MISP
/
misp-galaxy
mirror of https://github.com/MISP/misp-galaxy
2
0
Fork 0
Code Issues Releases Wiki Activity
3,526 Commits
6 Branches
47 Tags
57 MiB
Commit Graph

3526 Commits (f58c20fc20f92cfda8de9e43d8071d95a34c67a9)

Author SHA1 Message Date
Alexandre Dulaunoy 810cbe5b49
chg: [sigma] updated to the latest version 2023-05-11 10:27:48 +02:00
Alexandre Dulaunoy a27fda701b
Merge pull request #849 from danielplohmann/patch-34 
adding APT43 (Mandiant) for Kimsuky.
 2023-05-09 18:29:34 +02:00
Alexandre Dulaunoy 20e06dd067
Merge pull request #848 from nyx0/main 
chg: [mitre] bump to v13.
 2023-05-09 18:29:11 +02:00
Daniel Plohmann 094d56057c
adding APT43 (Mandiant) for Kimsuky. 2023-05-09 14:35:41 +02:00
Thomas Dupuy bbbd006215 chg: [mitre] bump to v13. 2023-05-08 14:04:50 +00:00
Christophe Vandeplas 2d7b7137bf
new: [tools] gen E.A.S.T. galaxy tool - not functional 2023-05-07 21:16:08 +02:00
Christophe Vandeplas 3c808921c3
chg: [attck4fraud] initial updates with E.A.S.T. data 
https://www.association-secure-transactions.eu/industry-information/fraud-definitions/
 2023-05-07 21:13:52 +02:00
Alexandre Dulaunoy c86c2a83ab
chg: [sigma] rules updated 2023-04-30 10:30:54 +02:00
Alexandre Dulaunoy 3dff8e65cb
Merge pull request #847 from Delta-Sierra/main 
add VEILEDSIGNAL and more
 2023-04-27 17:21:35 +02:00
Delta-Sierra 1649c3dfca Merge https://github.com/MISP/misp-galaxy 2023-04-27 10:04:30 +02:00
Delta-Sierra bd050668ef add VEILEDSIGNALand more 2023-04-27 09:53:49 +02:00
Alexandre Dulaunoy 0997f8eb70
Merge pull request #846 from sebdraven/main 
Update threat-actor.json
 2023-04-26 22:59:21 +02:00
Sebastien Larinier ddc285581d Update threat-actor.json 2023-04-26 21:52:57 +02:00
Sebastien Larinier d60cca9302 Update threat-actor.json 
fix mistake
 2023-04-26 21:46:33 +02:00
Sebastien Larinier 142d4aeaef Update threat-actor.json 2023-04-26 14:26:48 +02:00
Alexandre Dulaunoy 095c44e2ac
chg: [attck4fraud] add ATM cash trapping in the matrix 2023-04-26 07:48:29 +02:00
Alexandre Dulaunoy de05d2c58e
Merge pull request #844 from jloehel/redgolf 
chg [threat-actors] Add RedGolf
 2023-04-25 06:47:28 +02:00
Jürgen Löhel 15297c7b5f
chg [threat-actors] Add RedGolf 
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
 2023-04-24 16:59:18 -06:00
Christophe Vandeplas 79b80b0869
chg: [rels] more threat actor relations 2023-04-23 17:54:58 +02:00
Christophe Vandeplas 3c6c204f01
chg: [rels] more threat actor relations 2023-04-23 17:45:58 +02:00
Christophe Vandeplas 138c7c7ba8
chg: [rels] more relations on cluster "value" 2023-04-23 17:36:02 +02:00
Christophe Vandeplas fd44ebaee0
fix: [tool] minor cosmetic fix 2023-04-23 16:31:31 +02:00
Christophe Vandeplas 568e6a7507
fix: [tool] minor cosmetic fix 2023-04-23 15:00:57 +02:00
Christophe Vandeplas 7d98ac013c
chg: [tool] gen_relationships is now interactive 2023-04-23 14:59:26 +02:00
Christophe Vandeplas bea5fda2ab
new: [tool] Initial version of a Relationship generator. 2023-04-23 13:23:23 +02:00
Christophe Vandeplas bf7c5f1dd9
chg: [rels] threat-actor & MS activity group - on synonym 2023-04-23 11:56:41 +02:00
Christophe Vandeplas a5e7e0c95f
chg: [rels] threat-actor & MS activity group - on value 2023-04-23 11:55:57 +02:00
Christophe Vandeplas e056a9ea0c
fix: [tools] 360net cosmetic fix 2023-04-23 10:19:48 +02:00
Christophe Vandeplas f070943ee9
chg: [atrm] updated to latest version 2023-04-23 07:45:16 +02:00
Alexandre Dulaunoy 4152b9fb83
chg: [doc] updated 2023-04-21 11:24:50 +02:00
Alexandre Dulaunoy adc7a70cf9
chg: [microsoft-activity-group] country code added 2023-04-21 07:39:37 +02:00
Alexandre Dulaunoy 8688c41796
chg: [microsoft activity group] remove duplicate 2023-04-20 17:25:32 +02:00
Alexandre Dulaunoy 592361826a
fix: [microsoft activity group] duplicate in Microsoft source 2023-04-20 17:20:57 +02:00
Alexandre Dulaunoy 309f4f2ea5
chg: [microsoft-activity-group] updated following contribution from @botlabsDev script 2023-04-20 17:04:05 +02:00
Alexandre Dulaunoy 2cc6bdfbc1
chg: [sigma] rules updated 2023-04-20 12:17:46 +02:00
Alexandre Dulaunoy 7e25c9ef1f
Merge pull request #831 from sebdraven/main 
Update threat-actor.json
 2023-04-19 17:47:22 +02:00
Sebastien Larinier 862badf2c9 Update threat-actor.json 2023-04-19 17:41:44 +02:00
Sebastien Larinier 1c751b1ea8 Update threat-actor.json 2023-04-19 17:34:50 +02:00
Sebastien Larinier 165ce70a28
Merge branch 'MISP:main' into main 2023-04-19 16:48:02 +02:00
Alexandre Dulaunoy a891f2b5f7
Merge pull request #843 from Delta-Sierra/main 
Update Snowyamber, Halfrig & quarterrig relationships
 2023-04-19 16:23:40 +02:00
Alexandre Dulaunoy bf7005c1c3
chg: [microsoft-activity-group] jq all the things 2023-04-19 16:23:02 +02:00
Sebastien Larinier 87ef0a400e Update threat-actor.json 2023-04-19 15:42:14 +02:00
Sebastien Larinier a77dc82c0a Update threat-actor.json 
new apt30 group
 2023-04-19 15:35:36 +02:00
Delta-Sierra 063ac9fc71 jq? 2023-04-19 15:10:25 +02:00
Delta-Sierra ecb7e79a6e Merge https://github.com/MISP/misp-galaxy 2023-04-19 15:06:51 +02:00
Alexandre Dulaunoy 4277fd393e
Merge pull request #842 from neok0/main 
replace "sector" tag with "country" for matching data. this allows to…
 2023-04-19 14:43:33 +02:00
Tobias Mainka 8d2b9537f1
replace "sector" tag with "country" for matching data. this allows to be confirm with existing clusters. 2023-04-19 12:38:37 +02:00
Sebastien Larinier 926035633f
Merge branch 'MISP:main' into main 2023-04-19 11:55:57 +02:00
Alexandre Dulaunoy ccc8f0f801
chg: [microsoft-activity-group] updated to map the new funky Microsoft "taxonomy" 
Script to generate the cluster is the following, UUIDv5 based on
standard misp-stix source UUIDv4.

~~~python
lcluster = []
for v in data:
    cluster = {}
    cluster['value'] = v['threat_actor']
    cluster['meta'] = {}
    cluster['meta']['sector'] = v['sector']
    cluster['meta']['synonyms'] = v['synonyms']
    cluster['meta']['refs'] = []
    cluster['meta']['refs'].append('https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide')
    _uuid = uuid.uuid5(uuid.UUID("76beed5f-7251-457e-8c2a-b45f7b589d3d"), "{}".format(cluster['value']))
    cluster['uuid'] = str(_uuid)
    lcluster.append(cluster)
~~~

Relationships might be added in a later stage to map with the MISP threat actor galaxy.
 2023-04-19 10:47:11 +02:00
Alexandre Dulaunoy 76ff618d60
Merge pull request #840 from danielplohmann/patch-33 
adding Trend Micro alias Earth Smilodon for APT27
 2023-04-18 23:13:16 +02:00