adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/e8141fc5-e84d-4aeb-8879-f71caffab35a.json

355 lines
No EOL
14 KiB
JSON
Raw Blame History

{
"type": "bundle",
"id": "bundle--e8141fc5-e84d-4aeb-8879-f71caffab35a",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-08-29T13:44:26.000Z",
"modified": "2023-08-29T13:44:26.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--e8141fc5-e84d-4aeb-8879-f71caffab35a",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-08-29T13:44:26.000Z",
"modified": "2023-08-29T13:44:26.000Z",
"name": "FIN8-LINKED ACTOR TARGETS CITRIX NETSCALER SYSTEMS",
"published": "2023-08-29T13:45:05Z",
"object_refs": [
"indicator--14f20043-2e62-43b0-92ff-f0aac97f3bd6",
"indicator--50beeb77-22e3-408b-b1a7-081e17e4d087",
"indicator--4efab437-35ff-4c9d-8e6b-448f06df320d",
"indicator--9767d317-7f96-4d64-aae1-3c8102e08226",
"indicator--bb3747d5-07b1-44fd-8ecf-84807514b5bc",
"indicator--71bb09f8-b274-403b-98c0-e15e46c62382",
"indicator--8d152d5d-8d23-4791-bf82-9583f51eb30e",
"indicator--30767882-5846-4f4b-9887-5faac3f0aec0",
"indicator--d6756678-c4d9-4c96-ac80-9477ac1a28e1",
"indicator--d287851e-8762-4e63-96bc-b5ec5e9e93bf",
"x-misp-object--04d8530b-7834-425b-8db9-83c89bf9712b",
"x-misp-object--d18c50e6-70d7-4ddf-8f19-67b233b1b9df"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"type:OSINT",
"osint:lifetime=\"perpetual\"",
"osint:certainty=\"50\"",
"tlp:clear",
"misp-galaxy:malpedia=\"Unidentified 103 (FIN8)\"",
"misp-galaxy:mitre-enterprise-attack-intrusion-set=\"FIN8 - G0061\"",
"misp-galaxy:mitre-intrusion-set=\"FIN8 - G0061\"",
"misp-galaxy:threat-actor=\"FIN8\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--14f20043-2e62-43b0-92ff-f0aac97f3bd6",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-08-29T13:42:56.000Z",
"modified": "2023-08-29T13:42:56.000Z",
"pattern": "[file:hashes.SHA256 = 'ec89ec41f0e0a7e60fa3f6267d0197c7fa8568e11a2c564f6d59855ddd9e1d64']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-08-29T13:42:56Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--50beeb77-22e3-408b-b1a7-081e17e4d087",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-08-29T13:42:56.000Z",
"modified": "2023-08-29T13:42:56.000Z",
"pattern": "[file:hashes.SHA256 = 'bb28ba8d838c8eefdd5ae1e23d5872968d84e8cb86bf292b2c3bf4c84ad7dbd0']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-08-29T13:42:56Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--4efab437-35ff-4c9d-8e6b-448f06df320d",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-08-29T13:42:56.000Z",
"modified": "2023-08-29T13:42:56.000Z",
"pattern": "[file:hashes.SHA256 = '94f09d01e1397ca80c71b488b8775acfe2776b5ab42e9a54547d9e5f58caf11a']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-08-29T13:42:56Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--9767d317-7f96-4d64-aae1-3c8102e08226",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-08-29T13:42:56.000Z",
"modified": "2023-08-29T13:42:56.000Z",
"pattern": "[file:hashes.SHA256 = '857d6f7e4b96738adb9cc023e2c504362fe8b73bdce422f8f8cb791dd6ac2449']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-08-29T13:42:56Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--bb3747d5-07b1-44fd-8ecf-84807514b5bc",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-08-29T13:42:56.000Z",
"modified": "2023-08-29T13:42:56.000Z",
"pattern": "[file:hashes.SHA256 = '383df272841f9a677ee03f6f553bc6cf3197427d792dc9f86b7fb1911dc83d71']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-08-29T13:42:56Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--71bb09f8-b274-403b-98c0-e15e46c62382",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-08-29T13:42:56.000Z",
"modified": "2023-08-29T13:42:56.000Z",
"pattern": "[file:hashes.SHA256 = '2d53aaa2638f9a986779b9e36a7b6dfdaddf3cc06698f4aa9f558c1a0591dc9a']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-08-29T13:42:56Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--8d152d5d-8d23-4791-bf82-9583f51eb30e",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-08-29T13:42:56.000Z",
"modified": "2023-08-29T13:42:56.000Z",
"pattern": "[file:hashes.SHA256 = '20b375ac4487a5955d4b0dd0a600e851d1e455a30c3f8babd0e7e1e97d11a073']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-08-29T13:42:56Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--30767882-5846-4f4b-9887-5faac3f0aec0",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-08-29T13:42:57.000Z",
"modified": "2023-08-29T13:42:57.000Z",
"pattern": "[file:hashes.SHA256 = '03657d8f9dcb49a690d4b07da4f49ead58000efe458ca3ba7f878233dd25e391']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-08-29T13:42:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--d6756678-c4d9-4c96-ac80-9477ac1a28e1",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-08-29T13:43:51.000Z",
"modified": "2023-08-29T13:43:51.000Z",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '85.239.53.49']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-08-29T13:43:51Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--d287851e-8762-4e63-96bc-b5ec5e9e93bf",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-08-29T13:43:51.000Z",
"modified": "2023-08-29T13:43:51.000Z",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '45.66.248.189']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-08-29T13:43:51Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--04d8530b-7834-425b-8db9-83c89bf9712b",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-08-29T13:42:15.000Z",
"modified": "2023-08-29T13:42:15.000Z",
"labels": [
"misp:name=\"report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "link",
"object_relation": "link",
"value": "https://github.com/sophoslabs/IoCs/blob/master/2023-08-25%20Citrix%20CVE-2023-3519%20attacks.csv",
"category": "External analysis",
"uuid": "23aa69bc-7ae8-46fc-b56c-4259becdfb82"
},
{
"type": "text",
"object_relation": "type",
"value": "IoC-list",
"category": "Other",
"uuid": "22abc447-5527-43fc-ac45-f4b4de056416"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "report"
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--d18c50e6-70d7-4ddf-8f19-67b233b1b9df",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-08-29T13:42:36.000Z",
"modified": "2023-08-29T13:42:36.000Z",
"labels": [
"misp:name=\"report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "link",
"object_relation": "link",
"value": "https://securityaffairs.com/150028/hacking/fin8-citrix-netscaler.html",
"category": "External analysis",
"uuid": "3596e269-9e73-423f-b31a-b69988a2b29c"
},
{
"type": "text",
"object_relation": "type",
"value": "Blog",
"category": "Other",
"uuid": "ca88fda9-df20-49b6-be1c-b98cf066f145"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "report"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue View git blame Copy permalink