From 33a15bbdabe313b78725236f86d6e78c3ffb4137 Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Thu, 18 Apr 2019 14:46:32 +0200 Subject: [PATCH] rfc galaxy - add new fields for ransomware galaxy --- misp-galaxy-format/raw.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/misp-galaxy-format/raw.md b/misp-galaxy-format/raw.md index 7aab67c..0ec2a71 100644 --- a/misp-galaxy-format/raw.md +++ b/misp-galaxy-format/raw.md @@ -162,7 +162,7 @@ Example use of the country, motive fields in the threat-actor galaxy: } ~~~~ -encryption, extensions, ransomnotes, ransomnotes-filenames, ransomnotes-refs **MAY** be used to give further information in ransomware galaxy. encryption is represented as a string and **SHALL** be present. extensions is represented as an array containing one or more strings and **SHALL** be present. ransomnotes is represented as an array containing one or more strings ans **SHALL** be present. ransomnotes-filenames is represented as an array containing one or more strings ans **SHALL** be present. ransomnotes-refs is represented as an array containing one or more strings ans **SHALL** be present. +encryption, extensions, ransomnotes, ransomnotes-filenames, ransomnotes-refs, payment-method and price **MAY** be used to give further information in ransomware galaxy. encryption is represented as a string and **SHALL** be present. extensions is represented as an array containing one or more strings and **SHALL** be present. ransomnotes is represented as an array containing one or more strings ans **SHALL** be present. ransomnotes-filenames is represented as an array containing one or more strings ans **SHALL** be present. ransomnotes-refs is represented as an array containing one or more strings ans **SHALL** be present. payment-method is represented as a string and **SHALL** be present. price is represented as a string and **SHALL** be present. Example use of the encryption, extensions, ransomnotes fields in the ransomware galaxy: