diff --git a/MANIFEST.json b/MANIFEST.json index c9dc7ce..754ef76 100644 --- a/MANIFEST.json +++ b/MANIFEST.json @@ -26,7 +26,7 @@ { "description": "The Permissible Actions Protocol - or short: PAP - was designed to indicate how the received information can be used.", "name": "PAP", - "version": 2 + "version": 3 }, { "description": "The access method used to remotely access a system.", @@ -89,9 +89,9 @@ "version": 2 }, { - "description": "CIRCL Taxonomy - Schemes of Classification in Incident Response and Detection", + "description": "CIRCL Taxonomy - Schemes of Classification in Incident Response and Detection.", "name": "circl", - "version": 5 + "version": 6 }, { "description": "La presente taxonomia es la primera versión disponible para el Centro Nacional de Seguridad Digital del Perú.", @@ -124,7 +124,7 @@ "version": 2 }, { - "description": "The Crowdsec behaviors and classifications taxonomy is the list of taxonomies used in Crowdsec to describe the behaviors and classifications of an IP address. The behaviors are a list of attack categories for which a given IP address was reported, where the classifications describe a list of categories associated to an IP address and, when applicable, a list of false positive categories.", + "description": "Crowdsec IP address classifications and behaviors taxonomy.", "name": "crowdsec", "version": 1 }, @@ -238,6 +238,11 @@ "name": "domain-abuse", "version": 2 }, + { + "description": "This taxonomy aims to list doping substances", + "name": "doping-substances", + "version": 2 + }, { "description": "A taxonomy based on the superclass and class of drugs. Based on https://www.drugbank.ca/releases/latest", "name": "drugs", @@ -511,7 +516,7 @@ { "description": "MISP workflow taxonomy to support result of workflow execution.", "name": "misp-workflow", - "version": 2 + "version": 3 }, { "description": "MONARC Threats Taxonomy", @@ -626,7 +631,7 @@ { "description": "Runtime or software packer used to combine compressed or encrypted data with the decompression or decryption code. This code can add additional obfuscations mechanisms including polymorphic-packer or other obfuscation techniques. This taxonomy lists all the known or official packer used for legitimate use or for packing malicious binaries.", "name": "runtime-packer", - "version": 1 + "version": 2 }, { "description": "Flags describing the sample", @@ -658,6 +663,11 @@ "name": "social-engineering-attack-vectors", "version": 1 }, + { + "description": "SRB-CERT Taxonomy - Schemes of Classification in Incident Response and Detection", + "name": "srbcert", + "version": 3 + }, { "description": "A spectrum of state responsibility to more directly tie the goals of attribution to the needs of policymakers.", "name": "state-responsibility", @@ -696,7 +706,7 @@ { "description": "The Traffic Light Protocol (TLP) (v2.0) was created to facilitate greater sharing of potentially sensitive information and more effective collaboration. Information sharing happens from an information source, towards one or more recipients. TLP is a set of four standard labels (a fifth label is included in amber to limit the diffusion) used to indicate the sharing boundaries to be applied by the recipients. Only labels listed in this standard are considered valid by FIRST. This taxonomy includes additional labels for backward compatibility which are no more validated by FIRST SIG.", "name": "tlp", - "version": 7 + "version": 10 }, { "description": "Taxonomy to describe Tor network infrastructure", @@ -741,9 +751,9 @@ { "description": "Workflow support language is a common language to support intelligence analysts to perform their analysis on data and information.", "name": "workflow", - "version": 11 + "version": 12 } ], "url": "https://raw.githubusercontent.com/MISP/misp-taxonomies/main/", - "version": "20230514" + "version": "20231122" } diff --git a/PAP/machinetag.json b/PAP/machinetag.json index c6be37e..8bf3381 100644 --- a/PAP/machinetag.json +++ b/PAP/machinetag.json @@ -2,23 +2,28 @@ "namespace": "PAP", "expanded": "Permissible Actions Protocol", "description": "The Permissible Actions Protocol - or short: PAP - was designed to indicate how the received information can be used.", - "version": 2, + "version": 3, "exclusive": true, "predicates": [ { "value": "RED", "expanded": "(PAP:RED) Non-detectable actions only. Recipients may not use PAP:RED information on the network. Only passive actions on logs, that are not detectable from the outside.", - "colour": "#ff0000" + "colour": "#ff2b2b" }, { "value": "AMBER", "expanded": "(PAP:AMBER) Passive cross check. Recipients may use PAP:AMBER information for conducting online checks, like using services provided by third parties (e.g. VirusTotal), or set up a monitoring honeypot.", - "colour": "#ffa800" + "colour": "#ffc000" }, { "value": "GREEN", "expanded": "(PAP:GREEN) Active actions allowed. Recipients may use PAP:GREEN information to ping the target, block incoming/outgoing traffic from/to the target or specifically configure honeypots to interact with the target.", - "colour": "#00ad1c" + "colour": "#33ff00" + }, + { + "value": "CLEAR", + "expanded": "(PAP:CLEAR) No restrictions in using this information.", + "colour": "#ffffff" }, { "value": "WHITE", diff --git a/circl/machinetag.json b/circl/machinetag.json index 9091773..db88ce4 100644 --- a/circl/machinetag.json +++ b/circl/machinetag.json @@ -1,7 +1,7 @@ { "namespace": "circl", - "description": "CIRCL Taxonomy - Schemes of Classification in Incident Response and Detection", - "version": 5, + "description": "CIRCL Taxonomy - Schemes of Classification in Incident Response and Detection.", + "version": 6, "predicates": [ { "value": "incident-classification", @@ -10,6 +10,11 @@ { "value": "topic", "expanded": "Topic" + }, + { + "value": "significant", + "expanded": "Significant", + "description": "Significant topic which has been evaluated to have a certain level of significancy which can have or had a severe impact." } ], "values": [ diff --git a/cryptocurrency-threat/machinetag.json b/cryptocurrency-threat/machinetag.json index 8bba8fa..30bc2bd 100644 --- a/cryptocurrency-threat/machinetag.json +++ b/cryptocurrency-threat/machinetag.json @@ -42,6 +42,10 @@ { "value": "Crypto Robbing Ransomware", "expanded": "Cyber-extortionists began distributing new malware that empties cryptocurrency wallets and steals private keys while holding user data hostage." + }, + { + "value": "Pig Butchering Scam", + "expanded": "Cryptocurrency investment fraud that lures individuals into investing their money in seemingly legitimate and profitable ventures." } ], "refs": [ diff --git a/doping-substances/Misp-logo.png b/doping-substances/Misp-logo.png new file mode 100644 index 0000000..5f2d4dd Binary files /dev/null and b/doping-substances/Misp-logo.png differ diff --git a/doping-substances/README.md b/doping-substances/README.md new file mode 100644 index 0000000..db4ba68 --- /dev/null +++ b/doping-substances/README.md @@ -0,0 +1,44 @@ +# MISP_DopingSubstanceTaxonomy + +This project aims to gather information about all the prohibited sports Doping Substances. + +We collected all of the information on the [WADA website](https://www.wada-ama.org/en/prohibited-list). + +To do that we have created a python script to scrap this website and generate a JSON file (Taxonomy). + +This Taxonomy could be add in MISP to help sports organizations to fight against usage of doping substances. + +## MISP + +![logo](Misp-logo.png) + +What is MISP ? + +>A threat intelligence platform for sharing, storing and correlating +Indicators of Compromise of targeted attacks, threat intelligence, +financial fraud information, vulnerability information or even +counter-terrorism information. Discover how MISP is used today in +multiple organisations. Not only to store, share, collaborate on cyber +security indicators, malware analysis, but also to use the IoCs and +information to detect and prevent attacks, frauds or threats against ICT + infrastructures, organisations or people. + +## JSON Generation + +In order to build the JSON file, we created a Python script which scrap the WADA (World Anti-Doping Agency) ‘s prohibited list. + +Thanks to BeautifulSoup, a useful library that helps a lot when it comes to scrap HTLM documents, the script is able to get all the list of doping substances. + +The file is created with PyTaxonomies, a MISP library that help to create valid JSON file according to the [MISP Platform](https://www.misp-project.org/taxonomies.html#_misp_taxonomies). + +Finally, the script generates all predicates (doping categories) and the entries associated (the doping substances themselves). + +## Installation + +If you want to try it out yourself, you need to have both BeautifulSoup & PyTaxonomies installated. + +## Authors + +DELUS Thibaut : https://github.com/WooZyhh + +JACOB Lucas : https://github.com/Chaamoxs diff --git a/doping-substances/gen_taxonomy.py b/doping-substances/gen_taxonomy.py new file mode 100644 index 0000000..aa205da --- /dev/null +++ b/doping-substances/gen_taxonomy.py @@ -0,0 +1,63 @@ +import json +import requests +from bs4 import BeautifulSoup +from pathlib import Path +from pytaxonomies import Entry, Predicate, Taxonomy + +CONTENT_URL = 'https://www.wada-ama.org/en/prohibited-list' + +TAXONOMY_DESCRIPTION = 'This taxonomy aims to list doping substances' +TAXONOMY_EXPANDED = 'Doping substances' +TAXONOMY_NAME = 'doping-substances' + +ignore = ('NON-APPROVED SUBSTANCES', ) + + +def list_predicates(articles): + predicates = {} + for article in articles: + title = article.find('p', attrs={'class': 'h3 panel-title'}).text + if title in ignore: + continue + predicate = Predicate() + predicate.predicate = title + div = article.find('div', attrs={'class': 'layout-wysiwyg'}) + description = div.find('p') + predicate.description = description.find_next_sibling().text + predicates[title] = predicate + return predicates + + +def generate_taxonomy(): + new_taxonomy = Taxonomy() + + new_taxonomy.name = TAXONOMY_NAME + new_taxonomy.expanded = TAXONOMY_EXPANDED + new_taxonomy.description = TAXONOMY_DESCRIPTION + + response = requests.get(CONTENT_URL) + soup = BeautifulSoup(response.text, 'html.parser') + articles = soup.findAll('article', attrs={'class': 'panel hide-reader'}) + + new_taxonomy.predicates = list_predicates(articles) + + for article in articles: + title = article.find('p', attrs={'class': 'h3 panel-title'}).text + if title in ignore: + continue + products = article.findAll('li') + products_list = {} + for product in products: + entry = Entry() + entry.value = product.text + products_list[entry.value] = entry + new_taxonomy.predicates[title].entries = products_list + + return new_taxonomy + + +if __name__ == '__main__': + taxonomy = generate_taxonomy() + taxonomy.version = 2 + with open(Path(__file__).resolve().parent / 'machinetag.json', 'wt', encoding='utf-8') as f: + json.dump(taxonomy.to_dict(), f, indent=2, ensure_ascii=False) diff --git a/doping-substances/machinetag.json b/doping-substances/machinetag.json new file mode 100644 index 0000000..f700b9e --- /dev/null +++ b/doping-substances/machinetag.json @@ -0,0 +1,1128 @@ +{ + "namespace": "doping-substances", + "description": "This taxonomy aims to list doping substances", + "version": 2, + "expanded": "Doping substances", + "predicates": [ + { + "value": "anabolic agents", + "description": "Anabolic agents are prohibited." + }, + { + "value": "peptide hormones, growth factors, related substances and mimetics", + "description": "The following substances, and other substances with similar chemical structure or similar biological effect(s), are prohibited." + }, + { + "value": "beta-2 agonists", + "description": "All selective and non-selective beta-2 agonists, including all optical isomers, are prohibited." + }, + { + "value": "hormone and metabolic modulators", + "description": "The following hormone and metabolic modulators are prohibited." + }, + { + "value": "diuretics and masking agents", + "description": "All diuretics and masking agents, including all optical isomers, e.g. d- and l- where relevant, are prohibited." + }, + { + "value": "manipulation of blood and blood components", + "description": "The following are prohibited" + }, + { + "value": "chemical and physical manipulation", + "description": "The following are prohibited" + }, + { + "value": "gene and cell doping", + "description": "The following, with the potential to enhance sport performance, are prohibited" + }, + { + "value": "stimulants", + "description": "Substances of Abuse in this section: cocaine and methylenedioxymethamphetamine (MDMA / “ecstasy”)." + }, + { + "value": "narcotics", + "description": "The following narcotics, including all optical isomers, e.g. d- and l- where relevant, are prohibited." + }, + { + "value": "cannabinoids" + }, + { + "value": "glucocorticoids", + "description": "All glucocorticoids are prohibited when administered by any injectable, oral [including oromucosal (e.g. buccal, gingival, sublingual)] or rectal route." + }, + { + "value": "beta-blockers", + "description": "Beta-blockers are prohibited In-Competition only, in the following sports, and also prohibited Out-of-Competition where indicated (*)." + } + ], + "values": [ + { + "predicate": "anabolic agents", + "entry": [ + { + "value": "1-androstenediol", + "expanded": "1-androstenediol (5α-androst-1-ene-3β, 17β-diol)" + }, + { + "value": "1-androstenedione", + "expanded": "1-androstenedione (5α-androst-1-ene-3, 17-dione)" + }, + { + "value": "1-androsterone", + "expanded": "1-androsterone (3α-hydroxy-5α-androst-1-ene-17-one)" + }, + { + "value": "1-epiandrosterone", + "expanded": "1-epiandrosterone (3β-hydroxy-5α-androst-1-ene-17-one)" + }, + { + "value": "1-testosterone", + "expanded": "1-testosterone (17β-hydroxy-5α-androst-1-en-3-one)" + }, + { + "value": "4-androstenediol", + "expanded": "4-androstenediol (androst-4-ene-3β,17β-diol)" + }, + { + "value": "4-hydroxytestosterone", + "expanded": "4-hydroxytestosterone (4,17β-dihydroxyandrost-4-en-3-one)" + }, + { + "value": "5-androstenedione", + "expanded": "5-androstenedione (androst-5-ene-3,17-dione)" + }, + { + "value": "7α-hydroxy-dhea" + }, + { + "value": "7β-hydroxy-dhea" + }, + { + "value": "7-keto-dhea" + }, + { + "value": "17α-methylepithiostanol", + "expanded": "17α-methylepithiostanol (epistane)" + }, + { + "value": "19-norandrostenediol", + "expanded": "19-norandrostenediol  (estr-4-ene-3,17-diol)" + }, + { + "value": "19-norandrostenedione", + "expanded": "19-norandrostenedione (estr-4-ene-3,17-dione)" + }, + { + "value": "androst-4-ene-3,11,17-trione", + "expanded": "androst-4-ene-3,11,17-trione (11-ketoandrostenedione, adrenosterone)" + }, + { + "value": "androstanolone", + "expanded": "androstanolone (5α-dihydrotestosterone, 17β-hydroxy-5α-androstan-3-one)" + }, + { + "value": "androstenediol", + "expanded": "androstenediol (androst-5-ene-3β,17β-diol)" + }, + { + "value": "androstenedione", + "expanded": "androstenedione (androst-4-ene-3,17-dione)" + }, + { + "value": "bolasterone" + }, + { + "value": "boldenone" + }, + { + "value": "boldione", + "expanded": "boldione (androsta-1,4-diene-3,17-dione)" + }, + { + "value": "calusterone" + }, + { + "value": "clostebol" + }, + { + "value": "danazol", + "expanded": "danazol ([1,2]oxazolo[4’,5’:2,3]pregna-4-en-20-yn-17α-ol)" + }, + { + "value": "dehydrochlormethyltestosterone", + "expanded": "dehydrochlormethyltestosterone (4-chloro-17β-hydroxy-17α-methylandrosta-1,4-dien-3-one)" + }, + { + "value": "desoxymethyltestosterone", + "expanded": "desoxymethyltestosterone (17α-methyl-5α-androst-2-en-17β-ol and 17α-methyl-5α-androst-3-en-17β-ol)" + }, + { + "value": "drostanolone" + }, + { + "value": "epiandrosterone", + "expanded": "epiandrosterone (3β-hydroxy-5α-androstan-17-one)" + }, + { + "value": "epi-dihydrotestosterone", + "expanded": "epi-dihydrotestosterone (17β-hydroxy-5β-androstan-3-one)" + }, + { + "value": "epitestosterone" + }, + { + "value": "ethylestrenol", + "expanded": "ethylestrenol  (19-norpregna-4-en-17α-ol)" + }, + { + "value": "fluoxymesterone" + }, + { + "value": "formebolone" + }, + { + "value": "furazabol", + "expanded": "furazabol (17α-methyl [1,2,5] oxadiazolo[3’,4’:2,3]-5α-androstan-17β-ol)" + }, + { + "value": "gestrinone" + }, + { + "value": "mestanolone" + }, + { + "value": "mesterolone" + }, + { + "value": "metandienone", + "expanded": "metandienone (17β-hydroxy-17α- methylandrosta-1,4-dien-3-one)" + }, + { + "value": "metenolone" + }, + { + "value": "methandriol" + }, + { + "value": "methasterone", + "expanded": "methasterone (17β-hydroxy-2α,17α- dimethyl-5α-androstan-3-one)" + }, + { + "value": "methyl-1-testosterone", + "expanded": "methyl-1-testosterone (17β-hydroxy-17α- methyl-5α-androst-1-en-3-one)" + }, + { + "value": "methylclostebol" + }, + { + "value": "methyldienolone", + "expanded": "methyldienolone (17β-hydroxy-17α- methylestra-4,9-dien-3-one)" + }, + { + "value": "methylnortestosterone", + "expanded": "methylnortestosterone (17β-hydroxy-17α- methylestr-4-en-3-one)" + }, + { + "value": "methyltestosterone" + }, + { + "value": "metribolone", + "expanded": "metribolone (methyltrienolone, 17β-hydroxy- 17α-methylestra-4,9,11-trien-3-one)" + }, + { + "value": "mibolerone" + }, + { + "value": "nandrolone", + "expanded": "nandrolone (19-nortestosterone)" + }, + { + "value": "norboletone" + }, + { + "value": "norclostebol", + "expanded": "norclostebol (4-chloro-17β-ol-estr-4-en-3- one)" + }, + { + "value": "norethandrolone" + }, + { + "value": "oxabolone" + }, + { + "value": "oxandrolone" + }, + { + "value": "oxymesterone" + }, + { + "value": "oxymetholone" + }, + { + "value": "prasterone", + "expanded": "prasterone (dehydroepiandrosterone, dhea, 3β-hydroxyandrost-5-en-17-one)" + }, + { + "value": "prostanozol", + "expanded": "prostanozol (17β-[(tetrahydropyran-2-yl) oxy]-1’h-pyrazolo[3,4:2,3]-5α-androstane)" + }, + { + "value": "quinbolone" + }, + { + "value": "stanozolol" + }, + { + "value": "stenbolone" + }, + { + "value": "testosterone" + }, + { + "value": "tetrahydrogestrinone", + "expanded": "tetrahydrogestrinone (17-hydroxy-18a- homo-19-nor-17α-pregna-4,9,11-trien-3- one)" + }, + { + "value": "tibolone" + }, + { + "value": "trenbolone", + "expanded": "trenbolone (17β-hydroxyestr-4,9,11-trien-3-one) and other substances with a similar chemical structure or similar biological effect(s)." + }, + { + "value": "clenbuterol" + }, + { + "value": "osilodrostat" + }, + { + "value": "ractopamine" + }, + { + "value": "selective androgen receptor modulators", + "expanded": "selective androgen receptor modulators [sarms, e.g. andarine, enobosarm (ostarine), lgd-4033 (ligandrol), rad140, s-23 and yk-11]" + }, + { + "value": "zeranol" + }, + { + "value": "zilpaterol" + } + ] + }, + { + "predicate": "peptide hormones, growth factors, related substances and mimetics", + "entry": [ + { + "value": "darbepoetins", + "expanded": "darbepoetins (depo)" + }, + { + "value": "erythropoietins", + "expanded": "erythropoietins (epo)" + }, + { + "value": "epo-based constructs", + "expanded": "epo-based constructs [e.g. epo-fc, methoxy polyethylene glycol-epoetin beta (cera)]" + }, + { + "value": "epo-mimetic agents", + "expanded": "epo-mimetic agents and their constructs (e.g. cnto-530, peginesatide)" + }, + { + "value": "cobalt" + }, + { + "value": "daprodustat", + "expanded": "daprodustat (gsk1278863)" + }, + { + "value": "iox2" + }, + { + "value": "molidustat", + "expanded": "molidustat (bay 85-3934)" + }, + { + "value": "roxadustat", + "expanded": "roxadustat (fg-4592)" + }, + { + "value": "vadadustat", + "expanded": "vadadustat (akb-6548)" + }, + { + "value": "xenon" + }, + { + "value": "k-11706" + }, + { + "value": "luspatercept" + }, + { + "value": "sotatercept" + }, + { + "value": "asialo epo" + }, + { + "value": "carbamylated epo", + "expanded": "carbamylated epo (cepo)" + }, + { + "value": "buserelin" + }, + { + "value": "deslorelin" + }, + { + "value": "gonadorelin" + }, + { + "value": "goserelin" + }, + { + "value": "leuprorelin" + }, + { + "value": "nafarelin" + }, + { + "value": "triptorelin" + }, + { + "value": "corticorelin" + }, + { + "value": "growth hormone analogues, e.g. lonapegsomatropin, somapacitan and somatrogon" + }, + { + "value": "growth hormone fragments, e.g. aod-9604 and hgh 176-191" + }, + { + "value": "growth hormone-releasing hormone", + "expanded": "growth hormone-releasing hormone (ghrh) and its analogues (e.g. cjc-1293, cjc-1295, sermorelin and tesamorelin)" + }, + { + "value": "growth hormone secretagogues", + "expanded": "growth hormone secretagogues (ghs) and their mimetics [e.g. lenomorelin (ghrelin), anamorelin, ipamorelin, macimorelin and tabimorelin]" + }, + { + "value": "gh-releasing peptides", + "expanded": "gh-releasing peptides (ghrps) [e.g. alexamorelin, ghrp-1, ghrp-2 (pralmorelin), ghrp-3, ghrp-4, ghrp-5, ghrp-6, and examorelin (hexarelin)]" + }, + { + "value": "fibroblast growth factors", + "expanded": "fibroblast growth factors (fgfs)" + }, + { + "value": "hepatocyte growth factor", + "expanded": "hepatocyte growth factor (hgf)" + }, + { + "value": "insulin-like growth factor 1", + "expanded": "insulin-like growth factor 1 (igf-1) and its analogues" + }, + { + "value": "mechano growth factors", + "expanded": "mechano growth factors (mgfs)" + }, + { + "value": "platelet-derived growth factor", + "expanded": "platelet-derived growth factor (pdgf)" + }, + { + "value": "thymosin-β4 and its derivatives e.g. tb-500" + }, + { + "value": "vascular endothelial growth factor", + "expanded": "vascular endothelial growth factor (vegf) and other growth factors or growth factor modulators affecting muscle, tendon or ligament protein synthesis/degradation, vascularisation, energy utilization, regenerative capacity or fibre type switching." + } + ] + }, + { + "predicate": "beta-2 agonists", + "entry": [ + { + "value": "arformoterol" + }, + { + "value": "fenoterol" + }, + { + "value": "formoterol" + }, + { + "value": "higenamine" + }, + { + "value": "indacaterol" + }, + { + "value": "levosalbutamol" + }, + { + "value": "olodaterol" + }, + { + "value": "procaterol" + }, + { + "value": "reproterol" + }, + { + "value": "salbutamol" + }, + { + "value": "salmeterol" + }, + { + "value": "terbutaline" + }, + { + "value": "tretoquinol", + "expanded": "tretoquinol (trimetoquinol)" + }, + { + "value": "tulobuterol" + }, + { + "value": "vilanterol" + }, + { + "value": "salbutamol", + "expanded": "inhaled salbutamol: maximum 1600 micrograms over 24 hours in divided doses not to exceed 600 micrograms over 8 hours starting from any dose" + }, + { + "value": "formoterol", + "expanded": "inhaled formoterol: maximum delivered dose of 54 micrograms over 24 hours" + }, + { + "value": "salmeterol", + "expanded": "inhaled salmeterol: maximum 200 micrograms over 24 hours" + }, + { + "value": "vilanterol", + "expanded": "inhaled vilanterol: maximum 25 micrograms over 24 hours" + } + ] + }, + { + "predicate": "hormone and metabolic modulators", + "entry": [ + { + "value": "2-androstenol", + "expanded": "2-androstenol  (5α-androst-2-en-17-ol)" + }, + { + "value": "2-androstenone", + "expanded": "2-androstenone (5α-androst-2-en-17-one)" + }, + { + "value": "3-androstenol", + "expanded": "3-androstenol  (5α-androst-3-en-17-ol)" + }, + { + "value": "3-androstenone", + "expanded": "3-androstenone (5α-androst-3-en-17-one)" + }, + { + "value": "4-androstene-3,6,17 trione", + "expanded": "4-androstene-3,6,17 trione (6-oxo)" + }, + { + "value": "aminoglutethimide" + }, + { + "value": "anastrozole" + }, + { + "value": "androsta-1,4,6-triene-3,17-dione", + "expanded": "androsta-1,4,6-triene-3,17-dione (androstatrienedione)" + }, + { + "value": "androsta-3,5-diene-7,17-dione", + "expanded": "androsta-3,5-diene-7,17-dione (arimistane)" + }, + { + "value": "exemestane" + }, + { + "value": "formestane" + }, + { + "value": "letrozole" + }, + { + "value": "testolactone" + }, + { + "value": "bazedoxifene" + }, + { + "value": "clomifene" + }, + { + "value": "cyclofenil" + }, + { + "value": "fulvestrant" + }, + { + "value": "ospemifene" + }, + { + "value": "raloxifene" + }, + { + "value": "tamoxifen" + }, + { + "value": "toremifene" + }, + { + "value": "activin a-neutralizing antibodies" + }, + { + "value": "activin receptor iib competitors", + "expanded": "activin receptor iib competitors such as: decoy activin receptors (e.g. ace-031)" + }, + { + "value": "decoy activin receptors", + "expanded": "decoy activin receptors (e.g. ace-031)" + }, + { + "value": "anti-activin receptor iib antibodies", + "expanded": "anti-activin receptor iib antibodies (e.g. bimagrumab)" + }, + { + "value": "myostatin inhibitors", + "expanded": "myostatin inhibitors such as: agents reducing or ablating myostatin expression myostatin-binding proteins (e.g. follistatin, myostatin propeptide) myostatin- or precursor - neutralizing  antibodies (e.g. apitegromab, domagrozumab, landogrozumab, stamulumab)" + }, + { + "value": "agents reducing or ablating myostatin expression" + }, + { + "value": "myostatin-binding proteins", + "expanded": "myostatin-binding proteins (e.g. follistatin, myostatin propeptide)" + }, + { + "value": "myostatini - or precursor - neutralizing  antibodies", + "expanded": "myostatin - or precursor - neutralizing  antibodies (e.g. apitegromab, domagrozumab, landogrozumab, stamulumab)" + } + ] + }, + { + "predicate": "diuretics and masking agents", + "entry": [ + { + "value": "desmopressin" + }, + { + "value": "probenecid" + }, + { + "value": "plasma expanders", + "expanded": "plasma expanders, e.g. intravenous administration of albumin, dextran, hydroxyethyl starch and mannitol." + }, + { + "value": "acetazolamide" + }, + { + "value": "amiloride" + }, + { + "value": "bumetanide" + }, + { + "value": "canrenone" + }, + { + "value": "chlortalidone" + }, + { + "value": "etacrynic acid" + }, + { + "value": "furosemide" + }, + { + "value": "indapamide" + }, + { + "value": "metolazone" + }, + { + "value": "spironolactone" + }, + { + "value": "thiazides", + "expanded": "thiazides, e.g. bendroflumethiazide, chlorothiazide and hydrochlorothiazide" + }, + { + "value": "torasemide" + }, + { + "value": "triamterene" + }, + { + "value": "vaptans" + }, + { + "value": "vaptans, e.g. tolvaptan." + }, + { + "value": "drospirenone" + }, + { + "value": "pamabrom" + }, + { + "value": "carbonic anhydrase inhibitors", + "expanded": "topical ophthalmic administration of carbonic anhydrase inhibitors (e.g. dorzolamide, brinzolamide)" + }, + { + "value": "felypressin", + "expanded": "local administration of felypressin in dental anaesthesia" + } + ] + }, + { + "predicate": "stimulants", + "entry": [ + { + "value": "adrafinil" + }, + { + "value": "amfepramone" + }, + { + "value": "amfetamine" + }, + { + "value": "amfetaminil" + }, + { + "value": "amiphenazole" + }, + { + "value": "benfluorex" + }, + { + "value": "benzylpiperazine" + }, + { + "value": "bromantan" + }, + { + "value": "clobenzorex" + }, + { + "value": "cocaine" + }, + { + "value": "cropropamide" + }, + { + "value": "crotetamide" + }, + { + "value": "fencamine" + }, + { + "value": "fenetylline" + }, + { + "value": "fenfluramine" + }, + { + "value": "fenproporex" + }, + { + "value": "fonturacetam", + "expanded": "fonturacetam [4-phenylpiracetam (carphedon)]" + }, + { + "value": "furfenorex" + }, + { + "value": "lisdexamfetamine" + }, + { + "value": "mefenorex" + }, + { + "value": "mephentermine" + }, + { + "value": "mesocarb" + }, + { + "value": "metamfetamine", + "expanded": "metamfetamine(d-)" + }, + { + "value": "p-methylamfetamine" + }, + { + "value": "modafinil" + }, + { + "value": "norfenfluramine" + }, + { + "value": "phendimetrazine" + }, + { + "value": "phentermine" + }, + { + "value": "prenylamine" + }, + { + "value": "prolintane" + }, + { + "value": "3-methylhexan-2-amine", + "expanded": "3-methylhexan-2-amine (1,2-dimethylpentylamine)" + }, + { + "value": "4-fluoromethylphenidate" + }, + { + "value": "4-methylhexan-2-amine", + "expanded": "4-methylhexan-2-amine (methylhexaneamine, 1,3-dimethylamylamine, 1,3 dmaa)" + }, + { + "value": "4-methylpentan-2-amine", + "expanded": "4-methylpentan-2-amine (1,3-dimethylbutylamine)" + }, + { + "value": "5-methylhexan-2-amine", + "expanded": "5-methylhexan-2-amine (1,4-dimethylpentylamine, 1,4-dimethylamylamine, 1,4-dmaa)" + }, + { + "value": "benzfetamine" + }, + { + "value": "cathine**" + }, + { + "value": "cathinone and its analogues", + "expanded": "cathinone and its analogues, e.g. mephedrone, methedrone, and α - pyrrolidinovalerophenone" + }, + { + "value": "dimetamfetamine", + "expanded": "dimetamfetamine (dimethylamphetamine)" + }, + { + "value": "ephedrine***" + }, + { + "value": "epinephrine****", + "expanded": "epinephrine**** (adrenaline)" + }, + { + "value": "etamivan" + }, + { + "value": "ethylphenidate" + }, + { + "value": "etilamfetamine" + }, + { + "value": "etilefrine" + }, + { + "value": "famprofazone" + }, + { + "value": "fenbutrazate" + }, + { + "value": "fencamfamin" + }, + { + "value": "heptaminol" + }, + { + "value": "hydrafinil", + "expanded": "hydrafinil (fluorenol)" + }, + { + "value": "hydroxyamfetamine", + "expanded": "hydroxyamfetamine (parahydroxyamphetamine)" + }, + { + "value": "isometheptene" + }, + { + "value": "levmetamfetamine" + }, + { + "value": "meclofenoxate" + }, + { + "value": "methylenedioxymetham- phetamine" + }, + { + "value": "methylephedrine***" + }, + { + "value": "methylnaphthidate", + "expanded": "methylnaphthidate [((±)-methyl-2-(naphthalen-2-yl)-2-(piperidin-2-yl)acetate]" + }, + { + "value": "methylphenidate" + }, + { + "value": "nikethamide" + }, + { + "value": "norfenefrine" + }, + { + "value": "octodrine", + "expanded": "octodrine (1,5-dimethylhex- ylamine)" + }, + { + "value": "octopamine" + }, + { + "value": "oxilofrine", + "expanded": "oxilofrine (methylsynephrine)" + }, + { + "value": "pemoline" + }, + { + "value": "pentetrazol" + }, + { + "value": "phenethylamine and its derivatives" + }, + { + "value": "phenmetrazine" + }, + { + "value": "phenpromethamine" + }, + { + "value": "propylhexedrine" + }, + { + "value": "pseudoephedrine*****" + }, + { + "value": "selegiline" + }, + { + "value": "sibutramine" + }, + { + "value": "solriamfetol" + }, + { + "value": "strychnine" + }, + { + "value": "tenamfetamine", + "expanded": "tenamfetamine (methylenedioxyamphet- amine)" + }, + { + "value": "tuaminoheptane" + }, + { + "value": "clonidine" + }, + { + "value": "imidazole derivatives", + "expanded": "imidazole derivatives for dermatological, nasal, ophthalmic or otic use (e.g. brimonidine, clonazoline, fenoxazoline, indanazoline, naphazoline, oxymetazoline, tetryzoline, xylometazoline) and those stimulants included in the 2023 monitoring program*" + } + ] + }, + { + "predicate": "narcotics", + "entry": [ + { + "value": "buprenorphine" + }, + { + "value": "dextromoramide" + }, + { + "value": "diamorphine", + "expanded": "diamorphine (heroin)" + }, + { + "value": "fentanyl", + "expanded": "fentanyl and its derivatives" + }, + { + "value": "hydromorphone" + }, + { + "value": "methadone" + }, + { + "value": "morphine" + }, + { + "value": "nicomorphine" + }, + { + "value": "oxycodone" + }, + { + "value": "oxymorphone" + }, + { + "value": "pentazocine" + }, + { + "value": "pethidine" + } + ] + }, + { + "predicate": "cannabinoids", + "entry": [ + { + "value": "in cannabis", + "expanded": "in cannabis (hashish, marijuana) and cannabis products" + }, + { + "value": "synthetic cannabinoids that mimic the effects of thc" + }, + { + "value": "natural and synthetic tetrahydrocannabinols", + "expanded": "natural and synthetic tetrahydrocannabinols (thcs)" + }, + { + "value": "cannabidiol" + } + ] + }, + { + "predicate": "glucocorticoids", + "entry": [ + { + "value": "beclometasone" + }, + { + "value": "betamethasone" + }, + { + "value": "budesonide" + }, + { + "value": "ciclesonide" + }, + { + "value": "cortisone" + }, + { + "value": "deflazacort" + }, + { + "value": "dexamethasone" + }, + { + "value": "flucortolone" + }, + { + "value": "flunisolide" + }, + { + "value": "fluticasone" + }, + { + "value": "hydrocortisone" + }, + { + "value": "methylprednisolone" + }, + { + "value": "mometasone" + }, + { + "value": "prednisolone" + }, + { + "value": "prednisone" + }, + { + "value": "triamcinolone acetonide" + } + ] + }, + { + "predicate": "beta-blockers", + "entry": [ + { + "value": "acebutolol" + }, + { + "value": "alprenolol" + }, + { + "value": "atenolol" + }, + { + "value": "betaxolol" + }, + { + "value": "bisoprolol" + }, + { + "value": "bunolol" + }, + { + "value": "carteolol" + }, + { + "value": "carvedilol" + }, + { + "value": "celiprolol" + }, + { + "value": "esmolol" + }, + { + "value": "labetalol" + }, + { + "value": "metipranolol" + }, + { + "value": "metoprolol" + }, + { + "value": "nadolol" + }, + { + "value": "nebivolol" + }, + { + "value": "oxprenolol" + }, + { + "value": "pindolol" + }, + { + "value": "propranolol" + }, + { + "value": "sotalol" + }, + { + "value": "timolol" + } + ] + } + ] +} diff --git a/misp-workflow/machinetag.json b/misp-workflow/machinetag.json index 4e912b6..a33c5af 100644 --- a/misp-workflow/machinetag.json +++ b/misp-workflow/machinetag.json @@ -2,12 +2,27 @@ "namespace": "misp-workflow", "expanded": "MISP workflow", "description": "MISP workflow taxonomy to support result of workflow execution.", - "version": 2, + "version": 3, "predicates": [ { "value": "action-taken", "expanded": "Action taken", "description": "Action taken during the workflow execution" + }, + { + "value": "analysis", + "expanded": "Analysis", + "description": "Result of the analysis executed during the workflow execution" + }, + { + "value": "mutability", + "expanded": "Mutability", + "description": "Describe if the workflow is allowed to modify data" + }, + { + "value": "run", + "expanded": "Run", + "description": "Describe if the workflow is allowed to run on the data being passed" } ], "values": [ @@ -39,6 +54,41 @@ "expanded": "Execution stopped" } ] + }, + { + "predicate": "analysis", + "entry": [ + { + "value": "false-positive", + "expanded": "False positive" + }, + { + "value": "highly-likely-positive", + "expanded": "Highly Likely Positive" + }, + { + "value": "known-file-hash", + "expanded": "Known file hash" + } + ] + }, + { + "predicate": "mutability", + "entry": [ + { + "value": "allowed", + "expanded": "Allowed" + } + ] + }, + { + "predicate": "run", + "entry": [ + { + "value": "allowed", + "expanded": "Allowed" + } + ] } ] } diff --git a/runtime-packer/machinetag.json b/runtime-packer/machinetag.json index f8e91d6..4057e37 100644 --- a/runtime-packer/machinetag.json +++ b/runtime-packer/machinetag.json @@ -1,12 +1,8 @@ { "namespace": "runtime-packer", "description": "Runtime or software packer used to combine compressed or encrypted data with the decompression or decryption code. This code can add additional obfuscations mechanisms including polymorphic-packer or other obfuscation techniques. This taxonomy lists all the known or official packer used for legitimate use or for packing malicious binaries.", - "version": 1, + "version": 2, "predicates": [ - { - "value": "portable-executable", - "expanded": "Portable Executable (PE)" - }, { "value": "dex", "expanded": "Dalvik Executable (DEX)" @@ -16,9 +12,13 @@ "expanded": "Executable Linkable Format (ELF)" }, { - "value": "mach-o", + "value": "macho", "expanded": "Mach-object (Mach-O)" }, + { + "value": "pe", + "expanded": "Portable Executable (PE)" + }, { "value": "cli-assembly", "expanded": "CLI assembly" @@ -26,12 +26,91 @@ ], "values": [ { - "predicate": "portable-executable", + "predicate": "dex", + "entry": [ + { + "value": "apk-protect", + "expanded": "APK Protect" + }, + { + "value": "dexguard", + "expanded": "DexGuard" + }, + { + "value": "dexprotector", + "expanded": "DexProtector" + } + ] + }, + { + "predicate": "elf", + "entry": [ + { + "value": "bzexe", + "expanded": "BzExe" + }, + { + "value": "ezuri", + "expanded": "Ezuri" + }, + { + "value": "gzexe", + "expanded": "GzExe" + }, + { + "value": "midgetpack", + "expanded": "MidgetPack" + }, + { + "value": "pakkero", + "expanded": "Pakkero" + }, + { + "value": "papaw", + "expanded": "Papaw" + }, + { + "value": "shiva", + "expanded": "Shiva" + }, + { + "value": "upx", + "expanded": "UPX" + } + ] + }, + { + "predicate": "macho", + "entry": [ + { + "value": "eleckey", + "expanded": "ElecKey" + }, + { + "value": "muncho", + "expanded": "Muncho" + }, + { + "value": "mpress", + "expanded": "MPRESS" + }, + { + "value": "upx", + "expanded": "UPX" + } + ] + }, + { + "predicate": "pe", "entry": [ { "value": ".netshrink", "expanded": ".netshrink" }, + { + "value": "acprotect", + "expanded": "ACProtect" + }, { "value": "alienyze", "expanded": "Alienyze" @@ -40,10 +119,6 @@ "value": "apack", "expanded": "aPack" }, - { - "value": "apk-protect", - "expanded": "APK Protect" - }, { "value": "armadillo", "expanded": "Armadillo" @@ -53,13 +128,17 @@ "expanded": "ASPack" }, { - "value": "aspr-asprotect", - "expanded": "ASPR (ASProtect)" + "value": "asprotect", + "expanded": "ASProtect" }, { "value": "autoit", "expanded": "AutoIT" }, + { + "value": "axprotector", + "expanded": "AxProtector" + }, { "value": "bero", "expanded": "BeRo EXE Packer" @@ -77,21 +156,29 @@ "expanded": "Code Virtualizer" }, { - "value": "dexguard", - "expanded": "DexGuard" - }, - { - "value": "dexprotector", - "expanded": "DexProtector" + "value": "confuserex", + "expanded": "ConfuserEx" }, { "value": "dotbundle", "expanded": "dotBundle" }, + { + "value": "dragon-armor", + "expanded": "Dragon Armor" + }, + { + "value": "eleckey", + "expanded": "ElecKey" + }, { "value": "enigma-protector", "expanded": "Enigma Protector" }, + { + "value": "enigma-virtual-box", + "expanded": "Enigma Virtual Box" + }, { "value": "exe-bundle", "expanded": "EXE Bundle" @@ -100,6 +187,10 @@ "value": "exe-stealth", "expanded": "EXE Stealth" }, + { + "value": "exe32pack", + "expanded": "EXE32Pack" + }, { "value": "expressor", "expanded": "eXPressor" @@ -109,8 +200,12 @@ "expanded": "FSG" }, { - "value": "gzexe", - "expanded": "GzExe" + "value": "hxor-packer", + "expanded": "hXOR Packer" + }, + { + "value": "jdpack", + "expanded": "JDPack" }, { "value": "kkrunchy", @@ -124,10 +219,26 @@ "value": "mew", "expanded": "MEW" }, + { + "value": "molebox", + "expanded": "MoleBox" + }, + { + "value": "morphine", + "expanded": "Morphine" + }, { "value": "mpress", "expanded": "MPRESS" }, + { + "value": "neolite", + "expanded": "Neolite" + }, + { + "value": "netcrypt", + "expanded": "NetCrypt" + }, { "value": "nspack", "expanded": "NSPack" @@ -136,6 +247,10 @@ "value": "obsidium", "expanded": "Obsidium" }, + { + "value": "packman", + "expanded": "Packman" + }, { "value": "pecompact", "expanded": "PECompact" @@ -144,6 +259,10 @@ "value": "pelock", "expanded": "PELock" }, + { + "value": "pepacker", + "expanded": "PE Packer" + }, { "value": "peshield", "expanded": "PEShield" @@ -156,6 +275,10 @@ "value": "petite", "expanded": "PEtite" }, + { + "value": "procrypt", + "expanded": "ProCrypt" + }, { "value": "rlpack-basic", "expanded": "RLPack Basic" @@ -164,10 +287,22 @@ "value": "smart-packer-pro", "expanded": "Smart Packer Pro" }, + { + "value": "squishy", + "expanded": "Squishy" + }, + { + "value": "telock", + "expanded": "Telock" + }, { "value": "themida", "expanded": "Themida" }, + { + "value": "thinstall", + "expanded": "Thinstall" + }, { "value": "upack", "expanded": "UPack" diff --git a/srbcert/machinetag.json b/srbcert/machinetag.json new file mode 100644 index 0000000..f0ccbb1 --- /dev/null +++ b/srbcert/machinetag.json @@ -0,0 +1,193 @@ +{ + "namespace": "srbcert", + "description": "SRB-CERT Taxonomy - Schemes of Classification in Incident Response and Detection", + "version": 3, + "predicates": [ + { + "value": "incident-type", + "expanded": "Incident Type" + }, + { + "value": "incident-criticality-level", + "expanded": "Incident Criticality Level" + } + ], + "values": [ + { + "predicate": "incident-type", + "entry": [ + { + "value": "virus", + "expanded": "virus", + "description": "Virus is a piece of malicious code that aims to spread from computer to computer by attacking executable files and documents and can cause deliberate deletion of files from the hard drive and similar damage" + }, + { + "value": "worm", + "expanded": "worm", + "description": "Worm is a program that contains malicious code that spreads over a network, in such a way that it can reproduce and transfer , which reproduces and transfers independently, i.e. it does not depend on the files of the infected person device. Worms spread to email addresses from the victim's contact list or exploit the vulnerabilities of network applications and, due to the high speed of propagation, serve for transmission of other types of malicious software " + }, + { + "value": "ransomware", + "expanded": "Ransomware" + }, + { + "value": "trojan", + "expanded": "Trojan" + }, + { + "value": "spyware", + "expanded": "Spyware" + }, + { + "value": "rootkit", + "expanded": "Rootkit" + }, + { + "value": "malware", + "expanded": "Malware is a word derived from two words - Malicious Software, and represents any software that is written for malicious purposes, i.e. that aims to cause harm computer systems or networks" + }, + { + "value": "port-scanning", + "expanded": "Port scanning" + }, + { + "value": "sniffing", + "expanded": "Sniffing" + }, + { + "value": "social-engineering", + "expanded": "Social engineering" + }, + { + "value": "data-breaches", + "expanded": "Data breaches" + }, + { + "value": "other-type-of-information-gathering", + "expanded": "Other type of information gathering" + }, + { + "value": "phishing", + "expanded": "Phishing" + }, + { + "value": "unauthorized-use-of-resources", + "expanded": "Unauthorized use of resources" + }, + { + "value": "fraud", + "expanded": "Fraud" + }, + { + "value": "exploiting-known-vulnerabilities", + "expanded": "Exploiting known vulnerabilities" + }, + { + "value": "brute-force", + "expanded": "Brute force" + }, + { + "value": "other-type-of-intrusion-attempts", + "expanded": "Other type of Intrusion Attempts" + }, + { + "value": "privilege-account-compromise", + "expanded": "Privilege account compromise" + }, + { + "value": "unprivileged-account-compromise", + "expanded": "Unprivileged account compromise" + }, + { + "value": "application-compromise", + "expanded": "Application compromise" + }, + { + "value": "botnet", + "expanded": "Botnet" + }, + { + "value": "other-type-of-intrusions", + "expanded": "Other type of intrusions" + }, + { + "value": "dos", + "expanded": "DoS" + }, + { + "value": "ddos", + "expanded": "DDoS" + }, + { + "value": "sabotage", + "expanded": "Sabotage" + }, + { + "value": "outage", + "expanded": "Outage" + }, + { + "value": "other-type-of-availability-incident", + "expanded": "Other type of Availability incident" + }, + { + "value": "unauthorized-access-to-information", + "expanded": "Unauthorized access to information" + }, + { + "value": "unauthorized-modification-of-information", + "expanded": "Unauthorized modification of information" + }, + { + "value": "cryptographic-attack", + "expanded": "Cryptographic attack" + }, + { + "value": "other-type-of-information-content-security-incident", + "expanded": "Other type of Information Content Security incident" + }, + { + "value": "hardware-errors", + "expanded": "Hardware errors" + }, + { + "value": "software-errors", + "expanded": "Software errors" + }, + { + "value": "hardware-components-theft", + "expanded": "hardware-components-theft" + }, + { + "value": "other", + "expanded": "Other" + } + ] + }, + { + "predicate": "incident-criticality-level", + "entry": [ + { + "value": "low", + "expanded": "Low", + "numerical_value": 25 + }, + { + "value": "medium", + "expanded": "Medium", + "numerical_value": 50 + }, + { + "value": "high", + "expanded": "High", + "numerical_value": 75 + }, + { + "value": "very-high", + "expanded": "Very High", + "numerical_value": 100 + } + ] + } + ] +} diff --git a/tlp/machinetag.json b/tlp/machinetag.json index 09608f3..0861232 100755 --- a/tlp/machinetag.json +++ b/tlp/machinetag.json @@ -15,7 +15,7 @@ { "colour": "#FFC000", "description": "Limited disclosure, recipients can only spread this on a need-to-know basis within their organization. Sources may use TLP:AMBER+STRICT when information requires support to be effectively acted upon, yet carries risk to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may share TLP:AMBER+STRICT information with members of their own organization.", - "expanded": "Limited disclosure, recipients can only spread this on a need-to-know basis within their organization.", + "expanded": "(TLP:AMBER+STRICT) Limited disclosure, recipients can only spread this on a need-to-know basis within their organization.", "value": "amber+strict" }, { @@ -40,12 +40,17 @@ "colour": "#d208f4", "expanded": "(TLP:EX:CHR) Information extended with a specific tag called Chatham House Rule (CHR). When this specific CHR tag is mentioned, the attribution (the source of information) must not be disclosed. This additional rule is at the discretion of the initial sender who can decide to apply or not the CHR tag.", "value": "ex:chr" + }, + { + "colour": "#7e7eae", + "expanded": "(TLP:UNCLEAR) Community, Organization, Clients, and Recipients are all so confused what the appropriate disclosure level is, and if this or that indicator can or cannot be shared. Assumptions are rampant and the confusion is so high that a chi-square test might in fact be required to ensure the randomness of the mess before labelling this case TLP:UNCLEAR.", + "value": "unclear" } ], "refs": [ "https://www.first.org/tlp" ], - "version": 7, + "version": 10, "description": "The Traffic Light Protocol (TLP) (v2.0) was created to facilitate greater sharing of potentially sensitive information and more effective collaboration. Information sharing happens from an information source, towards one or more recipients. TLP is a set of four standard labels (a fifth label is included in amber to limit the diffusion) used to indicate the sharing boundaries to be applied by the recipients. Only labels listed in this standard are considered valid by FIRST. This taxonomy includes additional labels for backward compatibility which are no more validated by FIRST SIG.", "expanded": "Traffic Light Protocol", "exclusive": true, diff --git a/tools/machinetag.py b/tools/machinetag.py index d26252f..66ed96c 100755 --- a/tools/machinetag.py +++ b/tools/machinetag.py @@ -32,7 +32,7 @@ import argparse import os import sys -skip_list = ['death-possibilities', 'poison-taxonomy'] +skip_list = ['death-possibilities', 'poison-taxonomy', 'doping-substances'] taxonomies = [] # Get our current directory from file location