mirror of https://github.com/MISP/misp-objects
chg: [cs-beacon-config] major update following shadowserver.org requirements
- Fixed some matching type instead of text (like size-in-bytes or integer) - Added many fields and replace name with `_` to `-` - Added some basic descriptionpull/430/head
parent
3d78e17c4b
commit
7f95d3290a
|
@ -1,11 +1,43 @@
|
||||||
{
|
{
|
||||||
"attributes": {
|
"attributes": {
|
||||||
|
"architecture": {
|
||||||
|
"description": "Hardware architecture of the sample",
|
||||||
|
"disable_correlation": true,
|
||||||
|
"misp-attribute": "text",
|
||||||
|
"ui-priority": 0
|
||||||
|
},
|
||||||
"asn": {
|
"asn": {
|
||||||
"description": "Originating ASN for the CS Beacon Config",
|
"description": "Originating ASN for the CS Beacon Config",
|
||||||
"disable_correlation": true,
|
"disable_correlation": true,
|
||||||
"misp-attribute": "AS",
|
"misp-attribute": "AS",
|
||||||
"ui-priority": 0
|
"ui-priority": 0
|
||||||
},
|
},
|
||||||
|
"beacon-host": {
|
||||||
|
"description": "Beacon host IP",
|
||||||
|
"misp-attribute": "ip-dst",
|
||||||
|
"ui-priority": 0
|
||||||
|
},
|
||||||
|
"beacon-type": {
|
||||||
|
"description": "Beacon type used",
|
||||||
|
"disable_correlation": true,
|
||||||
|
"misp-attribute": "text",
|
||||||
|
"ui-priority": 0
|
||||||
|
},
|
||||||
|
"binary-md5": {
|
||||||
|
"description": "MD5 of the binary delivered",
|
||||||
|
"misp-attribute": "md5",
|
||||||
|
"ui-priority": 0
|
||||||
|
},
|
||||||
|
"binary-sha1": {
|
||||||
|
"description": "SHA1 of the binary delivered",
|
||||||
|
"misp-attribute": "sha1",
|
||||||
|
"ui-priority": 0
|
||||||
|
},
|
||||||
|
"binary-sha256": {
|
||||||
|
"description": "SHA256 of the binary delivered",
|
||||||
|
"misp-attribute": "sha256",
|
||||||
|
"ui-priority": 0
|
||||||
|
},
|
||||||
"c2": {
|
"c2": {
|
||||||
"categories": [
|
"categories": [
|
||||||
"Network activity"
|
"Network activity"
|
||||||
|
@ -21,12 +53,66 @@
|
||||||
"misp-attribute": "text",
|
"misp-attribute": "text",
|
||||||
"ui-priority": 0
|
"ui-priority": 0
|
||||||
},
|
},
|
||||||
|
"config-md5": {
|
||||||
|
"description": "MD5 of the configuration",
|
||||||
|
"misp-attribute": "md5",
|
||||||
|
"ui-priority": 0
|
||||||
|
},
|
||||||
|
"config-sha1": {
|
||||||
|
"description": "SHA1 of the configuration",
|
||||||
|
"misp-attribute": "sha1",
|
||||||
|
"ui-priority": 0
|
||||||
|
},
|
||||||
|
"config-sha256": {
|
||||||
|
"description": "SHA256 of the configuration",
|
||||||
|
"misp-attribute": "sha256",
|
||||||
|
"ui-priority": 0
|
||||||
|
},
|
||||||
|
"content-length": {
|
||||||
|
"disable_correlation": true,
|
||||||
|
"misp-attribute": "size-in-bytes",
|
||||||
|
"ui-priority": 0
|
||||||
|
},
|
||||||
|
"content-type": {
|
||||||
|
"description": "Content/type received",
|
||||||
|
"disable_correlation": true,
|
||||||
|
"misp-attribute": "text",
|
||||||
|
"ui-priority": 0
|
||||||
|
},
|
||||||
|
"encoded-data": {
|
||||||
|
"description": "Encoded payload data in Base64",
|
||||||
|
"misp-attribute": "text",
|
||||||
|
"ui-priority": 0
|
||||||
|
},
|
||||||
|
"encoded-length": {
|
||||||
|
"description": "Length of the encoded data",
|
||||||
|
"disable_correlation": true,
|
||||||
|
"misp-attribute": "size-in-bytes",
|
||||||
|
"ui-priority": 0
|
||||||
|
},
|
||||||
"geo": {
|
"geo": {
|
||||||
"description": "Country location of the CS Beacon Config",
|
"description": "Country location of the CS Beacon Config",
|
||||||
"disable_correlation": true,
|
"disable_correlation": true,
|
||||||
"misp-attribute": "text",
|
"misp-attribute": "text",
|
||||||
"ui-priority": 0
|
"ui-priority": 0
|
||||||
},
|
},
|
||||||
|
"http": {
|
||||||
|
"description": "HTTP protocol used",
|
||||||
|
"disable_correlation": true,
|
||||||
|
"misp-attribute": "text",
|
||||||
|
"ui-priority": 0
|
||||||
|
},
|
||||||
|
"http-code": {
|
||||||
|
"description": "HTTP return code",
|
||||||
|
"disable_correlation": true,
|
||||||
|
"misp-attribute": "integer",
|
||||||
|
"ui-priority": 0
|
||||||
|
},
|
||||||
|
"http-url": {
|
||||||
|
"description": "HTTP url path of the beacon",
|
||||||
|
"misp-attribute": "text",
|
||||||
|
"ui-priority": 0
|
||||||
|
},
|
||||||
"ip": {
|
"ip": {
|
||||||
"description": "IP of the C2",
|
"description": "IP of the C2",
|
||||||
"misp-attribute": "ip-dst",
|
"misp-attribute": "ip-dst",
|
||||||
|
@ -55,10 +141,9 @@
|
||||||
"ui-priority": 1
|
"ui-priority": 1
|
||||||
},
|
},
|
||||||
"naics": {
|
"naics": {
|
||||||
"description": "North American Industry Classification System Code",
|
"description": "NAICS code",
|
||||||
"disable_correlation": true,
|
"disable_correlation": true,
|
||||||
"misp-attribute": "text",
|
"misp-attribute": "text",
|
||||||
"multiple": true,
|
|
||||||
"ui-priority": 0
|
"ui-priority": 0
|
||||||
},
|
},
|
||||||
"sector": {
|
"sector": {
|
||||||
|
@ -112,5 +197,5 @@
|
||||||
"watermark"
|
"watermark"
|
||||||
],
|
],
|
||||||
"uuid": "d17355ef-ca1f-4b5a-86cd-65d877991f54",
|
"uuid": "d17355ef-ca1f-4b5a-86cd-65d877991f54",
|
||||||
"version": 4
|
"version": 5
|
||||||
}
|
}
|
Loading…
Reference in New Issue