MISP
/
misp-galaxy
mirror of https://github.com/MISP/misp-galaxy
2
0
Fork 0
Code Issues Releases Wiki Activity
2,977 Commits
6 Branches
46 Tags
32 MiB
Commit Graph

2977 Commits (ecb7e79a6e8777a8deede5e5ac692c66196807d6)

Author SHA1 Message Date
Delta-Sierra ecb7e79a6e Merge https://github.com/MISP/misp-galaxy 2023-04-19 15:06:51 +02:00
Alexandre Dulaunoy 4277fd393e
Merge pull request #842 from neok0/main 
replace "sector" tag with "country" for matching data. this allows to…
 2023-04-19 14:43:33 +02:00
Tobias Mainka 8d2b9537f1
replace "sector" tag with "country" for matching data. this allows to be confirm with existing clusters. 2023-04-19 12:38:37 +02:00
Alexandre Dulaunoy ccc8f0f801
chg: [microsoft-activity-group] updated to map the new funky Microsoft "taxonomy" 
Script to generate the cluster is the following, UUIDv5 based on
standard misp-stix source UUIDv4.

~~~python
lcluster = []
for v in data:
    cluster = {}
    cluster['value'] = v['threat_actor']
    cluster['meta'] = {}
    cluster['meta']['sector'] = v['sector']
    cluster['meta']['synonyms'] = v['synonyms']
    cluster['meta']['refs'] = []
    cluster['meta']['refs'].append('https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide')
    _uuid = uuid.uuid5(uuid.UUID("76beed5f-7251-457e-8c2a-b45f7b589d3d"), "{}".format(cluster['value']))
    cluster['uuid'] = str(_uuid)
    lcluster.append(cluster)
~~~

Relationships might be added in a later stage to map with the MISP threat actor galaxy.
 2023-04-19 10:47:11 +02:00
Alexandre Dulaunoy 76ff618d60
Merge pull request #840 from danielplohmann/patch-33 
adding Trend Micro alias Earth Smilodon for APT27
 2023-04-18 23:13:16 +02:00
Daniel Plohmann 41afab1c06
adding Trend Micro alias Earth Smilodon for APT27 2023-04-18 20:11:57 +02:00
Delta-Sierra 6b8994271e add relationships for HALFRIG & QUATTERRIG 2023-04-18 12:20:20 +02:00
Alexandre Dulaunoy dd9e033ce5
Merge pull request #839 from danielplohmann/patch-32 
adding Google alias HOODOO for APT41
 2023-04-17 22:52:14 +02:00
Daniel Plohmann 02e23a9a47
adding Google alias HOODOO for APT41 2023-04-17 22:32:50 +02:00
Delta-Sierra 4a4fa6d16f fix versions 2023-04-17 11:32:51 +02:00
Delta-Sierra 6d5df91efa add relationship SNOWYAMBER & Notion 2023-04-17 11:31:48 +02:00
Delta-Sierra 233a066a03 Merge https://github.com/MISP/misp-galaxy 2023-04-17 11:16:23 +02:00
Delta-Sierra d4225c5469 add some SNOWYAMBER relationships 2023-04-17 11:16:21 +02:00
Alexandre Dulaunoy 91af071bae
new: [online-service] online service added 2023-04-17 10:59:18 +02:00
Alexandre Dulaunoy 5f9760923f
Merge pull request #838 from Delta-Sierra/main 
Adding SNOWYAMBER, HALFRIG, QUARTERRIG tools & PowerMagic backdoor
 2023-04-14 16:03:57 +02:00
Delta-Sierra 8e9880d932 Add SNOWYAMBER, HALFRIG, QUARTERRIG tools 2023-04-14 15:59:42 +02:00
Delta-Sierra c5590ff79a add PowerMagic backdoor 2023-04-13 14:11:36 +02:00
Alexandre Dulaunoy c0cde98818
Merge pull request #835 from danielplohmann/patch-31 
adding Trend Micro alias Earth Preta for Mustang Panda
 2023-04-12 17:49:45 +02:00
Daniel Plohmann a966b3ff88
adding Trend Micro alias Earth Preta for Mustang Panda 2023-04-12 16:59:36 +02:00
Alexandre Dulaunoy 2763cdd72b
chg:[sigma] Sigma rules updated 2023-04-12 11:44:43 +02:00
Alexandre Dulaunoy f877cb4d08
Merge pull request #834 from Delta-Sierra/main 
more ransomwares from ransomlook
 2023-04-12 10:17:24 +02:00
Delta-Sierra 8c831d70c8 jq 2023-04-11 15:06:59 +02:00
Delta-Sierra d30e7357fe merge 2023-04-11 13:57:30 +02:00
Delta-Sierra eb9254713a Add more ransomwares from ransomlook 2023-04-11 13:56:29 +02:00
Alexandre Dulaunoy 3cc7e03af6
new: [stealer] add Sordeal Stealer 2023-04-11 09:54:02 +02:00
Alexandre Dulaunoy cbf12d9289
Merge pull request #833 from jloehel/HinataBot 
chg[botnet]: Add HinataBot
 2023-04-04 10:17:07 +02:00
Jürgen Löhel 647fc025d7
chg[botnet]: Add HinataBot 
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
 2023-04-03 11:19:08 -06:00
Alexandre Dulaunoy 52db030362
chg: [doc] index updated 2023-03-29 10:38:42 +02:00
Alexandre Dulaunoy 15a03e877e
chg: [sigma] updated 2023-03-29 10:33:57 +02:00
Christophe Vandeplas f817f694d6
Merge pull request #830 from sebdraven/main 
chg: [threat-actor] added ref to Aoqin Dragon
 2023-03-22 03:19:24 +00:00
Sebdraven d5843d46e2 Update threat-actor.json 
add ref to Aoqin Dragon
 2023-03-21 18:40:10 +01:00
Alexandre Dulaunoy 122a0bd39b
fix: [ransomware] fix duplicate Value "Cuba" 2023-03-19 11:03:12 +01:00
Alexandre Dulaunoy f2305dc165
Merge pull request #829 from Delta-Sierra/main 
update based on ransomlook+1
 2023-03-16 19:18:54 +01:00
Delta-Sierra 12f69a6082 update based on ransomlook 2023-03-16 15:24:44 +01:00
Alexandre Dulaunoy 1dd3c2efdd
Merge pull request #828 from Mathieu4141/threat-actors/add-anonymous-suddan 
[threat-actors] Add Anonymous Sudan
 2023-03-16 08:42:16 +01:00
Mathieu Beligon d82ff1ecfb [threat-actors] Add Anonymous Sudan 2023-03-15 17:38:03 -05:00
Alexandre Dulaunoy 1cadb52866
Merge pull request #827 from danielplohmann/patch-30 
add sofacy alias to apt28
 2023-03-15 22:56:32 +01:00
Daniel Plohmann c39b46e9d5
Update threat-actor.json 
when value "Sofacy" was changed to "APT28", it seems Sofacy was not added to aliases, so it's missing right now.
 2023-03-15 14:55:25 +01:00
Delta-Sierra 74390b27c5 Merge https://github.com/MISP/misp-galaxy 2023-03-13 09:59:04 +01:00
Delta-Sierra c4eca7dfe1 more from ransomlook 2023-03-13 09:59:00 +01:00
Alexandre Dulaunoy 963a389216
Merge pull request #826 from jloehel/wasabi 
[Proofpoint] [Campaign] Screentime
 2023-03-09 06:37:13 +01:00
Jürgen Löhel 9f9a263394
chg [tool]: Add tools used by TA866 during the Screentime campaign 
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
 2023-03-08 21:46:11 -06:00
Jürgen Löhel 031a4c8030
chg [stealer]: Add Rhadamanthys 
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
 2023-03-08 21:45:39 -06:00
Jürgen Löhel 437d4a30e5
chg [tds]: Add 404 TDS 
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
 2023-03-08 21:45:13 -06:00
Jürgen Löhel 2d30785af5
chg [threat-actors] Add TA866 
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
 2023-03-08 21:44:16 -06:00
Alexandre Dulaunoy 57f3e46273
chg: [sigma] updated 2023-03-07 12:14:48 +01:00
Alexandre Dulaunoy e7b97edaa4
chg: [ransomware] fixing duplicate cluster element Avaddon 2023-03-07 12:06:56 +01:00
Alexandre Dulaunoy 6db5b0b0cb
Merge pull request #824 from Delta-Sierra/main 
update based on ransomlook
 2023-03-06 16:23:48 +01:00
Delta-Sierra bed6bf8dd6 fix stupid duplicate-bis 2023-03-06 16:10:23 +01:00
Delta-Sierra d561350f7b fix stupid duplicate 2023-03-06 16:04:28 +01:00