diff --git a/objects.html b/objects.html index 7434100..9468100 100755 --- a/objects.html +++ b/objects.html @@ -491,7 +491,7 @@ body.book #toc,body.book #preamble,body.book h1.sect0,body.book .sect1>h2{page-b
text
+sensor
text
A description of the leak which could include the potential victim(s) or description of the leak.
+The AIL sensor uuid where the leak was processed and analysed.
-
original-date
datetime
When the information available in the leak was created. It’s usually before the first-seen.
-+
origin
-url
last-seen
datetime
The link where the leak is (or was) accessible at first-seen.
+When the leak has been accessible or seen for the last time.
+
last-seen
+original-date
datetime
When the leak has been accessible or seen for the last time.
+When the information available in the leak was created. It’s usually before the first-seen.
sensor
text
text
The AIL sensor uuid where the leak was processed and analysed.
+A description of the leak which could include the potential victim(s) or description of the leak.
++
origin
url
The link where the leak is (or was) accessible at first-seen.
text
-text
A description of the cookie.
--
cookie-name
text
Name of the cookie (if splitted)
--
cookie-value
text
cookie-name
text
Name of the cookie (if splitted)
++
text
text
A description of the cookie.
++
cookie
cookie
version
-comment
issued
datetime
yabin.py and regex.txt version used for the generation of the yara rules.
+Initial date of validity or issued date.
@@ -729,10 +729,10 @@ credit-card is a MISP object available in JSON format at
card-security-code
text
comment
comment
Card security code as embossed or printed on the card.
+A description of the card.
@@ -749,10 +749,20 @@ credit-card is a MISP object available in JSON format at
comment
version
comment
A description of the card.
+yabin.py and regex.txt version used for the generation of the yara rules.
++
card-security-code
text
Card security code as embossed or printed on the card.
issued
datetime
Initial date of validity or issued date.
--
text
+protocol
text
Description of the DDoS
--
ip-dst
ip-dst
Destination ID (victim)
+Protocol used for the attack
@@ -847,30 +837,10 @@ ddos is a MISP object available in JSON format at
protocol
text
total-pps
counter
Protocol used for the attack
--
ip-src
ip-src
IP address originating the attack
--
src-port
port
Port originating the attack
+Packets per second
@@ -887,20 +857,20 @@ ddos is a MISP object available in JSON format at
dst-port
port
ip-dst
ip-dst
Destination port of the attack
+Destination ID (victim)
total-pps
counter
ip-src
ip-src
Packets per second
+IP address originating the attack
dst-port
port
Destination port of the attack
++
text
text
Description of the DDoS
++
src-port
port
Port originating the attack
++
text
-text
ip
ip-dst
A description of the tuple
+IP Address
last-seen
datetime
domain
domain
Last time the tuple has been seen
+Domain name
@@ -985,20 +985,20 @@ domain|ip is a MISP object available in JSON format at
ip
ip-dst
text
text
IP Address
+A description of the tuple
domain
domain
last-seen
datetime
Domain name
+Last time the tuple has been seen
arch
+text
Architecture of the ELF file
++
entrypoint-address
text
Address of the entry point
++
os_abi
text
type
text
Type of ELF
++
text
text
entrypoint-address
text
Address of the entry point
--
type
text
Type of ELF
--
number-sections
counter
arch
text
Architecture of the ELF file
--
flag
-text
Flag of the section
--
sha512/256
sha512/256
sha384
sha384
Secure Hash Algorithm 2 (384 bits)
++
size-in-bytes
size-in-bytes
Size of the section, in bytes
++
sha512
sha512
Secure Hash Algorithm 2 (512 bits)
++
sha1
sha1
[Insecure] Secure Hash Algorithm 1 (160 bits)
++
md5
md5
[Insecure] MD5 hash (128 bits)
++
entropy
float
Entropy of the whole section
++
type
text
md5
md5
[Insecure] MD5 hash (128 bits)
--
name
text
sha512
sha512
sha256
sha256
Secure Hash Algorithm 2 (512 bits)
+Secure Hash Algorithm 2 (256 bits)
size-in-bytes
size-in-bytes
sha512/224
sha512/224
Size of the section, in bytes
+Secure Hash Algorithm 2 (224 bits)
+
entropy
float
sha224
sha224
Entropy of the whole section
+Secure Hash Algorithm 2 (224 bits)
++
flag
text
Flag of the section
sha384
sha384
Secure Hash Algorithm 2 (384 bits)
--
sha224
sha224
Secure Hash Algorithm 2 (224 bits)
--
sha1
sha1
[Insecure] Secure Hash Algorithm 1 (160 bits)
--
sha512/224
sha512/224
Secure Hash Algorithm 2 (224 bits)
--
sha256
sha256
Secure Hash Algorithm 2 (256 bits)
--
subject
+email-subject
Subject
++
header
email-header
attachment
email-attachment
reply-to
email-reply-to
Attachment
--
from-display-name
email-src-display-name
Display name of the sender
+Email address the reply will be sent to
@@ -1369,30 +1369,20 @@ email is a MISP object available in JSON format at
to
email-dst
from-display-name
email-src-display-name
Destination email address
+Display name of the sender
x-mailer
email-x-mailer
to-display-name
email-dst-display-name
X-Mailer generally tells the program that was used to draft and send the original email
--
mime-boundary
email-mime-boundary
MIME Boundary
+Display name of the receiver
@@ -1409,20 +1399,10 @@ email is a MISP object available in JSON format at
to-display-name
email-dst-display-name
attachment
email-attachment
Display name of the receiver
--
subject
email-subject
Subject
+Attachment
@@ -1439,6 +1419,16 @@ email is a MISP object available in JSON format at
to
email-dst
Destination email address
++
from
email-src
reply-to
email-reply-to
mime-boundary
email-mime-boundary
Email address the reply will be sent to
+MIME Boundary
++
x-mailer
email-x-mailer
X-Mailer generally tells the program that was used to draft and send the original email
ssdeep
-ssdeep
sha384
sha384
Fuzzy hash using context triggered piecewise hashes (CTPH)
--
malware-sample
malware-sample
The file itself (binary)
--
md5
md5
[Insecure] MD5 hash (128 bits)
--
filename
filename
Filename on disk
--
sha512
sha512
Secure Hash Algorithm 2 (512 bits)
+Secure Hash Algorithm 2 (384 bits)
@@ -1567,6 +1527,46 @@ file is a MISP object available in JSON format at
sha512
sha512
Secure Hash Algorithm 2 (512 bits)
++
sha1
sha1
[Insecure] Secure Hash Algorithm 1 (160 bits)
++
pattern-in-file
pattern-in-file
Pattern that can be found in the file
++
md5
md5
[Insecure] MD5 hash (128 bits)
++
entropy
float
text
text
malware-sample
malware-sample
Free text value to attach to the file
+The file itself (binary)
+
+
ssdeep
ssdeep
Fuzzy hash using context triggered piecewise hashes (CTPH)
++
sha256
sha256
Secure Hash Algorithm 2 (256 bits)
+
sha512/224
+sha512/224
Secure Hash Algorithm 2 (224 bits)
++
sha224
sha224
Secure Hash Algorithm 2 (224 bits)
++
tlsh
tlsh
sha384
sha384
text
text
Secure Hash Algorithm 2 (384 bits)
+Free text value to attach to the file
+
sha224
sha224
filename
filename
Secure Hash Algorithm 2 (224 bits)
--
sha1
sha1
[Insecure] Secure Hash Algorithm 1 (160 bits)
--
sha512/224
sha512/224
Secure Hash Algorithm 2 (224 bits)
--
sha256
sha256
Secure Hash Algorithm 2 (256 bits)
--
pattern-in-file
pattern-in-file
Pattern that can be found in the file
+Filename on disk
last-seen
-datetime
When the location was seen for the last time.
--
text
text
A generic description of the location.
--
latitude
float
first-seen
datetime
When the location was seen for the first time.
++
region
text
altitude
float
The altitude is the decimal value of the altitude in the World Geodetic System 84 (WGS84) reference.
++
city
text
City.
++
country
text
first-seen
datetime
text
text
When the location was seen for the first time.
+A generic description of the location.
city
text
last-seen
datetime
City.
+When the location was seen for the last time.
-
altitude
float
The altitude is the decimal value of the altitude in the World Geodetic System 84 (WGS84) reference.
-+
host
-hostname
basicauth-password
text
The domain name of the server
+HTTP Basic Authentication Password
++
proxy-password
text
HTTP Proxy Password
++
basicauth-user
text
HTTP Basic Authentication Username
++
method
http-method
HTTP Method invoked (one of GET, POST, PUT, HEAD, DELETE, OPTIONS, CONNECT)
++
url
url
Full HTTP Request URL
++
proxy-user
text
HTTP Proxy Username
++
content-type
other
The MIME type of the body of the request
@@ -1863,30 +1923,10 @@ http-request is a MISP object available in JSON format at
url
url
host
hostname
Full HTTP Request URL
--
referer
referer
This is the address of the previous web page from which a link to the currently requested page was followed
--
basicauth-password
text
HTTP Basic Authentication Password
+The domain name of the server
@@ -1913,6 +1953,16 @@ http-request is a MISP object available in JSON format at
referer
referer
This is the address of the previous web page from which a link to the currently requested page was followed
++
text
text
basicauth-user
text
HTTP Basic Authentication Username
--
proxy-password
text
HTTP Proxy Password
--
method
http-method
HTTP Method invoked (one of GET, POST, PUT, HEAD, DELETE, OPTIONS, CONNECT)
--
content-type
other
The MIME type of the body of the request
--
proxy-user
text
HTTP Proxy Username
--
text
-text
ip
ip-dst
Description of the tuple
--
last-seen
datetime
Last time the tuple has been seen
+IP Address
@@ -2041,10 +2031,10 @@ ip|port is a MISP object available in JSON format at
src-port
port
last-seen
datetime
Source port
+Last time the tuple has been seen
@@ -2061,10 +2051,20 @@ ip|port is a MISP object available in JSON format at
ip
ip-dst
text
text
IP Address
+Description of the tuple
++
src-port
port
Source port
name
+text
Binary’s name
++
number-sections
counter
type
text
Type of Mach-O
++
text
text
name
text
Binary’s name
--
type
text
Type of Mach-O
--
ssdeep
-ssdeep
sha384
sha384
Fuzzy hash using context triggered piecewise hashes (CTPH)
--
md5
md5
[Insecure] MD5 hash (128 bits)
--
name
text
Name of the section
--
sha512
sha512
Secure Hash Algorithm 2 (512 bits)
+Secure Hash Algorithm 2 (384 bits)
@@ -2257,40 +2227,10 @@ macho-section is a MISP object available in JSON format at
entropy
float
sha512
sha512
Entropy of the whole section
--
text
text
Free text value to attach to the section
--
sha384
sha384
Secure Hash Algorithm 2 (384 bits)
--
sha224
sha224
Secure Hash Algorithm 2 (224 bits)
+Secure Hash Algorithm 2 (512 bits)
@@ -2307,16 +2247,46 @@ macho-section is a MISP object available in JSON format at
sha512/224
sha512/224
md5
md5
Secure Hash Algorithm 2 (224 bits)
+[Insecure] MD5 hash (128 bits)
entropy
float
Entropy of the whole section
++
ssdeep
ssdeep
Fuzzy hash using context triggered piecewise hashes (CTPH)
++
name
text
Name of the section
++
sha256
sha256
sha512/224
sha512/224
Secure Hash Algorithm 2 (224 bits)
++
sha224
sha224
Secure Hash Algorithm 2 (224 bits)
++
text
text
Free text value to attach to the section
++
time_first
+datetime
First time that the unique tuple (rrname, rrtype, rdata) has been seen by the passive DNS
++
sensor_id
text
Sensor information where the record was seen
++
zone_time_first
datetime
First time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import
++
bailiwick
text
rdata
text
Resource records of the queried resource
++
time_last
datetime
Last time that the unique tuple (rrname, rrtype, rdata) record has been seen by the passive DNS
++
zone_time_last
datetime
time_first
datetime
rrtype
text
First time that the unique tuple (rrname, rrtype, rdata) has been seen by the passive DNS
+Resource Record type as seen by the passive DNS
++
rrname
text
Resource Record name of the queried resource
++
count
counter
How many authoritative DNS answers were received at the Passive DNS Server’s collectors with exactly the given set of values as answers
sensor_id
text
Sensor information where the record was seen
--
rrtype
text
Resource Record type as seen by the passive DNS
--
time_last
datetime
Last time that the unique tuple (rrname, rrtype, rdata) record has been seen by the passive DNS
--
rdata
text
Resource records of the queried resource
--
count
counter
How many authoritative DNS answers were received at the Passive DNS Server’s collectors with exactly the given set of values as answers
--
rrname
text
Resource Record name of the queried resource
--
zone_time_first
datetime
First time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import
--
entrypoint-address
-text
Address of the entry point
--
product-name
text
ProductName in the resources
--
type
text
Type of PE
--
file-version
text
FileVersion in the resources
--
product-version
text
ProductVersion in the resources
--
legal-copyright
text
LegalCopyright in the resources
--
company-name
text
CompanyName in the resources
--
imphash
imphash
Hash (md5) calculated from the import table
--
lang-id
text
Lang ID in the resources
--
impfuzzy
impfuzzy
text
text
Free text value to attach to the PE
--
file-description
text
FileDescription in the resources
--
original-filename
filename
internal-filename
filename
InternalFilename in the resources
--
pehash
pehash
Hash of the structural information about a sample. See https://www.usenix.org/legacy/event/leet09/tech/full_papers/wicherski/wicherski_html/
--
compilation-timestamp
datetime
number-sections
counter
lang-id
text
Number of sections
+Lang ID in the resources
++
pehash
pehash
Hash of the structural information about a sample. See https://www.usenix.org/legacy/event/leet09/tech/full_papers/wicherski/wicherski_html/
++
file-version
text
FileVersion in the resources
++
imphash
imphash
Hash (md5) calculated from the import table
++
type
text
Type of PE
++
company-name
text
CompanyName in the resources
++
entrypoint-address
text
Address of the entry point
++
file-description
text
FileDescription in the resources
++
internal-filename
filename
InternalFilename in the resources
++
legal-copyright
text
LegalCopyright in the resources
++
product-name
text
ProductName in the resources
product-version
text
ProductVersion in the resources
++
text
text
Free text value to attach to the PE
++
number-sections
counter
Number of sections
++
ssdeep
-ssdeep
sha384
sha384
Fuzzy hash using context triggered piecewise hashes (CTPH)
--
md5
md5
[Insecure] MD5 hash (128 bits)
--
name
text
Name of the section
--
sha512
sha512
Secure Hash Algorithm 2 (512 bits)
+Secure Hash Algorithm 2 (384 bits)
@@ -2801,50 +2771,10 @@ pe-section is a MISP object available in JSON format at
entropy
float
sha512
sha512
Entropy of the whole section
--
text
text
Free text value to attach to the section
--
characteristic
text
Characteristic of the section
--
sha384
sha384
Secure Hash Algorithm 2 (384 bits)
--
sha224
sha224
Secure Hash Algorithm 2 (224 bits)
+Secure Hash Algorithm 2 (512 bits)
@@ -2861,10 +2791,50 @@ pe-section is a MISP object available in JSON format at
sha512/224
sha512/224
md5
md5
Secure Hash Algorithm 2 (224 bits)
+[Insecure] MD5 hash (128 bits)
++
entropy
float
Entropy of the whole section
++
ssdeep
ssdeep
Fuzzy hash using context triggered piecewise hashes (CTPH)
++
name
text
Name of the section
++
characteristic
text
Characteristic of the section
sha512/224
sha512/224
Secure Hash Algorithm 2 (224 bits)
++
sha224
sha224
Secure Hash Algorithm 2 (224 bits)
++
text
text
Free text value to attach to the section
++
text
+gummei
text
A description of the phone.
+Globally Unique MME Identifier (GUMMEI) is composed from MCC, MNC and MME Identifier (MMEI).
+
last-seen
-datetime
When the phone has been accessible or seen for the last time.
--
imei
serial-number
text
International Mobile Equipment Identity (IMEI) is a number, usually unique, to identify 3GPP and iDEN mobile phones, as well as some satellite phones.
+Serial Number.
serial-number
imsi
text
Serial Number.
+A usually unique International Mobile Subscriber Identity (IMSI) is allocated to each mobile subscriber in the GSM/UMTS/EPS system. IMSI can also refer to International Mobile Station Identity in the ITU nomenclature.
++
tmsi
text
Temporary Mobile Subscriber Identities (TMSI) to visiting mobile subscribers can be allocated.
@@ -2989,33 +2989,33 @@ phone is a MISP object available in JSON format at
gummei
imei
text
Globally Unique MME Identifier (GUMMEI) is composed from MCC, MNC and MME Identifier (MMEI).
+International Mobile Equipment Identity (IMEI) is a number, usually unique, to identify 3GPP and iDEN mobile phones, as well as some satellite phones.
imsi
text
text
A usually unique International Mobile Subscriber Identity (IMSI) is allocated to each mobile subscriber in the GSM/UMTS/EPS system. IMSI can also refer to International Mobile Station Identity in the ITU nomenclature.
+A description of the phone.
+
tmsi
text
last-seen
datetime
Temporary Mobile Subscriber Identities (TMSI) to visiting mobile subscribers can be allocated.
+When the phone has been accessible or seen for the last time.
+
refsglobalvar
-counter
Amount of API calls outside of code section (glob var, dynamic API)
--
memory-allocations
counter
Amount of memory allocations
--
ratio-string
float
Ratio: amount of referenced strings per kilobyte of code section
--
create-thread
counter
callback-largest
counter
Largest callback
--
r2-commit-version
text
Radare2 commit ID used to generate this object
--
shortest-path-to-create-thread
counter
Shortest path to the first time the binary calls CreateThread
--
callbacks
counter
Amount of callbacks (functions started as thread)
--
not-referenced-strings
counter
Amount of not referenced strings
--
get-proc-address
counter
Amount of calls to GetProcAddress
--
ratio-functions
float
Ratio: amount of functions per kilobyte of code section
--
ratio-api
float
Ratio: amount of API calls per kilobyte of code section
--
unknown-references
counter
Amount of API calls not ending in a function (Radare2 bug, probalby)
--
referenced-strings
counter
Amount of referenced strings
--
text
text
Description of the r2graphity object
--
callback-average
counter
Average size of a callback
--
dangling-strings
counter
referenced-strings
counter
Amount of referenced strings
++
memory-allocations
counter
Amount of memory allocations
++
miss-api
counter
r2-commit-version
text
Radare2 commit ID used to generate this object
++
ratio-api
float
Ratio: amount of API calls per kilobyte of code section
++
text
text
Description of the r2graphity object
++
get-proc-address
counter
Amount of calls to GetProcAddress
++
callback-average
counter
Average size of a callback
++
local-references
counter
Amount of API calls inside a code section
++
not-referenced-strings
counter
Amount of not referenced strings
++
callbacks
counter
Amount of callbacks (functions started as thread)
++
ratio-functions
float
Ratio: amount of functions per kilobyte of code section
++
callback-largest
counter
Largest callback
++
unknown-references
counter
Amount of API calls not ending in a function (Radare2 bug, probalby)
++
ratio-string
float
Ratio: amount of referenced strings per kilobyte of code section
++
gml
attachment
Graph export in G>raph Modelling Language format
++
refsglobalvar
counter
Amount of API calls outside of code section (glob var, dynamic API)
++
shortest-path-to-create-thread
counter
Shortest path to the first time the binary calls CreateThread
++
total-functions
counter
local-references
counter
Amount of API calls inside a code section
--
gml
attachment
Graph export in G>raph Modelling Language format
--
last-modified
-datetime
data-type
reg-datatype
Last time the registry key has been modified
+Registry value type
data-type
reg-datatype
data
reg-data
Registry value type
+Data stored in the registry key
@@ -3355,20 +3355,20 @@ registry-key is a MISP object available in JSON format at
name
reg-name
last-modified
datetime
Name of the registry key
+Last time the registry key has been modified
data
reg-data
name
reg-name
Data stored in the registry key
+Name of the registry key
text
+nickname
text
Tor node comment.
+router’s nickname.
-
last-seen
datetime
When the Tor node designed by the IP address has been seen for the last time.
-+
fingerprint
+text
router’s fingerprint.
++
flags
text
first-seen
datetime
When the Tor node designed by the IP address has been seen for the first time.
++
version_line
text
nickname
text
published
datetime
router’s nickname.
+router’s publication time. This can be different from first-seen and last-seen.
+
fingerprint
+text
text
router’s fingerprint.
--
published
datetime
router’s publication time. This can be different from first-seen and last-seen.
+Tor node comment.
first-seen
last-seen
datetime
When the Tor node designed by the IP address has been seen for the first time.
+When the Tor node designed by the IP address has been seen for the last time.
domain
-domain
Full domain
--
credential
subdomain
text
Credential (username, password)
--
last-seen
datetime
Last time this URL has been seen
--
url
url
Full URL
+Subdomain
@@ -3621,30 +3591,10 @@ url is a MISP object available in JSON format at
subdomain
credential
text
Subdomain
--
host
hostname
Full hostname
--
text
text
Description of the URL
+Credential (username, password)
@@ -3671,20 +3621,20 @@ url is a MISP object available in JSON format at
tld
text
port
port
Top-Level Domain
+Port number
port
port
host
hostname
Port number
+Full hostname
@@ -3711,6 +3661,56 @@ url is a MISP object available in JSON format at
url
url
Full URL
++
domain
domain
Full domain
++
last-seen
datetime
Last time this URL has been seen
++
tld
text
Top-Level Domain
++
text
text
Description of the URL
++
scheme
text
text
-text
modified
datetime
Description of the vulnerability
--
references
link
External references
--
id
vulnerability
Vulnerability ID (generally CVE, but not necessarely)
+Last modification date
@@ -3799,20 +3779,20 @@ vulnerability is a MISP object available in JSON format at
modified
datetime
id
vulnerability
Last modification date
+Vulnerability ID (generally CVE, but not necessarely)
summary
text
references
link
Summary of the vulnerability
+External references
text
text
Description of the vulnerability
++
summary
text
Summary of the vulnerability
++
text
-text
Full whois entry
--
registrant-email
whois-registrant-email
domain
domain
registrant-name
whois-registrant-name
Domain of the whois entry
--
modification-date
datetime
Last update of the whois entry
+Registrant name
@@ -3927,10 +3907,10 @@ whois is a MISP object available in JSON format at
registrant-name
whois-registrant-name
domain
domain
Registrant name
+Domain of the whois entry
@@ -3947,6 +3927,26 @@ whois is a MISP object available in JSON format at
modification-date
datetime
Last update of the whois entry
++
text
text
Full whois entry
++
creation-date
datetime
subject
+text
Subject of the certificate
++
x509-fingerprint-md5
md5
[Insecure] MD5 hash (128 bits)
++
version
text
Version of the certificate
++
pubkey-info-exponent
text
Exponent of the public key
++
pubkey-info-size
text
x509-fingerprint-sha256
sha256
Secure Hash Algorithm 2 (256 bits)
++
serial-number
text
Serial number of the certificate
++
issuer
text
validity-not-after
datetime
Certificate invalid after that date
++
raw-base64
text
pubkey-info-algorithm
text
Algorithm of the public key
++
pubkey-info-modulus
text
serial-number
text
Serial number of the certificate
--
pubkey-info-exponent
text
Exponent of the public key
--
text
text
Free text description of hte certificate
--
pubkey-info-algorithm
text
Algorithm of the public key
--
validity-not-after
datetime
Certificate invalid after that date
--
subject
text
Subject of the certificate
--
validity-not-before
datetime
x509-fingerprint-sha256
sha256
Secure Hash Algorithm 2 (256 bits)
--
x509-fingerprint-md5
md5
[Insecure] MD5 hash (128 bits)
--
version
text
text
Version of the certificate
+Free text description of hte certificate
comment
-comment
yara-hunt
yara
A description of Yara rule generated.
+Wide yara rule generated from -yh.
+
yara-hunt
-yara
comment
comment
Wide yara rule generated from -yh.
+A description of Yara rule generated.
+