{
  "attributes": {
    "asn": {
      "description": "Originating ASN for the CS Beacon Config",
      "disable_correlation": true,
      "misp-attribute": "AS",
      "ui-priority": 0
    },
    "c2": {
      "categories": [
        "Network activity"
      ],
      "description": "The C2 sample communicates with",
      "misp-attribute": "url",
      "multiple": true,
      "ui-priority": 1
    },
    "city": {
      "description": "City location of the CS Beacon Config in question",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 0
    },
    "geo": {
      "description": "Country location of the CS Beacon Config",
      "disable_correlation": true,
      "misp-attribute": "text",
      "ui-priority": 0
    },
    "ip": {
      "description": "IP of the C2",
      "misp-attribute": "ip-dst",
      "multiple": true,
      "ui-priority": 1
    },
    "jar-md5": {
      "categories": [
        "External analysis"
      ],
      "description": "MD5 of adversary cobaltstrike.jar file",
      "misp-attribute": "md5",
      "ui-priority": 0
    },
    "license-id": {
      "description": "License ID of the Colbalt Strike",
      "misp-attribute": "text",
      "ui-priority": 1
    },
    "md5": {
      "categories": [
        "Payload delivery"
      ],
      "description": "MD5 of sample containing the Cobalt Strike shellcode",
      "misp-attribute": "md5",
      "ui-priority": 1
    },
    "naics": {
      "description": "North American Industry Classification System Code",
      "disable_correlation": true,
      "misp-attribute": "text",
      "multiple": true,
      "ui-priority": 0
    },
    "sector": {
      "description": "Sector of for the CS Beacon Config in question",
      "disable_correlation": true,
      "misp-attribute": "text",
      "multiple": true,
      "ui-priority": 0
    },
    "sha1": {
      "categories": [
        "Payload delivery"
      ],
      "description": "SHA1 of sample containing the Cobalt Strike shellcode",
      "misp-attribute": "sha1",
      "ui-priority": 1
    },
    "sha256": {
      "categories": [
        "Payload delivery"
      ],
      "description": "SHA256 of sample containing the Cobalt Strike shellcode",
      "misp-attribute": "sha256",
      "ui-priority": 1
    },
    "vt-sha256": {
      "categories": [
        "External analysis"
      ],
      "description": "SHA256 of sample uploaded to VirusTotal",
      "misp-attribute": "sha256",
      "ui-priority": 0
    },
    "watermark": {
      "categories": [
        "Other"
      ],
      "description": "The watermark of sample",
      "misp-attribute": "text",
      "ui-priority": 0
    }
  },
  "description": "Cobalt Strike Beacon Config",
  "meta-category": "file",
  "name": "cs-beacon-config",
  "requiredOneOf": [
    "jar-md5",
    "md5",
    "sha1",
    "sha256",
    "watermark"
  ],
  "uuid": "d17355ef-ca1f-4b5a-86cd-65d877991f54",
  "version": 4
}