misp-taxonomies/crowdsec/machinetag.json

310 lines
11 KiB
JSON

{
"version": 1,
"namespace": "crowdsec",
"description": "Crowdsec IP address classifications and behaviors taxonomy.",
"predicates": [
{
"value": "behavior",
"expanded": "Behavior",
"description": "Attack categories and behaviors associated with an IP address."
},
{
"value": "false-positive",
"expanded": "False positive",
"description": "Defines whether an IP address is a known false positive."
},
{
"value": "classification",
"expanded": "Classification",
"description": "Category associated to an IP address."
}
],
"values": [
{
"predicate": "behavior",
"entry": [
{
"value": "database-bruteforce",
"expanded": "Database Bruteforce",
"description": "IP has been reported for performing brute force on databases."
},
{
"value": "ftp-bruteforce",
"expanded": "FTP Bruteforce",
"description": "IP has been reported for performing brute force on FTP services."
},
{
"value": "generic-exploit",
"expanded": "Exploitation attempt",
"description": "IP has been reported trying to exploit known vulnerability/CVE on unspecified protocol."
},
{
"value": "http-bruteforce",
"expanded": "HTTP Bruteforce",
"description": "IP has been reported for performing a HTTP brute force attack (either generic http probing or applicative related brute force)."
},
{
"value": "http-crawl",
"expanded": "HTTP Crawl",
"description": "IP has been reported for performing aggressive crawling of web applications."
},
{
"value": "http-exploit",
"expanded": "HTTP Exploit",
"description": "IP has been reported for attempting to exploit a vulnerability in a web application."
},
{
"value": "http-scan",
"expanded": "HTTP Scan",
"description": "IP has been reported for performing actions related to HTTP vulnerability scanning and discovery."
},
{
"value": "http-spam",
"expanded": "Web form spam",
"description": "IP has been reported trying to perform spam via web forms/forums."
},
{
"value": "iot-bruteforce",
"expanded": "IOT Bruteforce",
"description": "IP has been reported for performing brute force on IOT management interfaces."
},
{
"value": "ldap-bruteforce",
"expanded": "LDAP Bruteforce",
"description": "IP has been reported for performing brute force on ldap services."
},
{
"value": "pop3/imap-bruteforce",
"expanded": "POP3/IMAP Bruteforce",
"description": "IP has been reported for performing a POP3/IMAP brute force attack."
},
{
"value": "sip-bruteforce",
"expanded": "SIP Bruteforce",
"description": "IP has been reported for performing a SIP (VOIP) brute force attack."
},
{
"value": "smb-bruteforce",
"expanded": "SMB Bruteforce",
"description": "IP has been reported for performing brute force on samba services."
},
{
"value": "smtp-spam",
"expanded": "SMTP spam",
"description": "IP has been reported trying to perform spam SMTP service."
},
{
"value": "ssh-bruteforce",
"expanded": "SSH Bruteforce",
"description": "IP has been reported for performing brute force on ssh services."
},
{
"value": "tcp-scan",
"expanded": "TCP Scan",
"description": "IP has been reported for performing TCP port scanning."
},
{
"value": "telnet-bruteforce",
"expanded": "TELNET Bruteforce",
"description": "IP has been reported for performing brute force on telnet services."
},
{
"value": "vm-management-bruteforce",
"expanded": "VM Management Bruteforce",
"description": "IP has been reported for performing brute force on virtual environement management applications."
},
{
"value": "windows-bruteforce",
"expanded": "SMB/RDP bruteforce",
"description": "IP has been reported for performing brute force on Windows (samba, remote desktop) services."
}
]
},
{
"predicate": "false-positive",
"entry": [
{
"value": "cdn-cloudflare_exit_node",
"expanded": "Cloudflare CDN",
"description": "IP is a Cloudflare CDN exit IP and should not be flagged as a threat."
},
{
"value": "cdn-exit_node",
"expanded": "CDN exit node",
"description": "IP is a CDN exit IP and should not be flagged as a threat."
},
{
"value": "ip-private_range",
"expanded": "Private IP address range",
"description": "This IP address is in a private IP range"
},
{
"value": "msp-scanner",
"expanded": "Legitimate Scanner",
"description": "IP belongs to a known 'legitimate' scanner (MSP) and should not be flagged as a threat."
},
{
"value": "seo-crawler",
"expanded": "SEO crawler",
"description": "IP belongs to a known SEO crawler and should not be flagged as a threat."
},
{
"value": "seo-duckduckbot",
"expanded": "Duckduckbot SEO crawler",
"description": "IP belongs to Duckduckbot SEO crawler and should not be flagged as a threat."
},
{
"value": "seo-pinterest",
"expanded": "Pinterest crawler",
"description": "IP belongs to Pinterest crawler and should not be flagged as a threat."
}
]
},
{
"predicate": "classification",
"entry": [
{
"value": "community-blocklist",
"expanded": "CrowdSec Community Blocklist",
"description": "IP belong to the CrowdSec Community Blocklist"
},
{
"value": "profile-insecure_services",
"expanded": "Dangerous Services Exposed",
"description": "IP exposes dangerous services (vnc, telnet, rdp), possibly due to a misconfiguration or because it's a honeypot."
},
{
"value": "profile-many_services",
"expanded": "Many Services Exposed",
"description": "IP exposes many open port, possibly due to a misconfiguration or because it's a honeypot."
},
{
"value": "proxy-tor",
"expanded": "TOR exit node",
"description": "IP is being flagged as a TOR exit node."
},
{
"value": "proxy-vpn",
"expanded": "VPN",
"description": "IP exposes a VPN service or is being flagged as one."
},
{
"value": "range-data_center",
"expanded": "Data Center",
"description": "IP is known to be hosted in a data center."
},
{
"value": "scanner-alphastrike",
"expanded": "Known Security Company",
"description": "IP belongs to a company that scans internet : AlphaSrike."
},
{
"value": "scanner-binaryedge",
"expanded": "Known Security Company",
"description": "IP belongs to a company that scans internet : binaryedge."
},
{
"value": "scanner-censys",
"expanded": "Known Security Company",
"description": "IP belongs to a company that scans internet : Censys."
},
{
"value": "scanner-cert.ssi.gouv.fr",
"expanded": "Known CERT",
"description": "IP belongs to an entity that scans internet : cert.ssi.gouv.fr."
},
{
"value": "scanner-cisa.dhs.gov",
"expanded": "Known CERT",
"description": "IP belongs to an entity that scans internet : cisa.dhs.gov."
},
{
"value": "scanner-internet-census",
"expanded": "Known Security Company",
"description": "IP belongs to a company that scans internet : internet-census."
},
{
"value": "scanner-leakix",
"expanded": "Known Security Company",
"description": "IP belongs to a company that scans internet : leakix."
},
{
"value": "scanner-legit",
"expanded": "Legit scanner",
"description": "IP belongs to a company that scans internet"
},
{
"value": "scanner-shadowserver.org",
"expanded": "Known Security Company",
"description": "IP belongs to an entity that scans internet : www.shadowserver.org."
},
{
"value": "scanner-shodan",
"expanded": "Known Security Company",
"description": "IP belongs to a company that scans internet : Shodan."
},
{
"value": "scanner-stretchoid",
"expanded": "Known Security Company",
"description": "IP belongs to an entity that scans internet : stretchoid."
},
{
"value": "profile-fake_rdns",
"expanded": "Fake RDNS",
"description": "IP is using a fake RDNS"
},
{
"value": "profile-nxdomain",
"expanded": "NXDOMAIN",
"description": "RDNS doesn't exist"
},
{
"value": "profile-router",
"expanded": "Router",
"description": "IP belongs to a router exping services on the internet"
},
{
"value": "profile-proxy",
"expanded": "Proxy",
"description": "IP exposes services that are commonly used by proxies"
},
{
"value": "profile-jupiter-vpn",
"expanded": "JupiterVPN",
"description": "IP belongs to a jupiter vpn"
},
{
"value": "device-cyberoam",
"expanded": "Cyberoam",
"description": "IP belongs to a Cyberoam router"
},
{
"value": "device-microtik",
"expanded": "Mikrotik",
"description": "IP belongs to a Mikrotik router"
},
{
"value": "device-asuswrt",
"expanded": "AsusWRT",
"description": "IP belongs to a AsusWRT router"
},
{
"value": "device-hikvision",
"expanded": "Hikvision",
"description": "IP belongs to a Hikvision camera"
},
{
"value": "device-ipcam",
"expanded": "IpCamera",
"description": "IP belongs to a IP camera"
},
{
"value": "profile-likely_botnet",
"expanded": "Likely Botnet",
"description": "IP is likely to belong to a botnet (based on behaviour and/or characteristics)"
}
]
}
]
}