MISP
/
misp-galaxy
mirror of https://github.com/MISP/misp-galaxy
2
0
Fork 0
Code Issues Releases Wiki Activity
3,126 Commits
6 Branches
46 Tags
42 MiB
Commit Graph

2120 Commits (fe77114b84b3c40620215fdaf971d825800bb382)

Author SHA1 Message Date
Sebastien Larinier 87ef0a400e Update threat-actor.json 2023-04-19 15:42:14 +02:00
Sebastien Larinier a77dc82c0a Update threat-actor.json 
new apt30 group
 2023-04-19 15:35:36 +02:00
Delta-Sierra 063ac9fc71 jq? 2023-04-19 15:10:25 +02:00
Delta-Sierra ecb7e79a6e Merge https://github.com/MISP/misp-galaxy 2023-04-19 15:06:51 +02:00
Tobias Mainka 8d2b9537f1
replace "sector" tag with "country" for matching data. this allows to be confirm with existing clusters. 2023-04-19 12:38:37 +02:00
Sebastien Larinier 926035633f
Merge branch 'MISP:main' into main 2023-04-19 11:55:57 +02:00
Alexandre Dulaunoy ccc8f0f801
chg: [microsoft-activity-group] updated to map the new funky Microsoft "taxonomy" 
Script to generate the cluster is the following, UUIDv5 based on
standard misp-stix source UUIDv4.

~~~python
lcluster = []
for v in data:
    cluster = {}
    cluster['value'] = v['threat_actor']
    cluster['meta'] = {}
    cluster['meta']['sector'] = v['sector']
    cluster['meta']['synonyms'] = v['synonyms']
    cluster['meta']['refs'] = []
    cluster['meta']['refs'].append('https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide')
    _uuid = uuid.uuid5(uuid.UUID("76beed5f-7251-457e-8c2a-b45f7b589d3d"), "{}".format(cluster['value']))
    cluster['uuid'] = str(_uuid)
    lcluster.append(cluster)
~~~

Relationships might be added in a later stage to map with the MISP threat actor galaxy.
 2023-04-19 10:47:11 +02:00
Daniel Plohmann 41afab1c06
adding Trend Micro alias Earth Smilodon for APT27 2023-04-18 20:11:57 +02:00
Delta-Sierra 6b8994271e add relationships for HALFRIG & QUATTERRIG 2023-04-18 12:20:20 +02:00
Daniel Plohmann 02e23a9a47
adding Google alias HOODOO for APT41 2023-04-17 22:32:50 +02:00
Delta-Sierra 4a4fa6d16f fix versions 2023-04-17 11:32:51 +02:00
Delta-Sierra 6d5df91efa add relationship SNOWYAMBER & Notion 2023-04-17 11:31:48 +02:00
Delta-Sierra 233a066a03 Merge https://github.com/MISP/misp-galaxy 2023-04-17 11:16:23 +02:00
Delta-Sierra d4225c5469 add some SNOWYAMBER relationships 2023-04-17 11:16:21 +02:00
Alexandre Dulaunoy 91af071bae
new: [online-service] online service added 2023-04-17 10:59:18 +02:00
Alexandre Dulaunoy 5f9760923f
Merge pull request #838 from Delta-Sierra/main 
Adding SNOWYAMBER, HALFRIG, QUARTERRIG tools & PowerMagic backdoor
 2023-04-14 16:03:57 +02:00
Delta-Sierra 8e9880d932 Add SNOWYAMBER, HALFRIG, QUARTERRIG tools 2023-04-14 15:59:42 +02:00
Delta-Sierra c5590ff79a add PowerMagic backdoor 2023-04-13 14:11:36 +02:00
Daniel Plohmann a966b3ff88
adding Trend Micro alias Earth Preta for Mustang Panda 2023-04-12 16:59:36 +02:00
Alexandre Dulaunoy 2763cdd72b
chg:[sigma] Sigma rules updated 2023-04-12 11:44:43 +02:00
Delta-Sierra 8c831d70c8 jq 2023-04-11 15:06:59 +02:00
Delta-Sierra d30e7357fe merge 2023-04-11 13:57:30 +02:00
Delta-Sierra eb9254713a Add more ransomwares from ransomlook 2023-04-11 13:56:29 +02:00
Alexandre Dulaunoy 3cc7e03af6
new: [stealer] add Sordeal Stealer 2023-04-11 09:54:02 +02:00
Alexandre Dulaunoy cbf12d9289
Merge pull request #833 from jloehel/HinataBot 
chg[botnet]: Add HinataBot
 2023-04-04 10:17:07 +02:00
Jürgen Löhel 647fc025d7
chg[botnet]: Add HinataBot 
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
 2023-04-03 11:19:08 -06:00
Alexandre Dulaunoy 15a03e877e
chg: [sigma] updated 2023-03-29 10:33:57 +02:00
Sebdraven 8713618777 Update threat-actor.json 
add new ref for sidecopy
 2023-03-23 09:13:23 +01:00
Sebdraven f5d68aa08d Update threat-actor.json 
delete ref to APT30 for Naikon
 2023-03-23 08:49:17 +01:00
Sebdraven d5843d46e2 Update threat-actor.json 
add ref to Aoqin Dragon
 2023-03-21 18:40:10 +01:00
Alexandre Dulaunoy 122a0bd39b
fix: [ransomware] fix duplicate Value "Cuba" 2023-03-19 11:03:12 +01:00
Alexandre Dulaunoy f2305dc165
Merge pull request #829 from Delta-Sierra/main 
update based on ransomlook+1
 2023-03-16 19:18:54 +01:00
Delta-Sierra 12f69a6082 update based on ransomlook 2023-03-16 15:24:44 +01:00
Mathieu Beligon d82ff1ecfb [threat-actors] Add Anonymous Sudan 2023-03-15 17:38:03 -05:00
Daniel Plohmann c39b46e9d5
Update threat-actor.json 
when value "Sofacy" was changed to "APT28", it seems Sofacy was not added to aliases, so it's missing right now.
 2023-03-15 14:55:25 +01:00
Delta-Sierra 74390b27c5 Merge https://github.com/MISP/misp-galaxy 2023-03-13 09:59:04 +01:00
Delta-Sierra c4eca7dfe1 more from ransomlook 2023-03-13 09:59:00 +01:00
Jürgen Löhel 9f9a263394
chg [tool]: Add tools used by TA866 during the Screentime campaign 
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
 2023-03-08 21:46:11 -06:00
Jürgen Löhel 031a4c8030
chg [stealer]: Add Rhadamanthys 
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
 2023-03-08 21:45:39 -06:00
Jürgen Löhel 437d4a30e5
chg [tds]: Add 404 TDS 
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
 2023-03-08 21:45:13 -06:00
Jürgen Löhel 2d30785af5
chg [threat-actors] Add TA866 
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
 2023-03-08 21:44:16 -06:00
Alexandre Dulaunoy 57f3e46273
chg: [sigma] updated 2023-03-07 12:14:48 +01:00
Alexandre Dulaunoy e7b97edaa4
chg: [ransomware] fixing duplicate cluster element Avaddon 2023-03-07 12:06:56 +01:00
Alexandre Dulaunoy 6db5b0b0cb
Merge pull request #824 from Delta-Sierra/main 
update based on ransomlook
 2023-03-06 16:23:48 +01:00
Delta-Sierra bed6bf8dd6 fix stupid duplicate-bis 2023-03-06 16:10:23 +01:00
Delta-Sierra d561350f7b fix stupid duplicate 2023-03-06 16:04:28 +01:00
Delta-Sierra 96cb1e22ba update based on ransomlook 2023-03-06 15:55:46 +01:00
Mathieu Beligon 395ffda94f [threat-actors] bump version 2023-03-02 10:29:52 -08:00
Mathieu Beligon e1407c3c3f [threat-actors] Add SLIPPY SPIDER alias to LAPSUS 2023-03-02 10:29:29 -08:00
Mathieu Beligon 4bbee8c1e7 [threat-actors] Add PROPHET SPIDER 2023-03-02 10:19:24 -08:00
Mathieu Beligon 61cb24a3fc [threat-actors] Add Nemesis Kitten 2023-03-01 16:37:42 -08:00
Mathieu Beligon 84faa3c92b [threat-actors] Add Karakurt 2023-03-01 16:34:03 -08:00
Mathieu Beligon 7d371b4c80 [threat-actors] Add CYBORG SPIDER alias to GOCLD BURLAP 2023-03-01 15:45:41 -08:00
Mathieu Beligon fa57354471 [threat-actors] Add Chamelgang 2023-03-01 15:40:23 -08:00
Mathieu Beligon bff978e4d1 [threat-actors] Add TA453 2023-03-01 15:24:55 -08:00
Mathieu Beligon 3406ad3aa9 [threat-actors] Add APT42 2023-03-01 15:18:53 -08:00
Mathieu Beligon 2567d6f1f8 [threat-actors] Add TA406 2023-03-01 15:01:22 -08:00
Rony 50624af741 add DEV-0147 https://twitter.com/MsftSecIntel/status/1625181255754039318 2023-02-25 20:18:09 +00:00
Rony cf727f034c
add other actor synonyms from Google's report https://services.google.com/fh/files/blogs/google_fog_of_war_research_report.pdf 2023-02-26 01:05:50 +05:30
Delta-Sierra 27f4c9fcdc synonyms must be an array 2023-02-23 14:26:20 +01:00
Delta-Sierra 0ca7675a5f Merge https://github.com/MISP/misp-galaxy 2023-02-23 14:16:00 +01:00
Delta-Sierra 55725c771e add/update ransomware based on ransomlook 2023-02-23 14:15:09 +01:00
Tom King e52eefa0e7 chg: [mitre] updated with correct ID parsing 2023-02-21 10:36:37 +00:00
Christophe Vandeplas 9f73ff73ac fix: [first-dns] corrected typo 2023-02-21 10:54:30 +08:00
Christophe Vandeplas e2f2026fea chg: [first-dns] Adds FIRST DNS Abuse Techniques Matrix 2023-02-21 10:26:46 +08:00
Christophe Vandeplas a6a9a73ae5 chg: [360net] updated to latest online version 2023-02-20 20:03:36 +08:00
Alexandre Dulaunoy 6460fde2e4
chg: [threat-actor] version updated 2023-02-16 14:43:45 +01:00
Daniel Plohmann 91255413d8
adding Google names for RU threat actors 
https://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/
 2023-02-16 14:30:05 +01:00
Alexandre Dulaunoy 73bd7d0983
Merge pull request #818 from Mathieu4141/threat-actors/proofpoint-aliases 
[threat actors] Adding some actors from ProofPoint
 2023-02-14 06:40:22 +01:00
Mathieu Beligon 9f09699047 [threat-actors] Fix: country was in the wrong place 2023-02-13 16:47:38 -08:00
Mathieu Beligon ac067a236e [threat-actors] fix: Add missing uuids 2023-02-13 16:36:41 -08:00
Mathieu Beligon a792115dd8 fix 2023-02-13 16:26:10 -08:00
Mathieu Beligon 8193b05e14 [threat-actors] bump version 2023-02-13 14:18:58 -08:00
Mathieu Beligon d34e894d2d [threat-actors] Add TA2536 2023-02-13 13:45:41 -08:00
Mathieu Beligon 20c31a5d10 [threat-actors] Add TA577 2023-02-13 13:32:24 -08:00
Mathieu Beligon e836a4a63c [threat-actors] Add TA575 2023-02-13 12:02:32 -08:00
Mathieu Beligon c52ac53765 [threat-actors] Add TA570 2023-02-13 11:54:47 -08:00
Mathieu Beligon 5f274f58c9 [threat-actors] Add Moskalvzapoe 2023-02-13 11:44:59 -08:00
Daniel Plohmann 62256854bc
adding Broadcom name for SaintBear. 2023-02-13 14:05:35 +01:00
Mathieu Beligon 33ff650327 [threat-actors] Add more information about NoName057(16) 2023-02-10 14:14:52 -08:00
Alexandre Dulaunoy 9645b9348b
chg: [tools] TgToxic added 2023-02-09 16:24:45 +01:00
o1mate 239883e2a9 Merging the handguns and shotguns clusters into a single firearm cluster. 2023-02-06 03:28:49 -05:00
Alexandre Dulaunoy 385826063b
chg: [sigma] updated to the latest version 2023-02-05 11:26:16 +01:00
Daniel Plohmann 9710e09e17
new APT29 name used by Recorded Future 
cf. https://go.recordedfuture.com/hubfs/reports/cta-2023-0127.pdf
 2023-02-02 11:46:50 +01:00
Alexandre Dulaunoy 3d6ec1b187
chg: [sigma] updated to the latest version 2023-02-02 11:25:19 +01:00
Jürgen Löhel cf492d9931
chg: [stealer] Adds Album Stealer 
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
 2023-02-01 17:30:56 -06:00
Alexandre Dulaunoy 033895b052
Merge pull request #812 from jloehel/boldmove 
chg: [backdoor] Adds BOLDMOVE
 2023-01-31 06:24:59 +01:00
Jürgen Löhel c7c2b8441a
chg: [stealer] Removes BluStealer 
The BluStealer is already in the malpedia cluster.

Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
 2023-01-30 18:35:28 -06:00
Jürgen Löhel ca635cc3fc
chg: [stealer] Adds DarkCloud and BluStealer 
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
 2023-01-30 18:29:25 -06:00
Jürgen Löhel 33513241bd
chg: [backdoor] Adds BOLDMOVE 
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
 2023-01-30 16:39:11 -06:00
Alexandre Dulaunoy 150e3152cc
Merge pull request #809 from MISP/dev 
Updated the `region` cluster
 2023-01-27 15:08:16 +01:00
Alexandre Dulaunoy b7543c5012
Merge pull request #789 from Mathieu4141/threat-actors/fix-sectorj04 
[threat-actors] Remove SectorJ04 duplicate
 2023-01-27 15:05:37 +01:00
Mathieu Beligon a452263ace [threat-actors] pr.review: Add SectorJ04 as alias of TA505 2023-01-27 13:32:58 +01:00
o1mate 0b661d4f80 Added two new galaxies : An ammunition galaxy containing a list of known sold ammunitions ordered by brands, and a firearm galaxy containing two clusters (handguns, shotguns) scrapped from a famous vendor and ordered by model name (Format : Model name - SKU). 2023-01-26 08:34:38 -05:00
Delta-Sierra 89bb349184 Merge https://github.com/MISP/misp-galaxy 2023-01-26 11:46:14 +01:00
Delta-Sierra 0bb1f48ad6 fix missing brackets 2023-01-25 14:47:22 +01:00
Christian Studer e87d39e3f4
fix: [region] JQed all the things !! 2023-01-25 09:24:52 +01:00
Delta-Sierra 50ca40e408 add Anubis & Godfather android banking trojans 2023-01-25 09:05:19 +01:00
Christian Studer 51610df907
chg: [region] Updated the `region` Galaxy Cluster 
- Added missing entry (Antarctica)
- Ordered the `subregions` meta field
 2023-01-24 22:53:54 +01:00
ofenomeno cb8d700e62 adding uavs 2023-01-24 19:55:46 +01:00
Alexandre Dulaunoy 2f0dfc7656
chg: [sigma] updated 2023-01-23 10:10:46 +01:00
Alexandre Dulaunoy 4a342354f9
chg: [sigma] updated 2023-01-20 13:58:11 +01:00
Christian Studer 5c21588d7c
add: [country] Manually added the missing relations to some `country` cluster values 
- The previous commit (071ecb8) that added the
  mahority of relations between countries and
  regions were automatically added based on the
  country names specified in the `region` cluster.
  The relations added here are the remaining
  countries that are not litterally defined the
  same way they are in the `region` cluster
 2023-01-16 22:22:42 +01:00
Christian Studer 325f51479b
chg: [country] Clarified the US cluster value 2023-01-16 22:20:30 +01:00
Christian Studer 071ecb8a52
add: [country] Added references between `country` cluster values and the related region they're located in, from the `region` galaxy cluster 2023-01-16 21:35:22 +01:00
Alexandre Dulaunoy 323f9f47a1
chg: [sigma] version must be an integer 2023-01-12 16:45:21 +01:00
Alexandre Dulaunoy fd226d47a2
chg: [sigma] new version of the cluster 2023-01-12 14:10:22 +01:00
Alexandre Dulaunoy c0fdfb0e99
chg: [sigma] updated with latest version + new relationship script 2023-01-12 13:46:31 +01:00
Alexandre Dulaunoy e54366fb87
chg: [threat-actor] added the missing synonyms 2023-01-10 15:55:30 +01:00
Alexandre Dulaunoy 187701bacb
chg: [sigma] regenerated from the test script (also updated the script 
to ensure UUID consistency for the galaxy)
 2023-01-06 15:36:33 +01:00
Alexandre Dulaunoy 9955401791
chg: [sigma] jq all the things 2023-01-06 15:13:35 +01:00
Alexandre Dulaunoy 8539361df5
Merge branch 'main' of https://github.com/jstnk9/misp-galaxy into jstnk9-main 2023-01-06 15:11:27 +01:00
jstnk9 5bcec1d72f
Merge branch 'MISP:main' into main 2023-01-03 11:10:49 +01:00
Jürgen Löhel d4debd619b
chg: [ransomware] Extends the entry for JCrypt 
* Add the reference to MafiaWare666 based on the latest research from
  the Avast Threat Lab: https://decoded.avast.io/threatresearch/decrypted-mafiaware666-ransomware/
* Add more infos from Andrew Ivanovs the great blog post: https://id-ransomware.blogspot.com/2020/12/jcrypt-ransomware.html

Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
 2022-12-23 01:44:20 -06:00
Delta-Sierra 3f4edb480b add Malteiro 2022-12-16 16:43:50 +01:00
jstnk9 cb19f6bda7 galaxy for sigma rules 2022-12-09 08:48:54 +01:00
Delta-Sierra 5931f51d7a add TAG-53 2022-12-08 11:31:02 +01:00
Delta-Sierra 3ea2d62a83 Version Update 2022-11-28 16:27:54 +01:00
Delta-Sierra 6016b1000c Merge https://github.com/MISP/misp-galaxy 2022-11-28 16:17:08 +01:00
Delta-Sierra 5d83563e0e Fix Duplicate 2022-11-28 16:15:40 +01:00
Delta-Sierra 6c36295318 Update several RAT & Ransomwares 2022-11-28 16:13:38 +01:00
Alexandre Dulaunoy de12f46ba6
chg: [mitre] updated 2022-11-28 12:48:29 +01:00
Alexandre Dulaunoy fda4160bed
chg: [target-information] fix the duplicate 2022-11-24 15:08:16 +01:00
Alexandre Dulaunoy f15e4ed3bc
chg: [target-information] duplicate removal 2022-11-24 15:05:47 +01:00
Alexandre Dulaunoy 1d9a73abdd
chg: [target] fix duplicate synonyms 2022-11-24 15:03:18 +01:00
Christian Studer e3126ef857
fix: [clusters] Fixed some other few `meta` field names 2022-11-24 09:17:28 +01:00
Christian Studer 823124d422
fix; [mitre-ics-assets] Fixed some `refs` meta field names 2022-11-23 20:44:46 +01:00
Christian Studer 493a5bf94e
fix: [target-information] Fixed `synonyms` meta field name 2022-11-23 20:40:35 +01:00
Alexandre Dulaunoy 5c979ae554
fix: [tool] Houdini relationship to something which exist (ok I know it's Houdini) 2022-11-22 15:19:40 +01:00
Alexandre Dulaunoy 0b6034d9be
Merge pull request #800 from Delta-Sierra/main 
Add ransomwares
 2022-11-22 15:11:42 +01:00
Alexandre Dulaunoy 8947d0035b
fix: [sigma rules] until new the PR and tool is done for sigma. The 
galaxy is removed.
 2022-11-22 15:08:17 +01:00
Delta-Sierra 5f0d7f6d68 add VJw0rm description 2022-11-22 14:55:10 +01:00
Delta-Sierra f4abf37b01 fix versions 2022-11-22 12:45:15 +01:00
Delta-Sierra c02b74f999 merge 2022-11-22 12:43:18 +01:00
Delta-Sierra ffc68b9b8f add several ransomwares 2022-11-22 12:40:47 +01:00
Delta-Sierra e316382b8a add qakbot ref 2022-11-22 12:06:03 +01:00
Delta-Sierra 8bf6d73d66 add BazarCall campaign 2022-11-22 09:08:28 +01:00
Delta-Sierra 3c7230e38e add Bazarbackdoor Synonyms 2022-11-22 09:00:04 +01:00
Thomas Dupuy be7450494e Add Evasive Panda Threat Actor 2022-11-18 16:38:11 +00:00
Alexandre Dulaunoy 4844a7021c
chg: [sigma] duplicate value changed 2022-11-18 14:36:02 +01:00
Alexandre Dulaunoy c41b99d8b9
fix: [sigma] remove duplicate references 2022-11-18 14:21:27 +01:00
Alexandre Dulaunoy 59f5fc5f76
Merge branch 'main' of github.com:MISP/misp-galaxy into main 2022-11-18 14:18:29 +01:00
Alexandre Dulaunoy 7d4011a0a2
chg: [sigma] jq all the things 2022-11-18 14:17:52 +01:00
Terrtia e3b6e9d229
fix: [handicap] fix galaxy icon + name + type 2022-11-17 15:16:05 +01:00
Alexandre Dulaunoy 9b8619bbbe
Merge branch 'main' of https://github.com/jstnk9/misp-galaxy into jstnk9-main 2022-11-16 11:07:50 +01:00
Jürgen Löhel f595195cd2
chg: [botnets] Adds KmsdBot 
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
 2022-11-15 18:10:39 -06:00
Jstnk9 473f1a13aa galaxy related to sigma rtules 
galaxy related to sigma rtules
 2022-11-15 22:56:18 +01:00
Delta-Sierra 2269f4decd fix tool type 2022-11-15 13:56:53 +01:00
Delta-Sierra 9fc65c0e34 version fix 2022-11-15 13:37:02 +01:00
Delta-Sierra 91d535925f version fix 2022-11-15 13:36:49 +01:00