From edcc3c0bc16f3ad0e5aa68d1053d44f572943eff Mon Sep 17 00:00:00 2001 From: Daniel Plohmann Date: Fri, 15 Jan 2021 18:52:49 +0100 Subject: [PATCH 01/11] merging ScarCruft->APT37 I would like to propose merging entry "ScarCruft" into "APT37". It really just seems like a redundancy, as both its aliases "Operation Daybreak" and "Operation Erebus" are already present for "APT37", along alias "StarCruft", which just seems to be a less popular variation of the name ("StarCruft" 3.2k google hits vs "ScarCruft" 31.5k google hits). The references of the entry can be fully merged as well - they do not overlap so far. --- clusters/threat-actor.json | 49 ++++++-------------------------------- 1 file changed, 7 insertions(+), 42 deletions(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 3227b5e..fd6d717 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -3331,39 +3331,6 @@ "uuid": "dab75e38-6969-4e78-9304-dc269c3cbcf0", "value": "Stealth Falcon" }, - { - "description": "ScarCruft is a relatively new APT group; victims have been observed in several countries, including Russia, Nepal, South Korea, China, India, Kuwait and Romania. The group has several ongoing operations utilizing multiple exploits — two for Adobe Flash and one for Microsoft Internet Explorer.", - "meta": { - "refs": [ - "https://securelist.com/cve-2016-4171-adobe-flash-zero-day-used-in-targeted-attacks/75082/", - "https://securelist.com/operation-daybreak/75100/", - "https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/", - "https://threatpost.com/scarcruft-apt-group-used-latest-flash-zero-day-in-two-dozen-attacks/118642/" - ], - "synonyms": [ - "Operation Daybreak", - "Operation Erebus" - ] - }, - "related": [ - { - "dest-uuid": "4a2ce82e-1a74-468a-a6fb-bbead541383c", - "tags": [ - "estimative-language:likelihood-probability=\"likely\"" - ], - "type": "similar" - }, - { - "dest-uuid": "50cd027f-df14-40b2-aa22-bf5de5061163", - "tags": [ - "estimative-language:likelihood-probability=\"likely\"" - ], - "type": "similar" - } - ], - "uuid": "bb446dc2-4fee-4212-8b2c-3ffa2917e338", - "value": "ScarCruft" - }, { "description": "This group created a malware that takes over Android devices and generates $300,000 per month in fraudulent ad revenue. The group effectively controls an arsenal of over 85 million mobile devices around the world. With the potential to sell access to these devices to the highest bidder", "meta": { @@ -5740,18 +5707,23 @@ "https://www.bleepingcomputer.com/news/security/report-ties-north-korean-attacks-to-new-malware-linked-by-word-macros/", "https://unit42.paloaltonetworks.com/unit42-freemilk-highly-targeted-spear-phishing-campaign/", "https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html", - "https://attack.mitre.org/groups/G0067/" + "https://attack.mitre.org/groups/G0067/", + "https://securelist.com/cve-2016-4171-adobe-flash-zero-day-used-in-targeted-attacks/75082/", + "https://securelist.com/operation-daybreak/75100/", + "https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/", + "https://threatpost.com/scarcruft-apt-group-used-latest-flash-zero-day-in-two-dozen-attacks/118642/" ], "synonyms": [ "APT 37", "Group 123", "Group123", "Starcruft", + "StarCruft", + "ScarCruft", "Reaper", "Reaper Group", "Red Eyes", "Ricochet Chollima", - "StarCruft", "Operation Daybreak", "Operation Erebus", "Venus 121" @@ -5765,13 +5737,6 @@ ], "type": "similar" }, - { - "dest-uuid": "bb446dc2-4fee-4212-8b2c-3ffa2917e338", - "tags": [ - "estimative-language:likelihood-probability=\"likely\"" - ], - "type": "similar" - }, { "dest-uuid": "68391641-859f-4a9a-9a1e-3e5cf71ec376", "tags": [ From 91e87cf82c13cab7284516ecb19b650e9dcc183d Mon Sep 17 00:00:00 2001 From: Rony Date: Sun, 17 Jan 2021 12:21:34 +0530 Subject: [PATCH 02/11] Update threat-actor.json Don't know how StarCraft --- clusters/threat-actor.json | 2 -- 1 file changed, 2 deletions(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index fd6d717..e2e7124 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -5717,8 +5717,6 @@ "APT 37", "Group 123", "Group123", - "Starcruft", - "StarCruft", "ScarCruft", "Reaper", "Reaper Group", From ca66fcd93a5a4b9cb6abc832dd19aa7e620342ff Mon Sep 17 00:00:00 2001 From: Daniel Plohmann Date: Sun, 17 Jan 2021 15:07:26 +0100 Subject: [PATCH 03/11] merge COVELLITE into Lazarus Group I would propose to move COVELLITE as tracked by Dragos as an alias into Lazarus Group and merge the references. Dragos' own description states that it refers to the same group as "Lazarus" and "Hidden Cobra" in that infrastructure and tools are the same: https://www.dragos.com/threat-activity-groups/ - the entry in MISP's threat actor library also reflects that. --- clusters/threat-actor.json | 60 ++++---------------------------------- 1 file changed, 6 insertions(+), 54 deletions(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index fd6d717..24d13ba 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -3083,7 +3083,10 @@ "https://blogs.jpcert.or.jp/en/2020/08/Lazarus-malware.html", "https://www.secureworks.com/research/threat-profiles/nickel-gladstone", "https://blogs.jpcert.or.jp/en/2020/09/BLINDINGCAN.html", - "https://www.welivesecurity.com/2020/11/16/lazarus-supply-chain-attack-south-korea/" + "https://www.welivesecurity.com/2020/11/16/lazarus-supply-chain-attack-south-korea/", + "https://dragos.com/adversaries.html", + "https://dragos.com/media/2017-Review-Industrial-Control-System-Threats.pdf", + "https://www.cfr.org/interactive/cyber-operations/covellite" ], "synonyms": [ "Operation DarkSeoul", @@ -3109,7 +3112,8 @@ "Appleworm", "Nickel Academy", "APT-C-26", - "NICKEL GLADSTONE" + "NICKEL GLADSTONE", + "COVELLITE" ] }, "related": [ @@ -3120,13 +3124,6 @@ ], "type": "similar" }, - { - "dest-uuid": "027a1428-6e79-4a4b-82b9-e698e8525c2b", - "tags": [ - "estimative-language:likelihood-probability=\"likely\"" - ], - "type": "similar" - }, { "dest-uuid": "b06c3af1-0243-4428-88da-b3451c345e1e", "tags": [ @@ -6016,51 +6013,6 @@ "uuid": "a0082cfa-32e2-42b8-92d8-5c7a7409dcf1", "value": "CHRYSENE" }, - { - "description": "Adversaries abusing ICS (based on Dragos Inc adversary list).\nThis threat actor compromises the networks of companies involved in electric power, specifically looking for intellectual property and information about the companies’ operations.", - "meta": { - "attribution-confidence": "50", - "capabilities": "Encoded binaries in documents, evasion techniques", - "cfr-suspected-state-sponsor": "Unknown", - "cfr-suspected-victims": [ - "United States" - ], - "cfr-target-category": [ - "Private sector" - ], - "cfr-type-of-incident": "Espionage", - "mode-of-operation": "IT compromise with hardened anti-analysis malware against industrial orgs", - "refs": [ - "https://dragos.com/adversaries.html", - "https://dragos.com/media/2017-Review-Industrial-Control-System-Threats.pdf", - "https://www.cfr.org/interactive/cyber-operations/covellite" - ], - "since": "2017", - "synonyms": [ - "Lazarus", - "Hidden Cobra" - ], - "victimology": "Electric Utilities, US" - }, - "related": [ - { - "dest-uuid": "c93fccb1-e8e8-42cf-ae33-2ad1d183913a", - "tags": [ - "estimative-language:likelihood-probability=\"likely\"" - ], - "type": "similar" - }, - { - "dest-uuid": "68391641-859f-4a9a-9a1e-3e5cf71ec376", - "tags": [ - "estimative-language:likelihood-probability=\"likely\"" - ], - "type": "similar" - } - ], - "uuid": "027a1428-6e79-4a4b-82b9-e698e8525c2b", - "value": "COVELLITE" - }, { "description": "Adversaries abusing ICS (based on Dragos Inc adversary list).\nThis threat actor targets industrial control systems in Turkey, Europe, and North America.\n Believed to be linked to Crouching Yeti", "meta": { From a131a7ce984f5f0e67b1b5e0196d4db40550a698 Mon Sep 17 00:00:00 2001 From: StefanKelm Date: Wed, 20 Jan 2021 17:43:18 +0100 Subject: [PATCH 04/11] Update threat-actor.json Lazarus --- clusters/threat-actor.json | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 2ee4e58..0a1cdbc 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -3086,7 +3086,10 @@ "https://www.welivesecurity.com/2020/11/16/lazarus-supply-chain-attack-south-korea/", "https://dragos.com/adversaries.html", "https://dragos.com/media/2017-Review-Industrial-Control-System-Threats.pdf", - "https://www.cfr.org/interactive/cyber-operations/covellite" + "https://www.cfr.org/interactive/cyber-operations/covellite", + "https://www.hvs-consulting.de/lazarus-report/", + "https://github.com/hvs-consulting/ioc_signatures/tree/main/Lazarus_APT37", + "https://blogs.jpcert.or.jp/en/2021/01/Lazarus_tools.html" ], "synonyms": [ "Operation DarkSeoul", @@ -8439,5 +8442,5 @@ "value": "UNC2452" } ], - "version": 196 + "version": 197 } From 9df95031a7b2592c49a6f884ea2c38a921898bd1 Mon Sep 17 00:00:00 2001 From: Thomas Dupuy Date: Wed, 20 Jan 2021 13:27:51 -0500 Subject: [PATCH 05/11] Update ZxShell tool. --- clusters/tool.json | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/clusters/tool.json b/clusters/tool.json index f0d1983..ebebdb3 100644 --- a/clusters/tool.json +++ b/clusters/tool.json @@ -1736,9 +1736,12 @@ "value": "Tdrop2" }, { + "description": "ZxShell is a remote access trojan (RAT). It was developed in 2006 by the persona \"LZX\", who then publicly released the source code in 2007", "meta": { "refs": [ - "http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html" + "http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html", + "https://blogs.cisco.com/security/talos/opening-zxshell", + "https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox" ], "synonyms": [ "Sensode" @@ -8206,5 +8209,5 @@ "value": "Beds Protector" } ], - "version": 139 + "version": 140 } From f964514ec57eb03857a10e2d2364377f785bb440 Mon Sep 17 00:00:00 2001 From: Thomas Dupuy Date: Wed, 20 Jan 2021 13:44:28 -0500 Subject: [PATCH 06/11] Add HyperBro in tools --- clusters/tool.json | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/clusters/tool.json b/clusters/tool.json index ebebdb3..4bab6de 100644 --- a/clusters/tool.json +++ b/clusters/tool.json @@ -8207,6 +8207,20 @@ "related": [], "uuid": "5ce18513-bd12-4689-a705-634cf727162e", "value": "Beds Protector" + }, + { + "description": "HyperBro Trojan was used as last-stage in-memory remote administration tool (RAT).", + "meta": { + "refs": [ + "https://securelist.com/luckymouse-hits-national-data-center/86083/" + ], + "type": [ + "RAT" + ] + }, + "related": [], + "uuid": "e1bfe1d9-190c-4cf4-aec8-a8f2c41c7d8b", + "value": "HyperBro" } ], "version": 140 From fb35646406bb2625d413448cf007820c2977834a Mon Sep 17 00:00:00 2001 From: StefanKelm Date: Tue, 26 Jan 2021 14:38:37 +0100 Subject: [PATCH 07/11] Update threat-actor.json Lazarus --- clusters/threat-actor.json | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 0a1cdbc..24852b6 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -3089,7 +3089,8 @@ "https://www.cfr.org/interactive/cyber-operations/covellite", "https://www.hvs-consulting.de/lazarus-report/", "https://github.com/hvs-consulting/ioc_signatures/tree/main/Lazarus_APT37", - "https://blogs.jpcert.or.jp/en/2021/01/Lazarus_tools.html" + "https://blogs.jpcert.or.jp/en/2021/01/Lazarus_tools.html", + "https://blogs.jpcert.or.jp/en/2021/01/Lazarus_malware2.html" ], "synonyms": [ "Operation DarkSeoul", @@ -8442,5 +8443,5 @@ "value": "UNC2452" } ], - "version": 197 + "version": 198 } From 23778666bab2cdf17c5efa4202c387a271efe9e6 Mon Sep 17 00:00:00 2001 From: Koen Van Impe Date: Thu, 28 Jan 2021 10:03:12 +0100 Subject: [PATCH 08/11] RSIT Galaxy/Cluster --- clusters/rsit.json | 648 +++++++++++++++++++++++++++++++++++++++++++++ galaxies/rsit.json | 24 ++ 2 files changed, 672 insertions(+) create mode 100644 clusters/rsit.json create mode 100644 galaxies/rsit.json diff --git a/clusters/rsit.json b/clusters/rsit.json new file mode 100644 index 0000000..1afaac1 --- /dev/null +++ b/clusters/rsit.json @@ -0,0 +1,648 @@ +{ + "authors": [ + "Koen Van Impe" + ], + "category": "rsit", + "description": "rsit", + "name": "rsit", + "source": "https://github.com/enisaeu/Reference-Security-Incident-Taxonomy-Task-Force", + "type": "rsit", + "uuid": "ed3f9269-8f08-4f78-8aee-ce0028f41b61", + "values": [ + { + "cfr-type-of-incident": "Spam", + "description": "Or 'Unsolicited Bulk Email', this means that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having a functionally comparable content. This IOC refers to resources, which make up a SPAM infrastructure, be it a harvesters like address verification, URLs in spam e-mails etc.", + "meta": { + "kill_chain": [ + "RSIT:Abusive Content" + ] + }, + "related": [ + { + "dest-uuid": "a62a8db3-f23a-4d8f-afd6-9dbc77e7813b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b81d1a4a-c71d-457b-9e02-7ea885a56564", + "value": "Abusive Content:Spam" + }, + { + "cfr-type-of-incident": "Harmful Speech", + "description": "Discretization or discrimination of somebody, e.g. cyber stalking, racism or threats against one or more individuals.", + "meta": { + "kill_chain": [ + "RSIT:Abusive Content" + ] + }, + "uuid": "a5fb0564-7bb6-4478-9713-9c23085df32e", + "value": "Abusive Content:Harmful Speech" + }, + { + "cfr-type-of-incident": "(Child) Sexual Exploitation/Sexual/Violent Content", + "description": "Child Sexual Exploitation (CSE), Sexual content, glorification of violence, etc.", + "meta": { + "kill_chain": [ + "RSIT:Abusive Content" + ] + }, + "related": [ + { + "dest-uuid": "a62a8db3-f23a-4d8f-afd6-9dbc77e7813b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "abfbf4ae-a10a-43aa-9ef2-0dbbaac3c789", + "value": "Abusive Content:(Child) Sexual Exploitation/Sexual/Violent Content" + }, + { + "cfr-type-of-incident": "Infected System", + "description": "System infected with malware, e.g. PC, smartphone or server infected with a rootkit. Most often this refers to a connection to a sinkholed C2 server", + "meta": { + "kill_chain": [ + "RSIT:Malicious Code" + ] + }, + "uuid": "e841c237-e39c-4804-a780-f6fc4a2e6371", + "value": "Malicious Code:Infected System" + }, + { + "cfr-type-of-incident": "C2 Server", + "description": "Command-and-control server contacted by malware on infected systems.", + "meta": { + "kill_chain": [ + "RSIT:Malicious Code" + ] + }, + "related": [ + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9c1bbe1b-8f51-4edc-8974-eb049617d6d1", + "value": "Malicious Code:C2 Server" + }, + { + "cfr-type-of-incident": "Malware Distribution", + "description": "URI used for malware distribution, e.g. a download URL included in fake invoice malware spam or exploit-kits (on websites).", + "meta": { + "kill_chain": [ + "RSIT:Malicious Code" + ] + }, + "uuid": "4eb23762-69e1-45fb-9e4a-700e0c183ac5", + "value": "Malicious Code:Malware Distribution" + }, + { + "cfr-type-of-incident": "Malware Configuration", + "description": "URI hosting a malware configuration file, e.g. web-injects for a banking trojan.", + "meta": { + "kill_chain": [ + "RSIT:Malicious Code" + ] + }, + "uuid": "c6eb8e72-40cc-4fc6-b2ca-dc8ba88c8fa3", + "value": "Malicious Code:Malware Configuration" + }, + { + "cfr-type-of-incident": "Scanning", + "description": "Attacks that send requests to a system to discover weaknesses. This also includes testing processes to gather information on hosts, services and accounts. Examples: fingerd, DNS querying, ICMP, SMTP (EXPN, RCPT, ...), port scanning.", + "meta": { + "kill_chain": [ + "RSIT:Information Gathering" + ] + }, + "related": [ + { + "dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + }, + { + "dest-uuid": "67073dde-d720-45ae-83da-b12d5e73ca3b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + }, + { + "dest-uuid": "5502c4e9-24ef-4d5f-8ee9-9e906c2f82c4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1f09c97b-fee4-4376-b525-809bb61de579", + "value": "Information Gathering:Scanning" + }, + { + "cfr-type-of-incident": "Sniffing", + "description": "Observing and recording of network traffic (wiretapping).", + "meta": { + "kill_chain": [ + "RSIT:Information Gathering" + ] + }, + "related": [ + { + "dest-uuid": "3257eb21-f9a7-4430-8de1-d8b6e288f529", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + }, + { + "dest-uuid": "035bb001-ab69-4a0b-9f6c-2de8b09e1b9d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4958bdb2-8d0d-4bc7-8762-5a967a92868b", + "value": "Information Gathering:Sniffing" + }, + { + "cfr-type-of-incident": "Social Engineering", + "description": "Gathering information from a human being in a non-technical way (e.g. lies, tricks, bribes, or threats).", + "meta": { + "kill_chain": [ + "RSIT:Information Gathering" + ] + }, + "uuid": "a7d12859-b60f-4536-b356-fcaaf8234403", + "value": "Information Gathering:Social Engineering" + }, + { + "cfr-type-of-incident": "Exploitation of known Vulnerabilities", + "description": "An attempt to compromise a system or to disrupt any service by exploiting vulnerabilities with a standardised identifier such as CVE name (e.g. buffer overflow, backdoor, cross site scripting, etc.)", + "meta": { + "kill_chain": [ + "RSIT:Intrusion Attempts" + ] + }, + "related": [ + { + "dest-uuid": "3f886f2a-874f-4333-b794-aa6075009b1c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + }, + { + "dest-uuid": "be2dcee9-a7a7-4e38-afd6-21b31ecc3d63", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + }, + { + "dest-uuid": "fe926152-f431-4baf-956c-4ad3cb0bf23b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + }, + { + "dest-uuid": "9db0cf3a-a3c9-4012-8268-123b9db6fd82", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b0e536ba-dce3-430d-a7f6-bcf99ca6de44", + "value": "Intrusion Attempts:Exploitation of known Vulnerabilities" + }, + { + "cfr-type-of-incident": "Login attempts", + "description": "Multiple login attempts (Guessing / cracking of passwords, brute force). This IOC refers to a resource, which has been observed to perform brute-force attacks over a given application protocol.", + "meta": { + "kill_chain": [ + "RSIT:Intrusion Attempts" + ] + }, + "related": [ + { + "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + }, + { + "dest-uuid": "09c4c11e-4fa1-4f8c-8dad-3cf8e69ad119", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + }, + { + "dest-uuid": "1d24cdee-9ea2-4189-b08e-af110bf2435d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + }, + { + "dest-uuid": "692074ae-bb62-4a5e-a735-02cb6bde458c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + }, + { + "dest-uuid": "b2d03cea-aec1-45ca-9744-9ee583c1e1cc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f4b8f7d6-bccb-49ef-b478-66a77e2c2238", + "value": "Intrusion Attempts:Login attempts" + }, + { + "cfr-type-of-incident": "New attack signature", + "description": "An attack using an unknown exploit.", + "meta": { + "kill_chain": [ + "RSIT:Intrusion Attempts" + ] + }, + "uuid": "a2687bac-9a4f-4e90-a094-8b2f481ceaef", + "value": "Intrusion Attempts:New attack signature" + }, + { + "cfr-type-of-incident": "Privileged Account Compromise", + "description": "Compromise of a system where the attacker gained administrative privileges.", + "meta": { + "kill_chain": [ + "RSIT:Intrusions" + ] + }, + "related": [ + { + "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "68cf72aa-0125-445e-adf8-de0efe4a664c", + "value": "Intrusions:Privileged Account Compromise" + }, + { + "cfr-type-of-incident": "Unprivileged Account Compromise", + "description": "Compromise of a system using an unprivileged (user/service) account.", + "meta": { + "kill_chain": [ + "RSIT:Intrusions" + ] + }, + "related": [ + { + "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "bc82f61e-7a39-4d2f-bc86-4f8ec886af01", + "value": "Intrusions:Unprivileged Account Compromise" + }, + { + "cfr-type-of-incident": "Application Compromise", + "description": "Compromise of an application by exploiting (un-)known software vulnerabilities, e.g. SQL injection.", + "meta": { + "kill_chain": [ + "RSIT:Intrusions" + ] + }, + "related": [ + { + "dest-uuid": "3f886f2a-874f-4333-b794-aa6075009b1c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d12415bd-d965-4afe-94a3-e56e16c78004", + "value": "Intrusions:Application Compromise" + }, + { + "cfr-type-of-incident": "System Compromise", + "description": "Compromise of a system, e.g. unauthorised logins or commands. This includes compromising attempts on honeypot systems.", + "meta": { + "kill_chain": [ + "RSIT:Intrusions" + ] + }, + "uuid": "995f7028-9b13-4519-80f1-1b22f36aefb4", + "value": "Intrusions:System Compromise" + }, + { + "cfr-type-of-incident": "Burglary", + "description": "Physical intrusion, e.g. into corporate building or data-centre.", + "meta": { + "kill_chain": [ + "RSIT:Intrusions" + ] + }, + "uuid": "2720eeb7-4611-4330-b3da-2d3c9c5e6667", + "value": "Intrusions:Burglary" + }, + { + "cfr-type-of-incident": "Denial of Service", + "description": "Denial of Service attack, e.g. sending specially crafted requests to a web application which causes the application to crash or slow down.", + "meta": { + "kill_chain": [ + "RSIT:Availability" + ] + }, + "related": [ + { + "dest-uuid": "d74c4a7e-ffbf-432f-9365-7ebf1f787cab", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "28883628-32cc-4bc6-8142-c1fc2c01bd9e", + "value": "Availability:Denial of Service" + }, + { + "cfr-type-of-incident": "Distributed Denial of Service", + "description": "Distributed Denial of Service attack, e.g. SYN-Flood or UDP-based reflection/amplification attacks.", + "meta": { + "kill_chain": [ + "RSIT:Availability" + ] + }, + "related": [ + { + "dest-uuid": "d74c4a7e-ffbf-432f-9365-7ebf1f787cab", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ff14d9d0-c952-4995-9871-5aea332002c9", + "value": "Availability:Distributed Denial of Service" + }, + { + "cfr-type-of-incident": "Misconfiguration", + "description": "Software misconfiguration resulting in service availability issues, e.g. DNS server with outdated DNSSEC Root Zone KSK.", + "meta": { + "kill_chain": [ + "RSIT:Availability" + ] + }, + "uuid": "8e9f1fa4-e657-4311-a362-a80fdd0b7f33", + "value": "Availability:Misconfiguration" + }, + { + "cfr-type-of-incident": "Sabotage", + "description": "Physical sabotage, e.g cutting wires or malicious arson.", + "meta": { + "kill_chain": [ + "RSIT:Availability" + ] + }, + "uuid": "c63fcb56-69bb-4b35-a1ea-13d8f3272ae0", + "value": "Availability:Sabotage" + }, + { + "cfr-type-of-incident": "Outage", + "description": "Outage caused e.g. by air condition failure or natural disaster.", + "meta": { + "kill_chain": [ + "RSIT:Availability" + ] + }, + "uuid": "934a52bd-da26-4f62-9ec7-d21c01db2802", + "value": "Availability:Outage" + }, + { + "cfr-type-of-incident": "Unauthorised access to information", + "description": "Unauthorised access to information, e.g. by abusing stolen login credentials for a system or application, intercepting traffic or gaining access to physical documents.", + "meta": { + "kill_chain": [ + "RSIT:Information Content Security" + ] + }, + "uuid": "ddbaedeb-dc34-4f6b-a3b1-6337270cb175", + "value": "Information Content Security:Unauthorised access to information" + }, + { + "cfr-type-of-incident": "Unauthorised modification of information", + "description": "Unauthorised modification of information, e.g. by an attacker abusing stolen login credentials for a system or application or a ransomware encrypting data. Also includes defacements.", + "meta": { + "kill_chain": [ + "RSIT:Information Content Security" + ] + }, + "related": [ + { + "dest-uuid": "ac9e6b22-11bf-45d7-9181-c1cb08360931", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b6f82050-4732-46b4-b110-d582c553ed0f", + "value": "Information Content Security:Unauthorised modification of information" + }, + { + "cfr-type-of-incident": "Data Loss", + "description": "Loss of data, e.g. caused by harddisk failure or physical theft.", + "meta": { + "kill_chain": [ + "RSIT:Information Content Security" + ] + }, + "uuid": "d9c04af1-deb8-44a8-9085-7857d5a2015d", + "value": "Information Content Security:Data Loss" + }, + { + "cfr-type-of-incident": "Leak of confidential information", + "description": "Leaked confidential information like credentials or personal data.", + "meta": { + "kill_chain": [ + "RSIT:Information Content Security" + ] + }, + "uuid": "a49fcb43-c94e-4a13-b39e-ed34bfbe2633", + "value": "Information Content Security:Leak of confidential information" + }, + { + "cfr-type-of-incident": "Unauthorised use of resources", + "description": "Using resources for unauthorised purposes including profit-making ventures, e.g. the use of e-mail to participate in illegal profit chain letters or pyramid schemes.", + "meta": { + "kill_chain": [ + "RSIT:Fraud" + ] + }, + "uuid": "38f58cf2-e72c-4d8e-ac1f-9a5180aaad99", + "value": "Fraud:Unauthorised use of resources" + }, + { + "cfr-type-of-incident": "Copyright", + "description": "Offering or Installing copies of unlicensed commercial software or other copyright protected materials (Warez).", + "meta": { + "kill_chain": [ + "RSIT:Fraud" + ] + }, + "uuid": "99b749d8-f9c6-445b-82d5-3722f0d664dd", + "value": "Fraud:Copyright" + }, + { + "cfr-type-of-incident": "Masquerade", + "description": "Type of attack in which one entity illegitimately impersonates the identity of another in order to benefit from it.", + "meta": { + "kill_chain": [ + "RSIT:Fraud" + ] + }, + "uuid": "1057ec33-5932-4696-80b0-ad3ce26d6c23", + "value": "Fraud:Masquerade" + }, + { + "cfr-type-of-incident": "Phishing", + "description": "Masquerading as another entity in order to persuade the user to reveal private credentials. This IOC most often refers to a URL, which is used to phish user credentials.", + "meta": { + "kill_chain": [ + "RSIT:Fraud" + ] + }, + "related": [ + { + "dest-uuid": "a62a8db3-f23a-4d8f-afd6-9dbc77e7813b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9c16409a-2029-470e-8579-77d953b2c6d3", + "value": "Fraud:Phishing" + }, + { + "cfr-type-of-incident": "Weak crypto", + "description": "Publicly accessible services offering weak crypto, e.g. web servers susceptible to POODLE/FREAK attacks.", + "meta": { + "kill_chain": [ + "RSIT:Vulnerable" + ] + }, + "uuid": "c8ca2965-f8df-4a74-92b3-4a473608ef90", + "value": "Vulnerable:Weak crypto" + }, + { + "cfr-type-of-incident": "DDoS amplifier", + "description": "Publicly accessible services that can be abused for conducting DDoS reflection/amplification attacks, e.g. DNS open-resolvers or NTP servers with monlist enabled.", + "meta": { + "kill_chain": [ + "RSIT:Vulnerable" + ] + }, + "related": [ + { + "dest-uuid": "d74c4a7e-ffbf-432f-9365-7ebf1f787cab", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "41ee48e3-92e0-4f0c-b2f0-461325e149bc", + "value": "Vulnerable:DDoS amplifier" + }, + { + "cfr-type-of-incident": "Potentially unwanted accessible services", + "description": "Potentially unwanted publicly accessible services, e.g. Telnet, RDP or VNC.", + "meta": { + "kill_chain": [ + "RSIT:Vulnerable" + ] + }, + "uuid": "a2dbfb66-dc27-41e0-976f-4888dcab0cb3", + "value": "Vulnerable:Potentially unwanted accessible services" + }, + { + "cfr-type-of-incident": "Information disclosure", + "description": "Publicly accessible services potentially disclosing sensitive information, e.g. SNMP or Redis.", + "meta": { + "kill_chain": [ + "RSIT:Vulnerable" + ] + }, + "uuid": "609449a3-5951-42b4-a4cd-196e09a3120f", + "value": "Vulnerable:Information disclosure" + }, + { + "cfr-type-of-incident": "Vulnerable system", + "description": "A system which is vulnerable to certain attacks. Example: misconfigured client proxy settings (example: WPAD), outdated operating system version, XSS vulnerabilities, etc.", + "meta": { + "kill_chain": [ + "RSIT:Vulnerable" + ] + }, + "uuid": "4d1c5a5e-1244-457b-9e33-c0b1695d5e51", + "value": "Vulnerable:Vulnerable system" + }, + { + "cfr-type-of-incident": "Uncategorised", + "description": "All incidents which don't fit in one of the given categories should be put into this class or the incident is not categorised.", + "meta": { + "kill_chain": [ + "RSIT:Other" + ] + }, + "uuid": "88e0d210-0b5a-405d-a979-5375f6cb2d01", + "value": "Other:Uncategorised" + }, + { + "cfr-type-of-incident": "Undetermined", + "description": "The categorisation of the incident is unknown/undetermined.", + "meta": { + "kill_chain": [ + "RSIT:Other" + ] + }, + "uuid": "6bdbec29-d198-4031-a15e-33e8973c5f05", + "value": "Other:Undetermined" + }, + { + "cfr-type-of-incident": "Test", + "description": "Meant for testing.", + "meta": { + "kill_chain": [ + "RSIT:Test" + ] + }, + "uuid": "bdeb2700-cc42-4ccc-a3bc-950c6c495102", + "value": "Test:Test" + } + ], + "version": 1 +} diff --git a/galaxies/rsit.json b/galaxies/rsit.json new file mode 100644 index 0000000..bbef760 --- /dev/null +++ b/galaxies/rsit.json @@ -0,0 +1,24 @@ +{ + "description": "Reference Security Incident Classification Taxonomy", + "icon": "map", + "kill_chain_order": { + "RSIT": [ + "Abusive Content", + "Malicious Code", + "Information Gathering", + "Intrusion Attempts", + "Intrusions", + "Availability", + "Information Content Security", + "Fraud", + "Vulnerable", + "Other", + "Test" + ] + }, + "name": "Reference Security Incident Classification Taxonomy", + "namespace": "RSIT", + "type": "rsit", + "uuid": "97eb5924-b784-437a-9110-6ed07d587fc4", + "version": 1 +} From 87b22f363c81e16c5e4fc22982ce6bb5091fbae1 Mon Sep 17 00:00:00 2001 From: Koen Van Impe Date: Thu, 28 Jan 2021 12:25:39 +0100 Subject: [PATCH 09/11] Move cfr-type-of-incident to meta --- clusters/rsit.json | 158 ++++++++++++++++++++++----------------------- galaxies/rsit.json | 2 +- 2 files changed, 80 insertions(+), 80 deletions(-) diff --git a/clusters/rsit.json b/clusters/rsit.json index 1afaac1..55cd996 100644 --- a/clusters/rsit.json +++ b/clusters/rsit.json @@ -7,12 +7,12 @@ "name": "rsit", "source": "https://github.com/enisaeu/Reference-Security-Incident-Taxonomy-Task-Force", "type": "rsit", - "uuid": "ed3f9269-8f08-4f78-8aee-ce0028f41b61", + "uuid": "9da6e48a-5475-4f1b-af54-f917ec72d995", "values": [ { - "cfr-type-of-incident": "Spam", "description": "Or 'Unsolicited Bulk Email', this means that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having a functionally comparable content. This IOC refers to resources, which make up a SPAM infrastructure, be it a harvesters like address verification, URLs in spam e-mails etc.", "meta": { + "cfr-type-of-incident": "Spam", "kill_chain": [ "RSIT:Abusive Content" ] @@ -26,24 +26,24 @@ "type": "similar" } ], - "uuid": "b81d1a4a-c71d-457b-9e02-7ea885a56564", + "uuid": "bae9e253-9515-4f1f-b34f-e8fc6747c2e0", "value": "Abusive Content:Spam" }, { - "cfr-type-of-incident": "Harmful Speech", "description": "Discretization or discrimination of somebody, e.g. cyber stalking, racism or threats against one or more individuals.", "meta": { + "cfr-type-of-incident": "Harmful Speech", "kill_chain": [ "RSIT:Abusive Content" ] }, - "uuid": "a5fb0564-7bb6-4478-9713-9c23085df32e", + "uuid": "a54e52f9-0335-43da-8878-bb60a710d56c", "value": "Abusive Content:Harmful Speech" }, { - "cfr-type-of-incident": "(Child) Sexual Exploitation/Sexual/Violent Content", "description": "Child Sexual Exploitation (CSE), Sexual content, glorification of violence, etc.", "meta": { + "cfr-type-of-incident": "(Child) Sexual Exploitation/Sexual/Violent Content", "kill_chain": [ "RSIT:Abusive Content" ] @@ -57,24 +57,24 @@ "type": "similar" } ], - "uuid": "abfbf4ae-a10a-43aa-9ef2-0dbbaac3c789", + "uuid": "15bd72f9-5ebc-4fef-8fbf-32c2d848f076", "value": "Abusive Content:(Child) Sexual Exploitation/Sexual/Violent Content" }, { - "cfr-type-of-incident": "Infected System", "description": "System infected with malware, e.g. PC, smartphone or server infected with a rootkit. Most often this refers to a connection to a sinkholed C2 server", "meta": { + "cfr-type-of-incident": "Infected System", "kill_chain": [ "RSIT:Malicious Code" ] }, - "uuid": "e841c237-e39c-4804-a780-f6fc4a2e6371", + "uuid": "aa3e1167-566c-43c2-afc0-f62f557689c6", "value": "Malicious Code:Infected System" }, { - "cfr-type-of-incident": "C2 Server", "description": "Command-and-control server contacted by malware on infected systems.", "meta": { + "cfr-type-of-incident": "C2 Server", "kill_chain": [ "RSIT:Malicious Code" ] @@ -88,35 +88,35 @@ "type": "similar" } ], - "uuid": "9c1bbe1b-8f51-4edc-8974-eb049617d6d1", + "uuid": "85b1f79e-49e7-4501-9b5c-a39ffce47428", "value": "Malicious Code:C2 Server" }, { - "cfr-type-of-incident": "Malware Distribution", "description": "URI used for malware distribution, e.g. a download URL included in fake invoice malware spam or exploit-kits (on websites).", "meta": { + "cfr-type-of-incident": "Malware Distribution", "kill_chain": [ "RSIT:Malicious Code" ] }, - "uuid": "4eb23762-69e1-45fb-9e4a-700e0c183ac5", + "uuid": "dd1b8e11-cec5-48d0-aaf2-a3d099a96c42", "value": "Malicious Code:Malware Distribution" }, { - "cfr-type-of-incident": "Malware Configuration", "description": "URI hosting a malware configuration file, e.g. web-injects for a banking trojan.", "meta": { + "cfr-type-of-incident": "Malware Configuration", "kill_chain": [ "RSIT:Malicious Code" ] }, - "uuid": "c6eb8e72-40cc-4fc6-b2ca-dc8ba88c8fa3", + "uuid": "0a6d604c-e78a-417e-b557-808c2ce260c3", "value": "Malicious Code:Malware Configuration" }, { - "cfr-type-of-incident": "Scanning", "description": "Attacks that send requests to a system to discover weaknesses. This also includes testing processes to gather information on hosts, services and accounts. Examples: fingerd, DNS querying, ICMP, SMTP (EXPN, RCPT, ...), port scanning.", "meta": { + "cfr-type-of-incident": "Scanning", "kill_chain": [ "RSIT:Information Gathering" ] @@ -144,13 +144,13 @@ "type": "similar" } ], - "uuid": "1f09c97b-fee4-4376-b525-809bb61de579", + "uuid": "5c96ebd0-d77f-479c-bc8f-247038f901f0", "value": "Information Gathering:Scanning" }, { - "cfr-type-of-incident": "Sniffing", "description": "Observing and recording of network traffic (wiretapping).", "meta": { + "cfr-type-of-incident": "Sniffing", "kill_chain": [ "RSIT:Information Gathering" ] @@ -171,24 +171,24 @@ "type": "similar" } ], - "uuid": "4958bdb2-8d0d-4bc7-8762-5a967a92868b", + "uuid": "8fda8ab1-077e-43b4-9284-880921ea0b86", "value": "Information Gathering:Sniffing" }, { - "cfr-type-of-incident": "Social Engineering", "description": "Gathering information from a human being in a non-technical way (e.g. lies, tricks, bribes, or threats).", "meta": { + "cfr-type-of-incident": "Social Engineering", "kill_chain": [ "RSIT:Information Gathering" ] }, - "uuid": "a7d12859-b60f-4536-b356-fcaaf8234403", + "uuid": "33a950d3-cc97-4589-b8cf-db8ca6140ea2", "value": "Information Gathering:Social Engineering" }, { - "cfr-type-of-incident": "Exploitation of known Vulnerabilities", "description": "An attempt to compromise a system or to disrupt any service by exploiting vulnerabilities with a standardised identifier such as CVE name (e.g. buffer overflow, backdoor, cross site scripting, etc.)", "meta": { + "cfr-type-of-incident": "Exploitation of known Vulnerabilities", "kill_chain": [ "RSIT:Intrusion Attempts" ] @@ -223,13 +223,13 @@ "type": "similar" } ], - "uuid": "b0e536ba-dce3-430d-a7f6-bcf99ca6de44", + "uuid": "ae99314d-0810-4b46-8ee8-4af7cdb146d0", "value": "Intrusion Attempts:Exploitation of known Vulnerabilities" }, { - "cfr-type-of-incident": "Login attempts", "description": "Multiple login attempts (Guessing / cracking of passwords, brute force). This IOC refers to a resource, which has been observed to perform brute-force attacks over a given application protocol.", "meta": { + "cfr-type-of-incident": "Login attempts", "kill_chain": [ "RSIT:Intrusion Attempts" ] @@ -271,24 +271,24 @@ "type": "similar" } ], - "uuid": "f4b8f7d6-bccb-49ef-b478-66a77e2c2238", + "uuid": "0cc1cf66-a838-4bdd-ace1-2da34a93520c", "value": "Intrusion Attempts:Login attempts" }, { - "cfr-type-of-incident": "New attack signature", "description": "An attack using an unknown exploit.", "meta": { + "cfr-type-of-incident": "New attack signature", "kill_chain": [ "RSIT:Intrusion Attempts" ] }, - "uuid": "a2687bac-9a4f-4e90-a094-8b2f481ceaef", + "uuid": "8ae29dc9-a208-4d7e-b79b-2573790df212", "value": "Intrusion Attempts:New attack signature" }, { - "cfr-type-of-incident": "Privileged Account Compromise", "description": "Compromise of a system where the attacker gained administrative privileges.", "meta": { + "cfr-type-of-incident": "Privileged Account Compromise", "kill_chain": [ "RSIT:Intrusions" ] @@ -302,13 +302,13 @@ "type": "similar" } ], - "uuid": "68cf72aa-0125-445e-adf8-de0efe4a664c", + "uuid": "dea60439-7e04-4af8-aeab-2840893195f7", "value": "Intrusions:Privileged Account Compromise" }, { - "cfr-type-of-incident": "Unprivileged Account Compromise", "description": "Compromise of a system using an unprivileged (user/service) account.", "meta": { + "cfr-type-of-incident": "Unprivileged Account Compromise", "kill_chain": [ "RSIT:Intrusions" ] @@ -322,13 +322,13 @@ "type": "similar" } ], - "uuid": "bc82f61e-7a39-4d2f-bc86-4f8ec886af01", + "uuid": "f1b691cb-2824-4e3a-9d5b-76aea4a087db", "value": "Intrusions:Unprivileged Account Compromise" }, { - "cfr-type-of-incident": "Application Compromise", "description": "Compromise of an application by exploiting (un-)known software vulnerabilities, e.g. SQL injection.", "meta": { + "cfr-type-of-incident": "Application Compromise", "kill_chain": [ "RSIT:Intrusions" ] @@ -342,35 +342,35 @@ "type": "similar" } ], - "uuid": "d12415bd-d965-4afe-94a3-e56e16c78004", + "uuid": "b0980068-8827-4bde-83c4-9ad70bc675e9", "value": "Intrusions:Application Compromise" }, { - "cfr-type-of-incident": "System Compromise", "description": "Compromise of a system, e.g. unauthorised logins or commands. This includes compromising attempts on honeypot systems.", "meta": { + "cfr-type-of-incident": "System Compromise", "kill_chain": [ "RSIT:Intrusions" ] }, - "uuid": "995f7028-9b13-4519-80f1-1b22f36aefb4", + "uuid": "f380a50f-3cdf-4ceb-ab75-bb046f0c03cc", "value": "Intrusions:System Compromise" }, { - "cfr-type-of-incident": "Burglary", "description": "Physical intrusion, e.g. into corporate building or data-centre.", "meta": { + "cfr-type-of-incident": "Burglary", "kill_chain": [ "RSIT:Intrusions" ] }, - "uuid": "2720eeb7-4611-4330-b3da-2d3c9c5e6667", + "uuid": "17c92ab0-831f-4fec-944d-1faeb8c55e7b", "value": "Intrusions:Burglary" }, { - "cfr-type-of-incident": "Denial of Service", "description": "Denial of Service attack, e.g. sending specially crafted requests to a web application which causes the application to crash or slow down.", "meta": { + "cfr-type-of-incident": "Denial of Service", "kill_chain": [ "RSIT:Availability" ] @@ -384,13 +384,13 @@ "type": "similar" } ], - "uuid": "28883628-32cc-4bc6-8142-c1fc2c01bd9e", + "uuid": "ccec8e6a-c316-485c-99f1-84e2ab0162e7", "value": "Availability:Denial of Service" }, { - "cfr-type-of-incident": "Distributed Denial of Service", "description": "Distributed Denial of Service attack, e.g. SYN-Flood or UDP-based reflection/amplification attacks.", "meta": { + "cfr-type-of-incident": "Distributed Denial of Service", "kill_chain": [ "RSIT:Availability" ] @@ -404,57 +404,57 @@ "type": "similar" } ], - "uuid": "ff14d9d0-c952-4995-9871-5aea332002c9", + "uuid": "bef4187f-1176-4551-83d8-8a1ba9987379", "value": "Availability:Distributed Denial of Service" }, { - "cfr-type-of-incident": "Misconfiguration", "description": "Software misconfiguration resulting in service availability issues, e.g. DNS server with outdated DNSSEC Root Zone KSK.", "meta": { + "cfr-type-of-incident": "Misconfiguration", "kill_chain": [ "RSIT:Availability" ] }, - "uuid": "8e9f1fa4-e657-4311-a362-a80fdd0b7f33", + "uuid": "6e004e50-54b0-4ad0-aced-b790226a7de9", "value": "Availability:Misconfiguration" }, { - "cfr-type-of-incident": "Sabotage", "description": "Physical sabotage, e.g cutting wires or malicious arson.", "meta": { + "cfr-type-of-incident": "Sabotage", "kill_chain": [ "RSIT:Availability" ] }, - "uuid": "c63fcb56-69bb-4b35-a1ea-13d8f3272ae0", + "uuid": "bd3d6608-0693-420f-a476-af460e3d0bf1", "value": "Availability:Sabotage" }, { - "cfr-type-of-incident": "Outage", "description": "Outage caused e.g. by air condition failure or natural disaster.", "meta": { + "cfr-type-of-incident": "Outage", "kill_chain": [ "RSIT:Availability" ] }, - "uuid": "934a52bd-da26-4f62-9ec7-d21c01db2802", + "uuid": "599dd157-848b-4020-ba96-fa2b053be448", "value": "Availability:Outage" }, { - "cfr-type-of-incident": "Unauthorised access to information", "description": "Unauthorised access to information, e.g. by abusing stolen login credentials for a system or application, intercepting traffic or gaining access to physical documents.", "meta": { + "cfr-type-of-incident": "Unauthorised access to information", "kill_chain": [ "RSIT:Information Content Security" ] }, - "uuid": "ddbaedeb-dc34-4f6b-a3b1-6337270cb175", + "uuid": "3c938a8d-0d0c-4b42-81dd-9c11011596c3", "value": "Information Content Security:Unauthorised access to information" }, { - "cfr-type-of-incident": "Unauthorised modification of information", "description": "Unauthorised modification of information, e.g. by an attacker abusing stolen login credentials for a system or application or a ransomware encrypting data. Also includes defacements.", "meta": { + "cfr-type-of-incident": "Unauthorised modification of information", "kill_chain": [ "RSIT:Information Content Security" ] @@ -468,68 +468,68 @@ "type": "similar" } ], - "uuid": "b6f82050-4732-46b4-b110-d582c553ed0f", + "uuid": "02fb1edd-59a5-4a2f-a48c-5f1d66b2c6cf", "value": "Information Content Security:Unauthorised modification of information" }, { - "cfr-type-of-incident": "Data Loss", "description": "Loss of data, e.g. caused by harddisk failure or physical theft.", "meta": { + "cfr-type-of-incident": "Data Loss", "kill_chain": [ "RSIT:Information Content Security" ] }, - "uuid": "d9c04af1-deb8-44a8-9085-7857d5a2015d", + "uuid": "b0d64016-8546-45a7-8853-6716a2f1f811", "value": "Information Content Security:Data Loss" }, { - "cfr-type-of-incident": "Leak of confidential information", "description": "Leaked confidential information like credentials or personal data.", "meta": { + "cfr-type-of-incident": "Leak of confidential information", "kill_chain": [ "RSIT:Information Content Security" ] }, - "uuid": "a49fcb43-c94e-4a13-b39e-ed34bfbe2633", + "uuid": "d3b4c23d-3c4d-4d0a-bf9b-3b4d3b005c66", "value": "Information Content Security:Leak of confidential information" }, { - "cfr-type-of-incident": "Unauthorised use of resources", "description": "Using resources for unauthorised purposes including profit-making ventures, e.g. the use of e-mail to participate in illegal profit chain letters or pyramid schemes.", "meta": { + "cfr-type-of-incident": "Unauthorised use of resources", "kill_chain": [ "RSIT:Fraud" ] }, - "uuid": "38f58cf2-e72c-4d8e-ac1f-9a5180aaad99", + "uuid": "6614e73f-dff9-49fb-9a9b-586862bd648f", "value": "Fraud:Unauthorised use of resources" }, { - "cfr-type-of-incident": "Copyright", "description": "Offering or Installing copies of unlicensed commercial software or other copyright protected materials (Warez).", "meta": { + "cfr-type-of-incident": "Copyright", "kill_chain": [ "RSIT:Fraud" ] }, - "uuid": "99b749d8-f9c6-445b-82d5-3722f0d664dd", + "uuid": "0f297d48-b06d-47fe-8ab0-3652581c6ade", "value": "Fraud:Copyright" }, { - "cfr-type-of-incident": "Masquerade", "description": "Type of attack in which one entity illegitimately impersonates the identity of another in order to benefit from it.", "meta": { + "cfr-type-of-incident": "Masquerade", "kill_chain": [ "RSIT:Fraud" ] }, - "uuid": "1057ec33-5932-4696-80b0-ad3ce26d6c23", + "uuid": "06f24b83-7a24-448c-9114-f1b3afcd0b3f", "value": "Fraud:Masquerade" }, { - "cfr-type-of-incident": "Phishing", "description": "Masquerading as another entity in order to persuade the user to reveal private credentials. This IOC most often refers to a URL, which is used to phish user credentials.", "meta": { + "cfr-type-of-incident": "Phishing", "kill_chain": [ "RSIT:Fraud" ] @@ -543,24 +543,24 @@ "type": "similar" } ], - "uuid": "9c16409a-2029-470e-8579-77d953b2c6d3", + "uuid": "d6ceeb8e-a17b-43b1-bad6-5a81192e2ebd", "value": "Fraud:Phishing" }, { - "cfr-type-of-incident": "Weak crypto", "description": "Publicly accessible services offering weak crypto, e.g. web servers susceptible to POODLE/FREAK attacks.", "meta": { + "cfr-type-of-incident": "Weak crypto", "kill_chain": [ "RSIT:Vulnerable" ] }, - "uuid": "c8ca2965-f8df-4a74-92b3-4a473608ef90", + "uuid": "13fad3df-5134-49d3-8a1a-efc693f3599c", "value": "Vulnerable:Weak crypto" }, { - "cfr-type-of-incident": "DDoS amplifier", "description": "Publicly accessible services that can be abused for conducting DDoS reflection/amplification attacks, e.g. DNS open-resolvers or NTP servers with monlist enabled.", "meta": { + "cfr-type-of-incident": "DDoS amplifier", "kill_chain": [ "RSIT:Vulnerable" ] @@ -574,73 +574,73 @@ "type": "similar" } ], - "uuid": "41ee48e3-92e0-4f0c-b2f0-461325e149bc", + "uuid": "e476bbab-662a-4318-9b71-9d1862baf727", "value": "Vulnerable:DDoS amplifier" }, { - "cfr-type-of-incident": "Potentially unwanted accessible services", "description": "Potentially unwanted publicly accessible services, e.g. Telnet, RDP or VNC.", "meta": { + "cfr-type-of-incident": "Potentially unwanted accessible services", "kill_chain": [ "RSIT:Vulnerable" ] }, - "uuid": "a2dbfb66-dc27-41e0-976f-4888dcab0cb3", + "uuid": "7934ae88-0a0a-4e1c-91b4-6d95182b4dbc", "value": "Vulnerable:Potentially unwanted accessible services" }, { - "cfr-type-of-incident": "Information disclosure", "description": "Publicly accessible services potentially disclosing sensitive information, e.g. SNMP or Redis.", "meta": { + "cfr-type-of-incident": "Information disclosure", "kill_chain": [ "RSIT:Vulnerable" ] }, - "uuid": "609449a3-5951-42b4-a4cd-196e09a3120f", + "uuid": "67686969-ad06-400b-bed3-1b0126599bd1", "value": "Vulnerable:Information disclosure" }, { - "cfr-type-of-incident": "Vulnerable system", "description": "A system which is vulnerable to certain attacks. Example: misconfigured client proxy settings (example: WPAD), outdated operating system version, XSS vulnerabilities, etc.", "meta": { + "cfr-type-of-incident": "Vulnerable system", "kill_chain": [ "RSIT:Vulnerable" ] }, - "uuid": "4d1c5a5e-1244-457b-9e33-c0b1695d5e51", + "uuid": "1a27c5d3-1920-4d49-89e2-644f8b130380", "value": "Vulnerable:Vulnerable system" }, { - "cfr-type-of-incident": "Uncategorised", "description": "All incidents which don't fit in one of the given categories should be put into this class or the incident is not categorised.", "meta": { + "cfr-type-of-incident": "Uncategorised", "kill_chain": [ "RSIT:Other" ] }, - "uuid": "88e0d210-0b5a-405d-a979-5375f6cb2d01", + "uuid": "fc39b7d5-575c-4a16-8507-d8a1c1e1589c", "value": "Other:Uncategorised" }, { - "cfr-type-of-incident": "Undetermined", "description": "The categorisation of the incident is unknown/undetermined.", "meta": { + "cfr-type-of-incident": "Undetermined", "kill_chain": [ "RSIT:Other" ] }, - "uuid": "6bdbec29-d198-4031-a15e-33e8973c5f05", + "uuid": "cf73ef8a-5c48-4341-811c-611c7ff1ec8c", "value": "Other:Undetermined" }, { - "cfr-type-of-incident": "Test", "description": "Meant for testing.", "meta": { + "cfr-type-of-incident": "Test", "kill_chain": [ "RSIT:Test" ] }, - "uuid": "bdeb2700-cc42-4ccc-a3bc-950c6c495102", + "uuid": "10f3f13f-52df-4f38-9940-c879d332261b", "value": "Test:Test" } ], diff --git a/galaxies/rsit.json b/galaxies/rsit.json index bbef760..e463dfa 100644 --- a/galaxies/rsit.json +++ b/galaxies/rsit.json @@ -19,6 +19,6 @@ "name": "Reference Security Incident Classification Taxonomy", "namespace": "RSIT", "type": "rsit", - "uuid": "97eb5924-b784-437a-9110-6ed07d587fc4", + "uuid": "ddff602c-d2a3-431e-b9e2-2eb5a39a6473", "version": 1 } From d61e7d2fac447fcbc7f18640ea78c27874941d93 Mon Sep 17 00:00:00 2001 From: Daniel Plohmann Date: Fri, 29 Jan 2021 10:39:18 +0100 Subject: [PATCH 10/11] adding ClearSky alias for Volatile Cedar adding ClearSky report as source and alias to the VolatileCedar entry. As proof from the report: "We attributed the operation to Lebanese Cedar (also known as Volatile Cedar), mainly based on the code overlaps between the 2015 variants of Explosive RAT and Caterpillar WebShell, to the 2020 variants of these malicious files." --- clusters/threat-actor.json | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 24852b6..2fd7c74 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -3918,12 +3918,14 @@ "refs": [ "https://blog.checkpoint.com/2015/03/31/volatilecedar/", "https://blog.checkpoint.com/2015/06/09/new-data-volatile-cedar/", - "https://securelist.com/sinkholing-volatile-cedar-dga-infrastructure/69421/" + "https://securelist.com/sinkholing-volatile-cedar-dga-infrastructure/69421/", + "https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf" ], "synonyms": [ "Reuse team", "Malware reusers", - "Dancing Salome" + "Dancing Salome", + "Lebanese Cedar" ] }, "uuid": "cf421ce6-ddfe-419a-bc65-6a9fc953232a", From 38a0d2d32d77bdd1757c3b6494c31559c43cbf62 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Fri, 29 Jan 2021 16:43:26 +0100 Subject: [PATCH 11/11] chg: [rsit] rsit as galaxy name --- galaxies/rsit.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/galaxies/rsit.json b/galaxies/rsit.json index e463dfa..82a1578 100644 --- a/galaxies/rsit.json +++ b/galaxies/rsit.json @@ -16,7 +16,7 @@ "Test" ] }, - "name": "Reference Security Incident Classification Taxonomy", + "name": "rsit", "namespace": "RSIT", "type": "rsit", "uuid": "ddff602c-d2a3-431e-b9e2-2eb5a39a6473",