mirror of https://github.com/MISP/misp-objects
116 lines
2.9 KiB
JSON
116 lines
2.9 KiB
JSON
{
|
|
"attributes": {
|
|
"asn": {
|
|
"description": "Originating ASN for the CS Beacon Config",
|
|
"disable_correlation": true,
|
|
"misp-attribute": "AS",
|
|
"ui-priority": 0
|
|
},
|
|
"c2": {
|
|
"categories": [
|
|
"Network activity"
|
|
],
|
|
"description": "The C2 sample communicates with",
|
|
"misp-attribute": "url",
|
|
"multiple": true,
|
|
"ui-priority": 1
|
|
},
|
|
"city": {
|
|
"description": "City location of the CS Beacon Config in question",
|
|
"disable_correlation": true,
|
|
"misp-attribute": "text",
|
|
"ui-priority": 0
|
|
},
|
|
"geo": {
|
|
"description": "Country location of the CS Beacon Config",
|
|
"disable_correlation": true,
|
|
"misp-attribute": "text",
|
|
"ui-priority": 0
|
|
},
|
|
"ip": {
|
|
"description": "IP of the C2",
|
|
"misp-attribute": "ip-dst",
|
|
"multiple": true,
|
|
"ui-priority": 1
|
|
},
|
|
"jar-md5": {
|
|
"categories": [
|
|
"External analysis"
|
|
],
|
|
"description": "MD5 of adversary cobaltstrike.jar file",
|
|
"misp-attribute": "md5",
|
|
"ui-priority": 0
|
|
},
|
|
"license-id": {
|
|
"description": "License ID of the Colbalt Strike",
|
|
"misp-attribute": "text",
|
|
"ui-priority": 1
|
|
},
|
|
"md5": {
|
|
"categories": [
|
|
"Payload delivery"
|
|
],
|
|
"description": "MD5 of sample containing the Cobalt Strike shellcode",
|
|
"misp-attribute": "md5",
|
|
"ui-priority": 1
|
|
},
|
|
"naics": {
|
|
"description": "North American Industry Classification System Code",
|
|
"disable_correlation": true,
|
|
"misp-attribute": "text",
|
|
"multiple": true,
|
|
"ui-priority": 0
|
|
},
|
|
"sector": {
|
|
"description": "Sector of for the CS Beacon Config in question",
|
|
"disable_correlation": true,
|
|
"misp-attribute": "text",
|
|
"multiple": true,
|
|
"ui-priority": 0
|
|
},
|
|
"sha1": {
|
|
"categories": [
|
|
"Payload delivery"
|
|
],
|
|
"description": "SHA1 of sample containing the Cobalt Strike shellcode",
|
|
"misp-attribute": "sha1",
|
|
"ui-priority": 1
|
|
},
|
|
"sha256": {
|
|
"categories": [
|
|
"Payload delivery"
|
|
],
|
|
"description": "SHA256 of sample containing the Cobalt Strike shellcode",
|
|
"misp-attribute": "sha256",
|
|
"ui-priority": 1
|
|
},
|
|
"vt-sha256": {
|
|
"categories": [
|
|
"External analysis"
|
|
],
|
|
"description": "SHA256 of sample uploaded to VirusTotal",
|
|
"misp-attribute": "sha256",
|
|
"ui-priority": 0
|
|
},
|
|
"watermark": {
|
|
"categories": [
|
|
"Other"
|
|
],
|
|
"description": "The watermark of sample",
|
|
"misp-attribute": "text",
|
|
"ui-priority": 0
|
|
}
|
|
},
|
|
"description": "Cobalt Strike Beacon Config",
|
|
"meta-category": "file",
|
|
"name": "cs-beacon-config",
|
|
"requiredOneOf": [
|
|
"jar-md5",
|
|
"md5",
|
|
"sha1",
|
|
"sha256",
|
|
"watermark"
|
|
],
|
|
"uuid": "d17355ef-ca1f-4b5a-86cd-65d877991f54",
|
|
"version": 4
|
|
} |