MISP
/
misp-taxonomies
mirror of https://github.com/MISP/misp-taxonomies
2
0
Fork 0
Code Issues Releases Wiki Activity

update RSIT to version 1003 

v1.3 was released in May: https://github.com/enisaeu/Reference-Security-Incident-Taxonomy-Task-Force/releases/tag/v1.3
including the version tag fix
(https://github.com/enisaeu/Reference-Security-Incident-Taxonomy-Task-Force/pull/109)
pull/214/head
Sebastian Wagner 2021-08-17 14:53:28 +02:00
parent f2fbd0e5fb
commit 17c8da5cf0
No known key found for this signature in database
GPG Key ID: 4BB5A67FBECFA8A5
1 changed files with 46 additions and 46 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

92
rsit/machinetag.json
View File

@ -3,17 +3,17 @@
{ {
"entry": [ "entry": [
{ {
"description": "Or 'Unsolicited Bulk Email', this means that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having a functionally comparable content. This IOC refers to resources, which make up a SPAM infrastructure, be it a harvesters like address verification, URLs in spam e-mails etc.", "description": "Or 'Unsolicited Bulk Email', this means that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having a functionally comparable content. This IOC refers to resources which make up spam infrastructure, for example, harvesters like address verification, URLs in spam emails, etc.",
"expanded": "Spam", "expanded": "Spam",
"value": "spam" "value": "spam"
}, },
{ {
"description": "Discretization or discrimination of somebody, e.g. cyber stalking, racism or threats against one or more individuals.", "description": "Bullying, harassment or discrimination of somebody, e.g., cyber stalking, racism or threats against one or more individuals.",
"expanded": "Harmful Speech", "expanded": "Harmful Speech",
"value": "harmful-speech" "value": "harmful-speech"
}, },
{ {
"description": "Child Sexual Exploitation (CSE), Sexual content, glorification of violence, etc.", "description": "Child Sexual Exploitation (CSE), sexual content, glorification of violence, etc.",
"expanded": "(Child) Sexual Exploitation/Sexual/Violent Content", "expanded": "(Child) Sexual Exploitation/Sexual/Violent Content",
"value": "violence" "value": "violence"
} }
@ -23,22 +23,22 @@
{ {
"entry": [ "entry": [
{ {
"description": "System infected with malware, e.g. PC, smartphone or server infected with a rootkit. Most often this refers to a connection to a sinkholed C2 server", "description": "System infected with malware, e.g., a PC, smartphone or server infected with a rootkit. Most often this refers to a connection to a sinkholed command and control server.",
"expanded": "Infected System", "expanded": "Infected System",
"value": "infected-system" "value": "infected-system"
}, },
{ {
"description": "Command-and-control server contacted by malware on infected systems.", "description": "Command and control server contacted by malware on infected systems.",
"expanded": "C2 Server", "expanded": "C2 Server",
"value": "c2-server" "value": "c2-server"
}, },
{ {
"description": "URI used for malware distribution, e.g. a download URL included in fake invoice malware spam or exploit-kits (on websites).", "description": "URI used for malware distribution, e.g., a download URL included in fake invoice malware spam or exploit kits (on websites).",
"expanded": "Malware Distribution", "expanded": "Malware Distribution",
"value": "malware-distribution" "value": "malware-distribution"
}, },
{ {
"description": "URI hosting a malware configuration file, e.g. web-injects for a banking trojan.", "description": "URI hosting a malware configuration file, e.g., web injects for a banking trojan.",
"expanded": "Malware Configuration", "expanded": "Malware Configuration",
"value": "malware-configuration" "value": "malware-configuration"
} }
@ -48,17 +48,17 @@
{ {
"entry": [ "entry": [
{ {
"description": "Attacks that send requests to a system to discover weaknesses. This also includes testing processes to gather information on hosts, services and accounts. Examples: fingerd, DNS querying, ICMP, SMTP (EXPN, RCPT, ...), port scanning.", "description": "Attacks that send requests to a system to discover weaknesses. This also includes testing processes to gather information on hosts, services and accounts. This includes fingerd, DNS querying, ICMP, SMTP (EXPN, RCPT, etc) port scanning.",
"expanded": "Scanning", "expanded": "Scanning",
"value": "scanner" "value": "scanner"
}, },
{ {
"description": "Observing and recording of network traffic (wiretapping).", "description": "Observing and recording of network traffic (i.e. wiretapping).",
"expanded": "Sniffing", "expanded": "Sniffing",
"value": "sniffing" "value": "sniffing"
}, },
{ {
"description": "Gathering information from a human being in a non-technical way (e.g. lies, tricks, bribes, or threats).", "description": "Gathering information from a human being in a non-technical way (e.g., using lies, tricks, bribes, or threats).",
"expanded": "Social Engineering", "expanded": "Social Engineering",
"value": "social-engineering" "value": "social-engineering"
} }
@ -68,18 +68,18 @@
{ {
"entry": [ "entry": [
{ {
"description": "An attempt to compromise a system or to disrupt any service by exploiting vulnerabilities with a standardised identifier such as CVE name (e.g. buffer overflow, backdoor, cross site scripting, etc.)", "description": "An attempt to compromise a system or to disrupt any service by exploiting vulnerabilities with a standardised identifier such as CVE name (e.g., using a buffer overflow, backdoor, cross site scripting)",
"expanded": "Exploitation of known Vulnerabilities", "expanded": "Exploitation of Known Vulnerabilities",
"value": "ids-alert" "value": "ids-alert"
}, },
{ {
"description": "Multiple login attempts (Guessing / cracking of passwords, brute force). This IOC refers to a resource, which has been observed to perform brute-force attacks over a given application protocol.", "description": "Multiple brute-force login attempts (including guessing or cracking of passwords). This IOC refers to a resource, which has been observed to perform brute-force attacks over a given application protocol.",
"expanded": "Login attempts", "expanded": "Login Attempts",
"value": "brute-force" "value": "brute-force"
}, },
{ {
"description": "An attack using an unknown exploit.", "description": "An attack using an unknown exploit.",
"expanded": "New attack signature", "expanded": "New Attack Signature",
"value": "exploit" "value": "exploit"
} }
], ],
@ -88,7 +88,7 @@
{ {
"entry": [ "entry": [
{ {
"description": "Compromise of a system where the attacker gained administrative privileges.", "description": "Compromise of a system where the attacker has gained administrative privileges.",
"expanded": "Privileged Account Compromise", "expanded": "Privileged Account Compromise",
"value": "privileged-account-compromise" "value": "privileged-account-compromise"
}, },
@ -98,17 +98,17 @@
"value": "unprivileged-account-compromise" "value": "unprivileged-account-compromise"
}, },
{ {
"description": "Compromise of an application by exploiting (un-)known software vulnerabilities, e.g. SQL injection.", "description": "Compromise of an application by exploiting (un)known software vulnerabilities, e.g., SQL injection.",
"expanded": "Application Compromise", "expanded": "Application Compromise",
"value": "application-compromise" "value": "application-compromise"
}, },
{ {
"description": "Compromise of a system, e.g. unauthorised logins or commands. This includes compromising attempts on honeypot systems.", "description": "Compromise of a system, e.g., unauthorised logins or commands. This includes attempts to compromise honeypot systems.",
"expanded": "System Compromise", "expanded": "System Compromise",
"value": "system-compromise" "value": "system-compromise"
}, },
{ {
"description": "Physical intrusion, e.g. into corporate building or data-centre.", "description": "Physical intrusion, e.g., into a corporate building or data centre.",
"expanded": "Burglary", "expanded": "Burglary",
"value": "burglary" "value": "burglary"
} }
@ -118,27 +118,27 @@
{ {
"entry": [ "entry": [
{ {
"description": "Denial of Service attack, e.g. sending specially crafted requests to a web application which causes the application to crash or slow down.", "description": "Denial of Service attack, e.g., sending specially crafted requests to a web application which causes the application to crash or slow down.",
"expanded": "Denial of Service", "expanded": "Denial of Service",
"value": "dos" "value": "dos"
}, },
{ {
"description": "Distributed Denial of Service attack, e.g. SYN-Flood or UDP-based reflection/amplification attacks.", "description": "Distributed Denial of Service attack, e.g., SYN flood or UDP-based reflection/amplification attacks.",
"expanded": "Distributed Denial of Service", "expanded": "Distributed Denial of Service",
"value": "ddos" "value": "ddos"
}, },
{ {
"description": "Software misconfiguration resulting in service availability issues, e.g. DNS server with outdated DNSSEC Root Zone KSK.", "description": "Software misconfiguration resulting in service availability issues, e.g., DNS server with outdated DNSSEC Root Zone KSK.",
"expanded": "Misconfiguration", "expanded": "Misconfiguration",
"value": "misconfiguration" "value": "misconfiguration"
}, },
{ {
"description": "Physical sabotage, e.g cutting wires or malicious arson.", "description": "Physical sabotage, e.g., cutting wires or malicious arson.",
"expanded": "Sabotage", "expanded": "Sabotage",
"value": "sabotage" "value": "sabotage"
}, },
{ {
"description": "Outage caused e.g. by air condition failure or natural disaster.", "description": "An outage caused, for example, by air conditioning failure or natural disaster.",
"expanded": "Outage", "expanded": "Outage",
"value": "outage" "value": "outage"
} }
@ -148,23 +148,23 @@
{ {
"entry": [ "entry": [
{ {
"description": "Unauthorised access to information, e.g. by abusing stolen login credentials for a system or application, intercepting traffic or gaining access to physical documents.", "description": "Unauthorised access to information, e.g., by abusing stolen login credentials for a system or application, intercepting traffic or gaining access to physical documents.",
"expanded": "Unauthorised access to information", "expanded": "Unauthorised Access to Information",
"value": "unauthorised-information-access" "value": "unauthorised-information-access"
}, },
{ {
"description": "Unauthorised modification of information, e.g. by an attacker abusing stolen login credentials for a system or application or a ransomware encrypting data. Also includes defacements.", "description": "Unauthorised modification of information, e.g., by an attacker abusing stolen login credentials for a system or application, or ransomware encrypting data. Also includes defacements.",
"expanded": "Unauthorised modification of information", "expanded": "Unauthorised Modification of Information",
"value": "unauthorised-information-modification" "value": "unauthorised-information-modification"
}, },
{ {
"description": "Loss of data, e.g. caused by harddisk failure or physical theft.", "description": "Loss of data caused by, for example, hard disk failure or physical theft.",
"expanded": "Data Loss", "expanded": "Data Loss",
"value": "data-loss" "value": "data-loss"
}, },
{ {
"description": "Leaked confidential information like credentials or personal data.", "description": "Leaked confidential information, e.g., credentials or personal data.",
"expanded": "Leak of confidential information", "expanded": "Leak of Confidential Information",
"value": "data-leak" "value": "data-leak"
} }
], ],
@ -173,12 +173,12 @@
{ {
"entry": [ "entry": [
{ {
"description": "Using resources for unauthorised purposes including profit-making ventures, e.g. the use of e-mail to participate in illegal profit chain letters or pyramid schemes.", "description": "Using resources for unauthorised purposes including profit-making ventures, e.g., the use of email to participate in illegal profit chain letters or pyramid schemes.",
"expanded": "Unauthorised use of resources", "expanded": "Unauthorised Use of Resources",
"value": "unauthorised-use-of-resources" "value": "unauthorised-use-of-resources"
}, },
{ {
"description": "Offering or Installing copies of unlicensed commercial software or other copyright protected materials (Warez).", "description": "Offering or installing copies of unlicensed commercial software or other copyright protected materials (also known as Warez).",
"expanded": "Copyright", "expanded": "Copyright",
"value": "copyright" "value": "copyright"
}, },
@ -198,28 +198,28 @@
{ {
"entry": [ "entry": [
{ {
"description": "Publicly accessible services offering weak crypto, e.g. web servers susceptible to POODLE/FREAK attacks.", "description": "Publicly accessible services offering weak cryptography, e.g., web servers susceptible to POODLE/FREAK attacks.",
"expanded": "Weak crypto", "expanded": "Weak Cryptography",
"value": "weak-crypto" "value": "weak-crypto"
}, },
{ {
"description": "Publicly accessible services that can be abused for conducting DDoS reflection/amplification attacks, e.g. DNS open-resolvers or NTP servers with monlist enabled.", "description": "Publicly accessible services that can be abused for conducting DDoS reflection/amplification attacks, e.g., DNS open-resolvers or NTP servers with monlist enabled.",
"expanded": "DDoS amplifier", "expanded": "DDoS Amplifier",
"value": "ddos-amplifier" "value": "ddos-amplifier"
}, },
{ {
"description": "Potentially unwanted publicly accessible services, e.g. Telnet, RDP or VNC.", "description": "Potentially unwanted publicly accessible services, e.g., Telnet, RDP or VNC.",
"expanded": "Potentially unwanted accessible services", "expanded": "Potentially Unwanted Accessible Services",
"value": "potentially-unwanted-accessible" "value": "potentially-unwanted-accessible"
}, },
{ {
"description": "Publicly accessible services potentially disclosing sensitive information, e.g. SNMP or Redis.", "description": "Publicly accessible services potentially disclosing sensitive information, e.g., SNMP or Redis.",
"expanded": "Information disclosure", "expanded": "Information disclosure",
"value": "information-disclosure" "value": "information-disclosure"
}, },
{ {
"description": "A system which is vulnerable to certain attacks. Example: misconfigured client proxy settings (example: WPAD), outdated operating system version, XSS vulnerabilities, etc.", "description": "A system which is vulnerable to certain attacks, e.g., misconfigured client proxy settings (such as WPAD), outdated operating system version, or cross-site scripting vulnerabilities.",
"expanded": "Vulnerable system", "expanded": "Vulnerable System",
"value": "vulnerable-system" "value": "vulnerable-system"
} }
], ],
@ -293,12 +293,12 @@
"value": "fraud" "value": "fraud"
}, },
{ {
"description": "Open resolvers, world readable printers, vulnerability apparent from Nessus etc scans, virus signatures not up-to-date, etc", "description": "Open resolvers, world-readable printers, vulnerabilities apparent from scans, anti-virus signatures not up-to-date, etc.",
"expanded": "Vulnerable", "expanded": "Vulnerable",
"value": "vulnerable" "value": "vulnerable"
}, },
{ {
"description": "All incidents which don't fit in one of the given categories should be put into this class. If the number of incidents in this category increases, it is an indicator that the classification scheme must be revised", "description": "All incidents which don't fit in one of the given categories should be put into this class. If the number of incidents in this category increases, it is an indicator that the classification scheme must be revised.",
"expanded": "Other", "expanded": "Other",
"value": "other" "value": "other"
}, },
@ -308,7 +308,7 @@
"value": "test" "value": "test"
} }
], ],
"version": 1002, "version": 1003,
"description": "Reference Security Incident Classification Taxonomy", "description": "Reference Security Incident Classification Taxonomy",
"namespace": "rsit" "namespace": "rsit"
} }