6 Commits (main)

Author	SHA1	Message	Date
Alexandre Dulaunoy	e46ddddb4f	chg: [network-profile] new-line	2024-08-06 17:57:11 +02:00
Thomas Dupuy	14c2bd9b5f	upd: [network-profile] add Yandex in `service-abuse` list.	2024-08-05 14:14:17 -04:00
Alexandre Dulaunoy	703b53fc3b	chg: [network-element] jq	2021-02-24 06:48:10 +01:00
Alexandre Dulaunoy	1fe9649205	chg: [network-profile] AS updated	2021-02-24 06:47:04 +01:00
Alexandre Dulaunoy	d87ce65cb9	chg: [network-profile] add jarm-fingerprint	2021-02-24 06:38:49 +01:00
Carlos Borges	85dc07a1f4	Creation of Network Profile MISP Object ... The idea behind this object is to provide a unique form to identify network artifacts. It's a mix of different including whois, URL and domain. The need for a consolidated object comes to group correlated elements. Beyond that, I'm introducing the idea to use the correlation feature in more generic ways. Example: The value of "threat-actor-infrastructure-value" is the unique value observed on a network resource that identify it. A practical and tested example is this resources from Kaspesky. https://securelist.com/the-tetrade-brazilian-banking-malware/97779/ On this article they mention a trojan family called Javali. They recover the C2 server abusing Google Docs services. The mentioned field "threat-actor-infrastructure-value" would register the values available on this image. This item should be hard to correlate with other similar items, as this can change frequently. A way to change it is also to register a more general pattern of the data with the "threat-actor-infrastructure-pattern". I.E inicio{ "host":"<variable>", "porta":"<variable>" }fim With other investigations and registry of it on MISP, is possible to correlate this data, facilitate identification of patterns used for tracking purposes and facilitate analysis.	2021-02-23 20:39:22 -03:00