misp-objects/objects/cs-beacon-config/definition.json

203 lines
5.2 KiB
JSON

{
"attributes": {
"architecture": {
"description": "Hardware architecture of the sample",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 0
},
"asn": {
"description": "Originating ASN for the CS Beacon Config",
"disable_correlation": true,
"misp-attribute": "AS",
"ui-priority": 0
},
"beacon-host": {
"description": "Beacon host IP",
"misp-attribute": "ip-dst",
"ui-priority": 0
},
"beacon-type": {
"description": "Beacon type used",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 0
},
"binary-md5": {
"description": "MD5 of the binary delivered",
"misp-attribute": "md5",
"ui-priority": 0
},
"binary-sha1": {
"description": "SHA1 of the binary delivered",
"misp-attribute": "sha1",
"ui-priority": 0
},
"binary-sha256": {
"description": "SHA256 of the binary delivered",
"misp-attribute": "sha256",
"ui-priority": 0
},
"c2": {
"categories": [
"Network activity"
],
"description": "The C2 sample communicates with",
"misp-attribute": "url",
"multiple": true,
"ui-priority": 1
},
"city": {
"description": "City location of the CS Beacon Config in question",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 0
},
"config-md5": {
"description": "MD5 of the configuration",
"misp-attribute": "md5",
"ui-priority": 0
},
"config-sha1": {
"description": "SHA1 of the configuration",
"misp-attribute": "sha1",
"ui-priority": 0
},
"config-sha256": {
"description": "SHA256 of the configuration",
"misp-attribute": "sha256",
"ui-priority": 0
},
"content-length": {
"description": "Content length of the payload",
"disable_correlation": true,
"misp-attribute": "size-in-bytes",
"ui-priority": 0
},
"content-type": {
"description": "Content/type received",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 0
},
"encoded-data": {
"description": "Encoded payload data in Base64",
"misp-attribute": "text",
"ui-priority": 0
},
"encoded-length": {
"description": "Length of the encoded data",
"disable_correlation": true,
"misp-attribute": "size-in-bytes",
"ui-priority": 0
},
"geo": {
"description": "Country location of the CS Beacon Config",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 0
},
"http": {
"description": "HTTP protocol used",
"disable_correlation": true,
"misp-attribute": "text",
"ui-priority": 0
},
"http-code": {
"description": "HTTP return code",
"disable_correlation": true,
"misp-attribute": "integer",
"ui-priority": 0
},
"http-url": {
"description": "HTTP url path of the beacon",
"misp-attribute": "text",
"ui-priority": 0
},
"ip": {
"description": "IP of the C2",
"misp-attribute": "ip-dst",
"multiple": true,
"ui-priority": 1
},
"jar-md5": {
"categories": [
"External analysis"
],
"description": "MD5 of adversary cobaltstrike.jar file",
"misp-attribute": "md5",
"ui-priority": 0
},
"license-id": {
"description": "License ID of the Colbalt Strike",
"misp-attribute": "text",
"ui-priority": 1
},
"md5": {
"categories": [
"Payload delivery"
],
"description": "MD5 of sample containing the Cobalt Strike shellcode",
"misp-attribute": "md5",
"ui-priority": 1
},
"naics": {
"description": "North American Industry Classification System Code (NAICS)",
"disable_correlation": true,
"misp-attribute": "text",
"multiple": true,
"ui-priority": 0
},
"sector": {
"description": "Sector of for the CS Beacon Config in question",
"disable_correlation": true,
"misp-attribute": "text",
"multiple": true,
"ui-priority": 0
},
"sha1": {
"categories": [
"Payload delivery"
],
"description": "SHA1 of sample containing the Cobalt Strike shellcode",
"misp-attribute": "sha1",
"ui-priority": 1
},
"sha256": {
"categories": [
"Payload delivery"
],
"description": "SHA256 of sample containing the Cobalt Strike shellcode",
"misp-attribute": "sha256",
"ui-priority": 1
},
"vt-sha256": {
"categories": [
"External analysis"
],
"description": "SHA256 of sample uploaded to VirusTotal",
"misp-attribute": "sha256",
"ui-priority": 0
},
"watermark": {
"categories": [
"Other"
],
"description": "The watermark of sample",
"misp-attribute": "text",
"ui-priority": 0
}
},
"description": "Cobalt Strike Beacon Config",
"meta-category": "file",
"name": "cs-beacon-config",
"requiredOneOf": [
"jar-md5",
"md5",
"sha1",
"sha256",
"watermark"
],
"uuid": "d17355ef-ca1f-4b5a-86cd-65d877991f54",
"version": 6
}