From bfbaa70ee3a370fed076b650e110db7083f83f9c Mon Sep 17 00:00:00 2001 From: Christophe Vandeplas Date: Thu, 20 Dec 2018 13:24:08 +0100 Subject: [PATCH] sort describeTypes.json output This is needed for the compatibility with the gen_misp_types_categories.py script. Data was sorted using the order_dict function of the gen_misp_types_categories script. --- pymisp/data/describeTypes.json | 816 ++++++++++++++++----------------- 1 file changed, 408 insertions(+), 408 deletions(-) diff --git a/pymisp/data/describeTypes.json b/pymisp/data/describeTypes.json index 1d4de59..6db79e1 100644 --- a/pymisp/data/describeTypes.json +++ b/pymisp/data/describeTypes.json @@ -1,48 +1,44 @@ { "result": { "categories": [ - "Internal reference", - "Targeting data", "Antivirus detection", - "Payload delivery", "Artifacts dropped", - "Payload installation", - "Persistence mechanism", - "Network activity", - "Payload type", "Attribution", "External analysis", "Financial fraud", - "Support Tool", - "Social network", + "Internal reference", + "Network activity", + "Other", + "Payload delivery", + "Payload installation", + "Payload type", + "Persistence mechanism", "Person", - "Other" + "Social network", + "Support Tool", + "Targeting data" ], "category_type_mappings": { "Antivirus detection": [ - "link", - "comment", - "text", - "hex", "attachment", - "other" + "comment", + "hex", + "link", + "other", + "text" ], "Artifacts dropped": [ - "md5", - "sha1", - "sha224", - "sha256", - "sha384", - "sha512", - "sha512/224", - "sha512/256", - "ssdeep", - "imphash", - "impfuzzy", + "attachment", "authentihash", "cdhash", + "comment", + "cookie", "filename", + "filename|authentihash", + "filename|impfuzzy", + "filename|imphash", "filename|md5", + "filename|pehash", "filename|sha1", "filename|sha224", "filename|sha256", @@ -50,261 +46,196 @@ "filename|sha512", "filename|sha512/224", "filename|sha512/256", - "filename|authentihash", "filename|ssdeep", "filename|tlsh", - "filename|imphash", - "filename|impfuzzy", - "filename|pehash", - "regkey", - "regkey|value", + "gene", + "hex", + "impfuzzy", + "imphash", + "malware-sample", + "md5", + "mime-type", + "mutex", + "named pipe", + "other", "pattern-in-file", "pattern-in-memory", "pdb", - "stix2-pattern", - "yara", + "regkey", + "regkey|value", + "sha1", + "sha224", + "sha256", + "sha384", + "sha512", + "sha512/224", + "sha512/256", "sigma", - "attachment", - "malware-sample", - "named pipe", - "mutex", - "windows-scheduled-task", - "windows-service-name", - "windows-service-displayname", - "comment", + "ssdeep", + "stix2-pattern", "text", - "hex", - "x509-fingerprint-sha1", + "windows-scheduled-task", + "windows-service-displayname", + "windows-service-name", "x509-fingerprint-md5", + "x509-fingerprint-sha1", "x509-fingerprint-sha256", - "other", - "cookie", - "gene", - "mime-type" + "yara" ], "Attribution": [ - "threat-actor", - "campaign-name", "campaign-id", - "whois-registrant-phone", + "campaign-name", + "comment", + "dns-soa-email", + "other", + "text", + "threat-actor", + "whois-creation-date", "whois-registrant-email", "whois-registrant-name", "whois-registrant-org", + "whois-registrant-phone", "whois-registrar", - "whois-creation-date", - "comment", - "text", - "x509-fingerprint-sha1", "x509-fingerprint-md5", - "x509-fingerprint-sha256", - "other", - "dns-soa-email" + "x509-fingerprint-sha1", + "x509-fingerprint-sha256" ], "External analysis": [ - "md5", - "sha1", - "sha256", + "AS", + "attachment", + "bro", + "comment", + "cortex", + "domain", + "domain|ip", "filename", "filename|md5", "filename|sha1", "filename|sha256", - "ip-src", + "github-repository", + "hostname", "ip-dst", "ip-dst|port", + "ip-src", "ip-src|port", + "link", "mac-address", "mac-eui-64", - "hostname", - "domain", - "domain|ip", - "url", - "user-agent", + "malware-sample", + "md5", + "other", + "pattern-in-file", + "pattern-in-memory", + "pattern-in-traffic", "regkey", "regkey|value", - "AS", + "sha1", + "sha256", "snort", - "bro", - "pattern-in-file", - "pattern-in-traffic", - "pattern-in-memory", - "vulnerability", - "attachment", - "malware-sample", - "link", - "comment", "text", - "x509-fingerprint-sha1", + "url", + "user-agent", + "vulnerability", "x509-fingerprint-md5", - "x509-fingerprint-sha256", - "github-repository", - "other", - "cortex" + "x509-fingerprint-sha1", + "x509-fingerprint-sha256" ], "Financial fraud": [ - "btc", - "xmr", - "iban", - "bic", - "bank-account-nr", "aba-rtn", + "bank-account-nr", + "bic", "bin", + "btc", "cc-number", - "prtn", - "phone-number", "comment", - "text", + "hex", + "iban", "other", - "hex" + "phone-number", + "prtn", + "text", + "xmr" ], "Internal reference": [ - "text", - "link", "comment", + "hex", + "link", "other", - "hex" + "text" ], "Network activity": [ - "ip-src", - "ip-dst", - "ip-dst|port", - "ip-src|port", - "port", - "hostname", + "AS", + "attachment", + "bro", + "comment", + "cookie", "domain", "domain|ip", - "mac-address", - "mac-eui-64", "email-dst", - "url", - "uri", - "user-agent", - "http-method", - "AS", - "snort", - "pattern-in-file", - "stix2-pattern", - "pattern-in-traffic", - "attachment", - "comment", - "text", - "x509-fingerprint-md5", - "x509-fingerprint-sha1", - "x509-fingerprint-sha256", - "other", "hex", - "cookie", + "hostname", "hostname|port", - "bro" - ], - "Other": [ - "comment", - "text", - "other", - "size-in-bytes", - "counter", - "datetime", - "cpe", - "port", - "float", - "hex", - "phone-number", - "boolean" - ], - "Payload delivery": [ - "md5", - "sha1", - "sha224", - "sha256", - "sha384", - "sha512", - "sha512/224", - "sha512/256", - "ssdeep", - "imphash", - "impfuzzy", - "authentihash", - "pehash", - "tlsh", - "cdhash", - "filename", - "filename|md5", - "filename|sha1", - "filename|sha224", - "filename|sha256", - "filename|sha384", - "filename|sha512", - "filename|sha512/224", - "filename|sha512/256", - "filename|authentihash", - "filename|ssdeep", - "filename|tlsh", - "filename|imphash", - "filename|impfuzzy", - "filename|pehash", - "mac-address", - "mac-eui-64", - "ip-src", + "http-method", "ip-dst", "ip-dst|port", + "ip-src", "ip-src|port", - "hostname", - "domain", - "email-src", - "email-dst", - "email-subject", - "email-attachment", - "email-body", - "url", - "user-agent", - "AS", + "mac-address", + "mac-eui-64", + "other", "pattern-in-file", "pattern-in-traffic", + "port", + "snort", "stix2-pattern", - "yara", - "sigma", - "mime-type", - "attachment", - "malware-sample", - "link", - "malware-type", - "comment", "text", - "hex", - "vulnerability", - "x509-fingerprint-sha1", + "uri", + "url", + "user-agent", "x509-fingerprint-md5", - "x509-fingerprint-sha256", - "other", - "hostname|port", - "email-dst-display-name", - "email-src-display-name", - "email-header", - "email-reply-to", - "email-x-mailer", - "email-mime-boundary", - "email-thread-index", - "email-message-id", - "mobile-application-id", - "whois-registrant-email" + "x509-fingerprint-sha1", + "x509-fingerprint-sha256" ], - "Payload installation": [ - "md5", - "sha1", - "sha224", - "sha256", - "sha384", - "sha512", - "sha512/224", - "sha512/256", - "ssdeep", - "imphash", - "impfuzzy", + "Other": [ + "boolean", + "comment", + "counter", + "cpe", + "datetime", + "float", + "hex", + "other", + "phone-number", + "port", + "size-in-bytes", + "text" + ], + "Payload delivery": [ + "AS", + "attachment", "authentihash", - "pehash", - "tlsh", "cdhash", + "comment", + "domain", + "email-attachment", + "email-body", + "email-dst", + "email-dst-display-name", + "email-header", + "email-message-id", + "email-mime-boundary", + "email-reply-to", + "email-src", + "email-src-display-name", + "email-subject", + "email-thread-index", + "email-x-mailer", "filename", + "filename|authentihash", + "filename|impfuzzy", + "filename|imphash", "filename|md5", + "filename|pehash", "filename|sha1", "filename|sha224", "filename|sha256", @@ -312,105 +243,174 @@ "filename|sha512", "filename|sha512/224", "filename|sha512/256", - "filename|authentihash", "filename|ssdeep", "filename|tlsh", - "filename|imphash", - "filename|impfuzzy", - "filename|pehash", - "pattern-in-file", - "pattern-in-traffic", - "pattern-in-memory", - "stix2-pattern", - "yara", - "sigma", - "vulnerability", - "attachment", + "hex", + "hostname", + "hostname|port", + "impfuzzy", + "imphash", + "ip-dst", + "ip-dst|port", + "ip-src", + "ip-src|port", + "link", + "mac-address", + "mac-eui-64", "malware-sample", "malware-type", - "comment", - "text", - "hex", - "x509-fingerprint-sha1", - "x509-fingerprint-md5", - "x509-fingerprint-sha256", + "md5", + "mime-type", "mobile-application-id", "other", - "mime-type" + "pattern-in-file", + "pattern-in-traffic", + "pehash", + "sha1", + "sha224", + "sha256", + "sha384", + "sha512", + "sha512/224", + "sha512/256", + "sigma", + "ssdeep", + "stix2-pattern", + "text", + "tlsh", + "url", + "user-agent", + "vulnerability", + "whois-registrant-email", + "x509-fingerprint-md5", + "x509-fingerprint-sha1", + "x509-fingerprint-sha256", + "yara" + ], + "Payload installation": [ + "attachment", + "authentihash", + "cdhash", + "comment", + "filename", + "filename|authentihash", + "filename|impfuzzy", + "filename|imphash", + "filename|md5", + "filename|pehash", + "filename|sha1", + "filename|sha224", + "filename|sha256", + "filename|sha384", + "filename|sha512", + "filename|sha512/224", + "filename|sha512/256", + "filename|ssdeep", + "filename|tlsh", + "hex", + "impfuzzy", + "imphash", + "malware-sample", + "malware-type", + "md5", + "mime-type", + "mobile-application-id", + "other", + "pattern-in-file", + "pattern-in-memory", + "pattern-in-traffic", + "pehash", + "sha1", + "sha224", + "sha256", + "sha384", + "sha512", + "sha512/224", + "sha512/256", + "sigma", + "ssdeep", + "stix2-pattern", + "text", + "tlsh", + "vulnerability", + "x509-fingerprint-md5", + "x509-fingerprint-sha1", + "x509-fingerprint-sha256", + "yara" ], "Payload type": [ "comment", - "text", - "other" + "other", + "text" ], "Persistence mechanism": [ + "comment", "filename", + "hex", + "other", "regkey", "regkey|value", - "comment", - "text", - "other", - "hex" + "text" ], "Person": [ - "first-name", - "middle-name", - "last-name", + "comment", + "country-of-residence", "date-of-birth", - "place-of-birth", + "first-name", + "frequent-flyer-number", "gender", - "passport-number", + "identity-card-number", + "issue-date-of-the-visa", + "last-name", + "middle-name", + "nationality", + "other", + "passenger-name-record-locator-number", "passport-country", "passport-expiration", - "redress-number", - "nationality", - "visa-number", - "issue-date-of-the-visa", - "primary-residence", - "country-of-residence", - "special-service-request", - "frequent-flyer-number", - "travel-details", + "passport-number", "payment-details", - "place-port-of-original-embarkation", + "phone-number", + "place-of-birth", "place-port-of-clearance", "place-port-of-onward-foreign-destination", - "passenger-name-record-locator-number", - "comment", + "place-port-of-original-embarkation", + "primary-residence", + "redress-number", + "special-service-request", "text", - "other", - "phone-number", - "identity-card-number" + "travel-details", + "visa-number" ], "Social network": [ - "github-username", - "github-repository", - "github-organisation", - "jabber-id", - "twitter-id", - "email-src", - "email-dst", "comment", - "text", + "email-dst", + "email-src", + "github-organisation", + "github-repository", + "github-username", + "jabber-id", "other", + "text", + "twitter-id", "whois-registrant-email" ], "Support Tool": [ - "link", - "text", "attachment", "comment", + "hex", + "link", "other", - "hex" + "text" ], "Targeting data": [ - "target-user", + "comment", "target-email", + "target-external", + "target-location", "target-machine", "target-org", - "target-location", - "target-external", - "comment" + "target-user" ] }, "sane_defaults": { @@ -1028,159 +1028,159 @@ } }, "types": [ - "md5", - "sha1", - "sha256", - "filename", - "pdb", - "filename|md5", - "filename|sha1", - "filename|sha256", - "ip-src", - "ip-dst", - "hostname", + "AS", + "aba-rtn", + "attachment", + "authentihash", + "bank-account-nr", + "bic", + "bin", + "boolean", + "bro", + "btc", + "campaign-id", + "campaign-name", + "cc-number", + "cdhash", + "comment", + "cookie", + "cortex", + "counter", + "country-of-residence", + "cpe", + "date-of-birth", + "datetime", + "dns-soa-email", "domain", "domain|ip", - "email-src", - "email-dst", - "email-subject", "email-attachment", "email-body", - "float", - "url", - "http-method", - "user-agent", - "regkey", - "regkey|value", - "AS", - "snort", - "bro", - "pattern-in-file", - "pattern-in-traffic", - "pattern-in-memory", - "yara", - "stix2-pattern", - "sigma", - "gene", - "mime-type", - "identity-card-number", - "cookie", - "vulnerability", - "attachment", - "malware-sample", - "link", - "comment", - "text", - "hex", - "other", - "named pipe", - "mutex", - "target-user", - "target-email", - "target-machine", - "target-org", - "target-location", - "target-external", - "btc", - "xmr", - "iban", - "bic", - "bank-account-nr", - "aba-rtn", - "bin", - "cc-number", - "prtn", - "phone-number", - "threat-actor", - "campaign-name", - "campaign-id", - "malware-type", - "uri", - "authentihash", - "ssdeep", - "imphash", - "pehash", - "impfuzzy", - "sha224", - "sha384", - "sha512", - "sha512/224", - "sha512/256", - "tlsh", - "cdhash", + "email-dst", + "email-dst-display-name", + "email-header", + "email-message-id", + "email-mime-boundary", + "email-reply-to", + "email-src", + "email-src-display-name", + "email-subject", + "email-thread-index", + "email-x-mailer", + "filename", "filename|authentihash", - "filename|ssdeep", - "filename|imphash", "filename|impfuzzy", + "filename|imphash", + "filename|md5", "filename|pehash", + "filename|sha1", "filename|sha224", + "filename|sha256", "filename|sha384", "filename|sha512", "filename|sha512/224", "filename|sha512/256", + "filename|ssdeep", "filename|tlsh", - "windows-scheduled-task", - "windows-service-name", - "windows-service-displayname", - "whois-registrant-email", - "whois-registrant-phone", - "whois-registrant-name", - "whois-registrant-org", - "whois-registrar", - "whois-creation-date", - "x509-fingerprint-sha1", - "x509-fingerprint-md5", - "x509-fingerprint-sha256", - "dns-soa-email", - "size-in-bytes", - "counter", - "datetime", - "cpe", - "port", - "ip-dst|port", - "ip-src|port", + "first-name", + "float", + "frequent-flyer-number", + "gender", + "gene", + "github-organisation", + "github-repository", + "github-username", + "hex", + "hostname", "hostname|port", + "http-method", + "iban", + "identity-card-number", + "impfuzzy", + "imphash", + "ip-dst", + "ip-dst|port", + "ip-src", + "ip-src|port", + "issue-date-of-the-visa", + "jabber-id", + "last-name", + "link", "mac-address", "mac-eui-64", - "email-dst-display-name", - "email-src-display-name", - "email-header", - "email-reply-to", - "email-x-mailer", - "email-mime-boundary", - "email-thread-index", - "email-message-id", - "github-username", - "github-repository", - "github-organisation", - "jabber-id", - "twitter-id", - "first-name", + "malware-sample", + "malware-type", + "md5", "middle-name", - "last-name", - "date-of-birth", - "place-of-birth", - "gender", - "passport-number", + "mime-type", + "mobile-application-id", + "mutex", + "named pipe", + "nationality", + "other", + "passenger-name-record-locator-number", "passport-country", "passport-expiration", - "redress-number", - "nationality", - "visa-number", - "issue-date-of-the-visa", - "primary-residence", - "country-of-residence", - "special-service-request", - "frequent-flyer-number", - "travel-details", + "passport-number", + "pattern-in-file", + "pattern-in-memory", + "pattern-in-traffic", "payment-details", - "place-port-of-original-embarkation", + "pdb", + "pehash", + "phone-number", + "place-of-birth", "place-port-of-clearance", "place-port-of-onward-foreign-destination", - "passenger-name-record-locator-number", - "mobile-application-id", - "cortex", - "boolean" + "place-port-of-original-embarkation", + "port", + "primary-residence", + "prtn", + "redress-number", + "regkey", + "regkey|value", + "sha1", + "sha224", + "sha256", + "sha384", + "sha512", + "sha512/224", + "sha512/256", + "sigma", + "size-in-bytes", + "snort", + "special-service-request", + "ssdeep", + "stix2-pattern", + "target-email", + "target-external", + "target-location", + "target-machine", + "target-org", + "target-user", + "text", + "threat-actor", + "tlsh", + "travel-details", + "twitter-id", + "uri", + "url", + "user-agent", + "visa-number", + "vulnerability", + "whois-creation-date", + "whois-registrant-email", + "whois-registrant-name", + "whois-registrant-org", + "whois-registrant-phone", + "whois-registrar", + "windows-scheduled-task", + "windows-service-displayname", + "windows-service-name", + "x509-fingerprint-md5", + "x509-fingerprint-sha1", + "x509-fingerprint-sha256", + "xmr", + "yara" ] } }