854 lines
No EOL
35 KiB
JSON
854 lines
No EOL
35 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--55e55686-ec88-4cba-a1bb-4b06950d210b",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-09-07T13:53:52.000Z",
|
|
"modified": "2015-09-07T13:53:52.000Z",
|
|
"name": "CthulhuSPRL.be",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--55e55686-ec88-4cba-a1bb-4b06950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-09-07T13:53:52.000Z",
|
|
"modified": "2015-09-07T13:53:52.000Z",
|
|
"name": "OSINT Defending the White Elephant by Arbor Networks",
|
|
"published": "2016-02-22T14:22:03Z",
|
|
"object_refs": [
|
|
"observed-data--55e556a3-f858-4d83-920d-441b950d210b",
|
|
"url--55e556a3-f858-4d83-920d-441b950d210b",
|
|
"observed-data--55e556a3-8258-41ef-aa7a-4f72950d210b",
|
|
"url--55e556a3-8258-41ef-aa7a-4f72950d210b",
|
|
"indicator--55ed81ed-d74c-4b1f-8d4f-4240950d210b",
|
|
"indicator--55ed81ed-b204-43b3-9913-4a8b950d210b",
|
|
"indicator--55ed81ee-0dc0-4a3b-a20d-47fa950d210b",
|
|
"indicator--55ed81ee-cab8-4e54-b7d6-48e2950d210b",
|
|
"indicator--55ed81ee-3418-4748-98de-4105950d210b",
|
|
"indicator--55ed81ee-7418-499d-831e-41ee950d210b",
|
|
"indicator--55ed81ef-01a8-4f78-afd1-41e1950d210b",
|
|
"indicator--55ed81ef-c124-4d42-b9dc-4187950d210b",
|
|
"indicator--55ed81ef-9e74-437b-9020-49df950d210b",
|
|
"indicator--55ed81f0-4f6c-491b-af5b-4306950d210b",
|
|
"indicator--55ed81f0-81e4-439f-b406-4266950d210b",
|
|
"indicator--55ed81f0-ab70-4a2a-b1fb-4916950d210b",
|
|
"indicator--55ed81f1-8bf8-4ea9-97db-4718950d210b",
|
|
"indicator--55ed81f1-0f6c-483e-b0c3-414f950d210b",
|
|
"indicator--55ed81f1-bf34-4d1c-899d-4b62950d210b",
|
|
"indicator--55ed96f0-b30c-48a1-a1ce-0275950d210b",
|
|
"indicator--55ed96f1-d66c-41cd-b21f-0275950d210b",
|
|
"indicator--55ed96f1-3fc0-4c86-81e6-0275950d210b",
|
|
"indicator--55ed96f1-ec8c-4dfb-b51e-0275950d210b",
|
|
"indicator--56c6a917-90a4-4b00-b8bf-c650950d210f",
|
|
"indicator--56c6a919-7e9c-4a1c-ab5f-c653950d210f",
|
|
"indicator--56c6a91b-2a68-41f2-a32a-599e950d210f",
|
|
"indicator--56c6a91d-8820-47ee-b2ac-c652950d210f",
|
|
"indicator--56c6a91f-538c-4eac-b354-599d950d210f",
|
|
"indicator--56c6a921-9e6c-4b19-85c3-59a4950d210f",
|
|
"indicator--56c6a918-da80-4b55-b413-c652950d210f",
|
|
"indicator--56c6a91a-e36c-49eb-a974-5f51950d210f",
|
|
"indicator--56c6a91c-b994-4d5a-88ed-435b950d210f",
|
|
"indicator--56c6a91e-b4a8-4a9a-a326-c654950d210f",
|
|
"indicator--56c6a920-8184-4d43-b7f5-45ef950d210f",
|
|
"indicator--56c6a921-afc0-47e3-94f3-599c950d210f"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"type:OSINT"
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--55e556a3-f858-4d83-920d-441b950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-09-01T07:41:23.000Z",
|
|
"modified": "2015-09-01T07:41:23.000Z",
|
|
"first_observed": "2015-09-01T07:41:23Z",
|
|
"last_observed": "2015-09-01T07:41:23Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--55e556a3-f858-4d83-920d-441b950d210b"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--55e556a3-f858-4d83-920d-441b950d210b",
|
|
"value": "https://asert.arbornetworks.com/defending-the-white-elephant/"
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--55e556a3-8258-41ef-aa7a-4f72950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-09-01T07:41:23.000Z",
|
|
"modified": "2015-09-01T07:41:23.000Z",
|
|
"first_observed": "2015-09-01T07:41:23Z",
|
|
"last_observed": "2015-09-01T07:41:23Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--55e556a3-8258-41ef-aa7a-4f72950d210b"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--55e556a3-8258-41ef-aa7a-4f72950d210b",
|
|
"value": "http://pages.arbornetworks.com/rs/082-KNA-087/images/ASERT%20Threat%20Intelligence%20Brief%202015-05%20PlugX%20Threat%20Activity%20in%20Myanmar.pdf"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--55ed81ed-d74c-4b1f-8d4f-4240950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-09-07T12:24:13.000Z",
|
|
"modified": "2015-09-07T12:24:13.000Z",
|
|
"pattern": "[file:hashes.MD5 = '1c7fafe58caf55568bd5f28cae1c18fd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-09-07T12:24:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--55ed81ed-b204-43b3-9913-4a8b950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-09-07T12:24:13.000Z",
|
|
"modified": "2015-09-07T12:24:13.000Z",
|
|
"pattern": "[file:hashes.MD5 = '1e36a853bc0b1d111ce726a508bc1a86']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-09-07T12:24:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--55ed81ee-0dc0-4a3b-a20d-47fa950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-09-07T12:24:14.000Z",
|
|
"modified": "2015-09-07T12:24:14.000Z",
|
|
"pattern": "[file:hashes.MD5 = '532f4c671a19145cf19c34d18138da63']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-09-07T12:24:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--55ed81ee-cab8-4e54-b7d6-48e2950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-09-07T12:24:14.000Z",
|
|
"modified": "2015-09-07T12:24:14.000Z",
|
|
"pattern": "[file:hashes.MD5 = '5ee5df9a5f4d16de3f880740db884f69']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-09-07T12:24:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--55ed81ee-3418-4748-98de-4105950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-09-07T12:24:14.000Z",
|
|
"modified": "2015-09-07T12:24:14.000Z",
|
|
"pattern": "[file:hashes.MD5 = '69754b86021d3daa658da15579b8f08a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-09-07T12:24:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--55ed81ee-7418-499d-831e-41ee950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-09-07T12:24:14.000Z",
|
|
"modified": "2015-09-07T12:24:14.000Z",
|
|
"pattern": "[file:hashes.MD5 = '78a9897344d756701d4674c7f559610a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-09-07T12:24:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--55ed81ef-01a8-4f78-afd1-41e1950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-09-07T12:24:15.000Z",
|
|
"modified": "2015-09-07T12:24:15.000Z",
|
|
"pattern": "[file:hashes.MD5 = '809976f3aa0ffd6860056be3b66d5092']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-09-07T12:24:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--55ed81ef-c124-4d42-b9dc-4187950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-09-07T12:24:15.000Z",
|
|
"modified": "2015-09-07T12:24:15.000Z",
|
|
"pattern": "[file:hashes.MD5 = '884d46c01c762ad6ddd2759fd921bf71']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-09-07T12:24:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--55ed81ef-9e74-437b-9020-49df950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-09-07T12:24:15.000Z",
|
|
"modified": "2015-09-07T12:24:15.000Z",
|
|
"pattern": "[file:hashes.MD5 = '9aceefb76c2e227c651ef6a035461b5c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-09-07T12:24:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--55ed81f0-4f6c-491b-af5b-4306950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-09-07T12:24:16.000Z",
|
|
"modified": "2015-09-07T12:24:16.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'a1c0c364e02b3b1e0e7b8ce89b611b53']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-09-07T12:24:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--55ed81f0-81e4-439f-b406-4266950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-09-07T12:24:16.000Z",
|
|
"modified": "2015-09-07T12:24:16.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'a30262bf36b3023ef717b6e23e21bd30']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-09-07T12:24:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--55ed81f0-ab70-4a2a-b1fb-4916950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-09-07T12:24:16.000Z",
|
|
"modified": "2015-09-07T12:24:16.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'd055518ad14f3d6c40aa6ced6a2d05f2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-09-07T12:24:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--55ed81f1-8bf8-4ea9-97db-4718950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-09-07T12:24:17.000Z",
|
|
"modified": "2015-09-07T12:24:17.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'd0c5410140c15c8d148437f0f7eabcf7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-09-07T12:24:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--55ed81f1-0f6c-483e-b0c3-414f950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-09-07T12:24:17.000Z",
|
|
"modified": "2015-09-07T12:24:17.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'e2eddf6e7233ab52ad29d8f63b1727cd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-09-07T12:24:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--55ed81f1-bf34-4d1c-899d-4b62950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-09-07T12:24:17.000Z",
|
|
"modified": "2015-09-07T12:24:17.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'eeb631127f1b9fb3d13d209d8e675634']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-09-07T12:24:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--55ed96f0-b30c-48a1-a1ce-0275950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-09-07T13:53:52.000Z",
|
|
"modified": "2015-09-07T13:53:52.000Z",
|
|
"pattern": "[domain-name:value = 'usacia.websecexp.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-09-07T13:53:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--55ed96f1-d66c-41cd-b21f-0275950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-09-07T13:53:53.000Z",
|
|
"modified": "2015-09-07T13:53:53.000Z",
|
|
"pattern": "[domain-name:value = 'webhttps.websecexp.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-09-07T13:53:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--55ed96f1-3fc0-4c86-81e6-0275950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-09-07T13:53:53.000Z",
|
|
"modified": "2015-09-07T13:53:53.000Z",
|
|
"pattern": "[domain-name:value = 'usafbi.websecexp.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-09-07T13:53:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--55ed96f1-ec8c-4dfb-b51e-0275950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-09-07T13:53:53.000Z",
|
|
"modified": "2015-09-07T13:53:53.000Z",
|
|
"pattern": "[domain-name:value = 'appeur.gnway.cc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-09-07T13:53:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56c6a917-90a4-4b00-b8bf-c650950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-19T05:33:11.000Z",
|
|
"modified": "2016-02-19T05:33:11.000Z",
|
|
"description": "Automatically added (via 1c7fafe58caf55568bd5f28cae1c18fd)",
|
|
"pattern": "[file:hashes.SHA1 = '6ce4f6fe5433d803b84c5d4094a5f10220653b8e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-19T05:33:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56c6a919-7e9c-4a1c-ab5f-c653950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-19T05:33:13.000Z",
|
|
"modified": "2016-02-19T05:33:13.000Z",
|
|
"description": "Automatically added (via 78a9897344d756701d4674c7f559610a)",
|
|
"pattern": "[file:hashes.SHA1 = 'c63d6a0581c6b8b3ea52555e1b4832a8730a21de']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-19T05:33:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56c6a91b-2a68-41f2-a32a-599e950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-19T05:33:15.000Z",
|
|
"modified": "2016-02-19T05:33:15.000Z",
|
|
"description": "Automatically added (via 884d46c01c762ad6ddd2759fd921bf71)",
|
|
"pattern": "[file:hashes.SHA1 = 'd201b130232e0ea411daa23c1ba2892fe6468712']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-19T05:33:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56c6a91d-8820-47ee-b2ac-c652950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-19T05:33:17.000Z",
|
|
"modified": "2016-02-19T05:33:17.000Z",
|
|
"description": "Automatically added (via a30262bf36b3023ef717b6e23e21bd30)",
|
|
"pattern": "[file:hashes.SHA1 = '47822c1392631db74f342edd5c73c7557e74a21b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-19T05:33:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56c6a91f-538c-4eac-b354-599d950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-19T05:33:19.000Z",
|
|
"modified": "2016-02-19T05:33:19.000Z",
|
|
"description": "Automatically added (via e2eddf6e7233ab52ad29d8f63b1727cd)",
|
|
"pattern": "[file:hashes.SHA1 = 'd533333381cd387581955085aefddfd68a50c8e2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-19T05:33:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56c6a921-9e6c-4b19-85c3-59a4950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-19T05:33:21.000Z",
|
|
"modified": "2016-02-19T05:33:21.000Z",
|
|
"description": "Automatically added (via eeb631127f1b9fb3d13d209d8e675634)",
|
|
"pattern": "[file:hashes.SHA1 = '7b1e620f9d6d3069b8fee92758e26ecf67a2a04b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-19T05:33:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56c6a918-da80-4b55-b413-c652950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-19T05:33:12.000Z",
|
|
"modified": "2016-02-19T05:33:12.000Z",
|
|
"description": "Automatically added (via 1c7fafe58caf55568bd5f28cae1c18fd)",
|
|
"pattern": "[file:hashes.SHA256 = '51df28538d8197dca53d53844f20e0de63658cfb71d57e9a9bd99b6a5fc2c54b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-19T05:33:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56c6a91a-e36c-49eb-a974-5f51950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-19T05:33:14.000Z",
|
|
"modified": "2016-02-19T05:33:14.000Z",
|
|
"description": "Automatically added (via 78a9897344d756701d4674c7f559610a)",
|
|
"pattern": "[file:hashes.SHA256 = '06c5e6446fd7391722441117fb4b3f2170d808872964a94fce2242eb5ab8572d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-19T05:33:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56c6a91c-b994-4d5a-88ed-435b950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-19T05:33:16.000Z",
|
|
"modified": "2016-02-19T05:33:16.000Z",
|
|
"description": "Automatically added (via 884d46c01c762ad6ddd2759fd921bf71)",
|
|
"pattern": "[file:hashes.SHA256 = '3124fcb79da0bdf9d0d1995e37b06f7929d83c1c4b60e38c104743be71170efe']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-19T05:33:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56c6a91e-b4a8-4a9a-a326-c654950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-19T05:33:18.000Z",
|
|
"modified": "2016-02-19T05:33:18.000Z",
|
|
"description": "Automatically added (via a30262bf36b3023ef717b6e23e21bd30)",
|
|
"pattern": "[file:hashes.SHA256 = 'ac5db170487d1a789e8b5fb1cb52f7b84086b1768b25083c50309a88a7229545']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-19T05:33:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56c6a920-8184-4d43-b7f5-45ef950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-19T05:33:20.000Z",
|
|
"modified": "2016-02-19T05:33:20.000Z",
|
|
"description": "Automatically added (via e2eddf6e7233ab52ad29d8f63b1727cd)",
|
|
"pattern": "[file:hashes.SHA256 = '7558ae598348f508ee656312a214aa24073258aebc95d9a50e7a5588be2a380a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-19T05:33:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56c6a921-afc0-47e3-94f3-599c950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-19T05:33:21.000Z",
|
|
"modified": "2016-02-19T05:33:21.000Z",
|
|
"description": "Automatically added (via eeb631127f1b9fb3d13d209d8e675634)",
|
|
"pattern": "[file:hashes.SHA256 = 'c2804080c3f45e8232b3e955611f56c9ba513a7845ddad56a588c4191d139990']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-19T05:33:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |