misp-taxonomies/adversary/machinetag.json

89 lines
2.5 KiB
JSON
Raw Normal View History

{
"namespace": "adversary",
"description": "An overview and description of the adversary infrastructure",
2016-02-16 11:44:12 +01:00
"version": 3,
"predicates": [
{
"value": "infrastructure-status",
"expanded": "Infrastructure Status"
},
{
"value": "infrastructure-type",
"expanded": "Infrastructure Type"
2016-02-16 11:44:12 +01:00
},
{
"value": "infrastructure-state",
"expanded": "Infrastructure State"
}
],
"values": [
{
"predicate": "infrastructure-status",
"entry": [
{
"value": "unknown",
"expanded": "Infrastructure ownership and status is unknown"
},
{
"value": "compromised",
"expanded": "Infrastructure compromised by or in the benefit of the adversary"
},
{
"value": "own-and-operated",
"expanded": "Infrastructure own and operated by the adversary"
}
]
},
2016-02-16 11:44:12 +01:00
{
"predicate": "infrastructure-state",
"entry": [
{
"value": "unknown",
"expanded": "Infrastructure state is unknown or cannot be evaluated"
},
{
"value": "active",
"expanded": "Infrastructure state is active and actively used by the adversary"
},
{
"value": "down",
"expanded": "Infrastructure state is known to be down"
}
]
},
{
"predicate": "infrastructure-type",
"entry": [
{
"value": "unknown",
"expanded": "Infrastructure usage by the adversary is unknown"
},
{
"value": "proxy",
"expanded": "Infrastructure used as proxy between the target and the adversary"
},
{
"value": "drop-zone",
"expanded": "Infrastructure used by the adversary to store information related to his campaigns"
},
{
"value": "exploit-distribution-point",
"expanded": "Infrastructure used to distribute exploit towards target(s)"
},
{
"value": "vpn",
"expanded": "Infrastructure used by the adversary as Virtual Private Network to hide activities and reduce the traffic analysis surface"
},
{
"value": "panel",
2016-02-04 09:54:56 +01:00
"expanded": "Panel used by the adversary to control or maintain his infrastructure"
},
{
"value": "tds",
2016-02-04 10:56:54 +01:00
"expanded": "Traffic Distribution Systems including exploit delivery or/and web monetization channels"
}
]
}
]
}