mirror of https://github.com/MISP/misp-galaxy
Merge branch 'master' of https://github.com/MISP/misp-galaxy
Deborah Servili
commit
50022d3905
|
|
@ -178,6 +178,56 @@
|
|||
"uuid": "102e0d9e-8807-4c52-8a79-455d5e688081",
|
||||
"value": "Insider Trading"
|
||||
},
|
||||
{
|
||||
"description": "Investment Fraud",
|
||||
"meta": {
|
||||
"kill_chain": [
|
||||
"fraud-tactics:Perform Fraud"
|
||||
]
|
||||
},
|
||||
"uuid": "92f5f46f-c506-45de-9a7f-f1128e40d47c",
|
||||
"value": "Investment Fraud"
|
||||
},
|
||||
{
|
||||
"description": "Romance Scam",
|
||||
"meta": {
|
||||
"kill_chain": [
|
||||
"fraud-tactics:Perform Fraud"
|
||||
]
|
||||
},
|
||||
"uuid": "8ac64815-52c0-4d14-a4e4-4a19b2a6057d",
|
||||
"value": "Romance Scam"
|
||||
},
|
||||
{
|
||||
"description": "Buying/Renting Fraud",
|
||||
"meta": {
|
||||
"kill_chain": [
|
||||
"fraud-tactics:Perform Fraud"
|
||||
]
|
||||
},
|
||||
"uuid": "464005e5-f608-41c9-a4fa-cfe9b8d26431",
|
||||
"value": "Buying/Renting Fraud"
|
||||
},
|
||||
{
|
||||
"description": "Cash Recovery Scam",
|
||||
"meta": {
|
||||
"kill_chain": [
|
||||
"fraud-tactics:Perform Fraud"
|
||||
]
|
||||
},
|
||||
"uuid": "97a79d67-02f4-4e1c-ac37-f835c88fe2c2",
|
||||
"value": "Cash Recovery Scam"
|
||||
},
|
||||
{
|
||||
"description": "Fake Invoice Fraud",
|
||||
"meta": {
|
||||
"kill_chain": [
|
||||
"fraud-tactics:Perform Fraud"
|
||||
]
|
||||
},
|
||||
"uuid": "a0f764d1-b541-4ee7-bb30-21b9a735f644",
|
||||
"value": "Fake Invoice Fraud"
|
||||
},
|
||||
{
|
||||
"description": "Business Email Compromise",
|
||||
"meta": {
|
||||
|
|
@ -330,5 +380,5 @@
|
|||
"value": "ATM Explosive Attack"
|
||||
}
|
||||
],
|
||||
"version": 2
|
||||
"version": 3
|
||||
}
|
||||
|
|
|
|||
File diff suppressed because one or more lines are too long
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
|
|
@ -89,13 +89,6 @@
|
|||
],
|
||||
"type": "similar"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "3da22160-12d9-4d27-a99f-338e8de3844a",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"likely\""
|
||||
],
|
||||
"type": "similar"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "1a1d3ea4-972e-4c48-8d85-08d9db8f1550",
|
||||
"tags": [
|
||||
|
|
@ -103,13 +96,6 @@
|
|||
],
|
||||
"type": "similar"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830",
|
||||
"tags": [
|
||||
|
|
@ -320,6 +306,13 @@
|
|||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "f879d51c-5476-431c-aedf-f14d207e4d1e",
|
||||
"tags": [
|
||||
|
|
@ -361,6 +354,13 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "9ddc2534-e91c-4dab-a8f6-43dab81e8142",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
}
|
||||
],
|
||||
"uuid": "aafea02e-ece5-4bb2-91a6-3bf8c7f38a39",
|
||||
|
|
@ -445,13 +445,6 @@
|
|||
],
|
||||
"type": "similar"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "6c174520-beea-43d9-aac6-28fb77f3e446",
|
||||
"tags": [
|
||||
|
|
@ -507,6 +500,13 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
}
|
||||
],
|
||||
"uuid": "afc079f3-c0ea-4096-b75d-3f05338b7f60",
|
||||
|
|
@ -866,14 +866,14 @@
|
|||
},
|
||||
"related": [
|
||||
{
|
||||
"dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59",
|
||||
"dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830",
|
||||
"dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
|
|
@ -921,20 +921,6 @@
|
|||
]
|
||||
},
|
||||
"related": [
|
||||
{
|
||||
"dest-uuid": "3e205e84-9f90-4b4b-8896-c82189936a15",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"likely\""
|
||||
],
|
||||
"type": "similar"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "d519cfd5-f3a8-43a9-a846-ed0bb40672b1",
|
||||
"tags": [
|
||||
|
|
@ -948,6 +934,13 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
}
|
||||
],
|
||||
"uuid": "0a68f1f1-da74-4d28-8d9a-696c082706cc",
|
||||
|
|
@ -1018,6 +1011,13 @@
|
|||
]
|
||||
},
|
||||
"related": [
|
||||
{
|
||||
"dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
|
||||
"tags": [
|
||||
|
|
@ -1026,7 +1026,7 @@
|
|||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776",
|
||||
"dest-uuid": "c8e87b83-edbb-48d4-9295-4974897525b7",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
|
|
@ -1250,13 +1250,6 @@
|
|||
]
|
||||
},
|
||||
"related": [
|
||||
{
|
||||
"dest-uuid": "b6075259-dba3-44e9-87c7-e954f37ec0d5",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392",
|
||||
"tags": [
|
||||
|
|
@ -1320,6 +1313,13 @@
|
|||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "b6075259-dba3-44e9-87c7-e954f37ec0d5",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "f3c544dc-673c-4ef3-accb-53229f1ae077",
|
||||
"tags": [
|
||||
|
|
@ -1338,6 +1338,196 @@
|
|||
"uuid": "03342581-f790-4f03-ba41-e82e67392e23",
|
||||
"value": "Net - S0039"
|
||||
},
|
||||
{
|
||||
"description": "[esentutl](https://attack.mitre.org/software/S0404) is a command-line tool that provides database utilities for the Windows Extensible Storage Engine.(Citation: Microsoft Esentutl)",
|
||||
"meta": {
|
||||
"external_id": "S0404",
|
||||
"mitre_platforms": [
|
||||
"Windows"
|
||||
],
|
||||
"refs": [
|
||||
"https://attack.mitre.org/software/S0404",
|
||||
"https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh875546(v=ws.11)"
|
||||
],
|
||||
"synonyms": [
|
||||
"esentutl",
|
||||
"esentutl.exe"
|
||||
]
|
||||
},
|
||||
"related": [
|
||||
{
|
||||
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "f2d44246-91f1-478a-b6c8-1227e0ca109d",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
}
|
||||
],
|
||||
"uuid": "c256da91-6dd5-40b2-beeb-ee3b22ab3d27",
|
||||
"value": "esentutl - S0404"
|
||||
},
|
||||
{
|
||||
"description": "[FlexiSpy](https://attack.mitre.org/software/S0408) is sophisticated surveillanceware for iOS and Android. Publicly-available, comprehensive analysis has only been found for the Android version.(Citation: FortiGuard-FlexiSpy)(Citation: CyberMerchants-FlexiSpy)\n\n[FlexiSpy](https://attack.mitre.org/software/S0408) markets itself as a parental control and employee monitoring application.(Citation: FlexiSpy-Website)",
|
||||
"meta": {
|
||||
"external_id": "S0408",
|
||||
"mitre_platforms": [
|
||||
"Android"
|
||||
],
|
||||
"refs": [
|
||||
"https://attack.mitre.org/software/S0408",
|
||||
"https://d3gpjj9d20n0p3.cloudfront.net/fortiguard/research/Dig%20Deep%20into%20FlexiSpy%20for%20Android%28white%20paper%29_KaiLu.pdf",
|
||||
"http://www.cybermerchantsofdeath.com/blog/2017/04/22/FlexiSpy.html",
|
||||
"https://www.flexispy.com/"
|
||||
],
|
||||
"synonyms": [
|
||||
"FlexiSpy"
|
||||
]
|
||||
},
|
||||
"related": [
|
||||
{
|
||||
"dest-uuid": "948a447c-d783-4ba0-8516-a64140fcacd5",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "fd658820-cbba-4c95-8ac9-0fac6b1099e2",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "c5089859-b21f-40a3-8be4-63e381b8b1c0",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "bd4d32f5-eed4-4018-a649-40b229dd1d69",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "702055ac-4e54-4ae9-9527-e23a38e0b160",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "6683aa0c-d98a-4f5b-ac57-ca7e9934a760",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "d8940e76-f9c1-4912-bea6-e21c251370b6",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "8e27551a-5080-4148-a584-c64348212e4f",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "4e6620ac-c30c-4f6d-918e-fa20cae7c1ce",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "62adb627-f647-498e-b4cc-41499361bacb",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "99e6295e-741b-4857-b6e5-64989eb039b4",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "e4c347e9-fb91-4bc5-83b8-391e389131e2",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "73c26732-6422-4081-8b63-6d0ae93d449e",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "a8c31121-852b-46bd-9ba4-674ae5afe7ad",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "e1c912a9-e305-434b-9172-8a6ce3ec9c4a",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
}
|
||||
],
|
||||
"uuid": "1622fd3d-fcfc-4d02-ac49-f2d786f79b81",
|
||||
"value": "FlexiSpy - S0408"
|
||||
},
|
||||
{
|
||||
"description": "[Reg](https://attack.mitre.org/software/S0075) is a Windows utility used to interact with the Windows Registry. It can be used at the command-line interface to query, add, modify, and remove information. (Citation: Microsoft Reg)\n\nUtilities such as [Reg](https://attack.mitre.org/software/S0075) are known to be used by persistent threats. (Citation: Windows Commands JPCERT)",
|
||||
"meta": {
|
||||
|
|
@ -1357,14 +1547,14 @@
|
|||
},
|
||||
"related": [
|
||||
{
|
||||
"dest-uuid": "2edd9d6a-5674-4326-a600-ba56de467286",
|
||||
"dest-uuid": "c32f7008-9fea-41f7-8366-5eb9b74bd896",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "c32f7008-9fea-41f7-8366-5eb9b74bd896",
|
||||
"dest-uuid": "2edd9d6a-5674-4326-a600-ba56de467286",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
|
|
@ -1751,13 +1941,6 @@
|
|||
],
|
||||
"type": "similar"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48",
|
||||
"tags": [
|
||||
|
|
@ -1940,6 +2123,13 @@
|
|||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc",
|
||||
"tags": [
|
||||
|
|
@ -1993,6 +2183,49 @@
|
|||
"uuid": "cb69b20d-56d0-41ab-8440-4a4b251614d4",
|
||||
"value": "Pupy - S0192"
|
||||
},
|
||||
{
|
||||
"description": "MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). It can be used by a non-administrative user to search their own email, or by an Exchange administrator to search the mailboxes of every user in a domain.(Citation: GitHub MailSniper)",
|
||||
"meta": {
|
||||
"external_id": "S0413",
|
||||
"mitre_platforms": [
|
||||
"Office 365",
|
||||
"Windows",
|
||||
"Azure AD"
|
||||
],
|
||||
"refs": [
|
||||
"https://attack.mitre.org/software/S0413",
|
||||
"https://github.com/dafthack/MailSniper"
|
||||
],
|
||||
"synonyms": [
|
||||
"MailSniper"
|
||||
]
|
||||
},
|
||||
"related": [
|
||||
{
|
||||
"dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
}
|
||||
],
|
||||
"uuid": "999c4e6e-b8dc-4b4f-8d6e-1b829f29997e",
|
||||
"value": "MailSniper - S0413"
|
||||
},
|
||||
{
|
||||
"description": "[Expand](https://attack.mitre.org/software/S0361) is a Windows utility used to expand one or more compressed CAB files.(Citation: Microsoft Expand Utility) It has been used by [BBSRAT](https://attack.mitre.org/software/S0127) to decompress a CAB file into executable content.(Citation: Palo Alto Networks BBSRAT)",
|
||||
"meta": {
|
||||
|
|
@ -2054,14 +2287,14 @@
|
|||
},
|
||||
"related": [
|
||||
{
|
||||
"dest-uuid": "7d751199-05fa-4a72-920f-85df4506c76c",
|
||||
"dest-uuid": "428ca9f8-0e33-442a-be87-f869cb4cf73e",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "428ca9f8-0e33-442a-be87-f869cb4cf73e",
|
||||
"dest-uuid": "7d751199-05fa-4a72-920f-85df4506c76c",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
|
|
@ -2088,14 +2321,14 @@
|
|||
},
|
||||
"related": [
|
||||
{
|
||||
"dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
|
||||
"dest-uuid": "3b0e52ce-517a-4614-a523-1bd5deef6c5e",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "3b0e52ce-517a-4614-a523-1bd5deef6c5e",
|
||||
"dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
|
|
@ -2599,6 +2832,13 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
}
|
||||
],
|
||||
"uuid": "da04ac30-27da-4959-a67d-450ce47d9470",
|
||||
|
|
@ -2776,7 +3016,7 @@
|
|||
],
|
||||
"refs": [
|
||||
"https://attack.mitre.org/software/S0378",
|
||||
"https://github.com/nettitude/PoshC2"
|
||||
"https://github.com/nettitude/PoshC2_Python"
|
||||
],
|
||||
"synonyms": [
|
||||
"PoshC2"
|
||||
|
|
@ -3500,6 +3740,13 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
}
|
||||
],
|
||||
"uuid": "3433a9e8-1c47-4320-b9bf-ed449061d1c3",
|
||||
|
|
@ -3578,6 +3825,13 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
}
|
||||
],
|
||||
"uuid": "b76b2d94-60e4-4107-a903-4a3a7622fb3b",
|
||||
|
|
@ -3724,5 +3978,5 @@
|
|||
"value": "Nltest - S0359"
|
||||
}
|
||||
],
|
||||
"version": 15
|
||||
"version": 17
|
||||
}
|
||||
|
|
|
|||
|
|
@ -13522,7 +13522,33 @@
|
|||
},
|
||||
"uuid": "7cea4438-1d1c-121a-30af-011d661260b2",
|
||||
"value": "Mr.Dec"
|
||||
},
|
||||
{
|
||||
"description": "Freezing crypto ransomware encrypts user data using AES, and then requires a ransom in # BTC to return the files. Original title: not indicated in the note. The file says: FreeMe.exe",
|
||||
"meta": {
|
||||
"encryption": "AES",
|
||||
"refs": [
|
||||
"http://id-ransomware.blogspot.com/2019/06/freeme-freezing-ransomware.html"
|
||||
],
|
||||
"synonyms": [
|
||||
"Freezing"
|
||||
]
|
||||
},
|
||||
"uuid": "4cea4448-1d3c-111a-40af-011d461260b4",
|
||||
"value": "Freeme"
|
||||
},
|
||||
{
|
||||
"description": "We have dubbed this new ransomware DoppelPaymer because it shares most of its code with the BitPaymer ransomware operated by INDRIK SPIDER. However, there are a number of differences between DoppelPaymer and BitPaymer, which may signify that one or more members of INDRIK SPIDER have split from the group and forked the source code of both Dridex and BitPaymer to start their own Big Game Hunting ransomware operation.",
|
||||
"meta": {
|
||||
"encryption": "AES",
|
||||
"refs": [
|
||||
"https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/",
|
||||
"https://malpedia.caad.fkie.fraunhofer.de/details/win.doppelpaymer"
|
||||
]
|
||||
},
|
||||
"uuid": "5cea5548-1e3c-222a-3faf-022d461260b5",
|
||||
"value": "DoppelPaymer"
|
||||
}
|
||||
],
|
||||
"version": 68
|
||||
"version": 70
|
||||
}
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
"Various"
|
||||
],
|
||||
"category": "actor",
|
||||
"description": "Known or estimated adversary groups targeting organizations and employees. Adversary groups are regularly confused with their initial operation or campaign.",
|
||||
"description": "Known or estimated adversary groups targeting organizations and employees. Adversary groups are regularly confused with their initial operation or campaign. threat-actor-classification meta can be used to clarify the understanding of the threat-actor if also considered as operation, campaign or activity group.",
|
||||
"name": "Threat Actor",
|
||||
"source": "MISP Project",
|
||||
"type": "threat-actor",
|
||||
|
|
@ -7293,11 +7293,14 @@
|
|||
"https://www.justice.gov/usao-sdny/pr/nine-iranians-charged-conducting-massive-cyber-theft-campaign-behalf-islamic",
|
||||
"https://www.justice.gov/opa/pr/nine-iranians-charged-conducting-massive-cyber-theft-campaign-behalf-islamic-revolutionary",
|
||||
"https://www.secureworks.com/blog/cobalt-dickens-goes-back-to-school-again",
|
||||
"https://www.secureworks.com/blog/back-to-school-cobalt-dickens-targets-universities"
|
||||
"https://www.secureworks.com/blog/back-to-school-cobalt-dickens-targets-universities",
|
||||
"https://www.proofpoint.com/us/threat-insight/post/seems-phishy-back-school-lures-target-university-students-and-staff",
|
||||
"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian"
|
||||
],
|
||||
"synonyms": [
|
||||
"COBALT DICKENS",
|
||||
"Mabna Institute"
|
||||
"Mabna Institute",
|
||||
"TA407"
|
||||
]
|
||||
},
|
||||
"uuid": "5059b44d-2753-4977-b987-4922f09afe6b",
|
||||
|
|
@ -7755,11 +7758,27 @@
|
|||
"meta": {
|
||||
"refs": [
|
||||
"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
|
||||
],
|
||||
"threat-actor-classification": [
|
||||
"operation"
|
||||
]
|
||||
},
|
||||
"uuid": "8dda51ef-9a30-48f7-b0fd-5b6f0a62262d",
|
||||
"value": "Operation Soft Cell"
|
||||
},
|
||||
{
|
||||
"description": "We are calling these attacks Operation WizardOpium. So far, we have been unable to establish a definitive link with any known threat actors. There are certain very weak code similarities with Lazarus attacks, although these could very well be a false flag. The profile of the targeted website is more in line with earlier DarkHotel attacks that have recently deployed similar false flag attacks.",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"https://securelist.com/chrome-0-day-exploit-cve-2019-13720-used-in-operation-wizardopium/94866/"
|
||||
],
|
||||
"threat-actor-classification": [
|
||||
"operation"
|
||||
]
|
||||
},
|
||||
"uuid": "75db4269-924b-4771-8f62-0de600a43634",
|
||||
"value": "Operation WizardOpium"
|
||||
}
|
||||
],
|
||||
"version": 138
|
||||
"version": 139
|
||||
}
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
"icon": "globe-europe",
|
||||
"name": "Regions UN M49",
|
||||
"namespace": "misp",
|
||||
"type": "regions",
|
||||
"type": "region",
|
||||
"uuid": "d151a79a-e029-11e9-9409-f3e0cf3d93aa",
|
||||
"version": 1
|
||||
"version": 2
|
||||
}
|
||||
|
|
|
|||
|
|
@ -28,10 +28,14 @@ thisDir = os.path.dirname(__file__)
|
|||
clusters = []
|
||||
|
||||
pathClusters = os.path.join(thisDir, '../clusters')
|
||||
pathGalaxies = os.path.join(thisDir, '../galaxies')
|
||||
|
||||
for f in os.listdir(pathClusters):
|
||||
for f in os.listdir(pathGalaxies):
|
||||
if '.json' in f:
|
||||
clusters.append(f)
|
||||
with open(os.path.join(pathGalaxies, f), 'r') as f_in:
|
||||
galaxy_data = json.load(f_in)
|
||||
if galaxy_data.get('namespace') != 'deprecated':
|
||||
clusters.append(f)
|
||||
|
||||
clusters.sort()
|
||||
|
||||
|
|
|
|||
|
|
@ -164,7 +164,7 @@ def main():
|
|||
amitt.write_amitt_file('../galaxies/misinfosec-amitt-misinformation-pattern.json', galaxy)
|
||||
|
||||
cluster = amitt.make_amitt_cluster()
|
||||
amitt.write_amitt_file('../clusters/misinfosec-amitt-misinformation-technique.json', cluster)
|
||||
amitt.write_amitt_file('../clusters/misinfosec-amitt-misinformation-pattern.json', cluster)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
|
|
|
|||
|
|
@ -17,36 +17,55 @@ domains = ['enterprise-attack', 'mobile-attack', 'pre-attack']
|
|||
types = ['attack-pattern', 'course-of-action', 'intrusion-set', 'malware', 'tool']
|
||||
all_data = {} # variable that will contain everything
|
||||
|
||||
# read in existing data
|
||||
# THIS IS FOR MIGRATION - reading the data from the enterprise-attack, mobile-attack, pre-attack
|
||||
# read in the non-MITRE data
|
||||
# we need this to be able to build a list of non-MITRE-UUIDs which we will use later on
|
||||
# to remove relations that are from MITRE.
|
||||
# the reasoning is that the new MITRE export might contain less relationships than it did before
|
||||
# so we cannot migrate all existing relationships as such
|
||||
non_mitre_uuids = set()
|
||||
for fname in os.listdir(os.path.join(misp_dir, 'clusters')):
|
||||
if 'mitre' in fname:
|
||||
continue
|
||||
if '.json' in fname:
|
||||
# print(fname)
|
||||
with open(os.path.join(misp_dir, 'clusters', fname)) as f_in:
|
||||
cluster_data = json.load(f_in)
|
||||
for cluster in cluster_data['values']:
|
||||
non_mitre_uuids.add(cluster['uuid'])
|
||||
|
||||
# read in existing MITRE data
|
||||
# first build a data set of the MISP Galaxy ATT&CK elements by using the UUID as reference, this speeds up lookups later on.
|
||||
# at the end we will convert everything again to separate datasets
|
||||
all_data_uuid = {}
|
||||
for domain in domains:
|
||||
for t in types:
|
||||
fname = os.path.join(misp_dir, 'clusters', 'mitre-{}-{}.json'.format(domain, t))
|
||||
if os.path.exists(fname):
|
||||
# print("##### {}".format(fname))
|
||||
with open(fname) as f:
|
||||
file_data = json.load(f)
|
||||
# print(file_data)
|
||||
for value in file_data['values']:
|
||||
if value['uuid'] in all_data_uuid:
|
||||
# exit("ERROR: Something is really wrong, we seem to have duplicates.")
|
||||
# if it already exists we need to copy over all the data manually to merge it
|
||||
# on the other hand, from a manual analysis it looks like it's mostly the relations that are different
|
||||
# so now we will just copy over the relationships
|
||||
# actually, at time of writing the code below results in no change as the new items always contained more than the previously seen items
|
||||
value_orig = all_data_uuid[value['uuid']]
|
||||
if 'related' in value_orig:
|
||||
for related_item in value_orig['related']:
|
||||
if related_item not in value['related']:
|
||||
value['related'].append(related_item)
|
||||
all_data_uuid[value['uuid']] = value
|
||||
|
||||
# THIS IS FOR NORMAL OPERATIONS - reading from the very old and new models - one model per type
|
||||
# FIXME implement this (copy paste above or put above in function and call function)
|
||||
|
||||
for t in types:
|
||||
fname = os.path.join(misp_dir, 'clusters', 'mitre-{}.json'.format(t))
|
||||
if os.path.exists(fname):
|
||||
# print("##### {}".format(fname))
|
||||
with open(fname) as f:
|
||||
file_data = json.load(f)
|
||||
# print(file_data)
|
||||
for value in file_data['values']:
|
||||
# remove (old)MITRE relations, and keep non-MITRE relations
|
||||
if 'related' in value:
|
||||
related_original = value['related']
|
||||
related_new = []
|
||||
for rel in related_original:
|
||||
if rel['dest-uuid'] in non_mitre_uuids:
|
||||
related_new.append(rel)
|
||||
value['related'] = related_new
|
||||
# find and handle duplicate uuids
|
||||
if value['uuid'] in all_data_uuid:
|
||||
# exit("ERROR: Something is really wrong, we seem to have duplicates.")
|
||||
# if it already exists we need to copy over all the data manually to merge it
|
||||
# on the other hand, from a manual analysis it looks like it's mostly the relations that are different
|
||||
# so now we will just copy over the relationships
|
||||
# actually, at time of writing the code below results in no change as the new items always contained more than the previously seen items
|
||||
value_orig = all_data_uuid[value['uuid']]
|
||||
if 'related' in value_orig:
|
||||
for related_item in value_orig['related']:
|
||||
if related_item not in value['related']:
|
||||
value['related'].append(related_item)
|
||||
all_data_uuid[value['uuid']] = value
|
||||
|
||||
# now load the MITRE ATT&CK
|
||||
for domain in domains:
|
||||
|
|
@ -136,6 +155,7 @@ for domain in domains:
|
|||
|
||||
# LATER find the opposite word of "rel_type" and build the relation in the opposite direction
|
||||
|
||||
|
||||
# dump all_data to their respective file
|
||||
for t in types:
|
||||
fname = os.path.join(misp_dir, 'clusters', 'mitre-{}.json'.format(t))
|
||||
|
|
@ -147,7 +167,7 @@ for t in types:
|
|||
file_data['values'] = []
|
||||
for item in all_data_uuid.values():
|
||||
# print(json.dumps(item, sort_keys=True, indent=2))
|
||||
if item['type'] != t:
|
||||
if 'type' not in item or item['type'] != t: # drop old data or not from the right type
|
||||
continue
|
||||
item_2 = item.copy()
|
||||
item_2.pop('type', None)
|
||||
|
|
|
|||
Loading…
Reference in New Issue