From 5133dbec55d8031a8465e9f3bc60c9b453563a97 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Wed, 10 Jun 2020 22:39:43 +0200 Subject: [PATCH] chg: [threat-actor-naming] WiP --- threat-actor-naming/raw.md | 12 ++- threat-actor-naming/threat-actor-naming.html | 92 +++++++++------- threat-actor-naming/threat-actor-naming.txt | 106 ++++++++++++++----- threat-actor-naming/threat-actor-naming.xml | 9 ++ 4 files changed, 154 insertions(+), 65 deletions(-) diff --git a/threat-actor-naming/raw.md b/threat-actor-naming/raw.md index 34d3699..e9a0903 100755 --- a/threat-actor-naming/raw.md +++ b/threat-actor-naming/raw.md @@ -55,17 +55,23 @@ The key words "**MUST**", "**MUST NOT**", "**REQUIRED**", "**SHALL**", "**SHALL "**SHOULD**", "**SHOULD NOT**", "**RECOMMENDED**", "**MAY**", and "**OPTIONAL**" in this document are to be interpreted as described in RFC 2119 [@!RFC2119]. -# Reusing threat actor naming +# Recommendations + +## Reusing threat actor naming Before creating a new threat actor name, you **MUST** consider a review of existing threat actor names from databases such as the threat actor MISP galaxy [@!MISP-G]. Proliferation of threat actor names is a significant challenge for the day-to-day analyst work. If your threat actor defined an existing threat actor, you **MUST** reuse an existing threat actor name. If there is no specific threat actor name, you **SHALL** create a new threat actor following the best practices defined in this document. -# Format +## Don't confuse actor naming with malware naming -# Encoding +## Format +## Encoding + +## Directory + # Examples # Security Considerations diff --git a/threat-actor-naming/threat-actor-naming.html b/threat-actor-naming/threat-actor-naming.html index 51e749c..ca26c13 100644 --- a/threat-actor-naming/threat-actor-naming.html +++ b/threat-actor-naming/threat-actor-naming.html @@ -376,16 +376,19 @@ - - - - - - - - - - + + + + + + + + + + + + + @@ -449,25 +452,31 @@
  • 2. Reusing threat actor naming +
  • 2. Recommendations
    • -
  • 3. Format +
  • 3. Examples
    • -
  • 9. References +
  • 4. Security Considerations
    • -