chg: [rsit] updated to the latest version
parent
da608c6cb7
commit
112005898d
|
|
@ -4,17 +4,17 @@
|
|||
"entry": [
|
||||
{
|
||||
"description": "Or 'Unsolicited Bulk Email', this means that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having a functionally comparable content.",
|
||||
"expanded": "spam",
|
||||
"expanded": "Spam",
|
||||
"value": "spam"
|
||||
},
|
||||
{
|
||||
"description": "Discreditation or discrimination of somebody e.g. cyber stalking, racism and threats against one or more individuals).",
|
||||
"description": "Discreditation or discrimination of somebody, e.g. cyber stalking, racism or threats against one or more individuals.",
|
||||
"expanded": "Harmful Speech",
|
||||
"value": "harmful-speech"
|
||||
},
|
||||
{
|
||||
"description": "Child Pornography, glorification of violence, ...",
|
||||
"expanded": "Child/Sexual/Violence/...",
|
||||
"description": "Child pornography, glorification of violence, etc.",
|
||||
"expanded": "Child Porn/Sexual/Violent Content",
|
||||
"value": "violence"
|
||||
}
|
||||
],
|
||||
|
|
@ -23,34 +23,24 @@
|
|||
{
|
||||
"entry": [
|
||||
{
|
||||
"description": "Software that is intentionally included or inserted in a system for a harmful purpose. A user interaction is normally necessary to activate the code.",
|
||||
"expanded": "Virus",
|
||||
"value": "virus"
|
||||
"description": "System infected with malware, e.g. PC, smartphone or server infected with a rootkit.",
|
||||
"expanded": "Infected System",
|
||||
"value": "infected-system"
|
||||
},
|
||||
{
|
||||
"description": "see 'virus'",
|
||||
"expanded": "Worm",
|
||||
"value": "worm"
|
||||
"description": "Command-and-control server contacted by malware on infected systems.",
|
||||
"expanded": "C2 Server",
|
||||
"value": "c2-server"
|
||||
},
|
||||
{
|
||||
"description": "see 'virus'",
|
||||
"expanded": "Trojan",
|
||||
"value": "trojan"
|
||||
"description": "URI used for malware distribution, e.g. a download URL included in fake invoice malware spam.",
|
||||
"expanded": "Malware Distribution",
|
||||
"value": "malware-distribution"
|
||||
},
|
||||
{
|
||||
"description": "see 'virus'",
|
||||
"expanded": "Spyware",
|
||||
"value": "spyware"
|
||||
},
|
||||
{
|
||||
"description": "see 'virus'",
|
||||
"expanded": "Dialer",
|
||||
"value": "dialer"
|
||||
},
|
||||
{
|
||||
"description": "see 'virus'",
|
||||
"expanded": "Rootkit",
|
||||
"value": "rootkit"
|
||||
"description": "URI hosting a malware configuration file, e.g. webinjects for a banking trojan.",
|
||||
"expanded": "Malware Configuration",
|
||||
"value": "malware-configuration"
|
||||
}
|
||||
],
|
||||
"predicate": "malicious-code"
|
||||
|
|
@ -58,7 +48,7 @@
|
|||
{
|
||||
"entry": [
|
||||
{
|
||||
"description": "Attacks that send requests to a system to discover weak points. This includes also some kind of testing processes to gather information about hosts, services and accounts. Examples: fingerd, DNS querying, ICMP, SMTP (EXPN, RCPT, ...), port scanning.",
|
||||
"description": "Attacks that send requests to a system to discover weaknesses. This also includes testing processes to gather information on hosts, services and accounts. Examples: fingerd, DNS querying, ICMP, SMTP (EXPN, RCPT, ...), port scanning.",
|
||||
"expanded": "Scanning",
|
||||
"value": "scanner"
|
||||
},
|
||||
|
|
@ -78,8 +68,8 @@
|
|||
{
|
||||
"entry": [
|
||||
{
|
||||
"description": "An attempt to compromise a system or to disrupt any service by exploiting vunerabilities with a standardised identifier such as CVE name (e.g. buffer overflow, backdoor, cross site scripting, etc.)",
|
||||
"expanded": "Exploiting of known Vulnerabilities",
|
||||
"description": "An attempt to compromise a system or to disrupt any service by exploiting vulnerabilities with a standardised identifier such as CVE name (e.g. buffer overflow, backdoor, cross site scripting, etc.)",
|
||||
"expanded": "Exploitation of known Vulnerabilities",
|
||||
"value": "ids-alert"
|
||||
},
|
||||
{
|
||||
|
|
@ -88,7 +78,7 @@
|
|||
"value": "brute-force"
|
||||
},
|
||||
{
|
||||
"description": "An attempt using an unknown exploit.",
|
||||
"description": "An attack using an unknown exploit.",
|
||||
"expanded": "New attack signature",
|
||||
"value": "exploit"
|
||||
}
|
||||
|
|
@ -98,24 +88,24 @@
|
|||
{
|
||||
"entry": [
|
||||
{
|
||||
"description": "A successful compromise of a system or application (service). This can have been caused remotely by a known or new vulnerability, but also by an unauthorized local access. Also includes being part of a botnet.",
|
||||
"description": "Compromise of a system where the attacker gained administrative privileges.",
|
||||
"expanded": "Privileged Account Compromise",
|
||||
"value": "privileged-account-compromise"
|
||||
},
|
||||
{
|
||||
"description": "see 'Privileged Account Compromise'",
|
||||
"description": "Compromise of a system using an unprivileged (user/service) account.",
|
||||
"expanded": "Unprivileged Account Compromise",
|
||||
"value": "unprivileged-account-compromise"
|
||||
},
|
||||
{
|
||||
"description": "see 'Privileged Account Compromise'",
|
||||
"description": "Compromise of an application by exploiting (un)known software vulnerabilities, e.g. SQL injection.",
|
||||
"expanded": "Application Compromise",
|
||||
"value": "application-compromise"
|
||||
},
|
||||
{
|
||||
"description": "see 'Privileged Account Compromise'",
|
||||
"expanded": "Bot",
|
||||
"value": "bot"
|
||||
"description": "Physical intrusion, e.g. into corporate building or data center.",
|
||||
"expanded": "Burglary",
|
||||
"value": "burglary"
|
||||
}
|
||||
],
|
||||
"predicate": "intrusions"
|
||||
|
|
@ -123,23 +113,28 @@
|
|||
{
|
||||
"entry": [
|
||||
{
|
||||
"description": "Denial of Service.",
|
||||
"expanded": "DoS",
|
||||
"description": "Denial of Service attack, e.g. sending specially crafted requests to a web application which causes the application to crash or slow down.",
|
||||
"expanded": "Denial of Service",
|
||||
"value": "dos"
|
||||
},
|
||||
{
|
||||
"description": "Distributed Denial of Service.",
|
||||
"expanded": "DDoS",
|
||||
"description": "Distributed Denial of Service attack, e.g. SYN-Flood or UDP-based reflection/amplification attacks.",
|
||||
"expanded": "Distributed Denial of Service",
|
||||
"value": "ddos"
|
||||
},
|
||||
{
|
||||
"description": "Sabotage.",
|
||||
"description": "Software misconfiguration resulting in service availability issues, e.g. DNS server with outdated DNSSEC Root Zone KSK.",
|
||||
"expanded": "Misconfiguration",
|
||||
"value": "misconfiguration"
|
||||
},
|
||||
{
|
||||
"description": "Physical sabotage, e.g cutting wires or malicious arson.",
|
||||
"expanded": "Sabotage",
|
||||
"value": "sabotage"
|
||||
},
|
||||
{
|
||||
"description": "Outage (no malice).",
|
||||
"expanded": "Outage (no malice)",
|
||||
"description": "Outage caused e.g. by air condition failure or natural disaster.",
|
||||
"expanded": "Outage",
|
||||
"value": "outage"
|
||||
}
|
||||
],
|
||||
|
|
@ -148,14 +143,19 @@
|
|||
{
|
||||
"entry": [
|
||||
{
|
||||
"description": "Besides local abuse of data and systems, the security of information can be endangered by successful compromise of an account or application. In addition, attacks that intercept and access information during transmission (wiretapping, spoofing or hijacking) are possible. Human/configuration/software error can also be the cause.",
|
||||
"description": "Unauthorized access to information, e.g. by abusing stolen login credentials for a system or application, intercepting traffic or gaining access to physical documents.",
|
||||
"expanded": "Unauthorised access to information",
|
||||
"value": "Unauthorised-information-access"
|
||||
"value": "unauthorised-information-access"
|
||||
},
|
||||
{
|
||||
"description": "see 'Unauthorised access to information'",
|
||||
"description": "Unauthorised modification of information, e.g. by an attacker abusing stolen login credentials for a system or application or a ransomware encrypting data.",
|
||||
"expanded": "Unauthorised modification of information",
|
||||
"value": "Unauthorised-information-modification"
|
||||
"value": "unauthorised-information-modification"
|
||||
},
|
||||
{
|
||||
"description": "Loss of data, e.g. caused by harddisk failure or physical theft.",
|
||||
"expanded": "Data Loss",
|
||||
"value": "data-loss"
|
||||
}
|
||||
],
|
||||
"predicate": "information-content-security"
|
||||
|
|
@ -163,7 +163,7 @@
|
|||
{
|
||||
"entry": [
|
||||
{
|
||||
"description": "Using resources for unauthorized purposes including profit-making ventures (E.g. the use of e-mail to participate in illegal profit chain letters or pyramid schemes).",
|
||||
"description": "Using resources for unauthorized purposes including profit-making ventures, e.g. the use of e-mail to participate in illegal profit chain letters or pyramid schemes.",
|
||||
"expanded": "Unauthorized use of resources",
|
||||
"value": "unauthorized-use-of-resources"
|
||||
},
|
||||
|
|
@ -173,12 +173,12 @@
|
|||
"value": "copyright"
|
||||
},
|
||||
{
|
||||
"description": "Type of attacks in which one entity illegitimately assumes the identity of another in order to benefit from it.",
|
||||
"description": "Type of attack in which one entity illegitimately impersonates the identity of another in order to benefit from it.",
|
||||
"expanded": "Masquerade",
|
||||
"value": "masquerade"
|
||||
},
|
||||
{
|
||||
"description": "Masquerading as another entity in order to persuade the user to reveal a private credential.",
|
||||
"description": "Masquerading as another entity in order to persuade the user to reveal private credentials.",
|
||||
"expanded": "Phishing",
|
||||
"value": "phishing"
|
||||
}
|
||||
|
|
@ -188,9 +188,34 @@
|
|||
{
|
||||
"entry": [
|
||||
{
|
||||
"description": "Open resolvers, world readable printers, vulnerability apparent from Nessus etc scans, virus, signatures not up to date, etc.",
|
||||
"expanded": "Open for abuse",
|
||||
"value": "vulnerable-service"
|
||||
"description": "Publicly accessible services offering weak crypto, e.g. web servers susceptible to POODLE/FREAK attacks.",
|
||||
"expanded": "Weak crypto",
|
||||
"value": "weak-crypto"
|
||||
},
|
||||
{
|
||||
"description": "Publicly accessible services that can be abused for conducting DDoS reflection/amplification attacks, e.g. DNS open-resolvers or NTP servers with monlist enabled.",
|
||||
"expanded": "DDoS amplifier",
|
||||
"value": "ddos-amplifier"
|
||||
},
|
||||
{
|
||||
"description": "Potentially unwanted publicly accessible services, e.g. Telnet, RDP or VNC.",
|
||||
"expanded": "Potentially unwanted accessible services",
|
||||
"value": "potentially-unwanted-accessible"
|
||||
},
|
||||
{
|
||||
"description": "Publicly accessible services potentially disclosing sensitive information, e.g. SNMP or Redis.",
|
||||
"expanded": "Information disclosure",
|
||||
"value": "information-disclosure"
|
||||
}
|
||||
],
|
||||
"predicate": "vulnerable"
|
||||
},
|
||||
{
|
||||
"entry": [
|
||||
{
|
||||
"description": "A system which is vulnerable to certain attacks. Example: misconfigured client proxy settings (example: WPAD), outdated operating system version, etc.",
|
||||
"expanded": "Vulnerable system",
|
||||
"value": "vulnerable-system"
|
||||
}
|
||||
],
|
||||
"predicate": "vulnerable"
|
||||
|
|
@ -199,7 +224,7 @@
|
|||
"entry": [
|
||||
{
|
||||
"description": "All incidents which don't fit in one of the given categories should be put into this class.",
|
||||
"expanded": "other",
|
||||
"expanded": "Other",
|
||||
"value": "other"
|
||||
}
|
||||
],
|
||||
|
|
@ -273,7 +298,7 @@
|
|||
"value": "test"
|
||||
}
|
||||
],
|
||||
"version": 1,
|
||||
"version": 2,
|
||||
"description": "Reference Security Incident Classification Taxonomy",
|
||||
"namespace": "rsit"
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in New Issue