MISP
/
misp-taxonomies
mirror of https://github.com/MISP/misp-taxonomies
2
0
Fork 0
Code Issues Releases Wiki Activity

Merge branch 'th3r3d-patch-1' into main

pull/240/head
Alexandre Dulaunoy 2022-05-05 18:59:37 +02:00
parent 5908b6585c 4984b1a009
commit 20ffb6980f
No known key found for this signature in database
GPG Key ID: 09E2CD4944E6CBCD
5 changed files with 253 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

243
GrayZone/machinetag.json Normal file
View File

@ -0,0 +1,243 @@
{
"namespace": "GrayZone",
"description": "Gray Zone of Active defense includes all elements which lay between reactive defense elements and offensive operations. It does fill the gray spot between them. Taxo may be used for active defense planning or modeling.",
"version": 3,
"predicates": [
{
"value": "Adversary Emulation",
"expanded": "Adversary Emulation"
},
{
"value": "Beacons",
"expanded": "Beacons"
},
{
"value": "Deterrence",
"expanded": "Deterrence"
},
{
"value": "Deception",
"expanded": "Deception"
},
{
"value": "Tarpits, Sandboxes and Honeypots",
"expanded": "Tarpits, Sandboxes and Honeypots"
},
{
"value": "Threat Intelligence",
"expanded": "Threat Intelligence"
},
{
"value": "Threat Hunting",
"expanded": "Threat Hunting"
},
{
"value": "Adversary Takedowns",
"expanded": "Adversary Takedowns"
},
{
"value": "Ransomware",
"expanded": "Ransomware"
},
{
"value": "Rescue Missions",
"expanded": "Rescue Missions"
},
{
"value": "Sanctions, Indictments & Trade Remedies",
"expanded": "Sanctions, Indictments & Trade Remedies"
}
],
"values": [
{
"predicate": "Adversary Emulation",
"entry": [
{
"value": "Threat Modeling",
"expanded": "Arch threat modeling",
"description": "Modeling threat in services or/and in applications"
},
{
"value": "Purple Teaming",
"expanded": "Purple team collaboration",
"description": "Collaboration between red and blue team"
},
{
"value": "Blue Team",
"expanded": "Blue Team activities",
"description": "Defenders team actions, TTPs etc."
},
{
"value": "Red Team",
"expanded": "Red Team activities",
"description": "Actions, TTPs etc.of Red Team"
}
]
},
{
"predicate": "Beacons",
"entry": [
{
"value": "Inform",
"expanded": "Information from beacon",
"description": "Provide defender with informations about beacon user, intentional or not"
},
{
"value": "Notify",
"expanded": "Notification from beacon",
"description": "Beacon will just send alert, that has been accessed"
}
]
},
{
"predicate": "Deterrence",
"entry": [
{
"value": "by Retaliation",
"expanded": "Retaliation risk",
"description": "Adversary is threatened by retaliation if it will continue in actions"
},
{
"value": "by Denial",
"expanded": "Risk of Denial",
"description": "Deny action ever happened - example: if the attribution is important for adversary"
},
{
"value": "by Entanglement",
"expanded": "Risk of reputation loss",
"description": "By continuing in action adversary may be exhibited to punishment from defenders ally"
}
]
},
{
"predicate": "Deception",
"entry": [
{
"value": "Deception",
"expanded": "Deceptive actions",
"description": "Confuse adversary by deception, can be either whole campaign or just simple word in internal manuals"
},
{
"value": "Denial",
"expanded": "Suppress anything",
"description": "You can deny any part of infrastructure or whole including servers, personal computers, users, machine accounts etc."
},
{
"value": "CounterDeception",
"expanded": "Answer to deception",
"description": "Answer to deception from adversary is counter-deception, for example: answer to phish with shadow user account to uncover next adversary actions"
},
{
"value": "Counter-Deception",
"expanded": "Active counterdeception",
"description": "Answer to adversary deception and his tactical goals, example: if You know the adversary goal(extraction) You can plant documents with fake content to enable damage on adversary sources (fake blueprints of engine, which explode on purpose)"
}
]
},
{
"predicate": "Tarpits, Sandboxes and Honeypots",
"entry": [
{
"value": "Honeypots",
"expanded": "Honeypots",
"description": "Emulating technical resources as services or whole machines or identities"
},
{
"value": "Sandboxes",
"expanded": "Sandboxes",
"description": "Place for secure detonation of anything"
},
{
"value": "Tarpits",
"expanded": "Slow Downs",
"description": "You can slow adversary from action for example by sending slow responses to request"
}
]
},
{
"predicate": "Threat Intelligence",
"entry": [
{
"value": "Passive - OSINT",
"expanded": "OpenSourceINTelligence",
"description": "Use of OSINT for creating of Threat Intelligence"
},
{
"value": "Passive - platforms",
"expanded": "Platforms for TI",
"description": "Save, share and collaborate on threat intelligence platforms"
},
{
"value": "Counter-Intelligence public",
"expanded": "Counter Intelligence",
"description": "Active retrieval of Threat Intelligence for purpose of defense collected with available public resources - example: active monitoring of web services to uncover action before happen (forum hacktivist group)"
},
{
"value": "Counter-Intelligence government",
"expanded": "Counter Intelligence",
"description": "Active retrieval of Threat Intelligence for purpose of defense collected with non-public resources - example: cooperation between secret services in EU"
}
]
},
{
"predicate": "Threat Hunting",
"entry": [
{
"value": "Threat Hunting",
"expanded": "Threat Hunting",
"description": "Threat Hunting is the activity of active search for possible signs of adversary in environment"
}
]
},
{
"predicate": "Adversary Takedowns",
"entry": [
{
"value": "Botnet Takedowns",
"expanded": "Botnet Takedowns",
"description": "Activity with approval of legal governmental entities ie. courts to stop unwanted actions or prevent them"
},
{
"value": "Domain Takedowns",
"expanded": "Domain Takedowns",
"description": "Activity with approval of legal governmental entities ie. courts to stop unwanted actions or prevent them"
},
{
"value": "Infrastructure Takedowns",
"expanded": "Whole environment takedowns",
"description": "Activity with approval of legal governmental entities ie. courts to stop unwanted actions or prevent them"
}
]
},
{
"predicate": "Ransomware",
"entry": [
{
"value": "Ransomware",
"expanded": "Ransomware by defenders",
"description": "Activity with approval of legal governmental entities ie. courts to stop unwanted actions or prevent them"
}
]
},
{
"predicate": "Rescue Missions",
"entry": [
{
"value": "Rescue Missions",
"expanded": "Rescue Missions",
"description": "Activity with approval of legal governmental entities ie. courts to stop unwanted actions or prevent them"
}
]
},
{
"predicate": "Sanctions, Indictments & Trade Remedies",
"entry": [
{
"value": "Sanctions, Indictments & Trade Remedies",
"expanded": "Business and diplomatic actions and counteractions",
"description": "Activity with approval of legal governmental entities ie. courts, states, governments to stop unwanted actions or prevent them"
}
]
}
]
}

5
MANIFEST.json
View File

@ -18,6 +18,11 @@
"name": "DML",
"version": 1
},
{
"description": "Gray Zone of Active defense includes all elements which lay between reactive defense elements and offensive operations. It does fill the gray spot between them. Taxo may be used for active defense planning or modeling.",
"name": "GrayZone",
"version": 3
},
{
"description": "The Permissible Actions Protocol - or short: PAP - was designed to indicate how the received information can be used.",
"name": "PAP",

4
tlp/machinetag.json
View File

@ -36,6 +36,6 @@
"version": 5,
"description": "The Traffic Light Protocol - or short: TLP - was designed with the objective to create a favorable classification scheme for sharing sensitive information while keeping the control over its distribution at the same time.",
"expanded": "Traffic Light Protocol",
"namespace": "tlp",
"exclusive": true
"exclusive": true,
"namespace": "tlp"
}

4
tools/gen.sh
View File

@ -1,7 +1,7 @@
python3 machinetag.py -a >a.txt
asciidoctor a.txt
asciidoctor-pdf -a allow-uri-read a.txt
cp a.html ../../misp-website/static/taxonomies.html
cp a.pdf ../../misp-website/static/taxonomies.pdf
cp a.html ../../misp-website-new/static/taxonomies.html
cp a.pdf ../../misp-website-new/static/taxonomies.pdf
scp a.html circl@cpab.circl.lu:/var/www/nwww.circl.lu/doc/misp-taxonomies/index.html
scp a.pdf circl@cpab.circl.lu://var/www/nwww.circl.lu/doc/misp-taxonomies/taxonomies.pdf

2
tools/gen_markdown.py
View File

@ -26,7 +26,7 @@ def generateMarkdown(taxonomies):
markdown_line_array.append("- license: %s" % 'CC-0')
markdown_line_array.append("- description: %s" % 'Manifest file of MISP taxonomies available.')
markdown_line_array.append("")
markdown_line_array.append("## Taxonomies")
markdown_line_array.append("")
for taxonomy in taxonomies: