc8-4f93-91ac-67c602de0b81",
|
|
"indicator--5d13ce9d-4c98-45df-a2ef-485202de0b81",
|
|
"indicator--5d13ce9d-0ed8-41f1-bf7f-40d302de0b81",
|
|
"indicator--5d13ce9d-b130-4a29-9ad1-44ba02de0b81",
|
|
"indicator--5d13ce9d-8584-4143-b396-43d402de0b81",
|
|
"indicator--5d13ce9d-920c-4deb-9a61-4d0902de0b81",
|
|
"indicator--5d13ce9d-8a4c-44f4-9bea-40e602de0b81",
|
|
"indicator--5d13ce9d-0ae0-4249-85be-4d3702de0b81",
|
|
"indicator--5d13ce9d-842c-4c80-a02b-42fa02de0b81",
|
|
"indicator--5d13ce9d-235c-4bee-8114-485a02de0b81",
|
|
"indicator--5d13ce9d-00e8-4815-8ea1-4ee202de0b81",
|
|
"indicator--5d13ce9d-77dc-4c60-8f1f-494102de0b81",
|
|
"indicator--5d13ce9d-2a94-42d0-ab9f-44e802de0b81",
|
|
"indicator--5d13ce9d-96fc-4fde-918e-4df102de0b81",
|
|
"indicator--5d13ce9d-2114-48c3-b506-453d02de0b81",
|
|
"indicator--5d13ce9d-90c4-4c7b-8a07-4b9e02de0b81",
|
|
"indicator--5d13ce9d-07f8-4ae4-a599-4ba602de0b81",
|
|
"indicator--5d13ce9d-f1bc-4b9f-8acd-46f202de0b81",
|
|
"indicator--5d13ce9d-eb20-4e37-9850-423102de0b81",
|
|
"indicator--5d13ce9d-2708-4856-a9e8-443802de0b81",
|
|
"indicator--5d13ce9d-f10c-4921-9e86-469602de0b81",
|
|
"indicator--5d13ce9d-d7f8-42f3-bae5-482502de0b81",
|
|
"indicator--5d13ce9d-e0fc-48da-ac18-4a3302de0b81",
|
|
"indicator--5d13ce9d-0130-4f9e-a78f-422a02de0b81",
|
|
"indicator--5d13ce9d-3338-484f-87ae-428402de0b81",
|
|
"indicator--5d13ce9d-2108-4bb0-b24f-44c702de0b81",
|
|
"indicator--5d13ce9d-6270-49da-89f3-473102de0b81",
|
|
"indicator--5d13ce9d-ffc0-4d25-9a4c-476902de0b81",
|
|
"indicator--5d13ce9d-8d78-41b5-adad-454b02de0b81",
|
|
"indicator--5d13ce9d-afa8-4978-83e7-456e02de0b81",
|
|
"indicator--5d13ce9d-eeb0-4a30-a0b0-4e9f02de0b81",
|
|
"indicator--5d13ce9d-eb48-46e6-b228-4de802de0b81",
|
|
"indicator--5d13ce9d-bd54-4a3d-86e2-4ff402de0b81",
|
|
"indicator--5d13ce9d-5904-4bb6-88ce-46c402de0b81",
|
|
"indicator--5d13ce9d-d570-4d33-bd42-4f3602de0b81",
|
|
"indicator--5d13ce9d-8440-4bd7-8025-463202de0b81",
|
|
"indicator--5d13ce9d-21f4-4b9d-837d-4d7e02de0b81",
|
|
"indicator--5d13ce9d-428c-40dc-8b3c-460a02de0b81",
|
|
"indicator--5d13ce9d-5ccc-4606-97e9-4eab02de0b81",
|
|
"indicator--5d13ce9d-b3c4-4157-8f1d-49f702de0b81",
|
|
"indicator--5d13ce9d-019c-45bf-8ea5-4c3c02de0b81",
|
|
"indicator--5d13ce9d-da3c-404c-8767-4c0d02de0b81",
|
|
"indicator--5d13ce9d-0e18-46a2-9354-492402de0b81",
|
|
"indicator--5d13ce9e-5310-4512-ab1e-482202de0b81",
|
|
"indicator--5d13ce9e-f1fc-4ea9-bf45-48da02de0b81",
|
|
"indicator--5d13ce9e-b68c-40fc-9a46-4e4f02de0b81",
|
|
"indicator--5d13ce9e-59b8-4142-9386-4ec602de0b81",
|
|
"indicator--5d13ce9e-851c-44a3-a3bc-443502de0b81",
|
|
"indicator--5d13ce9e-ca24-4c08-bde8-4b3902de0b81",
|
|
"indicator--5d13ce9e-6430-4bc8-a321-4e7502de0b81",
|
|
"indicator--5d13ce9e-a9b8-4894-83e7-45b702de0b81",
|
|
"indicator--5d13ce9e-7714-42fd-8ed8-40af02de0b81",
|
|
"indicator--5d13ce9e-e824-44e2-9498-452402de0b81",
|
|
"indicator--5d13ce9e-bc10-4f9c-86cc-4bbb02de0b81",
|
|
"indicator--5d13ce9e-d3b4-47d1-b06b-441b02de0b81",
|
|
"indicator--5d13ce9e-687c-4346-9eaf-4a0902de0b81",
|
|
"indicator--5d13ce9e-58d0-40d2-a1f3-4b2702de0b81",
|
|
"indicator--5d13ce9e-8fd8-4f6d-b2df-461402de0b81",
|
|
"indicator--5d13ce9e-fd6c-40a9-b53e-49b202de0b81",
|
|
"indicator--5d13ce9e-b3e0-4ce1-b4d7-4e0402de0b81",
|
|
"indicator--5d13ce9e-e280-4bb4-ae81-4fd602de0b81",
|
|
"indicator--5d13ce9e-63f8-4a37-9f5e-4f8102de0b81",
|
|
"indicator--5d13ce9e-f704-4a0b-9e96-4c3f02de0b81",
|
|
"indicator--5d13ce9e-4cfc-4cd4-8d49-4ca202de0b81",
|
|
"indicator--5d13ce9e-57f4-4622-9915-4ca702de0b81",
|
|
"indicator--5d13ce9e-90cc-414a-ba97-4b2a02de0b81",
|
|
"indicator--5d13ce9e-efec-4d71-b1ff-47f702de0b81",
|
|
"indicator--5d13ce9e-7a28-4e36-8696-419f02de0b81",
|
|
"indicator--5d13ce9e-32a0-46b7-b3ed-43ff02de0b81",
|
|
"indicator--5d13ce9e-064c-48a7-8e3f-48f202de0b81",
|
|
"indicator--5d13ce9e-3758-48ff-be3d-450102de0b81",
|
|
"indicator--5d13ce9e-7964-4ea4-ac98-4b8602de0b81",
|
|
"indicator--5d13ce9e-a380-4539-9b16-410f02de0b81",
|
|
"indicator--5d13ce9e-e54c-42f9-a1a6-4ace02de0b81",
|
|
"indicator--5d13ce9e-acc4-4324-a747-436802de0b81",
|
|
"indicator--5d13ce9e-d2e0-4908-b0eb-4a0902de0b81",
|
|
"indicator--5d13ce9e-48e0-43d4-8032-432002de0b81",
|
|
"indicator--5d13ce9e-eb04-4f13-8563-4de102de0b81",
|
|
"indicator--5d13ce9e-a560-4809-84ec-4c6202de0b81",
|
|
"indicator--5d13ce9e-fa74-4d6b-abf6-4f3702de0b81",
|
|
"indicator--5d13ce9e-3454-417c-af8a-442802de0b81",
|
|
"indicator--5d13ce9e-71b8-4d85-ad45-483d02de0b81",
|
|
"indicator--5d13ce9e-9064-427c-b4b1-46c102de0b81",
|
|
"indicator--5d13ce9e-5dd0-4906-add4-4cd802de0b81",
|
|
"indicator--5d13ce9e-0490-45c4-9b24-40d702de0b81",
|
|
"indicator--5d13ce9e-ab6c-4e7a-9266-488f02de0b81",
|
|
"indicator--5d13ce9e-55cc-453c-9278-493e02de0b81",
|
|
"indicator--5d13ce9e-ad70-400a-8451-4ee502de0b81",
|
|
"indicator--5d13ce9e-7a3c-4e76-ab38-4b9d02de0b81",
|
|
"indicator--5d13ce9e-ce5c-4e46-a6d6-4ad902de0b81",
|
|
"indicator--5d13ce9e-25dc-4912-bcc9-4a1e02de0b81",
|
|
"indicator--5d13ce9e-0d38-44f1-8fb8-49fd02de0b81",
|
|
"indicator--5d13ce9e-3bb4-4ffd-a0d4-4aa702de0b81",
|
|
"indicator--5d13ce9e-23d8-483e-8e44-49ad02de0b81",
|
|
"indicator--5d13ce9e-5c98-4bba-8fda-4c8802de0b81",
|
|
"indicator--5d13ce9e-713c-4711-9fa8-45a802de0b81",
|
|
"indicator--5d13ce9e-fa58-4f6d-bd3b-4f3f02de0b81",
|
|
"indicator--5d13ce9e-dfac-434a-823e-414602de0b81",
|
|
"indicator--5d13ce9e-5424-4ae8-98ad-4a6502de0b81",
|
|
"indicator--5d13ce9e-8440-4b10-ac6d-452a02de0b81",
|
|
"indicator--5d13ce9e-c288-4114-94da-462e02de0b81",
|
|
"indicator--5d13ce9e-82ec-41a2-a67e-4c1402de0b81",
|
|
"indicator--5d13ce9e-5d2c-49c4-a88b-406502de0b81",
|
|
"indicator--5d13ce9f-04e0-4093-9eb1-408d02de0b81",
|
|
"indicator--5d13ce9f-f774-43fc-ba90-403202de0b81",
|
|
"indicator--5d13ce9f-581c-4915-990f-4c3002de0b81",
|
|
"indicator--5d13ce9f-8e3c-4572-8c58-494102de0b81",
|
|
"indicator--5d13ce9f-c67c-48e8-b5c3-461102de0b81",
|
|
"indicator--5d13ce9f-286c-434d-97ff-4ab402de0b81",
|
|
"indicator--5d13ce9f-4bc0-4571-8ac3-431002de0b81",
|
|
"indicator--5d13ce9f-b118-4ff4-a602-45ee02de0b81",
|
|
"indicator--5d13ce9f-5c88-4795-890d-4afd02de0b81",
|
|
"indicator--5d13ce9f-0194-45a8-a63d-4ac902de0b81",
|
|
"indicator--5d13ce9f-d414-41e9-8c77-428402de0b81",
|
|
"indicator--5d13ce9f-c5a8-432b-9aba-4c7502de0b81",
|
|
"indicator--5d13ce9f-d510-47a1-a6be-455702de0b81",
|
|
"indicator--5d13ce9f-fec0-4c53-a478-463302de0b81",
|
|
"indicator--5d13ce9f-41f8-447f-aa65-407e02de0b81",
|
|
"indicator--5d13ce9f-ad00-426c-8b53-480e02de0b81",
|
|
"indicator--5d13ce9f-0690-4a9a-9d50-4df702de0b81",
|
|
"indicator--5d13ce9f-77d0-43a0-83d0-452f02de0b81",
|
|
"indicator--5d13ce9f-dd98-470b-9a56-439e02de0b81",
|
|
"indicator--5d13ce9f-4b1c-47d8-ba21-4bcd02de0b81",
|
|
"indicator--5d13ce9f-52ac-4d0b-b81d-4fac02de0b81",
|
|
"indicator--5d13ce9f-01d0-4b83-8380-47b102de0b81",
|
|
"indicator--5d13ce9f-677c-4862-a409-4f8202de0b81",
|
|
"indicator--5d13ce9f-90a4-4bdc-a501-4add02de0b81",
|
|
"indicator--5d13ce9f-40fc-403e-bcb1-475a02de0b81",
|
|
"indicator--5d13ce9f-1f54-4966-a0eb-4ab002de0b81",
|
|
"indicator--5d13ce9f-c2f8-4acd-b9a5-459f02de0b81",
|
|
"indicator--5d13ce9f-0a90-4380-8277-481c02de0b81",
|
|
"indicator--5d13ce9f-40e4-48d5-a434-4b3102de0b81",
|
|
"indicator--5d13ce9f-8f54-44ce-848d-4d4002de0b81",
|
|
"indicator--5d13ce9f-fa88-4140-86fc-404502de0b81",
|
|
"indicator--5d13ce9f-64ac-4a50-9c86-4cc602de0b81",
|
|
"indicator--5d13ce9f-9010-4728-b9b9-482302de0b81",
|
|
"indicator--5d13ce9f-e30c-47ea-b7a3-479c02de0b81",
|
|
"indicator--5d13ce9f-f8f4-4e07-89bf-42d402de0b81",
|
|
"indicator--5d13ce9f-2e9c-441e-a708-4be702de0b81",
|
|
"indicator--5d13ce9f-3158-479d-abdd-401602de0b81",
|
|
"indicator--5d13ce9f-4f50-4774-adf7-47f702de0b81",
|
|
"indicator--5d13ce9f-362c-4954-8c7a-4fac02de0b81",
|
|
"indicator--5d13ce9f-d554-426f-ad4d-41ef02de0b81",
|
|
"indicator--5d13ce9f-98ac-4dab-a857-48f302de0b81",
|
|
"indicator--5d13ce9f-f524-487a-bc60-4aed02de0b81",
|
|
"indicator--5d13ce9f-0e08-4e27-a14a-419602de0b81",
|
|
"indicator--5d13ce9f-af80-454e-bfe8-45c502de0b81",
|
|
"indicator--5d13ce9f-6aa4-4261-8201-4f1602de0b81",
|
|
"indicator--5d13ce9f-c358-4328-a7fb-439602de0b81",
|
|
"indicator--5d13ce9f-ed2c-42d8-8c02-4bb402de0b81",
|
|
"indicator--5d13ce9f-8934-402b-88e4-4dea02de0b81",
|
|
"indicator--5d13ce9f-c564-4d62-a08c-4ad502de0b81",
|
|
"indicator--5d13ce9f-4d9c-4442-8481-4a2c02de0b81",
|
|
"indicator--5d13ce9f-b26c-432c-ae0f-449202de0b81",
|
|
"indicator--5d13ce9f-9f90-4e91-bd81-4a2f02de0b81",
|
|
"indicator--5d13ce9f-97c8-4661-b2df-497502de0b81",
|
|
"indicator--5d13ce9f-863c-43e5-a039-46ba02de0b81",
|
|
"indicator--5d13ce9f-ee2c-4e59-889e-4cb102de0b81",
|
|
"indicator--5d13ce9f-86f0-46aa-a85a-42e502de0b81",
|
|
"indicator--5d13ce9f-8950-4bb0-98b6-41df02de0b81",
|
|
"indicator--5d13ce9f-0bf4-4a15-a3ca-42a202de0b81",
|
|
"indicator--5d13ce9f-ad74-46ab-baa0-481502de0b81",
|
|
"indicator--5d13ce9f-4850-4b05-95ad-457b02de0b81",
|
|
"indicator--5d13ce9f-9d4c-49bd-be3b-480402de0b81",
|
|
"indicator--5d13ce9f-ee54-4bab-9746-483502de0b81",
|
|
"indicator--5d13ce9f-2594-433e-8b2a-418202de0b81",
|
|
"indicator--5d13ce9f-3fe4-4a6e-8e81-40b202de0b81",
|
|
"indicator--5d13ce9f-379c-4a7e-b8cd-435a02de0b81",
|
|
"indicator--5d13cea0-5f44-46e7-90eb-477d02de0b81",
|
|
"indicator--5d13cea0-1860-4d40-81f2-4da902de0b81",
|
|
"indicator--5d13cea0-5968-45bd-ab62-469402de0b81",
|
|
"indicator--5d13cea0-5330-44b6-98b0-46c402de0b81",
|
|
"indicator--5d13cea0-84dc-4aeb-8a6e-498202de0b81",
|
|
"indicator--5d13cea0-f8cc-4473-b84a-4b3002de0b81",
|
|
"indicator--5d13cea0-31e4-421f-b4d2-412602de0b81",
|
|
"indicator--5d13cea0-1d40-4ef2-9470-4af802de0b81",
|
|
"indicator--5d13cea0-1ea0-4d20-89e2-4b6d02de0b81",
|
|
"indicator--5d13cea0-1a48-40fa-a3fa-413602de0b81",
|
|
"indicator--5d13cea0-2a40-4a16-9c86-442e02de0b81",
|
|
"indicator--5d13cea0-9090-485e-9787-4e3c02de0b81",
|
|
"indicator--5d13cea0-63d4-4d9e-afb6-432d02de0b81",
|
|
"indicator--5d13cea0-b8ac-4dfe-ae03-4c6802de0b81",
|
|
"indicator--5d13cea0-cb90-445a-bc40-40fc02de0b81",
|
|
"indicator--5d13cea0-1050-400d-b501-40f902de0b81",
|
|
"indicator--5d13cea0-7c20-431b-ba83-4ff002de0b81",
|
|
"indicator--5d13cea0-f790-435d-9b4a-487402de0b81",
|
|
"indicator--5d13cea0-5eb0-4836-ba2f-467602de0b81",
|
|
"indicator--5d13cea0-ffa0-4628-bd6d-486202de0b81",
|
|
"indicator--5d13cea0-1198-454d-8ac7-47a902de0b81",
|
|
"indicator--5d13cea0-757c-4307-862a-426102de0b81",
|
|
"indicator--5d13cea0-8dc4-41c6-923d-48ea02de0b81",
|
|
"indicator--5d13cea0-8750-4ca7-b3ce-4a3e02de0b81",
|
|
"indicator--5d13cea0-bbcc-4f1d-8759-402f02de0b81",
|
|
"indicator--5d13cea0-d968-4560-a0c5-497f02de0b81",
|
|
"indicator--5d13cea0-2578-428d-952f-4ec802de0b81",
|
|
"indicator--5d13cea0-0e3c-470a-a561-4cc602de0b81",
|
|
"indicator--5d13cea0-8e08-44f2-8f40-45f702de0b81",
|
|
"indicator--5d13cea0-db8c-4b9f-b6f6-4f2502de0b81",
|
|
"indicator--5d13cea0-48d0-4275-90c6-428902de0b81",
|
|
"indicator--5d13cea0-078c-4f56-9b71-47e802de0b81",
|
|
"indicator--5d13cea0-8b04-45c5-b74e-420d02de0b81",
|
|
"indicator--5d13cea0-5f84-46d4-a5d1-4e6402de0b81",
|
|
"indicator--5d13cea0-5328-481c-94a9-4d1102de0b81",
|
|
"indicator--5d13cea0-d9f4-4dc6-8c7f-496002de0b81",
|
|
"indicator--5d13cea0-94d8-468c-9795-493f02de0b81",
|
|
"indicator--5d13cea0-5e4c-4545-9dee-4cc302de0b81",
|
|
"indicator--5d13cea0-b11c-41ba-a150-456302de0b81",
|
|
"indicator--5d13cea0-8bb8-48fb-844d-434b02de0b81",
|
|
"indicator--5d13cea0-ba34-42e3-bc66-4d9d02de0b81",
|
|
"indicator--5d13cea0-6460-4513-9446-408702de0b81",
|
|
"indicator--5d13cea0-ff34-4cc4-821d-45a702de0b81",
|
|
"indicator--5d13cea0-97d4-42fe-b87f-4fb402de0b81",
|
|
"indicator--5d13cea0-a2a8-46af-ac45-482002de0b81",
|
|
"indicator--5d13cea0-d2b4-40b6-a474-488b02de0b81",
|
|
"indicator--5d13cea0-9d94-4356-86b8-493202de0b81",
|
|
"indicator--5d13cea0-8398-4c32-9bb0-404002de0b81",
|
|
"indicator--5d13cea0-9b6c-449e-adf3-472402de0b81",
|
|
"indicator--5d13cea0-9f5c-409f-a580-407502de0b81",
|
|
"indicator--5d13cea0-dbf0-4824-b5e2-49d502de0b81",
|
|
"indicator--5d13cea0-8d50-4b8f-90c5-4b4102de0b81",
|
|
"indicator--5d13cea0-b890-417d-a73e-492002de0b81",
|
|
"indicator--5d13cea0-7474-4f9a-8996-4f2f02de0b81",
|
|
"indicator--5d13cea0-f454-47eb-82c8-424a02de0b81",
|
|
"indicator--5d13cea0-1be4-4e9b-9529-42bc02de0b81",
|
|
"indicator--5d13cea0-5f94-4e38-aeed-4ac602de0b81",
|
|
"indicator--5d13cea0-6180-4b8f-8dbd-4d1102de0b81",
|
|
"indicator--5d13cea0-57fc-41d7-b557-47c002de0b81",
|
|
"indicator--5d13cea1-ae60-4ab7-bdc6-4db602de0b81",
|
|
"indicator--5d13cea1-d9a0-4f1c-9ce7-4c5202de0b81",
|
|
"indicator--5d13cea1-1de0-48db-b355-460602de0b81",
|
|
"indicator--5d13cea1-2998-4d47-a348-432902de0b81",
|
|
"indicator--5d13cea1-ef90-4f3c-b128-452602de0b81",
|
|
"indicator--5d13cea1-66e0-401e-9302-4d1302de0b81",
|
|
"indicator--5d13cea1-0160-4072-a441-42e002de0b81",
|
|
"indicator--5d13cea1-0e54-4464-885a-4f4502de0b81",
|
|
"indicator--5d13cea1-7888-43ab-8222-40a202de0b81",
|
|
"indicator--5d13cea1-0e3c-4bd8-b54a-479e02de0b81",
|
|
"indicator--5d13cea1-c6b4-4be6-af1d-4f8302de0b81",
|
|
"indicator--5d13cea1-c70c-4a72-b20e-4b3302de0b81",
|
|
"indicator--5d13cea1-88c0-4e64-a95e-48ba02de0b81",
|
|
"indicator--5d13cea1-6450-49c1-8a7f-4cc902de0b81",
|
|
"indicator--5d13cea1-26e0-424b-9051-449c02de0b81",
|
|
"indicator--5d13cea1-0d84-4ba3-b2b2-47f002de0b81",
|
|
"indicator--5d13cea1-2bc4-44b7-a454-4f5402de0b81",
|
|
"indicator--5d13cea1-b8d8-4624-bda1-4c2602de0b81",
|
|
"indicator--5d13cea1-f354-4a4d-9a04-4ede02de0b81",
|
|
"indicator--5d13cea1-0ccc-47fd-b9cb-4b0802de0b81",
|
|
"indicator--5d13cea1-517c-4613-b265-446b02de0b81",
|
|
"indicator--5d13cea1-650c-4f1d-9e23-4ffa02de0b81",
|
|
"indicator--5d13cea1-648c-4d39-9493-406e02de0b81",
|
|
"indicator--5d13cea1-23fc-4171-a815-46fa02de0b81",
|
|
"indicator--5d13cea1-7ff4-45e1-8b5b-461a02de0b81",
|
|
"indicator--5d13cea1-f400-4a1e-bd9d-4b7302de0b81",
|
|
"indicator--5d13cea1-5188-4e62-9ce6-42ee02de0b81",
|
|
"indicator--5d13cea1-c8e0-4117-88b6-495502de0b81",
|
|
"indicator--5d13cea1-53b8-4678-9d14-49c102de0b81",
|
|
"indicator--5d13cea1-f4d4-41a9-9b23-4fe202de0b81",
|
|
"indicator--5d13cea1-318c-4af5-89b5-4fd702de0b81",
|
|
"indicator--5d13cea1-10e8-4e33-886d-467702de0b81",
|
|
"indicator--5d13cea1-ff80-491b-bd75-48d402de0b81",
|
|
"indicator--5d13cea1-e3f0-466e-8fbd-40f502de0b81",
|
|
"indicator--5d13cea1-37d8-4059-a55e-40c402de0b81",
|
|
"indicator--5d13cea1-9db8-4561-aa70-45ed02de0b81",
|
|
"indicator--5d13cea1-0f90-44ca-81ca-466302de0b81",
|
|
"indicator--5d13cea1-5c8c-4935-94bd-42e302de0b81",
|
|
"indicator--5d13cea1-0d24-4b11-a73d-4b1002de0b81",
|
|
"indicator--5d13cea1-8340-4330-b20c-424802de0b81",
|
|
"indicator--5d13cea1-3670-48c6-847c-433f02de0b81",
|
|
"indicator--5d13cea1-d35c-4bce-9449-412b02de0b81",
|
|
"indicator--5d13cea1-17b8-4b19-bfc3-49c502de0b81",
|
|
"indicator--5d13cea1-2d3c-4926-a848-4c0102de0b81",
|
|
"indicator--5d13cea1-1188-4ad8-89d7-43af02de0b81",
|
|
"indicator--5d13cea1-55a4-4679-847f-475b02de0b81",
|
|
"indicator--5d13cea1-801c-4dbb-98f5-4a2202de0b81",
|
|
"indicator--5d13cea1-8e58-4398-ba1a-459a02de0b81",
|
|
"indicator--5d13cea1-6b9c-45f3-9d91-413102de0b81",
|
|
"indicator--5d13cea1-5410-4db1-9f66-45ea02de0b81",
|
|
"indicator--5d13cea1-b064-4859-a6c3-462702de0b81",
|
|
"indicator--5d13cea1-d928-4e67-869d-48a202de0b81",
|
|
"indicator--5d13cea1-3794-4af1-863f-403f02de0b81",
|
|
"indicator--5d13cea1-7ef4-41ee-ba42-4d9602de0b81",
|
|
"indicator--5d13cea1-86c4-4305-bbfa-455e02de0b81",
|
|
"indicator--5d13cea1-0cdc-458b-96bd-478202de0b81",
|
|
"indicator--5d13cea1-5bbc-4c77-8171-44f902de0b81",
|
|
"indicator--5d13cea1-7c44-483f-96e4-4dfa02de0b81",
|
|
"indicator--5d13cea1-5f14-44f7-a0c5-4d2102de0b81",
|
|
"indicator--5d13cea1-4638-4eed-bb0e-4e7b02de0b81",
|
|
"indicator--5d13cea1-a1b4-47bc-820c-4ce502de0b81",
|
|
"indicator--5d13cea1-780c-417c-90ea-4cbf02de0b81",
|
|
"indicator--5d13cea1-0ca8-4ec5-a53b-4a6e02de0b81",
|
|
"indicator--5d13cea1-1f14-4444-9666-400102de0b81",
|
|
"indicator--5d13cea1-8d70-4dac-bc9d-47ed02de0b81",
|
|
"indicator--5d13cea1-8d1c-4a2d-a0d3-450e02de0b81",
|
|
"indicator--5d13cea1-8b38-49ec-905f-466002de0b81",
|
|
"indicator--5d13cea2-2e74-4cf2-a4d7-4acd02de0b81",
|
|
"indicator--5d13cea2-50a4-4019-8da7-430402de0b81",
|
|
"indicator--5d13cea2-6b68-4172-ad23-4d4002de0b81",
|
|
"indicator--5d13cea2-8f28-4888-bc55-49ea02de0b81",
|
|
"indicator--5d13cea2-5054-4c41-bbfe-401002de0b81",
|
|
"indicator--5d13cea2-1a74-431e-a020-4f9102de0b81",
|
|
"indicator--5d13cea2-91f4-4a79-a8f8-4f7f02de0b81",
|
|
"indicator--5d13ceb5-d078-4202-a4b0-47a802de0b81",
|
|
"indicator--5d13ceb6-5b64-4233-ae59-47ff02de0b81",
|
|
"indicator--5d13ceb6-add0-44c4-aa28-4e1302de0b81",
|
|
"indicator--5d13ceb6-2b2c-4f54-baf5-4b8d02de0b81",
|
|
"indicator--5d13ceb6-9314-463a-9be7-40c702de0b81",
|
|
"indicator--5d13ceb6-1ed0-4f24-9454-4bdb02de0b81",
|
|
"indicator--5d13ceb6-7978-49ec-89b1-4ac302de0b81",
|
|
"indicator--5d13ceb6-cc38-4f11-9fe1-426602de0b81",
|
|
"indicator--5d13ceb6-ea28-46e1-922c-440502de0b81",
|
|
"indicator--5d13ceb6-b56c-4aa0-9004-4d8c02de0b81",
|
|
"indicator--5d13ceb6-b4e4-4905-b4d2-457802de0b81",
|
|
"indicator--5d13ceb6-e108-457e-a1da-427002de0b81",
|
|
"indicator--5d13ceb6-ed18-4849-bd32-436d02de0b81",
|
|
"indicator--5d13ceb6-c5ec-40fd-b339-436f02de0b81",
|
|
"indicator--5d13ceb6-8968-414e-9cc5-464902de0b81",
|
|
"indicator--5d13ceb6-ca24-4c83-901d-43a902de0b81",
|
|
"indicator--5d13ceb6-c964-45f0-bdf6-49d502de0b81",
|
|
"indicator--5d13ceb6-dbd0-401c-9d52-4f0b02de0b81",
|
|
"indicator--5d13ceb6-5dc8-4c66-ab9d-498802de0b81",
|
|
"indicator--5d13ceb6-fb18-4b94-adb5-4c0e02de0b81",
|
|
"indicator--5d13ceb6-eff0-450f-a0bf-44cd02de0b81",
|
|
"indicator--5d13ceb6-b030-4a65-8cb3-4eca02de0b81",
|
|
"indicator--5d13ceb6-1b88-4126-8d07-40fb02de0b81",
|
|
"indicator--5d13ceb6-68f0-4c49-901d-47f802de0b81",
|
|
"indicator--5d13ced1-1670-4a38-bb07-4c8002de0b81",
|
|
"indicator--5d13ced1-c8dc-427e-aefa-4d0002de0b81",
|
|
"indicator--5d13cee5-eb7c-4e9a-9d4a-46fc02de0b81",
|
|
"observed-data--5d13cf12-511c-4239-b0a5-423d02de0b81",
|
|
"url--5d13cf12-511c-4239-b0a5-423d02de0b81",
|
|
"indicator--2f57498c-e927-41b9-a77c-eca067a9c40a",
|
|
"x-misp-object--3ac01012-63fb-4556-8e01-5878a4769e9f",
|
|
"relationship--71033b05-209a-4da3-828c-c26f64668d71"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"type:OSINT",
|
|
"osint:lifetime=\"perpetual\"",
|
|
"osint:certainty=\"50\"",
|
|
"misp-galaxy:malpedia=\"Ngioweb\"",
|
|
"malware_classification:malware-category=\"Botnet\"",
|
|
"ms-caro-malware-full:malware-platform=\"Linux\""
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--5d13ce1a-6cc8-4f93-91ac-67c602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:57:14.000Z",
|
|
"modified": "2019-06-26T19:57:14.000Z",
|
|
"labels": [
|
|
"misp:type=\"comment\"",
|
|
"misp:category=\"External analysis\""
|
|
],
|
|
"x_misp_category": "External analysis",
|
|
"x_misp_type": "comment",
|
|
"x_misp_value": "On May 27, 2019, Our Unknown Threat Detect System highlighted a suspicious ELF file, and till this day, the detection rate on VT is still only one with a very generic name. We determined that this is a Proxy Botnet, and it is a Linux version variant of the Win32.Ngioweb[1] malware. We named it Linux.Ngioweb. It shares a lot of code with Win32.Ngioweb, except that it has DGA features. We registered one of the DGA C2 domain names (enutofish-pronadimoful-multihitision.org) and was able to observe the Bot connections.\r\n\r\nIn addition, we have observed that Linux.Ngioweb malware has been implanted into a large number of WordPress Web servers.\r\n\r\nAlthough the Bot program is loaded with the privilege of the user group corresponding to the Web container, it still works and runs as Rotating Proxy node[2].\r\n\r\nWe don\u00e2\u20ac\u2122t know why the attacker runs this proxy botnet, but it is possible that everything goes through the proxy is being recorded by the attacker."
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-4c98-45df-a2ef-485202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'enutofish-pronadimoful-multihitision.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-0ed8-41f1-bf7f-40d302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'exaraxexese-macrobacaward-exafosuness.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-b130-4a29-9ad1-44ba02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'nonafudazage.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-8584-4143-b396-43d402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'demigelike.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-920c-4deb-9a61-4d0902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'emuvufehood.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-8a4c-44f4-9bea-40e602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'subolukobese.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-0ae0-4249-85be-4d3702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'inogepicor-prorarurument.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-842c-4c80-a02b-42fa02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'overahudulize-unazibezize-overuzozerish.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-235c-4bee-8114-485a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'imunolance-postodinenetn-antifipuketn.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-00e8-4815-8ea1-4ee202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'antizerolant-monogevudom.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-77dc-4c60-8f1f-494102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'transavecaful-transinenation-transikaduhern.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-2a94-42d0-ab9f-44e802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'subogonance.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-96fc-4fde-918e-4df102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'inoxodusor-misehupukism.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-2114-48c3-b506-453d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'devikoviward-semibazegily-copaxugage.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-90c4-4c7b-8a07-4b9e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'eniguzeless-inecimanable.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-07f8-4ae4-a599-4ba602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'subilebesion-irogipate.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-f1bc-4b9f-8acd-46f202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'colozosion-antigobunaful.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-eb20-4e37-9850-423102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'inudiduty-dezaviness.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-2708-4856-a9e8-443802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'irelizaring-enipulical-monovuxehossion.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-f10c-4921-9e86-469602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'ilenudavous-monoxoxapal-semimihupution.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-d7f8-42f3-bae5-482502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'ultrapadupize.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-e0fc-48da-ac18-4a3302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'covategal-dezakedify-enebugassion.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-0130-4f9e-a78f-422a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'transivesudom-macropimuship.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-3338-484f-87ae-428402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'rezolezation-transapupirify-seminecation.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-2108-4bb0-b24f-44c702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'macrolutoxous-overefimety.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-6270-49da-89f3-473102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'coxumumage-dexolalite.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-ffc0-4d25-9a4c-476902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'cotexafical-postirutuvian-emimimous.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-8d78-41b5-adad-454b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'copubuloness-misumusal-disokozian.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-afa8-4978-83e7-456e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'nonecuzuking-enekopofen-imakozity.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-eeb0-4a30-a0b0-4e9f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'dezohipal-ultrazebebive.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-eb48-46e6-b228-4de802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'cosazalike-antifoxirer-subudikic.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-bd54-4a3d-86e2-4ff402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'underotutilism-monoceraretion-underosociful.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-5904-4bb6-88ce-46c402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'overugiror.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-d570-4d33-bd42-4f3602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'emuzixucize.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-8440-4bd7-8025-463202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'disicevament-desizigasion-recadihuful.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-21f4-4b9d-837d-4d7e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'decehoward-microhikodely-overokerezant.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-428c-40dc-8b3c-460a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'microlasokadom-ultralarumous.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-5ccc-4606-97e9-4eab02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'minixecision-iruzaxuhood.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-b3c4-4157-8f1d-49f702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'profusonuty.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-019c-45bf-8ea5-4c3c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'multifipakency-conovofy-prorakikate.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-da3c-404c-8767-4c0d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'antiseramoment.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9d-0e18-46a2-9354-492402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:25.000Z",
|
|
"modified": "2019-06-26T19:59:25.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'postavutetn-emedarevous.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-5310-4512-ab1e-482202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'inolugoty-inidiverible.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-f1fc-4ea9-bf45-48da02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'prodipamament.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-b68c-40fc-9a46-4e4f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'overogobity-imivocurify-disovizution.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-59b8-4142-9386-4ec602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'decozaness-antihazation-overetalovical.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-851c-44a3-a3bc-443502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'nonesolafy.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-ca24-4c08-bde8-4b3902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'unihatosancy.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-6430-4bc8-a321-4e7502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'interiragocern-micropuxotion-transogorion.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-a9b8-4894-83e7-45b702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'seminamatity-enogibely.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-7714-42fd-8ed8-40af02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'inosebovion.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-e824-44e2-9498-452402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'exofifure-postirexument.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-bc10-4f9c-86cc-4bbb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'transirirenern-semizafunic-nonivubed.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-d3b4-47d1-b06b-441b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'enegizize-microtizobity.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-687c-4346-9eaf-4a0902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'macrohuseded-multipazaseship.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-58d0-40d2-a1f3-4b2702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'imefihured-macrohixuhood.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-8fd8-4f6d-b2df-461402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'microlulition-macrokiguxable.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-fd6c-40a9-b53e-49b202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'multizesumefy-emebefion.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-b3e0-4ce1-b4d7-4e0402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'underebelassion-postizoziless.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-e280-4bb4-ae81-4fd602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'dezuvazen.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-63f8-4a37-9f5e-4f8102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'decotusion-exexavihood-exevozebant.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-f704-4a0b-9e96-4c3f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'disuzepuly.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-4cfc-4cd4-8d49-4ca202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'inuviging-antizoluly.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-57f4-4622-9915-4ca702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'multisotiren-ilazufist.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-90cc-414a-ba97-4b2a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'predepussion.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-efec-4d71-b1ff-47f702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'inidozadom.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-7a28-4e36-8696-419f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'interikuhaful.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-32a0-46b7-b3ed-43ff02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'cozuheming.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-064c-48a7-8e3f-48f202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'multiruxuth.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-3758-48ff-be3d-450102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'monozogeced.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-7964-4ea4-ac98-4b8602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'mononoredom.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-a380-4539-9b16-410f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'postarubixage-monocinamety-overogefesal.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-e54c-42f9-a1a6-4ace02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'prebekokian-misadepepive-transilogify.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-acc4-4324-a747-436802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'monohatodom-cohotiship.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-d2e0-4908-b0eb-4a0902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'exebasusion.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-48e0-43d4-8032-432002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'unahodoness-emevuzeward-emuzeduness.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-eb04-4f13-8563-4de102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'exemidexous-underiposapite-unegatature.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-a560-4809-84ec-4c6202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'interocugopist-misugexadic-ilobipegency.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-fa74-4d6b-abf6-4f3702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'monokifomancy-misagefism-macrobepoth.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-3454-417c-af8a-442802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'antizekussion-minipusaral-copofuxoship.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-71b8-4d85-ad45-483d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'relutodom-comakitize.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-9064-427c-b4b1-46c102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'multikezusion.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-5dd0-4906-add4-4cd802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'emopumical-enohecical.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-0490-45c4-9b24-40d702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'semitegopish.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-ab6c-4e7a-9266-488f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'recepatission.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-55cc-453c-9278-493e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'inoluvary.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-ad70-400a-8451-4ee502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'seminitotuful.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-7a3c-4e76-ab38-4b9d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'interanubing-emelulotal-transugotuzern.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-ce5c-4e46-a6d6-4ad902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'subefehity-iledutession.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-25dc-4912-bcc9-4a1e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'ultrapapiten.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-0d38-44f1-8fb8-49fd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'transuvarusish-prozumoxety.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-3bb4-4ffd-a0d4-4aa702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'transisigern.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-23d8-483e-8e44-49ad02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'imirotiship-microhopulive-emotomeship.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-5c98-4bba-8fda-4c8802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'presefavution.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-713c-4711-9fa8-45a802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'enevifaking.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-fa58-4f6d-bd3b-4f3f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'misidogive-coxecovor-dexefoxan.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-dfac-434a-823e-414602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'overazadudom-deliromohood.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-5424-4ae8-98ad-4a6502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'emakanuward.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-8440-4b10-ac6d-452a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'emitohage-overasuhorure-antitipenoless.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-c288-4114-94da-462e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'ultrasesebible.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-82ec-41a2-a67e-4c1402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'multihadekite.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9e-5d2c-49c4-a88b-406502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:26.000Z",
|
|
"modified": "2019-06-26T19:59:26.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'iluvused-iravoxish.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-04e0-4093-9eb1-408d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'postobagoly-detovaward-unixohible.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-f774-43fc-ba90-403202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'underasusogen.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-581c-4915-990f-4c3002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'imovaman-multimihivoship-imeduxian.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-8e3c-4572-8c58-494102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'dedunuguhood.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-c67c-48e8-b5c3-461102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'prevukition.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-286c-434d-97ff-4ab402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'underehugavish.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-4bc0-4571-8ac3-431002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'misoxomelical-iluxubism.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-b118-4ff4-a602-45ee02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'microcolacoful-postabitition.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-5c88-4795-890d-4afd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'overurohely-overadolure-iruraluness.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-0194-45a8-a63d-4ac902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'unurodable-dekipuhic-postuxufous.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-d414-41e9-8c77-428402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'unitucihern-postadagen-imupuduth.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-c5a8-432b-9aba-4c7502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'imukokuship.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-d510-47a1-a6be-455702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'prenubocetion-ultrahahohood.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-fec0-4c53-a478-463302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'monofugition-underefogukic.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-41f8-447f-aa65-407e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'irofetufy.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-ad00-426c-8b53-480e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'irobigelike.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-0690-4a9a-9d50-4df702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'presifament.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-77d0-43a0-83d0-452f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'overetigution.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-dd98-470b-9a56-439e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'enuvopan-imixesoward-irarupipary.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-4b1c-47d8-ba21-4bcd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'inorofizian.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-52ac-4d0b-b81d-4fac02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'monopadecotion-multicecihood-imuzicasion.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-01d0-4b83-8380-47b102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'exofosehance-minimezazofy.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-677c-4862-a409-4f8202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'monokacofudom-inuvinable.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-90a4-4bdc-a501-4add02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'emisucosion-prohosexite-imorekusion.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-40fc-403e-bcb1-475a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'semiledoduly.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-1f54-4966-a0eb-4ab002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'multivapufy-promumuly-enonuben.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-c2f8-4acd-b9a5-459f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'subebodency.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-0a90-4380-8277-481c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'cofexasish-inodehed.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-40e4-48d5-a434-4b3102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'unutexupify-conofubusion.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-8f54-44ce-848d-4d4002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'misebonure-iluborize-rezericify.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-fa88-4140-86fc-404502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'exunaxian.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-64ac-4a50-9c86-4cc602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'colanizity-postosecive-nonuresible.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-9010-4728-b9b9-482302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'dedaliward-imipusen-inacaliver.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-e30c-47ea-b7a3-479c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'refusovize.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-f8f4-4e07-89bf-42d402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'monokuvission-transodigical-semihehamussion.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-2e9c-441e-a708-4be702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'transalavudom-multilavezuhood.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-3158-479d-abdd-401602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'exusizeward.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-4f50-4774-adf7-47f702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'unisimor.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-362c-4954-8c7a-4fac02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'minipihagaship.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-d554-426f-ad4d-41ef02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'recusigetion-transubeviful.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-98ac-4dab-a857-48f302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'multixizitufy-microtomuly-multixoleward.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-f524-487a-bc60-4aed02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'microxulodish-semibahoty.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-0e08-4e27-a14a-419602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'macrokunith-proxobivive.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-af80-454e-bfe8-45c502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'preginaxodom.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-6aa4-4261-8201-4f1602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'transimapeful-cotalision.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-c358-4328-a7fb-439602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'prefinazuly.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-ed2c-42d8-8c02-4bb402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'inucasazing-microhesunian-semidikokement.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-8934-402b-88e4-4dea02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'disitirotion-transekarenate.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-c564-4d62-a08c-4ad502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'unehihify-antimepavable-nonubovafy.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-4d9c-4442-8481-4a2c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'misunotelike-nonugidant.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-b26c-432c-ae0f-449202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'enogosudom-macrogekabive.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-9f90-4e91-bd81-4a2f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'postozokipetn-microdomobaly.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-97c8-4661-b2df-497502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'interunavission-ininibecist.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-863c-43e5-a039-46ba02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'microhinoler.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-ee2c-4e59-889e-4cb102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'prosihamish-noneguhaness.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-86f0-46aa-a85a-42e502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'preberekous-microkagibant-imemahal.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-8950-4bb0-98b6-41df02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'iletegifage.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-0bf4-4a15-a3ca-42a202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'emikuraran.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-ad74-46ab-baa0-481502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'overokigoty-ilecavish.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-4850-4b05-95ad-457b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'nonikofucable-postelihuzism-rexecigism.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-9d4c-49bd-be3b-480402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'imixifure.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-ee54-4bab-9746-483502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'minirabupeness-nonitefuward.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-2594-433e-8b2a-418202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'misasugegify-underazosuzish-exuvexezical.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-3fe4-4a6e-8e81-40b202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'multipocihood-monomuhunible.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ce9f-379c-4a7e-b8cd-435a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:27.000Z",
|
|
"modified": "2019-06-26T19:59:27.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'nonohacutancy-postuxikitan-microseditoless.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-5f44-46e7-90eb-477d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'overasobament.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-1860-4d40-81f2-4da902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'overulurotion.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-5968-45bd-ab62-469402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'disepadely-disuzirovor.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-5330-44b6-98b0-46c402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'repetepian-irelucify.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-84dc-4aeb-8a6e-498202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'enikobadom-postolixement.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-f8cc-4473-b84a-4b3002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'inunatogite-imoboraness.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-31e4-421f-b4d2-412602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'irimarefy.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-1d40-4ef2-9470-4af802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'monohiloless-demodefy.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-1ea0-4d20-89e2-4b6d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'previbetian-misunohigate.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-1a48-40fa-a3fa-413602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'multivunuhance-inabiber.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-2a40-4a16-9c86-442e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'semicasinaty-ilibaholy.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-9090-485e-9787-4e3c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'transupovetn-monozeruduless.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-63d4-4d9e-afb6-432d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'debapesetn-underisaxufical-imukugamism.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-b8ac-4dfe-ae03-4c6802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'multibibetefy.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-cb90-445a-bc40-40fc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'exanonish.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-1050-400d-b501-40f902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'interanulish-imazekalike-unisukugate.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-7c20-431b-ba83-4ff002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'inokevidage.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-f790-435d-9b4a-487402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'monofipuly-underubihal.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-5eb0-4836-ba2f-467602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'profobekify-subebobefy-exozufous.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-ffa0-4628-bd6d-486202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'macrovetecuship-emebudemical-underaxakament.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-1198-454d-8ac7-47a902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'demeficiward-retitisily-macromuvaward.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-757c-4307-862a-426102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'monosumuly-ilenusuty-dedabaness.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-8dc4-41c6-923d-48ea02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'exapofaran-postulusadify.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-8750-4ca7-b3ce-4a3e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'microhobament-postevofafity.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-bbcc-4f1d-8759-402f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'rebezusaly-overidirity-ultrahiseness.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-d968-4560-a0c5-497f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'unafacigage-transihicical-prebokity.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-2578-428d-952f-4ec802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'interazution-irudegufy-antinefoly.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-0e3c-470a-a561-4cc602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'minizecidish-macrolafukish-depovased.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-8e08-44f2-8f40-45f702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'derirepous-cosideship-semibiseless.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-db8c-4b9f-b6f6-4f2502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'overupazadity-irativorical.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-48d0-4275-90c6-428902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'coseviness-nonikunant-macrorasihood.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-078c-4f56-9b71-47e802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'nonesocern-macrotocipity.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-8b04-45c5-b74e-420d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'interuzoputy.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-5f84-46d4-a5d1-4e6402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'inicinic-misuluzan-ultrakuxuness.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-5328-481c-94a9-4d1102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'sububesebism-ultrabutath.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-d9f4-4dc6-8c7f-496002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'misacireship.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-94d8-468c-9795-493f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'exuxuburan-miniravuhood-exosoxen.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-5e4c-4545-9dee-4cc302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'macrozigahood-monosulopancy.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-b11c-41ba-a150-456302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'unegoping-detunusion-antimuruseful.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-8bb8-48fb-844d-434b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'macrozixaward-semivanimoly-underekutoty.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-ba34-42e3-bc66-4d9d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'ultratipuxian-inosilission-multiridith.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-6460-4513-9446-408702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'microtonagament.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-ff34-4cc4-821d-45a702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'cobemesion-redacocoful.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-97d4-42fe-b87f-4fb402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'disicogure-seminedasoly.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-a2a8-46af-ac45-482002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'dekacify.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-d2b4-40b6-a474-488b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'emegamilike-imupogazance-ultrapanacesion.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-9d94-4356-86b8-493202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'unocelibable-underelatucance.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-8398-4c32-9bb0-404002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'irodetolike-imisocatite-inecolafian.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-9b6c-449e-adf3-472402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'antikuzucen-irokarance-transitupikible.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-9f5c-409f-a580-407502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'semiralety-macrorobinant-ultrapixutency.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-dbf0-4824-b5e2-49d502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'transisomuless.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-8d50-4b8f-90c5-4b4102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'ilebigument-macroripakesion.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-b890-417d-a73e-492002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'profebarable.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-7474-4f9a-8996-4f2f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'nonixigefy-protisumiless.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-f454-47eb-82c8-424a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'corahicohood.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-1be4-4e9b-9529-42bc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'pretuvution-disafatutical-irehopuvese.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-5f94-4e38-aeed-4ac602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'miniregath-anticesuty-postudagily.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-6180-4b8f-8dbd-4d1102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'coguvilaship-recakubodom.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea0-57fc-41d7-b557-47c002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:28.000Z",
|
|
"modified": "2019-06-26T19:59:28.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'overipugoful-interizihing.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-ae60-4ab7-bdc6-4db602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'imipadaness-iralikoward-semitolicoly.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-d9a0-4f1c-9ce7-4c5202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'interupefity-semigiduly.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-1de0-48db-b355-460602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'macromosoriship.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-2998-4d47-a348-432902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'antigizepist.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-ef90-4f3c-b128-452602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'subuluhic-disomokate.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-66e0-401e-9302-4d1302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'irunucudor-macrogocudern-comoxizish.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-0160-4072-a441-42e002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'underedofobate.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-0e54-4464-885a-4f4502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'prolapuzern-progobutiful-dehifasion.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-7888-43ab-8222-40a202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'irucasian-macrofevasion.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-0e3c-4bd8-b54a-479e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'unogoxeness-semixocapency.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-c6b4-4be6-af1d-4f8302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'rehofocese.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-c70c-4a72-b20e-4b3302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'exebutian-interomifenism.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-88c0-4e64-a95e-48ba02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'subihefahood-subenopure-ultramoherihood.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-6450-49c1-8a7f-4cc902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'nonezogeward.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-26e0-424b-9051-449c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'exasavate-minidevilefy-subanevous.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-0d84-4ba3-b2b2-47f002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'enodenission-overucelancy-microvitasission.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-2bc4-44b7-a454-4f5402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'ultrafakitesion-misesuzahical-transanafetion.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-b8d8-4624-bda1-4c2602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'interinipoly-minimorovor-debininess.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-f354-4a4d-9a04-4ede02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'prenedelission-interugefable-repekosossion.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-0ccc-47fd-b9cb-4b0802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'postifozible-irololuship.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-517c-4613-b265-446b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'unozolasion.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-650c-4f1d-9e23-4ffa02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'unobelaness-prepifavety.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-648c-4d39-9493-406e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'cofukosable.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-23fc-4171-a815-46fa02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'iloletible-imakeben.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-7ff4-45e1-8b5b-461a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'ultraronupity.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-f400-4a1e-bd9d-4b7302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'minikisision-monobavunism-micronepavage.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-5188-4e62-9ce6-42ee02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'unufepaness-misedepugance.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-c8e0-4117-88b6-495502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'inafolage.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-53b8-4678-9d14-49c102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'semifolofic-unaraxal.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-f4d4-41a9-9b23-4fe202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'enerivosism-imenufanist-macrovonahood.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-318c-4af5-89b5-4fd702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'monobocution.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-10e8-4e33-886d-467702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'cosuzuness-prepurizor-unasulal.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-ff80-491b-bd75-48d402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'inopivic-antimaporary-subavocobive.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-e3f0-466e-8fbd-40f502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'covogidish-iletinassion.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-37d8-4059-a55e-40c402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'defizalike-unodatage-inarabevous.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-9db8-4561-aa70-45ed02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'unuvirisern-interusalosize-misucakiness.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-0f90-44ca-81ca-466302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'ireninenish-multicemath-prezucetussion.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-5c8c-4935-94bd-42e302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'interodekive.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-0d24-4b11-a73d-4b1002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'iramilahood-antirotuxary-misobegesion.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-8340-4330-b20c-424802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'multidafadite-postagoker.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-3670-48c6-847c-433f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'monobagehance.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-d35c-4bce-9449-412b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'emixuvidite-ilofikency-subolubify.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-17b8-4b19-bfc3-49c502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'postugihucency-emademify.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-2d3c-4926-a848-4c0102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'cotefehood-imocakitency.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-1188-4ad8-89d7-43af02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'enikavely-inosifuty-postaviraly.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-55a4-4679-847f-475b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'transabusossion.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-801c-4dbb-98f5-4a2202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'interitebure.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-8e58-4398-ba1a-459a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'unehumugage-ultraburosion.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-6b9c-45f3-9d91-413102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'subutavahen-inuhabish.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-5410-4db1-9f66-45ea02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'subifefer-devufoward-probelalance.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-b064-4859-a6c3-462702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'emefimafible.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-d928-4e67-869d-48a202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'ilibefudom.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-3794-4af1-863f-403f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'postemivaxage.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-7ef4-41ee-ba42-4d9602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'monofudumossion.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-86c4-4305-bbfa-455e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'inuxazodom-macrodexaxahood.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-0cdc-458b-96bd-478202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'semibugegetn-monohifutuly.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-5bbc-4c77-8171-44f902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'macromohazaship-subonohion-disonixucing.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-7c44-483f-96e4-4dfa02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'emosacekant-cokebohood-nonetakive.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-5f14-44f7-a0c5-4d2102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'interozecifist-antipinukity-multifekemath.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-4638-4eed-bb0e-4e7b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'refedomous-antifaliless.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-a1b4-47bc-820c-4ce502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'ultraxekevohood-nonizerosion-exovigant.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-780c-417c-90ea-4cbf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'interarogous-unuculuhood.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-0ca8-4ec5-a53b-4a6e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'semipulimian.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-1f14-4444-9666-400102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'monocalacaless.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-8d70-4dac-bc9d-47ed02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'disevolikency-retipegation.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-8d1c-4a2d-a0d3-450e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'cosituxath-misuxunor.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea1-8b38-49ec-905f-466002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'ultraporader-conapefy-prolobeziless.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea2-2e74-4cf2-a4d7-4acd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:29.000Z",
|
|
"modified": "2019-06-26T19:59:29.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'ilucasure.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea2-50a4-4019-8da7-430402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:30.000Z",
|
|
"modified": "2019-06-26T19:59:30.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'reletohite-misosulahood-antitedudom.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea2-6b68-4172-ad23-4d4002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:30.000Z",
|
|
"modified": "2019-06-26T19:59:30.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'minivucilous-inafafomism.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea2-8f28-4888-bc55-49ea02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:30.000Z",
|
|
"modified": "2019-06-26T19:59:30.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'monorifutaless-ilocamussion.name']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea2-5054-4c41-bbfe-401002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:30.000Z",
|
|
"modified": "2019-06-26T19:59:30.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'inohufohese-imufilahood-antifidupite.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea2-1a74-431e-a020-4f9102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:30.000Z",
|
|
"modified": "2019-06-26T19:59:30.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'emegemaxed-transigifuty-multitumolith.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cea2-91f4-4a79-a8f8-4f7f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:30.000Z",
|
|
"modified": "2019-06-26T19:59:30.000Z",
|
|
"description": "Stage-1 C2 (DGA)",
|
|
"pattern": "[domain-name:value = 'exotacible-denitokolike.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb5-d078-4202-a4b0-47a802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:49.000Z",
|
|
"modified": "2019-06-26T19:59:49.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '163.172.201.184']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb6-5b64-4233-ae59-47ff02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:50.000Z",
|
|
"modified": "2019-06-26T19:59:50.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '163.172.202.116']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb6-add0-44c4-aa28-4e1302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:50.000Z",
|
|
"modified": "2019-06-26T19:59:50.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.135.35.160']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb6-2b2c-4f54-baf5-4b8d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:50.000Z",
|
|
"modified": "2019-06-26T19:59:50.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.135.58.119']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb6-9314-463a-9be7-40c702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:50.000Z",
|
|
"modified": "2019-06-26T19:59:50.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.135.58.121']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb6-1ed0-4f24-9454-4bdb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:50.000Z",
|
|
"modified": "2019-06-26T19:59:50.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.135.58.123']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb6-7978-49ec-89b1-4ac302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:50.000Z",
|
|
"modified": "2019-06-26T19:59:50.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.135.58.124']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb6-cc38-4f11-9fe1-426602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:50.000Z",
|
|
"modified": "2019-06-26T19:59:50.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.196.194.209']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb6-ea28-46e1-922c-440502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:50.000Z",
|
|
"modified": "2019-06-26T19:59:50.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '51.254.57.83']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb6-b56c-4aa0-9004-4d8c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:50.000Z",
|
|
"modified": "2019-06-26T19:59:50.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '54.36.244.84']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb6-b4e4-4905-b4d2-457802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:50.000Z",
|
|
"modified": "2019-06-26T19:59:50.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '54.36.244.85']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb6-e108-457e-a1da-427002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:50.000Z",
|
|
"modified": "2019-06-26T19:59:50.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '54.36.244.91']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb6-ed18-4849-bd32-436d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:50.000Z",
|
|
"modified": "2019-06-26T19:59:50.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '91.121.36.212']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb6-c5ec-40fd-b339-436f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:50.000Z",
|
|
"modified": "2019-06-26T19:59:50.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '91.121.236.219']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb6-8968-414e-9cc5-464902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:50.000Z",
|
|
"modified": "2019-06-26T19:59:50.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '91.134.157.11']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb6-ca24-4c83-901d-43a902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:50.000Z",
|
|
"modified": "2019-06-26T19:59:50.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '92.222.151.63']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb6-c964-45f0-bdf6-49d502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:50.000Z",
|
|
"modified": "2019-06-26T19:59:50.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '145.239.108.241']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb6-dbd0-401c-9d52-4f0b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:50.000Z",
|
|
"modified": "2019-06-26T19:59:50.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '178.33.101.176']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb6-5dc8-4c66-ab9d-498802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:50.000Z",
|
|
"modified": "2019-06-26T19:59:50.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '178.33.101.177']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb6-fb18-4b94-adb5-4c0e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:50.000Z",
|
|
"modified": "2019-06-26T19:59:50.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '178.33.101.178']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb6-eff0-450f-a0bf-44cd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:50.000Z",
|
|
"modified": "2019-06-26T19:59:50.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '178.33.101.182']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb6-b030-4a65-8cb3-4eca02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:50.000Z",
|
|
"modified": "2019-06-26T19:59:50.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '188.165.5.123']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb6-1b88-4126-8d07-40fb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:50.000Z",
|
|
"modified": "2019-06-26T19:59:50.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '188.165.163.20']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ceb6-68f0-4c49-901d-47f802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T19:59:50.000Z",
|
|
"modified": "2019-06-26T19:59:50.000Z",
|
|
"description": "Stage-2 C2",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '193.70.73.115']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T19:59:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ced1-1670-4a38-bb07-4c8002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T20:00:17.000Z",
|
|
"modified": "2019-06-26T20:00:17.000Z",
|
|
"description": "Stage-1 C2 (Hardcoded IP)",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '169.239.128.166']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T20:00:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13ced1-c8dc-427e-aefa-4d0002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T20:00:17.000Z",
|
|
"modified": "2019-06-26T20:00:17.000Z",
|
|
"description": "Stage-1 C2 (Hardcoded IP)",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.244.149.73']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T20:00:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5d13cee5-eb7c-4e9a-9d4a-46fc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T20:00:37.000Z",
|
|
"modified": "2019-06-26T20:00:37.000Z",
|
|
"description": "Sample",
|
|
"pattern": "[file:hashes.MD5 = '827ecf99001fa66de513fe5281ce064d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T20:00:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5d13cf12-511c-4239-b0a5-423d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T20:01:21.000Z",
|
|
"modified": "2019-06-26T20:01:21.000Z",
|
|
"first_observed": "2019-06-26T20:01:21Z",
|
|
"last_observed": "2019-06-26T20:01:21Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5d13cf12-511c-4239-b0a5-423d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5d13cf12-511c-4239-b0a5-423d02de0b81",
|
|
"value": "https://blog.netlab.360.com/an-analysis-of-linux-ngioweb-botnet-en/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--2f57498c-e927-41b9-a77c-eca067a9c40a",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T20:00:57.000Z",
|
|
"modified": "2019-06-26T20:00:57.000Z",
|
|
"pattern": "[file:hashes.MD5 = '827ecf99001fa66de513fe5281ce064d' AND file:hashes.SHA1 = 'a92299b76c99a5915760e91f9bf52429415f4fb9' AND file:hashes.SHA256 = '0b213e1f92a2613f7cebff82e8ffbdae985e3446960bf4bd365b5751efa08b53']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-06-26T20:00:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--3ac01012-63fb-4556-8e01-5878a4769e9f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-06-26T20:00:58.000Z",
|
|
"modified": "2019-06-26T20:00:58.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-06-26T02:09:07",
|
|
"category": "Other",
|
|
"comment": "Sample",
|
|
"uuid": "91b3c9eb-8efa-40bd-b689-b4cfe6dbccda"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/0b213e1f92a2613f7cebff82e8ffbdae985e3446960bf4bd365b5751efa08b53/analysis/1561514947/",
|
|
"category": "Payload delivery",
|
|
"comment": "Sample",
|
|
"uuid": "9e372908-3354-43c6-bd9a-9e47c34057f1"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "10/54",
|
|
"category": "Payload delivery",
|
|
"comment": "Sample",
|
|
"uuid": "1d56cb36-2e8c-469b-bffa-7d0c941ba808"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--71033b05-209a-4da3-828c-c26f64668d71",
|
|
"created": "2019-06-26T20:00:58.000Z",
|
|
"modified": "2019-06-26T20:00:58.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--2f57498c-e927-41b9-a77c-eca067a9c40a",
|
|
"target_ref": "x-misp-object--3ac01012-63fb-4556-8e01-5878a4769e9f"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |