{
  "attributes": {
    "architecture": {
      "description": "Hardware architecture of the sample",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 0
    },
    "asn": {
      "description": "Originating ASN for the CS Beacon Config",
      "disable_correlation": true,
      "misp-attribute": "AS",
      "ui-priority": 0
    },
    "beacon-host": {
      "description": "Beacon host IP",
      "misp-attribute": "ip-dst",
      "ui-priority": 0
    },
    "beacon-type": {
      "description": "Beacon type used",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 0
    },
    "binary-md5": {
      "description": "MD5 of the binary delivered",
      "misp-attribute": "md5",
      "ui-priority": 0
    },
    "binary-sha1": {
      "description": "SHA1 of the binary delivered",
      "misp-attribute": "sha1",
      "ui-priority": 0
    },
    "binary-sha256": {
      "description": "SHA256 of the binary delivered",
      "misp-attribute": "sha256",
      "ui-priority": 0
    },
    "c2": {
      "categories": [
        "Network activity"
      ],
      "description": "The C2 sample communicates with",
      "misp-attribute": "url",
      "multiple": true,
      "ui-priority": 1
    },
    "city": {
      "description": "City location of the CS Beacon Config in question",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 0
    },
    "config-md5": {
      "description": "MD5 of the configuration",
      "misp-attribute": "md5",
      "ui-priority": 0
    },
    "config-sha1": {
      "description": "SHA1 of the configuration",
      "misp-attribute": "sha1",
      "ui-priority": 0
    },
    "config-sha256": {
      "description": "SHA256 of the configuration",
      "misp-attribute": "sha256",
      "ui-priority": 0
    },
    "content-length": {
      "description": "Content length of the payload",
      "disable_correlation": true,
      "misp-attribute": "size-in-bytes",
      "ui-priority": 0
    },
    "content-type": {
      "description": "Content/type received",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 0
    },
    "encoded-data": {
      "description": "Encoded payload data in Base64 as file attachment",
      "misp-attribute": "attachment",
      "ui-priority": 0
    },
    "encoded-length": {
      "description": "Length of the encoded data",
      "disable_correlation": true,
      "misp-attribute": "size-in-bytes",
      "ui-priority": 0
    },
    "geo": {
      "description": "Country location of the CS Beacon Config",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 0
    },
    "http": {
      "description": "HTTP protocol used",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 0
    },
    "http-code": {
      "description": "HTTP return code",
      "disable_correlation": true,
      "misp-attribute": "integer",
      "ui-priority": 0
    },
    "http-url": {
      "description": "HTTP url path of the beacon",
      "misp-attribute": "text",
      "ui-priority": 0
    },
    "ip": {
      "description": "IP of the C2",
      "misp-attribute": "ip-dst",
      "multiple": true,
      "ui-priority": 1
    },
    "jar-md5": {
      "categories": [
        "External analysis"
      ],
      "description": "MD5 of adversary cobaltstrike.jar file",
      "misp-attribute": "md5",
      "ui-priority": 0
    },
    "license-id": {
      "description": "License ID of the Colbalt Strike",
      "misp-attribute": "text",
      "ui-priority": 1
    },
    "md5": {
      "categories": [
        "Payload delivery"
      ],
      "description": "MD5 of sample containing the Cobalt Strike shellcode",
      "misp-attribute": "md5",
      "ui-priority": 1
    },
    "naics": {
      "description": "North American Industry Classification System Code (NAICS)",
      "disable_correlation": true,
      "misp-attribute": "text",
      "multiple": true,
      "ui-priority": 0
    },
    "sector": {
      "description": "Sector of for the CS Beacon Config in question",
      "disable_correlation": true,
      "misp-attribute": "text",
      "multiple": true,
      "ui-priority": 0
    },
    "sha1": {
      "categories": [
        "Payload delivery"
      ],
      "description": "SHA1 of sample containing the Cobalt Strike shellcode",
      "misp-attribute": "sha1",
      "ui-priority": 1
    },
    "sha256": {
      "categories": [
        "Payload delivery"
      ],
      "description": "SHA256 of sample containing the Cobalt Strike shellcode",
      "misp-attribute": "sha256",
      "ui-priority": 1
    },
    "vt-sha256": {
      "categories": [
        "External analysis"
      ],
      "description": "SHA256 of sample uploaded to VirusTotal",
      "misp-attribute": "sha256",
      "ui-priority": 0
    },
    "watermark": {
      "categories": [
        "Other"
      ],
      "description": "The watermark of sample",
      "misp-attribute": "text",
      "ui-priority": 0
    }
  },
  "description": "Cobalt Strike Beacon Config",
  "meta-category": "file",
  "name": "cs-beacon-config",
  "requiredOneOf": [
    "jar-md5",
    "md5",
    "sha1",
    "sha256",
    "watermark"
  ],
  "uuid": "d17355ef-ca1f-4b5a-86cd-65d877991f54",
  "version": 7
}