misp-warninglists/README.md

97 lines
5.7 KiB
Markdown
Raw Normal View History

2016-04-19 21:59:42 +02:00
# misp-warninglist
misp-warninglists are lists of well-known indicators that can be associated to potential false positives, errors or mistakes.
2016-06-24 11:04:01 +02:00
[![Build Status](https://travis-ci.org/MISP/misp-warninglists.svg?branch=master)](https://travis-ci.org/MISP/misp-warninglists)
2016-04-19 21:59:42 +02:00
The warning lists are integrated in MISP to display an info/warning box at the event and attribute level if such indicators
are available in one of the list. The list can be globally enabled or disabled in MISP following the practices of the organization.
# lists
2019-03-09 17:11:53 +01:00
- [lists/akamai](lists/akamai) - Akamai networks
2016-05-28 21:34:48 +02:00
- [lists/alexa](lists/alexa) - Top 1000 websites from Alexa
2018-02-22 09:49:10 +01:00
- [lists/amazon-aws](lists/amazon-aws) - Known Amazon AWS IP address ranges
- [lists/automated-malware-analysis](lists/automated-malware-analysis) - known domains used by automated malware analysis services
2018-09-07 20:48:56 +02:00
- [lists/bank-website](lists/bank-website) - List of known banking website
2018-08-10 15:48:55 +02:00
- [lists/cisco_top1000](lists/cisco_top1000) - Cisco (Umbrella) top 1000 websites
- [lists/cloudflare](lists/cloudflare) - known IP ranges published by Cloudflare
2018-07-06 17:46:39 +02:00
- [lists/common-ioc-false-positive](lists/common-ioc-false-positive) - common false-positives in IOCs
2019-03-01 14:45:37 +01:00
- [lists/crl](lists/crl-ip-hostname) - Source IP addresses, hostname and url from CRL (certificate revocation list)
2017-02-01 14:51:59 +01:00
- [lists/eicar.com](lists/eicar.com) - hashes for EICAR test virus
- [lists/disposable-email](lists/disposable-email) - List of disposable email domains
2016-04-19 21:59:42 +02:00
- [lists/empty-hashes](lists/empty-hashes) - hash values of empty files
2016-04-22 09:24:59 +02:00
- [lists/google](lists/google) - known domains and hostnames from Google
- [lists/googlebot](lists/googlebot) - known IP ranges for googlebot crawler
- [lists/google-gmail-sending-ips](lists/google-gmail-sending-ips) - known IP ranges use by Google gmail mail sending
2018-01-02 15:58:32 +01:00
- [lists/ipv6-linklocal](lists/ipv6-linklocal) - IPv6 link local prefix
- [lists/microsoft](lists/microsoft) - known Microsoft domains
- [lists/microsoft-azure](lists/microsoft-azure) - known Microsoft Azure Datacenter IP Ranges
- [lists/microsoft-office365](lists/microsoft-office365) - known Office 365 URLs
- [lists/microsoft-office365-ip](lists/microsoft-office365-ip) - known Office 365 IP address ranges
- [lists/microsoft-office365-cn](lists/microsoft-office365-cn) - known Office 365 IP address ranges in China
- [lists/microsoft-attack-simulator](lists/microsoft-attack-simulator/) - known Office 365 hostnames and IP address used for Microsoft "Attack Simulator"
2018-08-31 14:17:05 +02:00
- [lists/microsoft-win10-connection-endpoints](lists/microsoft-win10-connection-endpoints/) - known Windows 10 connection endpoints
- [lists/mozilla-CA](lists/mozilla-CA) - Mozilla keystore CA
- [lists/mozilla-IntermediateCA](lists/mozilla-IntermediateCA) - Mozilla keystore Intermediate CA
2016-04-26 22:25:21 +02:00
- [lists/multicast](lists/multicast) - known IPv4 multicast CIDR blocks
2018-02-23 16:22:28 +01:00
- [lists/ovh-cluster](lists/ovh-cluster) - List of known OVH Cluster IP
- [lists/public-dns-v4](lists/public-dns-v4) - IPv4 addresses and reverse of public DNS resolver
- [lists/public-dns-v6](lists/public-dns-v6) - IPv6 addresses and reverse of public DNS resolver
2016-04-19 21:59:42 +02:00
- [lists/rfc1918](lists/rfc1918) - RFC 1918 network subnets
- [lists/rfc3849](lists/rfc3849) - RFC 3849 - Documentation prefix for ipv6
2016-06-24 10:53:23 +02:00
- [lists/rfc5735](lists/rfc5735) - RFC 5735 CIDR blocks - Special Use IPv4 Addresses
2017-02-01 13:38:23 +01:00
- [lists/rfc6598](lists/rfc6598) - RFC 6598 IANA-Reserved IPv4 Prefix for Shared Address Space (Carrier- Grade NAT (CGN) devices)
2018-03-29 14:39:58 +02:00
- [lists/rfc6761](lists/rfc6761) - RFC 6761 Special-Use Domain Names
- [lists/security-provider-blogpost](lists/security-provider-blogpost) - Security providers or vendors blog domains
2016-04-20 21:36:21 +02:00
- [lists/second-level-tlds](lists/second-level-tlds) - Mozilla list of second level top-level domains
- [lists/sinkholes](lists/sinkholes) - List of known sinkholes
2016-04-19 21:59:42 +02:00
- [lists/tlds](lists/tlds) - top-level domains
2017-01-06 18:41:30 +01:00
- [lists/url-shortener](lists/url-shortener) - URL shorteners services
2019-03-09 17:16:49 +01:00
- [lists/university_domains](lists/university_domains) - University domain names
- [lists/vpn-ipv4](lists/vpn-ipv4) - Specialized list of IPv4 addresses belonging to common VPN providers and datacenters
- [lists/vpn-ipv6](lists/vpn-ipv6) - Specialized list of IPv6 addresses belonging to common VPN providers and datacenters
2018-08-10 15:48:55 +02:00
- [lists/whats-my-ip](lists/whats-my-ip) - "What's my IP" service
- [lists/wikimedia/list.json](lists/wikimedia/) - Lists of subnet used by Wikimedia (such as Wikipedia and alike)
2016-04-19 21:59:42 +02:00
# Format of a warning list
~~~~json
{
"name": "List of known public DNS resolvers",
"version": 1,
"description": "Event contains one or more public DNS resolvers as attribute with an IDS flag set",
"matching_attributes": [
"ip-src",
"ip-dst"
],
"list": [
"8.8.8.8",
"8.8.4.4",
"208.67.222.222",
"208.67.220.220",
"195.46.39.39",
"195.46.39.40"
]
}
~~~~
If matching_attributes are not set, the list is matched against any type of attributes.
2016-09-04 17:49:55 +02:00
2017-01-20 07:29:08 +01:00
## type of warning list
- ```string``` (default) - perfect match of a string in the warning list against matching attributes
- ```substring``` - substring matching of a string in the warning list against matching attributes
2017-02-01 13:38:23 +01:00
- ```hostname``` - hostname matching (e.g. domain matching from URL) of a string in the warning list against matching attributes
2017-12-22 15:17:36 +01:00
- ```cidr``` - IP or CDIR block matching in the warning list against matching attributes
- ```regex``` - regex matching of a string matching attributes
2017-01-20 07:29:08 +01:00
2018-05-09 09:05:58 +02:00
# Processing warning lists in python
See [PyMISPWarningLists](https://github.com/MISP/PyMISPWarningLists) for a
python interface to warning lists.
2016-09-04 17:49:55 +02:00
# License
MISP warning-lists are licensed under [CC0 1.0 Universal (CC0 1.0)](https://creativecommons.org/publicdomain/zero/1.0/) - Public Domain Dedication. If a specific author of a taxonomy wants to license it under a different license, a pull request can be requested.