misp-taxonomies/europol-incident/machinetag.json

{
    "version": 1,
    "description": "This taxonomy was designed to describe the type of incidents by class.",
    "expanded": "Europol class of incidents taxonomy",
    "namespace": "europol-incident",
    "predicates": [
        {
            "value": "malware",
            "expanded": "Malware"
        },
        {
            "value": "availability",
            "expanded": "Availability"
        },
        {
            "value": "information-gathering",
            "expanded": "Gathering of information"
        },
        {
            "value": "intrusion-attempt",
            "expanded": "Intrusion attempt"
        },
        {
            "value": "intrusion",
            "expanded": "Intrusion"
        },
        {
            "value": "information-security",
            "expanded": "Information security"
        },
        {
            "value": "fraud",
            "expanded": "Fraud"
        },
        {
            "value": "abusive-content",
            "expanded": "Abusive content"
        },
        {
            "value": "other",
            "expanded": "Other"
        }
    ],
    "values": [
        {
            "predicate": "malware",
            "entry": [
                {
                    "value": "infection",
                    "expanded": "Infection",
                    "description": "Infecting one or various systems with a specific type of malware."
                },
                {
                    "value": "distribution",
                    "expanded": "Distribution",
                    "description": "Infecting one or various systems with a specific type of malware."
                },
                {
                    "value": "c&c",
                    "expanded": "C&C",
                    "description": "Infecting one or various systems with a specific type of malware."
                },
                {
                    "value": "undetermined",
                    "expanded": "Undetermined"
                }
            ]
        },
        {
            "predicate": "availability",
            "entry": [
                {
                    "value": "dos-ddos",
                    "expanded": "DoS/DDoS",
                    "description": "Disruption of the processing and response capacity of systems and networks in order to render them inoperative."
                },
                {
                    "value": "sabotage",
                    "expanded": "Sabotage",
                    "description": "Premeditated action to damage a system, interrupt a process, change or delete information, etc."
                }
            ]
        },
        {
            "predicate": "information-gathering",
            "entry": [
                {
                    "value": "scanning",
                    "expanded": "Scanning",
                    "description": "Active and passive gathering of information on systems or networks."
                },
                {
                    "value": "sniffing",
                    "expanded": "Sniffing",
                    "description": "Unauthorised monitoring and reading of network traffic."
                },
                {
                    "value": "phishing",
                    "expanded": "Phishing",
                    "description": "Attempt to gather information on a user or a system through phishing methods."
                }
            ]
        },
        {
            "predicate": "intrusion-attempt",
            "entry": [
                {
                    "value": "exploitation-vulnerability",
                    "expanded": "Exploitation of vulnerability",
                    "description": "Attempt to intrude by exploiting a vulnerability in a system, component or network."
                },
                {
                    "value": "login-attempt",
                    "expanded": "Login attempt",
                    "description": "Attempt to log in to services or authentication / access control mechanisms."
                }
            ]
        },
        {
            "predicate": "intrusion",
            "entry": [
                {
                    "value": "exploitation-vulnerability",
                    "expanded": "Exploitation of vulnerability",
                    "description": "Actual intrusion by exploiting a vulnerability in the system, component or network."
                },
                {
                    "value": "compromising-account",
                    "expanded": "Compromising an account",
                    "description": "Actual intrusion in a system, component or network by compromising a user or administrator account."
                }
            ]
        },
        {
            "predicate": "information-security",
            "entry": [
                {
                    "value": "unauthorized-access",
                    "expanded": "Unauthorised access",
                    "description": "Unauthorised access to a particular set of information"
                },
                {
                    "value": "unauthorized-modification",
                    "expanded": "Unauthorised modification/deletion",
                    "description": "Unauthorised change or elimination of a particular set of information"
                }
            ]
        },
        {
            "predicate": "fraud",
            "entry": [
                {
                    "value": "illegitimate-use-resources",
                    "expanded": "Misuse or unauthorised use of resources",
                    "description": "Use of institutional resources for purposes other than those intended."
                },
                {
                    "value": "illegitimate-use-name",
                    "expanded": "Illegitimate use of the name of a third party",
                    "description": "Use of the name of an institution without permission to do so."
                }
            ]
        },
        {
            "predicate": "abusive-content",
            "entry": [
                {
                    "value": "spam",
                    "expanded": "SPAM",
                    "description": " Sending SPAM messages."
                },
                {
                    "value": "copyright",
                    "expanded": "Copyright",
                    "description": "Distribution and sharing of copyright protected content."
                },
                {
                    "value": "content-forbidden-by-law",
                    "expanded": "Dissemination of content forbidden by law.",
                    "description": "Child pornography, racism and apology of violence."
                }
            ]
        },
        {
            "predicate": "other",
            "entry": [
                {
                    "value": "other",
                    "expanded": "Other",
                    "description": " Other type of unspecified incident"
                }
            ]
        }
    ]
}