MISP
/
misp-objects
mirror of https://github.com/MISP/misp-objects
2
0
Fork 0
Code Issues Releases Wiki Activity

new: [cert-pl-phishing] first draft of a template for the CERT.PL 

phishing system
pull/424/head
Alexandre Dulaunoy 2024-04-04 16:45:33 +02:00
parent e056c9c32f
commit 4c661b7747
No known key found for this signature in database
GPG Key ID: 09E2CD4944E6CBCD
1 changed files with 42 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
objects/cert-pl-phishing/definition.json Normal file
View File

@ -0,0 +1,42 @@
{
"attributes": {
"favicon-mmh3": {
"description": "Favicon of the phishing url in Murmurhash3 format (base64).",
"misp-attribute": "text",
"ui-priority": 0
},
"html-structure": {
"description": "HTML tags defining the structure of the HTML page.",
"disable-correlation": true,
"misp-attribute": "text",
"ui-priority": 0
},
"phash-dct-base64": {
"description": "pHash (DCT hash) - as described in https://github.com/thorn-oss/perception.",
"misp-attribute": "text",
"ui-priority": 0
},
"truncated-hash-html-structure": {
"description": "Truncated hash value of the html-structure.",
"misp-attribute": "text",
"ui-priority": 0
},
"url": {
"description": "Full URL of the phishing object.",
"misp-attribute": "url",
"ui-priority": 1
}
},
"description": "cert.pl phishing object template representing an url along with some metadata as such phash, html-structure or partial-hash",
"meta-category": "network",
"name": "cert-pl-phishing",
"requiredOneOf": [
"url",
"phash-dct-base64",
"html-structure",
"truncated-hash-html-structure",
"favicon-mmh3"
],
"uuid": "4c37c9af-ca71-4365-bcfb-6393c22dd88e",
"version": 1
}