adversary machine tag added - first draft version

adversary/machinetag.json

@@ -0,0 +1,59 @@
+{
+  "namespace": "adversary",
+  "description": "An overview and description of the adversary infrastructure",
+  "version": 1,
+  "predicates": [
+    {
+      "value": "infrastructure-status",
+      "expanded": "Infrastructure Status"
+    },
+    {
+      "value": "infrastructure-type",
+      "expanded": "Infrastructure Type"
+    }
+  ],
+  "values": [
+    {
+      "predicate": "infrastructure-status",
+      "entry": [
+        {
+          "value": "unknown",
+          "expanded": "Infrastructure ownership and status is unknown"
+        },
+        {
+          "value": "compromised",
+          "expanded": "Infrastructure compromised by or in the benefit of the adversary"
+        },
+        {
+          "value": "own-and-operated",
+          "expanded": "Infrastructure own and operated by the adversary"
+        }
+      ]
+    },
+    {
+      "predicate": "infrastructure-type",
+      "entry": [
+        {
+          "value": "unknown",
+          "expanded": "Infrastructure usage by the adversary is unknown"
+        },
+        {
+          "value": "proxy",
+          "expanded": "Infrastructure used as proxy between the target and the adversary"
+        },
+        {
+          "value": "drop-zone",
+          "expanded": "Infrastructure used by the adversary to store information related to its campaigns"
+        },
+        {
+          "value": "exploit-distribution-point",
+          "expanded": "Infrastructure used to distribute exploit towards target(s)"
+        },
+        {
+          "value": "vpn",
+          "expanded": "Infrastructure used by an adversary as Virtual Private Network to hide activities and reduce the traffic analysis surface"
+        }
+      ]
+    }
+  ]
+}

tools/machinetag.py

@@ -30,7 +30,7 @@ import json
 import os.path
 import argparse
 
-taxonomies = ['admiralty-scale','tlp', 'circl', 'veris', 'ecsirt', 'dni-ism', 'nato', 'euci', 'osint']
+taxonomies = ['admiralty-scale', 'adversary', 'tlp', 'circl', 'veris', 'ecsirt', 'dni-ism', 'nato', 'euci', 'osint']
 
 argParser = argparse.ArgumentParser(description='Dump Machine Tags (Triple Tags) from MISP taxonomies')
 argParser.add_argument('-e', action='store_true', help='Include expanded tags')