spam

Spam or ‘unsolicited bulk e-mail’, meaning that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having identical content.

Harmful Speech

Discretization or discrimination of somebody (e.g. cyber stalking, racism and threats against one or more individuals) May be found on a forum, email, tweet etc…

Child/Sexual/Violence/…​

Any Child pornography, glorification of violence, may be found on a website, forum, email, tweet etc…

Virus

Malicious code that replicate itself and infects the computer and files;

Worm

Malware that self-replicates and spread itself to other computers in the network without any user interaction;

Ransomware

Ransomware is a type of malicious software from cryptovirology that blocks access to the victim’s data or threatens to publish it until a ransom is paid.

Trojan/Malware

This category regroups many common malware types (Banking, POS, Mining malware).

Spyware/Rat

This category regroups malware types and tools that may have a bigger impact on the breached infrastructure and usually need further investigations (Common Spyware/Rat, State sponsored malwares, StealersHacking tool).

Dialer

Computer program used to identify the phone numbers that can successfully make a connection with a computer modem. Use this category to classify overpriced SMS sent by malicious mobile application.

Rootkit

Malware, which alter the standard functionality of an operating system in order to do its malicious actions in a stealthy way. In practice, Rootkits hijacks systems functions in order to alter the returning values to hide themselves from simple analysis tools.

Scanning

Attacks that send requests to a system to discover weak points. This also includes some kinds of testing processes to gather information about hosts, services and accounts. Examples: fingerd, DNS querying, ICMP, SMTP (EXPN, RCPT,).

Sniffing

Observing and recording network traffic (wiretapping).

Social Engineering

Gathering information from a human being in a non-technical way (eg, lies, tricks, bribes, or threats).

Exploiting known vulnerabilities

An attempt to compromise a system or to disrupt any service by exploiting vulnerabilities with a standardised identifier such as CVE name (eg, buffer overflow, backdoors, cross side scripting, etc).

Login attempts

Multiple login attempts (guessing / cracking of passwords, brute force).

New attack signature

An attempt using an unknown exploit.

Privileged Account Compromise

A successful full compromise of a system or application (service). This can have been caused remotely by a known or new vulnerability, but also by an unauthorized local access.

Unprivileged Account Compromise

A successful compromise of a system or application (service). This can have been caused remotely by a known or new vulnerability, but also by an unauthorized local access. The intruded did not achieve to escale his privileges locally.

Botnet member

The compromised asset is also being part of a botnet. This is reserved mainly for public web servers. See malicious code in priority for workstations or internal server’s compromise. For example, phpmailer, etc…

Domain Compromise

The whole domain is compromised; this is commonly used for active directory and detected by a “pass the ticket” attack or a discovery of “ad dumps” files.

Application Compromise

An application is compromised; the attacker possess an uncontrolled access to data, server, and assets used by this application (CMDB, DB, Backend services, etc.).

DoS

An attacker attempts to prevent legitimate users from accessing information or services.

DDoS

Form of electronic attack involving multiple computers, which send repeated requests (HTTP requests, pings, TCP or UDP Flood) to a server to load it down and render the service inaccessible for a period of time.

Sabotage

Deliberate and malicious acts that result in the disruption of the normal processes and functions or the destruction or damage of equipment or information.

Outage (no malice)

Unavailability of the system but done with no malice.

Unauthorised access to information

Any access to unauthorized data. It may be access of data on improperly restricted server share or database exfiltered by using a SQLi.

Unauthorised modification of information

Unauthorized tampering of data on files, documents or database.

Copyright

Selling or installing copies of unlicensed commercial software or other copyright protected materials (Warez).

Masquerade

Types of attacks in which one entity illegitimately assumes the identity of another in order to benefit from it. This attack may be used for president fraud requesting transactions.

Phishing

Masquerading as another entity in order to persuade the user to reveal a private credential.

Open for abuse

Open resolvers, world readable printers, vulnerability apparent from Nessus etc scans, virus, signatures not up to date, etc. This includes for example default SNMP community or default password on any application.

Regulator

All lack about regulator rules (CSSF, GDPR, etc.).

Standard

All lack about standards certification of the company (ISO27000, NIS, ISAE3402, etc.).

Security policy

All lack about the internal security policy of the company.

Other

All lack that do not fit in one of previous categories should be put on this class.

other

All incidents that do not fit in one of the given categories should be put into this class. If the number of incidents in this category increases, it is an indicator that the classification scheme must be revised.

Goals

If the actor is part of a larger organized operation they may be receiving their goals from a higher level source or handler. Depending on how organized and sophisticated the adversary’s campaigns are, these goals may not even be shared with the operator(s) themselves. In cases of non-targeted threat actors, this may be much less organized or distributed. Goals are nearly impossible to detect (directly) but they’re almost always the toughest question C-level leaders ask about post-breach. "Who was it and why?" These kinds of questions can never truthfully be answered unless you’re operating at Detection Maturity Level 8 against your adversary and can prove reliably that you know what their goals are. Short of that, it’s guessing at what the adversary’s true intentions were based on behavioral observations made at lower DMLs (e.g. data stolen, directories listed, employees or programs targeted, etc). I anticipate less than a handful of organizations truly operate at this level, consistently, against the threat actors they face because it’s nearly impossible to detect based on goals alone.

Strategy

Tactics

To successfully operate at DML-6, one must be able to reliably detect a tactic being employed regardless of the Technique or Procedure used by the adversary, the Tools they chose to use, or the Artifacts and Atomic Indicators left behind as a result of employing the tactic. While this may sound impossible on the surface, it absolutely is possible. In nearly all cases, tactics are not detected directly by a single indicator or artifact serving as the smoking gun, or a single detection signature or analytic technique. Tactics become known only after observation of multiple activities in aggregate, with respect to time and circumstance. As a result, detection of tactics are usually done by skilled analysts, rather than technical correlation or analytics systems.

Techniques

From a maturity perspective, being able to detect an adversary’s techniques is superior to being able to detect their procedures. The primary difference being techniques are specific to an individual. So when respecting this distinction, the ability to detect a specific actor operating within your environment by technique exclusively is an advantage. The best analogy to this is a rifled barrel, which leaves uniquely identifiable characteristics in the side of a bullet. Because of this, ballistics specialists can forensically match a spent round to the exact weapon from which it was fired with a high degree of certainty. Not just any weapon by calibur or model, but the exact weapon used to fire that specific round. Human beings are creatures of habit, and most adversaries aren’t aware of the fact that every time they attack they’re leaving evidence of their personal techniques behind for us to find. The same applies for the tool builders writing the tools these adversaries use. It’s our obligation to find these distinctions and ensure we’re looking for them. It’s personal behavior and habits that are the hardest for humans to change, so put the hurt on your adversaries by finding creative ways to detect their behaviors and habits in your environment.

Procedures

Given today’s detection technology, and readily available correlation and analytics techniques, it’s amazing that more organizations haven’t reached Detection Maturity Level 4 for most of their adversaries. Procedures are one of the most effective ways of detecting adversary activity and can really inflict the most pain against lesser experienced "B-teams". In it’s most simple form, detecting a procedure is as simple as detecting a sequence of two or more of the individual steps employed by the actor. The goal here is to isolate activities that the adversary appears to perform methodically, two or more times during an incident.

Tools

Being able to detect at DML-3 means you can reliably detect the adversary’s tools, regardless of minor functionality changes to the tool, or the Artifacts or Atomic Indicators it may leave behind. Detecting tools falls into two main areas. The first is detecting the transfer and presence of the tool. This includes being able to observe the tool being transferred over the network, being able to locate it sitting at rest on a file system, or being able to identify it loaded in memory. The second, and more important area of tool detection, is detecting the tool reliably by functionality. For example, let’s take a given webshell that has 25 functions. If we want to claim DML-3 level detection for this webshell we have to exercise each of those 25 functions and understand what each of them do. What do they look like at the host, network, and event log level when they are exercised? We then aim to build detections for as many of those 25 functions across those data domains as we possibly can, reliably, balancing false positives and other constraints. The reason behind this is simple, we want to be able to detect this version of the tool and as many future variants of the tool as we can by function that it performs. If the adversary decides to change up 5 of the 25 functions for which we have detections, we’re still detecting the entire tool. In order for the adversary to use this tool completely undetected in our environment, they’ll be forced to change every one of those functions; or at least the ones that we were able to reliably build detections against.

Host & Network Artifacts

DML-2 is where most organizations spend too much of their resources; attempting to collect what they call "threat intelligence" in the form of Host & Network Artifacts. The reality is, these are merely just indicators that are observed either during or after the attack. They’re like symptoms of the flu but not the flu itself. I often use the analogy "chasing the vapor trail" when I think of DML-2 because chasing after Host & Network Artifacts is much like chasing the vapor trail behind an aircraft. We know the enemy aircraft is up there in front of us somewhere, if we just keep chasing this vapor trial we’ll eventually catch up to the aircraft and find our enemy right? Wrong. Having a mature detection and response program means your operating above DML-2 and you’re actually locked onto the aircraft itself. You know how it operates, you know what it’s capabilities are, you know the Tactics, Techniques, and Procedures of it’s pilot and you can almost predict what it’s next moves might be. This is precisely why good Cyber Intelligence Analysts will almost never attribute activity to a specific threat actor, group, or country based on just Host & Network Artifacts alone; they understand this DML concept and realize when they’re likely just staring at the vapor trail. They understand that in reality the vapor trail (indicators) could be from any number of aircraft (tools), with any number of pilots (actors) behind the stick.

Atomic IOCs

These are the atomic particles that make up Host & Network artifacts. If you’re detecting at Detection Maturity Level 1, it means you are probably taking "feeds of intel" from various sharing organizations and vendors in the form of lists, like domains and IP addresses, and feeding them into your detection technologies. Let me be clear on my position here. There are a few, and I mean a very precious few, circumstances where this makes sense and can be done reliably. These are edge cases where specific atomic indicators have a high enough "shelf life" where it makes sense to go ahead and create detection capabilities from them. Examples of this include unique strings found inside a binary, or perhaps an adversary is foolish enough to sit on the same recon, delivery, C2, or exfiltration infrastructure allowing you to detect reliably on their domain names or IP addresses. These might be viable cases where detecting on atomic indicator alone makes sense. Unfortunately, for the remaining 99% of the time, attempting to detect on this kind of data is suboptimal, for a number of reasons.

None or Unknown

For organizations who either don’t operate at DML-1 or higher, or they don’t even know where they operate on this scale, we have Detection Maturity Level - 0. Instead of pointing out all the negative things associated with this level, I’ll take the high road and lend a bit of positive encouragement. Congratulations, you are at ground zero. It can only get better from here.

(PAP:RED) Non-detectable actions only. Recipients may not use PAP:RED information on the network. Only passive actions on logs, that are not detectable from the outside.

(PAP:AMBER) Passive cross check. Recipients may use PAP:AMBER information for conducting online checks, like using services provided by third parties (e.g. VirusTotal), or set up a monitoring honeypot.

(PAP:GREEN) Active actions allowed. Recipients may use PAP:GREEN information to ping the target, block incoming/outgoing traffic from/to the target or specifically configure honeypots to interact with the target.

(PAP:WHITE) No restrictions in using this information.

Brute force

Access was gained through systematic trial of credentials in bulk.

Password guessing

Access was gained through guessing passwords through trial and error.

Remote desktop application

Access was gained through an application designed for remote access.

Stolen credentials

Access was gained with stolen credentials.

Pass the hash

Access was gained through use of an existing known hash.

Default credentials

Access was gained through use of the system’s default credentials.

Shell

Access was gained through the use of a shell.

Other

Access was gained through another method.

Anti-Corruption and transparency

The organization campaigns, or takes other actions against corruption and transparency.

Anti-War / Anti-Violence

The organization campaigns, or takes other actions against war

Culture

The organization campaigns or acts to promote cultural events

Economic Change

Issues of economic policy, wealth distribution, etc.

Education

The organization is concerned with some form of education

Election Monitoring

The organization is an election monitor, or involved in election monitoring

Environment

The organization campaigns or acts to protect the environment

Freedom of Expression

The organization is concerned with freedom of speech issues

Freedom Tool Development

The organization develops tools for use in defending or extending digital rights

Funding

Health Issues

The organization prevents epidemic illness or acts on curing them

Human Rights Issues

relating to the detection, recording, exposure, or challenging of abuses of human rights

Internet and Telecoms

Issues of digital rights in electronic communications

LGBT / Gender / Sexuality

Issues relating to the Lesbian, Gay, Bi, Transgender community

Policy

The organization is a policy think-tank, or policy advocate

Politics

The organization takes a strong political view or is a political entity

Privacy

Issues relating to the individual’s reasonable right to privacy

Rapid Response

The organization provides rapid response type capability for civil society

Refugees

Issues relating to displaced people

Security

Issues relating to physical or information security

Women’s Rights

Issues pertaining to inequality between men and women, or issues of particular relevance to women

Youth Rights

Issues of particular relevance to youth

Informed ISP/Hosting Service Provider

Informed Registrar

Informed Registrant

Informed abuse-contact (domain)

Informed abuse-contact (IP)

Informed legal department

Completely reliable

No doubt of authenticity, trustworthiness, or competency; has a history of complete reliability

Associated numerical value="100"

Usually reliable

Minor doubt about authenticity, trustworthiness, or competency; has a history of valid information most of the time

Associated numerical value="75"

Fairly reliable

Doubt of authenticity, trustworthiness, or competency but has provided valid information in the past

Associated numerical value="50"

Not usually reliable

Significant doubt about authenticity, trustworthiness, or co mpetency but has provided valid information in the past

Associated numerical value="25"

Unreliable

Lacking in authenticity, trustworthiness, and competency; history of invalid information

Reliability cannot be judged

No basis exists for evaluating the reliability of the source

Associated numerical value="50"

Deliberatly deceptive

Confirmed by other sources

Confirmed by other independent sources; logical in itself; Consistent with other information on the subject

Associated numerical value="100"

Probably true

Not confirmed; logical in itself; consistent with other information on the subject

Associated numerical value="75"

Possibly true

Not confirmed; reasonably logical in itself; agrees with some other information on the subject

Associated numerical value="50"

Doubtful

Not confirmed; possible but not logical ; no other information on the subject

Associated numerical value="25"

Improbable

Not confirmed; not logical in itself; contradicted by other information on the subject

Truth cannot be judged

No basis exists for evaluating the validity of the information

Associated numerical value="50"

Infrastructure ownership and status is unknown

Infrastructure compromised by or in the benefit of the adversary

Infrastructure own and operated by the adversary

Only passive requests shall be performed to avoid detection by the adversary

Take down requests can be performed in order to deactivate the adversary infrastructure

Monitoring requests are ongoing on the adversary infrastructure

Law enforcement requests are ongoing on the adversary infrastructure

Infrastructure state is unknown or cannot be evaluated

Infrastructure state is active and actively used by the adversary

Infrastructure state is known to be down

Infrastructure usage by the adversary is unknown

Infrastructure used as proxy between the target and the adversary

Infrastructure used by the adversary to store information related to his campaigns

Infrastructure used to distribute exploit towards target(s)

Infrastructure used by the adversary as Virtual Private Network to hide activities and reduce the traffic analysis surface

Panel used by the adversary to control or maintain his infrastructure

Traffic Distribution Systems including exploit delivery or/and web monetization channels

WHITE

GREEN

AMBER

EVERYONE

USG

NONE

true

false

Is_Proprietary

Not_Proprietary

Less than 1 year

Associated numerical value="20"

Between 1 and 5 years

Associated numerical value="40"

Between 5 and 10 years

Associated numerical value="60"

Between 10 and 20 years

Associated numerical value="80"

More than 20 years

Associated numerical value="100"

x86-32 & x86-64

ARM & ARM-64

mips & mips-64

PowerPC

Less than 1 year

Associated numerical value="20"

Between 1 and 5 years

Associated numerical value="40"

Between 5 and 10 years

Associated numerical value="60"

Between 10 and 20 years

Associated numerical value="80"

More than 20 years

Associated numerical value="100"

Current Microsoft Windows system

GNU/linux derivative OS

Current IOS

Current Apple OS

Current Android OS

BSD

Inter-protocol exploitations

Common vulnerabilities as SQL injections, CSRF, XSS, CSP bypasses, etc.

De-obfuscation of Javascript payloads

Less than 1 year

Associated numerical value="20"

Between 1 and 5 years

Associated numerical value="40"

Between 5 and 10 years

Associated numerical value="60"

Between 10 and 20 years

Associated numerical value="80"

More than 20 years

Associated numerical value="100"

Less than 1 year

Associated numerical value="20"

Between 1 and 5 years

Associated numerical value="40"

Between 5 and 10 years

Associated numerical value="60"

Between 10 and 20 years

Associated numerical value="80"

More than 20 years

Associated numerical value="100"

Cat1

Minimal Exposure - Passive Collection: CAT 1 actions provide the least exposure of an indicator, either through adversary observation or disclosure. Usage of the indicator is restricted to passive monitoring on Government or Cleared Partner networks, or through a classified passive capability or Operation. CAT 1 actions do not interact with or affect malicious network traffic.

Cat2

Moderate Exposure - Government or Cleared Partner Internal Active Collection: CAT 2 actions expose the usage of an indicator through non-disruptive collection techniques which require interactions with an adversary, within Government or Cleared Partner networks. While it is not the intent to disrupt the adversary it is possible that an adversary may discover they are subject to such techniques.

Cat3

Moderate Exposure - Government or Cleared Partner Internal Countermeasures: CAT 3 actions expose the usage of an indicator through inward-facing countermeasures. Malicious network traffic is affected in some manner, however the results are not directly observable to the adversary or external parties and is, therefore, more difficult to attribute as a deliberate action. Usage of the indicator is restricted to Government and Cleared Partner networks, or a classified capability or Operation. This implies a lower likelihood for non-approved disclosures.

Cat4

Moderate Exposure - Government Actions on External Networks: CAT 4 actions expose the usage of an indicator through actions which occur on internet accessible networks, without the authorization of the network or information owner. Such actions are conducted as classified Operations under the auspices of national legislative and compliance provisions. Action consequences are observable to the adversary and other, public parties and it is possible they may be attributed as Government sanctioned actions.

Cat5

High Exposure - Public Actions Which Enable Internal Countermeasures: CAT 5 actions expose the usage of an indicator through the public release of information which enables internal actions on networks not owned and controlled by the Government (i.e. industry, commercial or foreign governments). These actions are official public releases and are attributable as Government sanctioned actions.

Cat6

High Exposure - Actions on Adversary Infrastructure: CAT 6 actions expose the usage of an indicator through actions which occur on adversary owned networks, without the authorization of the network or information owner. Such actions are conducted as classified Operations under the auspices of national legislative and compliance provisions. Action consequences are observable to the adversary, and possibly other public parties, and it is possible they may deduce this as FVEY action.

Known Good/Safe

Known Bad/Malicious

Not yet known

Beacon

A host infected with malware is connecting to threat actor owned infrastructure.

Browser based exploitation

A browser component is being exploited in order to infect a host.

Dos

An attack in which the goal is to disrupt access to a host or resource.

Email

Malicious emails sent to a department (baiting, content delivery, phishing).

Exfiltration

Unauthorized transfer of data from a target’s network to a location a threat actor controls.

Generic event

Represents a collection of virtually identical events within a range of time.

Improper usage

Technology used in a way that compromises security or violates policy.

Malware artifacts

Signs of the presence of malware observed on a host.

Malware download

Malware was transferred (downloaded/uploaded) to a host.

Phishing

Information or credentials disclosed to a threat actor.

Remote access

A threat actor is attempting to or succeeding in remotely logging in to a host.

Remote exploitation

A threat actor is attempting to exploit vulnerabilities remotely.

Scan

A threat actor is scanning the network.

Scraping

Represents a collection of virtually identical scraping events within a range of time.

Traffic interception

Represents a collection of virtually identical traffic interception events within a range of time.

Goc credential disclosure

Credentials for a GoC system or user were disclosed.

Personal credential disclosure

Credentials not related to a GoC system or user were disclosed.

Personal information disclosure

Information about a person or persons was disclosed.

None

No information was disclosed.

Other

Information other than credentials and personal information was disclosed.

C2

Domain is being used as command-and-control infrastructure.

Proxy

Domain is being used as a proxy.

Seeded

Domain has been seeded with malware or other malicious code.

Wateringhole

Domain is being used a wateringhole.

Cloud infrastructure

Domain is hosted on cloud infrastructure.

Name server

Domain is a name server.

Sinkholed

Domain is being re-directed to a sinkhole.

Spam

Unsolicited or junk email named after a Monty Python sketch.

Content\-delivery\-attack

Email contained malicious content or attachments.

Phishing

Email designed to trick the recipient into providing sensitive information.

Baiting

Email designed to trick the recipient into providing sensitive information.

Unknown

Type of email was unknown.

Sql injection

Exploitation occurred due to malicious SQL queries being executed against a database.

Directory traversal

Exploitation occurred through a directory traversal attack allowing access to a restricted directory.

Remote file inclusion

Exploitation occurred due to vulnerabilities allowing malicious files to be sent.

Code injection

Exploitation occurred due to malicious code being injected.

Other

Other.

C2

IP address is a command-and-control server.

Proxy

IP address is a proxy server.

Seeded

IP address has been seeded with malware or other malicious code.

Wateringhole

IP address is a wateringhole.

Cloud infrastructure

IP address is part of cloud infrastructure.

Network gateway

IP address is a network gateway.

Server

IP address is a server of some type.

Dns server

IP address is a DNS server.

Smtp server

IP address is a mail server.

Web server

IP address is a web server.

File server

IP address is a file server.

Database server

IP address is a database server.

Security appliance

IP address is a security appliance of some type.

Tor node

IP address is a node of the TOR anonymization system.

Sinkhole

IP address is a sinkhole.

Router

IP address is a router device.

Non-malicious

Non-malicious is not malicious or suspicious.

Suspicious

Suspicious is not non-malicious and not malicious.

Malicious

Malicious is not non-malicious or suspicious.

Exploit kit

Toolkit used to attack vulnerabilities in systems.

First stage

Malware used in the initial phase of an attack and commonly used to retrieve a second stage.

Second stage

Typical more complex malware retrieved by first stage malware.

Scanner

Malware used to look for common vulnerabilities or running software.

Downloader

Malware used to retrieve additional malware or tools.

Proxy

Malware used to proxy traffic on an infected host.

Reverse proxy

If you choose this option please provide a description of what it is to the ALFRED PO.

Webshell

Malware uploaded to a web server allowing remote access to an attacker.

Ransomware

Malware used to hold infected host’s data hostage, typically through encryption until a payment is made to the attackers.

Adware

Malware used to display ads to the infected host.

Spyware

Malware used to collect information from the infected host, such as credentials.

Virus

Malware that propogates by inserting a copy of itself into another program.

Worm

Standalone malware that propogates by copying itself..

Trojan

Malware that looks like legitimate software but hides malicious code.

Rootkit

Malware that can hide the existance of other malware by modifying operating system functions.

Keylogger

Malware that runs in the background, capturing keystrokes from a user unknowingly for exfiltration.

Browser hijacker

Malware that re-directs or otherwise intercepts Internet browsing by the user.

Unauthorized usage

Usage of the system or resource was without appropriate permission or authorization.

Misconfiguration

System or resource is misconfigured.

Lack of encryption

System or resources has insufficient encryption or no encryption.

Vulnerable software

System or resource has software with known vulnerabilities.

Privilege escalation

System or resource was exploited to gain higher privilege level.

Other

Other.

Anti-virus

Anti-Virus

Content filtering system

Content Filtering System

Dynamic defense

Dynamic Defense

Insufficient privileges

Insufficient Privileges

Ids

Intrusion Detection System

Sink hole / take down by third party

Sink Hole / Take Down by Third Party

Isp

Internet Service Provider

Invalid credentials

Invalid Credentials

Not vulnerable

No mitigation was required because the system was not vulnerable to the attack.

Other

Other

Unknown

Unknown

User

User

Subscriber

Subscriber.

Internet

Internet.

Cse

Communications Security Establishment.

Nsa

National Security Agency.

Gchq

Government Communications Headquarters.

Asd

Australian Signals Directorate.

Gcsb

Government Communications Security Bureau.

Open source

Originated from publically available information.

3rd party

Originated from a 3rd party organization.

Other

Other.

Open port

Scan was looking for open ports corresponding to common applications or protocols.

Icmp

Scan was attempting to enumerate devices through the ICMP protocol.

Os fingerprinting

Scan was looking for operating system information through unique characteristics in responses.

Web

Scan was enumerating or otherwise traversing web hosts.

Other

Other.

Reconnaissance

An actor attempted or succeeded in gaining information that may be used to identify and/or compromise systems or data.

Attempted compromise

An actor attempted affecting the confidentiality, integrity or availability of a system.

Exploited

A vulnerability was successfully exploited.

Application:cms

Content Management System.

Application:bash

BASH script.

Application:acrobat reader

Adobe Acrobat Reader.

Application:ms excel

Microsoft Excel.

Application:other

Other Application.

Language:sql

Structured Query Language.

Language:php

PHP: Hypertext Preprocessor.

Language:javascript

JavaScript.

Language:other

Other Language.

Protocol:dns

Domain Name System.

Protocol:ftp

File Transfer Protocol.

Protocol:http

Hyper Text Transfer Protocol.

Protocol:icmp

Internet Control Message Protocol.

Protocol:ntp

Network Time Protocol.

Protocol:rdp

Remote Desktop Protocol.

Protocol:smb

Server Message Block.

Protocol:snmp

Simple Network Management Protocol.

Protocol:ssl

Secure Sockets Layer.

Protocol:telnet

Network Virtual Terminal Protocol.

Protocol:sip

Session Initiation Protocol.

Spam

System compromise

Scan

Denial of Service

Copyright issue

Phishing

Malware

XSS

Vulnerability

Fastflux

SQL Injection

Information leak

Scam

Cryptojacking

Locker

Screenlocker

Wiper

sextortion

Finance

ICT

Individual

Industry

Medical

Services

Undefined

Request a binary sample

Extracted malware config

Request of the malware configuration extracted from the malware sample tagged.

Request a deobfuscated sample of the shared sample

Request additional samples compared to the original analysis to build a competitive analysis on the reversing aspect

Request related samples required for further analysis

Request additional static analysis or reversing on the information shared

Request detection signature from

Request more contextual information

Request an abuse contact to report to

Request more historical information from

Request complementary validation

Request about the target(s) including field of activities or companies

Request further technical or tactical analysis

Request for generic additional information

Infection

Malware detected in a system.

Distribution

Malware attached to a message or email message containing link to malicious URL or IP.

Command & Control (C&C)

System used as a command-and-control point by a botnet. Also included in this field are systems serving as a point for gathering information stolen by botnets.

Malicious connection

System attempting to gain access to a port normally linked to a specific type of malware / System attempting to gain access to an IP address or URL normally linked to a specific type of malware, e.g. C&C or a distribution page for components linked to a specific botnet.

Denial of Service (DoS) / Distributed Denial of Service (DDoS)

Single source using specially designed software to affect the normal functioning of a specific service, by exploiting vulnerability / Mass mailing of requests (network packets, emails, etc.) from one single source to a specific service, aimed at affecting its normal functioning.

Sabotage

Logical and physical activities which – although they are not aimed at causing damage to information or at preventing its transmission among systems – have this effect.

Scanning

Single system scan searching for open ports or services using these ports for responding / Scanning a network aimed at identifying systems which are active in the same network / Transfer of a specific DNS zone.

Sniffing

Logical or physical interception of communications.

Phishing

Mass emailing aimed at collecting data for phishing purposes with regard to the victims / Hosting web sites for phishing purposes.

Exploitation of vulnerability attempt

Unsuccessful use of a tool exploiting a specific vulnerability of the system / Unsuccessful attempt to manipulate or read the information of a database by using the SQL injection technique / Unsuccessful attempts to perform attacks by using cross-site scripting techniques / Unsuccessful attempt to include files in the system under attack by using file inclusion techniques / Unauthorised access to a system or component by bypassing an access control system in place.

Login attempt

Unsuccessful login by using sequential credentials for gaining access to the system / Unsuccessful acquisition of access credentials by breaking the protective cryptographic keys / Unsuccessful login by using system access credentials previously loaded into a dictionary.

(Successful) Exploitation of vulnerability

Unauthorised use of a tool exploiting a specific vulnerability of the system / Unauthorised manipulation or reading of information contained in a database by using the SQL injection technique / Attack performed with the use of cross-site scripting techniques / Unauthorised inclusion of files into a system under attack with the use of file inclusion techniques / Unauthorised access to a system or component by bypassing an access control system in place.

Compromising an account

Unauthorised access to a system or component by using stolen access credentials.

Unauthorised access

Unauthorised access to a system or component / Unauthorised access to a set of information / Unauthorised access to and sharing of a specific set of information.

Unauthorised modification / deletion

Unauthorised changes to a specific set of information / Unauthorised deleting of a specific set of information.

Misuse or unauthorised use of resources

Use of institutional resources for purposes other than those intended.

False representation

Unauthorised use of the name of an institution.

SPAM

Sending an unusually large quantity of email messages / Unsolicited or unwanted email message sent to the recipient.

Copyright

Unauthorised distribution or sharing of content protected by Copyright and related rights.

Child Sexual Exploitation, racism or incitement to violence

Distribution or sharing of illegal content such as child sexual exploitation material, racism, xenophobia, etc.

Unclassified incident

Incidents which do not fit the existing classification, acting as an indicator for the classification’s update.

Undetermined incident

Unprocessed incidents which have remained undetermined from the beginning.

Sadistic/bestiality: (a) Pictures showing a child being tied, bound, beaten, whipped, or otherwise subjected to something that implies pain; (b) Pictures where an animal is involved in some form of sexual behavior with a child

100

Gross assault: Grossly obscene pictures of sexual assault, involving penetrative sex, masturbation, or oral sex involving an adult

90

Assault: Pictures of children being subjected to a sexual assault, involving digital touching, involving an adult

80

Explicit sexual activity: Involves touching, mutual and self-masturbation, oral sex, and intercourse by child, not involving an adult

70

Explicit erotic posing: Emphasizing genital areas where the child is posing either naked, partially clothed, or fully clothed

60

Erotic posing: Deliberately posed pictures of fully or partially clothed or naked children in sexualized or provocative poses

50

Posing: Deliberately posed pictures of children fully or partially clothed or naked (where the amount, context, and organization suggests sexual interest)

40

Erotica: Surreptitiously taken photographs of children in play areas or other safe environments showing either underwear or varying degrees of nakedness

30

Nudist: Pictures of naked or seminaked children in appropriate nudist settings, and from legitimate sources

20

Indicative: Nonerotic and nonsexualized pictures showing children in their underwear, swimming costumes, and so on, from either commercial sources or family albums; pictures of children playing in normal settings, in which the context or organization of pictures by the collector indicates inappropriateness

10

The discover action is a 'historical look at the data'. This action heavily relies on your capability to store logs for a reasonable amount of time and have them accessible for searching. Typically, this type of action is applied against security information and event management (SIEM) or stored network data. The goal is to determine whether you have seen a specific indicator in the past.

The passive action is setting up detection rules of an indicator for future traffic. These actions are most often executed via an intrusion detection system (IDS) or a specific logging rule on your firewall or application. It can also be configured as an alert in a SIEM when a specific condition is triggered.

The deny action prevents the event from taking place. Common examples include a firewall block or a proxy filter.

Disruption makes the event fail as it is occurring. Examples include quarantining or memory protection measures.

Degrading will not immediately fail an event, but it will slow down the further actions of the attacker. This tactic allows you to catch up during an incident response process, but you have to consider that the attackers may eventually succeed in achieving their objectives. Throttling bandwidth is one way to degrade an intrusion.

Deception allows you to learn more about the intentions of the attacker by making them think the action was successful. One way to do this is to put a honeypot in place and redirect the traffic, based on an indicator, towards the honeypot.

The destroy action is rarely for 'usual' defenders, as this is an offensive action against the attacker. These actions, including physical destructive actions and arresting the attackers, are usually left to law enforcement agencies.

An identity theft technique that takes over a victim’s mobile device to steal credentials and break into wallets or exchange accounts to steal cryptocurrency.

A new form of blockchain spam that erodes the recipient’s reputation by sending cryptocurrency from known money mixers.

Nation states using cryptocurrencies has been promoted by the Iranian and Venezuelan governments.

Money laundering services that promise to exchange tainted tokens for freshly mined crypto, but in reality, cleanse cryptocurrency through exchanges.

Unlicensed Money Service Businesses (MSBs) banking cryptocurrency without the knowledge of host financial institutions, and thus exposing banks to unknown risk.

Takeover attacks that mine for cryptocurrency at a massive scale have been discovered in datacenters, including AWS.

Enable anonymous bitcoin transactions by going "off-chain," and cannow scale to $2,150,000.

Stabilized tokens that can be designed for use as private coins.

Cyber-extortionists stepped up mass-customized phishing emails campaigns using old passwords and spouse names in 2018. Bomb threat extortion scams demanding bitcoin spiked in December.

Cyber-extortionists began distributing new malware that empties cryptocurrency wallets and steals private keys while holding user data hostage.

Defacement

Malware

DDoS

Phishing

Spam

Botnet

Fastflux

Cryptojacking

XSS

SQL Injection

Vulnerability

Information leak

System compromise

Other

Denial of service / Distributed Denial of service

Forensics work

Attempted or successful destruction, corruption, or disclosure of sensitive corporate information or Intellectual Property

Compromised host (root account, Trojan, rootkit), network device, application, user account.

Theft / Fraud / Human Safety / Child Porn

Reconnaissance or Suspicious activity originating from inside the Company corporate network, excluding malware

Reconnaissance or Suspicious Activity originating from outside the Company corporate network (partner network, Internet), excluding malware.

A virus or worm typically affecting multiple corporate devices. This does not include compromised hosts that are being actively controlled by an attacker via a backdoor or Trojan.

Spoofed email, SPAM, and other email security-related events.

Security consulting unrelated to any confirmed incident

Violation of various policies

Incident affecting critical systems or information with potential to be revenue or customer impacting.

Incident affecting non-critical systems or information, not revenue or customer impacting. Employee investigations that are time sensitive should typically be classified at this level.

Possible incident, non-critical systems. Incident or employee investigations that are not time sensitive. Long-term investigations involving extensive research and/or detailed forensic work.

Extremely Sensitive

Sensitive

Not Sensitive

Generated within the company during incident/case related investigations or forensic analysis or via malware reversing, validated by humans and highly contextualized.

Associated numerical value="95"

Generated within the company, validated by a human prior to sharing, data points have been contextualized (to a degree) e.g. IPs are related to C2 or drop site.

Associated numerical value="50"

Generated within the company by automated means without human interaction e.g., by malware sandbox, honeypots, IDS, etc.

Associated numerical value="10"

Information gathered by an analyst/incident responder/forensic expert/etc.

Information coming out of honeypots.

Information coming out of sandboxes.

Information coming out of email infrastructure.

Information from outside the company.

If none of the other origins applies.

Origin of the data unknown.

Plan activity

Associated numerical value="10"

Conduct research & analysis

Associated numerical value="11"

Develop resources & capabilities

Associated numerical value="12"

Acquire victim & specific knowledge

Associated numerical value="13"

Complete preparations

Associated numerical value="14"

Deploy capability

Associated numerical value="20"

Interact with intended victim

Associated numerical value="21"

Exploit vulnerabilities

Associated numerical value="22"

Deliver malicious capabilities

Associated numerical value="23"

Establish controlled access

Associated numerical value="30"

Hide

Associated numerical value="31"

Expand presence

Associated numerical value="32"

Refine focus of activity

Associated numerical value="33"

Establish persistence

Associated numerical value="34"

Enable other operations

Associated numerical value="40"

Deny access

Associated numerical value="41"

Extract data

Associated numerical value="42"

Alter data and/or computer, network or system behavior

Associated numerical value="43"

Destroy HW/SW/data

Associated numerical value="44"

Drugs/Narcotics

Illegal drugs/chemical compounds for consumption/ingestion - either via blanket unlawfulness (e.g. proscribed drugs) or via unlawful access (e.g. prescription-only/restricted medications sold without lawful accessibility).

Electronics

Electronics and high tech materials, described or to sell for example.

Finance

Any monetary/currency/exchangeable materials. Includes carding, Paypal etc.

CryptoFinance

Any monetary/currency/exchangeable materials based on cryptocurrencies. Includes Bitcoin, Litecoin etc.

Credit-Card

Credit cards and payments materials

Cash-in

Buying parts of assets, conversion from liquid assets, currency, etc.

Cash-out

Selling parts of assets, conversion to liquid assets, currency, etc.

Escrow

Third party keeping assets in behalf of two other parties making a transactions.

Hacking

Materials relating to the illegal access to or alteration of data and/or electronic services.

Identification/Credentials

Materials used for providing/establishing identification with third parties. Examples include passports, driver licenses and login credentials.

Intellectual Property/Copyright Materials

Otherwise lawful materials stored, transferred or made available without consent of their legal rights holders.

Pornography - Adult

Lawful, ethical pornography (i.e. involving only consenting adults).

Pornography - Child (Child Exploitation)

Child abuse materials (aka child pornography), including 'fantasy' fiction materials, CGI. Also includes the provision/offering of child abuse materials and/or activities

Pornography - Illicit or Illegal

Illegal pornography NOT including children/child abuse. Includes bestiality, stolen/revenge porn, hidden cameras etc.

Search Engine/Index

Site providing links/references to other sites/services. Referred to as a ‘nexus’ by (Moore and Rid, 2016)

Unclear

Unable to completely establish topic of material.

Extremism

Illegal or ‘of concern’ levels of extremist ideology. Note this does not provide blanket coverage of fundamentalist ideologies and dogma - only those associated with illegal acts. Socialist/anarchist/religious materials (for example) will not be included unless inclusive or indicative of associated illegal conduct, such as hate crimes.

Violence

Materials relating to violence against persons or property.

Weapons

Materials specifically associated with materials and/or items for use in violent acts against persons or property. Examples include firearms and bomb-making ingredients.

Softwares

Illegal or armful software distribution

Counter-feit materials

Fake identification papers.

Gambling

Games involving money

Library

Library or list of books

Other not illegal

Material not of interest to law enforcement - e.g. personal sites, Facebook mirrors.

Legitimate

Legitimate websites

Chats platforms

Chats space or equivalent, which are not forums

Mixer

Anonymization tools for crypto-currencies transactions

Mystery-Box

Mystery Box seller

Anonymizer

Anonymization tools

VPN-Provider

Provides VPN services and related

EMail-Provider

Provides e-mail services and related

Ponies

self-explanatory. It’s ponies

Games

Flash or online games

Parody or Joke

Meme, Parody, Jokes, Trolling, …​

Whistleblower

Exposition and sharing of confidential information with protection of the witness in mind

Education & Training

Materials providing instruction - e.g. ‘how to’ guides

Wiki

Wiki pages, documentation and information display

Forum

Sites specifically designed for multiple users to communicate as peers

File Sharing

General file sharing, typically (but not limited to) movie/image sharing

Hosting

Hosting providers, e-mails, websites, file-storage etc.

DDoS-Services

Stresser, Booter, DDoSer, DDoS as a Service provider, DDoS tools, etc.

General

Materials not covered by the other motivations. Typically, materials of a nature not of interest to law enforcement. For example, personal biography sites.

Information Sharing/Reportage

Journalism/reporting on topics. Can include biased coverage, but obvious propaganda materials are covered by Recruitment/Advocacy.

Scam

Intentional confidence trick to fraud people or group of people

Political-Speech

Political, activism, without extremism.

Conspirationist

Conspirationist content, fake news, etc.

Hate-Speech

Racism, violent, hate…​ speech.

Religious

Religious, faith, doctrinal related content.

Marketplace/For Sale

Services/goods for sale, regardless of means of payment.

Smuggling

Information or trading of wild animals, prohibited goods, …​

Recruitment/Advocacy

Propaganda

System/Placeholder

Automatically generated content, not designed for any identifiable purpose other than diagnostics - e.g. “It Works” message provided by default by Apache2

Unclear

Unable to completely establish motivation of material.

Incomplete websites or information

Websites and pages that are unable to load completely properly

Captcha and Solvers

Captchas and solvers elements

Logins forms and gates

Authentication pages, login page, login forms that block access to an internal part of a website.

Contact forms and gates

Forms to perform a contact request, send an e-mail, fill information, enter a password, …​

Encryption and decryption keys

e.g. PGP Keys, passwords, …​

Police Notice

Closed websites, with police-equivalent banners

Legal-Statement

RGPD statement, Privacy-policy, guidelines of a websites or forum…​

Test

Test websites without any real consequences or effects

Videos

Videos and streaming

Unclear

Unable to completely establish structure of material.

Regulated data

Data which is regulated under a specific regulation or law such as PII, SPD, PCI or PHI.

Commercially confidential information (CCI)

Data which represents a specific commercial value and is confidential to an organisation such as trade secrets, customer accounts.

Financially sensitive information (FSI)

Data which represents a specific financial value to an organisation such as payroll, investment information.

Valuation sensitive information (VSI)

Data which is sensitive to the valuation of an organisation such as inside information (as defined by a Financial Services Authority).

Sensitive information

Data which is sensitive such as email or letters.

This event describes traits and indicators closely related to a single entity, like an email campaign or sighting of a reference sample on VirusTotal. Events of this type are typically created by CSOC staff and may be verified by analysts. Observed and verified indicators would be consumed by automated filtering systems in order to support near-time threat prevention. In retrospect, observations could be correlated with reports and analysis events in order to help understand the motivation for an attack and to reassess the associated risk.

This event describes traits and indicators related to a security incident. As such, the event may refer to multiple entities like organizations, bank account numbers, files, and URLs. Events of this type contain first-hand information, that is, the reporting organization took part in the analysis of the incident. Use event type "Report" for second-hand information. Events of this type are typically created and consumed by analysts.

Traceability of indicators can be essential to document compliance of processes with legal obligations or company regulations. This event preserves a report to document the origin and context of indicators. Events of this type need to be checked by a human to ensure correct reproduction of indicators and context. Intended consumers are automated processes. Events may also serve as a basis for analysis reports or to justify preventive measures. If your organization is or was directly involved in an incident and you want to provide a first-hand account, then please use event type "Incident" instead.

This event builds on "observation", "incident", and "report" events; adds enrichments; and provides context. Events of this type will be created by analysts with support by automated tools. Analysts are also the main consumers.

This event collects unrelated IoCs. For example, an event could combine all network IoCs that were learned of during a day or a week from events of other types.

Amplification attack

Reflected and Spoofed attack

Slow Read attack

Flooding attack

Large POST HTTP attack

STRENG GEHEIM

Kenntnisnahme durch Unbefugte kann den Bestand oder lebenswichtige Interessen der Bundesrepublik Deutschland oder eines ihrer Länder gefährden.

GEHEIM

Kenntnisnahme durch Unbefugte kann die Sicherheit der Bundesrepublik Deutschland oder eines ihrer Länder gefährden oder ihren Interessen schweren Schaden zufügen.

VS-VERTRAULICH

Kenntnisnahme durch Unbefugte kann für die Interessen der Bundesrepublik Deutschland oder eines ihrer Länder schädlich sein.

VS-NUR FÜR DEN DIENSTGEBRAUCH

Kenntnisnahme durch Unbefugte kann für die Interessen der Bundesrepublik Deutschland oder eines ihrer Länder nachteilig sein.

Dummy

Platzhalter.

Chemical

Commercial Facilities

Communications

Critical Manufacturing

Dams

Defense Industrial Base

Emergency services

energy

Financial Services

Food and Agriculture

Government Facilities

Healthcare and Public Health

Information Technology

Nuclear

Transportation Systems

Water and water systems

An adversary is the actor/organization responsible for utilizing a capability against the victim to achieve their intent.

The capability describes the tools and/or techniques of the adversary used in the event. It includes all means to affect the victim from the most manual “unsophisticated” methods (e.g., manual password guessing) to the most sophisticated automated techniques.

The infrastructure feature describes the physical and/or logical communication structures the adversary uses to deliver a capability, maintain control of capabilities (e.g., commandand-control/C2), and effect results from the victim (e.g., exfiltrate data). As with the other features, the infrastructure can be as specific or broad as necessary. Examples include: Internet Protocol (IP) addresses, domain names, e-mail addresses, Morse code flashes from a phone’s voice-mail light watched from across a street, USB devices found in a parking lot and inserted into a workstation, or the compromising emanations from hardware (e.g., Van Eck Phreaking) being collected by a nearby listening post.

A victim is the target of the adversary and against whom vulnerabilities and exposures are exploited and capabilities used. A victim can be described in whichever way necessary and appropriate: organization, person, target email address, IP address, domain, etc. However, it is useful to define the victim persona and their assets separately as they serve different analytic functions. Victim personae are useful in non-technical analysis such as cyber-victimology and social-political centered approaches whereas victim assets are associated with common technical approaches such as vulnerability analysis..

RESTRICTED

CONFIDENTIAL

SECRET

TOP SECRET

UNCLASSIFIED

CONFIDENTIAL

SECRET

TOP SECRET

UNCLASSIFIED

ENDSEAL

ECRU

NONBOOK

HCS

HCS-O

HCS-P

KLONDIKE

KDK BLUEFISH

KDK IDITAROD

KDK KANDIK

RESERVE

SPECIAL INTELLIGENCE

SI-GAMMA

TALENT KEYHOLE

Document claims compliance with all rules encoded in ISM for documents produced by the US Federal Government. This is the minimum set of rules for US documents to adhere to, and all US documents should claim compliance with USGov.

Document claims compliance with all rules encoded in ISM for documents produced by the US Intelligence Community. Documents that claim compliance with USIC MUST also claim compliance with USGov.

Document claims compliance with all rules encoded in ISM for documents produced by the US Department of Defense. Documents that claim compliance with USDOD MUST also claim compliance with USGov.

Document claims compliance with an authority other than the USGov, USIC, or USDOD.

RESTRICTED DATA

RD-CRITICAL NUCLEAR WEAPON DESIGN INFORMATION

FORMERLY RESTRICTED DATA

DoD CONTROLLED NUCLEAR INFORMATION

DoE CONTROLLED NUCLEAR INFORMATION

TRANSCLASSIFIED FOREIGN NUCLEAR INFORMATION

FISA Warning statement

IMCON Warning statement

Controled Nuclear Weapon Design Information Warning statement

RD Warning statement

FRD Warning statement

LIMDIS caveat

LES Notice

LES-NF Notice

DSEN Notice

DoD Distribution statement A from DoD Directive 5230.24

DoD Distribution statement B from DoD Directive 5230.24

DoD Distribution statement C from DoD Directive 5230.24

DoD Distribution statement D from DoD Directive 5230.24

DoD Distribution statement E from DoD Directive 5230.24

DoD Distribution statement F from DoD Directive 5230.24

DoD Distribution statement X from DoD Directive 5230.24

US Person info Notice

Indicates that an instance document must abide by rules pertaining to ORIGINATOR CONTROLLED data issued prior to Executive Order 13526.

Indicates that the contents of this notice specify the contact information for a required point-of-contact.

COMSEC Notice

NAVAL NUCLEAR PROPULSION INFORMATION

LIMITED DISTRIBUTION

EXCLUSIVE DISTRIBUTION

NO DISTRIBUTION

SENSITIVE BUT UNCLASSIFIED

SENSITIVE BUT UNCLASSIFIED NOFORN

LAW ENFORCEMENT SENSITIVE

LAW ENFORCEMENT SENSITIVE NOFORN

SENSITIVE SECURITY INFORMATION

NATO Atomal mark

NATO Bohemia mark

NATO Balk mark

RISK SENSITIVE

FOR OFFICIAL USE ONLY

ORIGINATOR CONTROLLED

ORIGINATOR CONTROLLED US GOVERNMENT

CONTROLLED IMAGERY

NOT RELEASABLE TO FOREIGN NATIONALS

CAUTION-PROPRIETARY INFORMATION INVOLVED

AUTHORIZED FOR RELEASE TO

RELEASABLE BY INFORMATION DISCLOSURE OFFICIAL

DEA SENSITIVE

FOREIGN INTELLIGENCE SURVEILLANCE ACT

AUTHORIZED FOR DISPLAY BUT NOT RELEASE TO

Registered & active

Domain name is registered and DNS is delegated

Registered & inactive

Domain name is registered and DNS is not delegated

Registered & suspended

Domain name is registered & DNS delegation is temporarily removed by the registry

Not registered

Domain name is not registered and open for registration

Not registrable

Domain is not registered and cannot be registered

Grace period

Domain is deleted and still reserved for previous owner

Criminal registration

Domain name is registered for criminal purposes

Compromised webserver

Webserver is compromised for criminal purposes

Compromised DNS

Compromised authoritative DNS or compromised delegation

Sinkhole

Domain Name is sinkholed for research, detection, LE

Ajmaline-sarpagine alkaloids

Aporphines

Camptothecins

Cephalotaxus alkaloids

Cinchona alkaloids

Eburnan-type alkaloids

Epibatidine analogues

Ergoline and derivatives

Harmala alkaloids

Ibogan-type alkaloids

Lupin alkaloids

Morphinans

Phthalide isoquinolines

Protoberberine alkaloids and derivatives

Tropane alkaloids

Vinca alkaloids

Yohimbine alkaloids

Anthracenes

Benzene and substituted derivatives

Dibenzocycloheptenes

Fluorenes

Indanes

Indenes and isoindenes

Naphthacenes

Phenanthrenes and derivatives

Phenol esters

Phenol ethers

Phenols

Pyrenes

Tetralins

Triphenyl compounds

Homogeneous actinide compounds

Homogeneous alkali metal compounds

Homogeneous alkaline earth metal compounds

Homogeneous lanthanide compounds

Homogeneous metalloid compounds

Homogeneous post-transition metal compounds

Homogeneous transition metal compounds

Halogen organides

Homogeneous halogens

Homogeneous noble gases

Homogeneous other non-metal compounds

Non-metal oxoanionic compounds

Other non-metal halides

Other non-metal organides

Polycyclic hydrocarbons

Tropones

Aryltetralin lignans

Dibenzylbutane lignans

Flavonolignans

Furanoid lignans

Lignan lactones

Fatty Acyls

Glycero-3-dithiophosphocholines

Glycerolipids

Glycerophospholipids

Prenol lipids

Saccharolipids

S-alkyl-CoAs

Sphingolipids

Steroids and steroid derivatives

Alkali metal organides

Alkali metal oxoanionic compounds

Alkali metal salts

Alkaline earth metal organides

Alkaline earth metal oxoanionic compounds

Alkaline earth metal salts

Metalloid organides

Metalloid oxoanionic compounds

Miscellaneous mixed metal/non-metals

Other mixed metal/non-metal oxoanionic compounds

Post-transition metal organides

Post-transition metal oxoanionic compounds

Post-transition metal salts

Transition metal organides

Transition metal oxoanionic compounds

Transition metal salts

2',3'-dideoxy-3'-thionucleoside monophosphates

2',5'-dideoxyribonucleosides

(3'->5')-dinucleotides and analogues

5'-deoxyribonucleosides

(5'->5')-dinucleotides

Benzimidazole ribonucleosides and ribonucleotides

Flavin nucleotides

Glycinamide ribonucleotides

Imidazole[4,5-c]pyridine ribonucleosides and ribonucleotides

Imidazole ribonucleosides and ribonucleotides

Molybdopterin dinucleotides

Nucleoside and nucleotide analogues

Purine nucleosides

Pyrazolo[3,4-d]pyrimidine glycosides

Pyridine nucleotides

Pyrimidine nucleosides

Pyrimidine nucleotides

Pyrrolopyrimidine nucleosides and nucleotides

Ribonucleoside 3'-phosphates

Triazole ribonucleosides and ribonucleotides

Allyl-type 1,3-dipolar organic compounds

Boronic acid derivatives

Carboximidic acids and derivatives

Carboxylic acids and derivatives

Hydroxy acids and derivatives

Keto acids and derivatives

Organic carbonic acids and derivatives

Organic phosphonic acids and derivatives

Organic phosphoric acids and derivatives

Organic sulfonic acids and derivatives

Organic sulfuric acids and derivatives

Organic thiophosphoric acids and derivatives

Orthocarboxylic acid derivatives

Peptidomimetics

Thiosulfinic acid esters

Carboxylic Acids and Derivatives

Organonitrogen compounds

Organic oxides

Organic oxoanionic compounds

Organooxygen compounds

Phosphorothioate polynucleotides

Polypeptides

Polysaccharides

Organic metal salts

Acyl halides

Alkyl halides

Aryl halides

Halohydrins

Organochlorides

Organofluorides

Sulfonyl halides

Vinyl halides

Azaspirodecane derivatives

Azepanes

Azobenzenes

Azoles

Azolidines

Azolines

Benzazepines

Benzimidazoles

Benzisoxazoles

Benzocycloheptapyridines

Benzodiazepines

Benzodioxanes

Benzodioxoles

Benzofurans

Benzopyrans

Benzopyrazoles

Benzothiadiazoles

Benzothiazepines

Benzothiazines

Benzothiazoles

Benzothiepins

Benzothiophenes

Benzothiopyrans

Benzotriazoles

Benzoxadiazoles

Benzoxazepines

Benzoxazines

Benzoxazoles

Benzoxepines

Bi- and oligothiophenes

Biotin and derivatives

Coumarans

Cycloheptapyrans

Cycloheptathiophenes

Diazanaphthalenes

Diazepanes

Diazinanes

Diazines

Dihydrofurans

Dihydroisoquinolines

Dihydrothiophenes

Dioxaborolanes

Dioxanes

Dioxolopyrans

Dithianes

Dithiolanes

Epoxides

Furans

Furofurans

Furopyrans

Furopyridines

Furopyrroles

Heteroaromatic compounds

Imidazo[1,5-a]pyrazines

Imidazodiazepines

Imidazopyrazines

Imidazopyridines

Imidazopyrimidines

Imidazotetrazines

Imidazothiazoles

Indoles and derivatives

Indolizidines

Isocoumarans

Isoindoles and derivatives

Isoquinolines and derivatives

Isoxazolopyridines

Lactams

Lactones

Metalloheterocyclic compounds

Naphthofurans

Naphthopyrans

Oxanes

Oxazaphosphinanes

Oxazinanes

Oxepanes

Phenanthrolines

Piperazinoazepines

Piperidines

Pteridines and derivatives

Pyranodioxins

Pyranopyridines

Pyranopyrimidines

Pyrans

Pyrazolopyridines

Pyrazolopyrimidines

Pyrazolotriazines

Pyridines and derivatives

Pyridopyrimidines

Pyrroles

Pyrrolidines

Pyrrolines

Pyrrolizines

Pyrroloazepines

Pyrrolopyrazines

Pyrrolopyrazoles

Pyrrolopyridines

Pyrrolopyrimidines

Pyrrolotriazines

Quinolines and derivatives

Quinuclidines

Selenazoles

Tetrahydrofurans

Tetrahydroisoquinolines

Tetrapyrroles and derivatives

Thiadiazinanes

Thiadiazines

Thianes

Thiazepines

Thiazinanes

Thiazines

Thienodiazepines

Thienoimidazolidines

Thienopyridines

Thienopyrimidines

Thienopyrroles

Thienothiazines

Thiochromanes

Thiochromenes

Thiolanes

Thiophenes

Triazinanes

Triazines

Triazolopyrazines

Triazolopyridines

Triazolopyrimidines

Trioxanes

Organometalloid compounds

Organo-post-transition metal compounds

Organic phosphines and derivatives

Organophosphinic acids and derivatives

Organothiophosphorus compounds

Isothioureas

Organic disulfides

Sulfonyls

Sulfoxides

Thiocarbonyl compounds

Thioethers

Thiols

Thioureas

2-arylbenzofuran flavonoids

Anthracyclines

Aurone flavonoids

Cinnamic acids and derivatives

Cinnamyl alcohols

Coumarins and derivatives

Depsides and depsidones

Diarylheptanoids

Flavonoids

Isochromanequinones

Isocoumarins and derivatives

Isoflavonoids

Linear 1,3-diarylpropanoids

Macrolactams

Macrolide lactams

Macrolides and analogues

Neoflavonoids

Phenylpropanoic acids

Saxitoxins, gonyautoxins, and derivatives

Stilbenes

Tannins

Tetracyclines

No loss

Less than 25K EUR

Associated numerical value="10"

Less than 50K EUR

Associated numerical value="20"

Less than 100K EUR

Associated numerical value="30"

Less than 1 million EUR

Associated numerical value="40"

Less than 10 million EUR

Associated numerical value="50"

Less than 100 million EUR

Associated numerical value="60"

Less than 1 billion EUR

Associated numerical value="70"

More than 1 billion EUR

Associated numerical value="80"

No gain

Less than 25K EUR

Associated numerical value="10"

Less than 50K EUR

Associated numerical value="20"

Less than 100K EUR

Associated numerical value="30"

Less than 1 million EUR

Associated numerical value="40"

Less than 10 million EUR

Associated numerical value="50"

Less than 100 million EUR

Associated numerical value="60"

Less than 1 billion EUR

Associated numerical value="70"

More than 1 billion EUR

Associated numerical value="80"

spam

Or 'Unsolicited Bulk Email', this means that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having a functionally comparable content.

Harmful Speech

Discreditation or discrimination of somebody e.g. cyber stalking, racism and threats against one or more individuals).

Child/Sexual/Violence/…​

Child Pornography, glorification of violence, …​

Virus

Worm

Trojan

Spyware

Dialer

Rootkit

Malware

Botnet drone

Ransomware

Malware configuration

C&C

Scanning

Attacks that send requests to a system to discover weak points. This includes also some kind of testing processes to gather information about hosts, services and accounts. Examples: fingerd, DNS querying, ICMP, SMTP (EXPN, RCPT, …​), port scanning.

Sniffing

Observing and recording of network traffic (wiretapping).

Social Engineering

Gathering information from a human being in a non-technical way (e.g. lies, tricks, bribes, or threats).

Exploiting of known Vulnerabilities

An attempt to compromise a system or to disrupt any service by exploiting vunerabilities with a standardised identifier such as CVE name (e.g. buffer overflow, backdoor, cross site scripting, etc.)

Login attempts

Multiple login attempts (Guessing / cracking of passwords, brute force).

New attack signature

An attempt using an unknown exploit.

Privileged Account Compromise

Unprivileged Account Compromise

Application Compromise

Bot

defacement

compromised

backdoor

DoS

Denial of Service.

DDoS

Distributed Denial of Service.

Sabotage

Sabotage.

Outage (no malice)

Outage (no malice).

Unauthorised access to information

Unauthorised modification of information

dropzone

Unauthorized use of resources

Using resources for unauthorized purposes including profit-making ventures (E.g. the use of e-mail to participate in illegal profit chain letters or pyramid schemes).

Copyright

Offering or Installing copies of unlicensed commercial software or other copyright protected materials (Warez).

Masquerade

Type of attacks in which one entity illegitimately assumes the identity of another in order to benefit from it.

Phishing

Masquerading as another entity in order to persuade the user to reveal a private credential.

Open for abuse

blacklist

unknown

other

Test

Fraud

Fraud committed by humans.

Fraud committed by employees

Fraud committed by employees or others that are in relation with entities, who have access to entities' information and IT assets.

Sabotage

Intentional actions (non-fulfilment or defective fulfilment of personal duties) aimed to cause disruption or damage to IT assets.

Vandalism

Act of physically damaging IT assets.

Theft (of devices, storage media and documents)

Stealing information or IT assets. Robbery.

Theft of mobile devices (smartphones/ tablets)

Taking away another person’s property in the form of mobile devices, for example smartphones, tablets.

Theft of fixed hardware

Taking away another person’s hardware property (except mobile devices), which often contains business-sensitive data.

Theft of documents

Stealing documents from private/company archives, often for the purpose of re-sale or to achieve personal benefits.

Theft of backups

Stealing media devices, on which copies of essential information are kept.

Information leak /sharing

Sharing information with unauthorised entities. Loss of information confidentiality due to intentional human actions (e.g., information leak may occur due to loss of paper copies of confidential information).

Unauthorized physical access / Unauthorised entry to premises

Unapproved access to facility.

Coercion, extortion or corruption

Actions following acts of coercion, extortion or corruption.

Damage from the warfare

Threats of direct impact of warfare activities.

Terrorist attack

Threats from terrorists.

Information leak /sharing due to human error

Information leak / sharing caused by humans, due to their mistakes.

Accidental leaks/sharing of data by employees

Unintentional distribution of private or sensitive data to an unauthorized entity by a staff member.

Leaks of data via mobile applications

Threat of leaking private data (a result of using applications for mobile devices).

Leaks of data via Web applications

Threat of leaking important information using web applications.

Leaks of information transferred by network

Threat of eavesdropping of unsecured network traffic.

Erroneous use or administration of devices and systems

Information leak / sharing / damage caused by misuse of IT assets (lack of awareness of application features) or wrong / improper IT assets configuration or management.

Loss of information due to maintenance errors / operators' errors

Threat of loss of information by incorrectly performed maintenance of devices or systems or other operator activities.

Loss of information due to configuration/ installation error

Threat of loss of information due to errors in installation or system configuration.

Increasing recovery time

Threat of unavailability of information due to errors in the use of backup media and increasing information recovery time.

Loss of information due to user errors

Threat of unavailability of information or damage to IT assets caused by user errors (using IT infrastructure) or IT software recovery time.

Using information from an unreliable source

Bad decisions based on unreliable sources of information or unchecked information.

Unintentional change of data in an information system

Loss of information integrity due to human error (information system user mistake).

Inadequate design and planning or improper adaptation

Threats caused by improper IT assets or business processes design (inadequate specifications of IT products, inadequate usability, insecure interfaces, policy/procedure flows, design errors).

Damage caused by a third party

Threats of damage to IT assets caused by third party.

Security failure caused by third party

Threats of damage to IT assets caused by breach of security regulations by third party.

Damages resulting from penetration testing

Threats to information systems caused by conducting IT penetration tests inappropriately.

Loss of information in the cloud

Threats of losing information or data stored in the cloud.

Loss of (integrity of) sensitive information

Threats of losing information or data, or changing information classified as sensitive.

Loss of integrity of certificates

Threat of losing integrity of certificates used for authorisation services

Loss of devices, storage media and documents

Threats of unavailability (losing) of IT assets and documents.

Loss of devices/ mobile devices

Threat of losing mobile devices.

Loss of storage media

Threat of losing data-storage media.

Loss of documentation of IT Infrastructure

Threat of losing important documentation.

Destruction of records

Threats of unavailability (destruction) of data and records (information) stored in devices and storage media.

Infection of removable media

Threat of loss of important data due to using removable media, web or mail infection.

Abuse of storage

Threat of loss of records by improper /unauthorised use of storage devices.

Disaster (natural earthquakes, floods, landslides, tsunamis, heavy rains, heavy snowfalls, heavy winds)

Large scale natural disasters.

Fire

Threat of fire.

Pollution, dust, corrosion

Threat of disruption of work of IT systems (hardware) due to pollution, dust or corrosion (arising from the air).

Thunderstrike

Threat of damage to IT hardware caused by thunder strike (overvoltage).

Water

Threat of damage to IT hardware caused by water.

Explosion

Threat of damage to IT hardware caused by explosion.

Dangerous radiation leak

Threat of damage to IT hardware caused by radiation leak.

Unfavourable climatic conditions

Threat of disruption of work of IT systems due to climatic conditions that have a negative effect on hardware.

Loss of data or accessibility of IT infrastructure as a result of heightened humidity

Threat of disruption of work of IT systems due to high humidity.

Lost of data or accessibility of IT infrastructure as a result of very high temperature

Threat of disruption of work of IT systems due to high or low temperature.

Threats from space / Electromagnetic storm

Threats of the negative impact of solar radiation to satellites and radio wave communication systems - electromagnetic storm.

Wildlife

Threat of destruction of IT assets caused by animals: mice, rats, birds.

Failure of devices or systems

Threat of failure of IT hardware and/or software assets or its parts.

Failure of data media

Threat of failure of data media.

Hardware failure

Threat of failure of IT hardware.

Failure of applications and services

Threat of failure of software/applications or services.

Failure of parts of devices (connectors, plug-ins)

Threat of failure of IT equipment or its part.

Failure or disruption of communication links (communication networks)

Threat of failure or malfunction of communications links.

Failure of cable networks

Threat of failure of communications links due to problems with cable network.

Failure of wireless networks

Threat of failure of communications links due to problems with wireless networks.

Failure of mobile networks

Threat of failure of communications links due to problems with mobile networks.

Failure or disruption of main supply

Threat of failure or disruption of supply required for information systems.

Failure or disruption of power supply

Threat of failure or malfunction of power supply.

Failure of cooling infrastructure

Threat of failure of IT assets due to improper work of cooling infrastructure.

Failure or disruption of service providers (supply chain)

Threat of failure or disruption of third party services required for proper operation of information systems.

Malfunction of equipment (devices or systems)

Threat of malfunction of IT hardware and/or software assets or its parts (i.e. improper working parameters, jamming, rebooting).

Absence of personnel

Unavailability of key personnel and their competences.

Strike

Unavailability of staff due to a strike (large scale absence of personnel).

Loss of support services

Unavailability of support services required for proper operation of the information system.

Internet outage

Unavailability of the Internet connection.

Network outage

Unavailability of communication links.

Outage of cable networks

Threat of lack of communications links due to problems with cable network.

Outage of short-range wireless networks

Threat of lack of communications links due to problems with wireless networks (802.11 networks, Bluetooth, NFC etc.).

Outages of long-range wireless networks

Threat of lack of communications links due to problems with mobile networks like cellular network (3G, LTE, GSM etc.) or satellite links.

War driving

Threat of locating and possibly exploiting connection to the wireless network.

Intercepting compromising emissions

Threat of disclosure of transmitted information using interception and analysis of compromising emission.

Interception of information

Threat of interception of information which is improperly secured in transmission or by improper actions of staff.

Corporate espionage

Threat of obtaining information secrets by dishonest means.

Nation state espionage

Threats of stealing information by nation state espionage (e.g. China based governmental espionage, NSA from USA).

Information leakage due to unsecured Wi-Fi, rogue access points

Threat of obtaining important information by insecure network rogue access points etc.

Interfering radiation

Threat of failure of IT hardware or transmission connection due to electromagnetic induction or electromagnetic radiation emitted by an outside source.

Replay of messages

Threat in which valid data transmission is maliciously or fraudulently repeated or delayed.

Network Reconnaissance, Network traffic manipulation and Information gathering

Threat of identifying information about a network to find security weaknesses.

Man in the middle/ Session hijacking

Threats that relay or alter communication between two parties.

Violation of rules and regulations / Breach of legislation

Threat of financial or legal penalty or loss of trust of customers and collaborators due to violation of law or regulations.

Failure to meet contractual requirements

Threat of financial penalty or loss of trust of customers and collaborators due to failure to meet contractual requirements.

Failure to meet contractual requirements by third party

Threat of financial penalty or loss of trust of customers and collaborators due to a third party’s failure to meet contractual requirements

Unauthorized use of IPR protected resources

Threat of financial or legal penalty or loss of trust of customers and collaborators due to improper/illegal use of IPR protected material (IPR- Intellectual Property Rights.

Illegal usage of File Sharing services

Threat of financial or legal penalty or loss of trust of customers and collaborators due to improper/illegal use of file sharing services.

Abuse of personal data

Threat of illegal use of personal data.

Judiciary decisions/court order

Threat of financial or legal penalty or loss of trust of customers and collaborators due to judiciary decisions/court order.

Identity theft (Identity Fraud/ Account)

Threat of identity theft action.

Credentials-stealing trojans

Threat of identity theft action by malware computer programs.

Receiving unsolicited E-mail

Threat of receiving unsolicited email which affects information security and efficiency.

SPAM

Threat of receiving unsolicited, undesired, or illegal email messages.

Unsolicited infected e-mails

Threat emanating from unwanted emails that may contain infected attachments or links to malicious / infected web sites.

Denial of service

Threat of service unavailability due to massive requests for services.

Distributed denial of network service (DDoS) (network layer attack i.e. Protocol exploitation / Malformed packets / Flooding / Spoofing)

Threat of service unavailability due to a massive number of requests for access to network services from malicious clients.

Distributed denial of application service (DDoS) (application layer attack i.e. Ping of Death / XDoS / WinNuke / HTTP Floods)

Threat of service unavailability due to massive requests sent by multiple malicious clients.

Distributed DoS (DDoS) to both network and application services (amplification/reflection methods i.e. NTP/ DNS /…​/ BitTorrent)

Threat of creating a massive number of requests, using multiplication/amplification methods.

Malicious code/ software/ activity

Search Engine Poisoning

Threat of deliberate manipulation of search engine indexes.

Exploitation of fake trust of social media

Threat of malicious activities making use of trusted social media.

Worms/ Trojans

Threat of malware computer programs (trojans/worms).

Rootkits

Threat of stealthy types of malware software.

Mobile malware

Threat of mobile malware programs.

Infected trusted mobile apps

Threat of using mobile malware software that is recognised as trusted one.

Elevation of privileges

Threat of exploiting bugs, design flaws or configuration oversights in an operating system or software application to gain elevated access to resources.

Web application attacks / injection attacks (Code injection: SQL, XSS)

Threat of utilizing custom web applications embedded within social media sites, which can lead to installation of malicious code onto computers to be used to gain unauthorized access.

Spyware or deceptive adware

Threat of using software that aims to gather information about a person or organization without their knowledge.

Viruses

Threat of infection by viruses.

Rogue security software/ Rogueware / Scareware

Threat of internet fraud or malicious software that mislead users into believing there is a virus on their computer, and manipulates them to pay money for fake removal tool.

Ransomware

Threat of infection of computer system or device by malware that restricts access to it and demands that the user pay a ransom to remove the restriction.

Exploits/Exploit Kits

Threat to IT assets due to the use of web available exploits or exploits software.

Social Engineering

Threat of social engineering type attacks (target: manipulation of personnel behaviour).

Phishing attacks

Threat of an email fraud method in which the perpetrator sends out legitimate-looking email in an attempt to gather personal and financial information from recipients. Typically, the messages appear to come from well-known and trustworthy websites.

Spear phishing attacks

Spear-phishing is a targeted e-mail message that has been crafted to create fake trust and thus lure the victim to unveil some business or personal secrets that can be abused by the adversary.

Abuse of Information Leakage

Threat of leaking important information.

Leakage affecting mobile privacy and mobile applications

Threat of leaking important information due to using malware mobile applications.

Leakage affecting web privacy and web applications

Threat of leakage important information due to using malware web applications.

Leakage affecting network traffic

Threat of leaking important information in network traffic.

Leakage affecting cloud computing

Threat of leaking important information in cloud computing.

Generation and use of rogue certificates

Threat of use of rogue certificates.

Loss of (integrity of) sensitive information

Threat of loss of sensitive information due to loss of integrity.

Man in the middle / Session hijacking

Threat of attack consisting in the exploitation of the web session control mechanism, which is normally managed by a session token.

Social Engineering / signed malware

Threat of install fake trust signed software (malware) e.g. fake OS updates.

Fake SSL certificates

Threat of attack due to malware application signed by a certificate that is typically inherently trusted by an endpoint.

Manipulation of hardware and software

Threat of unauthorised manipulation of hardware and software.

Anonymous proxies

Threat of unauthorised manipulation by anonymous proxies.

Abuse of computing power of cloud to launch attacks (cybercrime as a service)

Threat of using large computing powers to generate attacks on demand.

Abuse of vulnerabilities, 0-day vulnerabilities

Threat of attacks using 0-day or known IT assets vulnerabilities.

Access of web sites through chains of HTTP Proxies (Obfuscation)

Threat of bypassing the security mechanism using HTTP proxies (bypassing the website blacklist).

Access to device software

Threat of unauthorised manipulation by access to device software.

Alternation of software

Threat of unauthorized modifications to code or data, attacking its integrity.

Rogue hardware

Threat of manipulation due to unauthorized access to hardware.

Manipulation of information

Threat of intentional data manipulation to mislead information systems or somebody or to cover other nefarious activities (loss of integrity of information).

Repudiation of actions

Threat of intentional data manipulation to repudiate action.

Address space hijacking (IP prefixes)

Threat of the illegitimate takeover of groups of IP addresses.

Routing table manipulation

Threat of route packets of network to IP addresses other than that was intended via sender by unauthorised manipulation of routing table.

DNS poisoning / DNS spoofing / DNS Manipulations

Threat of falsification of DNS information.

Falsification of record

Threat of intentional data manipulation to falsify records.

Autonomous System hijacking

Threat of overtaking by the attacker the ownership of a whole autonomous system and its prefixes despite origin validation.

Autonomous System manipulation

Threat of manipulation by the attacker of a whole autonomous system in order to perform malicious actions.

Falsification of configurations

Threat of intentional manipulation due to falsification of configurations.

Misuse of audit tools

Threat of nefarious actions performed using audit tools (discovery of security weaknesses in information systems)

Misuse of information/ information systems (including mobile apps)

Threat of nefarious action due to misuse of information / information systems.

Unauthorized activities

Threat of nefarious action due to unauthorised activities.

Unauthorised use or administration of devices and systems

Threat of nefarious action due to unauthorised use of devices and systems.

Unauthorised use of software

Threat of nefarious action due to unauthorised use of software.

Unauthorized access to the information systems-or-networks (IMPI Protocol / DNS Registrar Hijacking)

Threat of unauthorised access to the information systems / network.

Network Intrusion

Threat of unauthorised access to network.

Unauthorized changes of records

Threat of unauthorised changes of information.

Unauthorized installation of software

Threat of unauthorised installation of software.

Web based attacks (Drive-by download / malicious URLs / Browser based attacks)

Threat of installation of unwanted malware software by misusing websites.

Compromising confidential information (data breaches)

Threat of data breach.

Hoax

Threat of loss of IT assets security due to cheating.

False rumour and/or fake warning

Threat of disruption of work due to rumours and/or a fake warning.

Remote activity (execution)

Threat of nefarious action by attacker remote activity.

Remote Command Execution

Threat of nefarious action due to remote command execution.

Remote Access Tool (RAT)

Threat of infection of software that has a remote administration capabilities allowing an attacker to control the victim’s computer.

Botnets / Remote activity

Threat of penetration by software from malware distribution.

Targeted attacks (APTs etc.)

Threat of sophisticated, targeted attack which combine many attack techniques.

Mobile malware (exfiltration)

Threat of mobile software that aims to gather information about a person or organization without their knowledge.

Spear phishing attacks (targeted)

Threat of attack focused on a single user or department within an organization, coming from someone within the company in a position of trust and requesting information such as login, IDs and passwords.

Installation of sophisticated and targeted malware

Threat of malware delivered by sophisticated and targeted software.

Watering Hole attacks

Threat of malware residing on the websites which a group often uses.

Failed business process

Threat of damage or loss of IT assets due to improperly executed business process.

Brute force

Threat of unauthorised access via systematically checking all possible keys or passwords until the correct one is found.

Abuse of authorizations

Threat of using authorised access to perform illegitimate actions.

Almost no chance - remote - 01-05%

Very unlikely - highly improbable - 05-20%

Associated numerical value="5"

Unlikely - improbable (improbably) - 20-45%

Associated numerical value="20"

Roughly even change - roughly even odds - 45-55%

Associated numerical value="45"

Likely - probable (probably) - 55-80%

Associated numerical value="55"

Very likely - highly probable - 80-95%

Associated numerical value="80"

Almost certain(ly) - nearly certain - 95-99%

Associated numerical value="95"

Low

Uncorroborated information from good or marginal sources. Many assumptions. Mostly weak logical inferences, minimal methods application. Glaring intelligence gaps exist. Terms or expressions used: 'Possible', 'Could, may, might', 'Cannot judge, unclear.'

Moderate

Partially corroborated information from good sources. Several assumptions. Mix of strong and weak inferences and methods. Minimum intelligence gaps exist. Terms or expressions used: 'Likely, unlikely', 'Probable, improbable' 'Anticipate, appear'.

Associated numerical value="55"

High

Well-corroborated information from proven sources. Minimal assumptions. Strong logical inferences and methods. No or minor intelligence gaps exist. Terms or expressions used: 'Will, will not', 'Almost certainly, remote', 'Highly likely, highly unlikely', 'Expect, assert, affirm'.

Associated numerical value="95"

Transport

Energy

Health

Financial market operators

Banking

e-commerce platforms

Internet payment

cloud computing

search engines

social networks

application stores

Public Administrations

Energy

Transport Sector

Banking

Financial market operators

Health

Drinking Water Supply and Distribution

Digital Infrastructure

Electricity Sub Sector

Oil Sub Sector

Gas Sub Sector

Air Transport Sub Sector

Rail Transport Sub Sector

Water Transport Sub Sector

Road Transport Sub Sector

Bank Credit Institutions Sub Sector

Operators of Financial Trading Sub Sector

Financial Central Counterparty Sub Sector

Healthcare Provider Sub Sector

Water Supply Sub Sector

Water Distribution Sub Sector

IXPs Sub Sector

DNS Service Provider Sub Sector

TLD Name Registry Sub Sector

Online Marketplace Sub Sector

Online Search Engine Sub Sector

Cloud Computing Service Sub Sector

TRES SECRET UE/EU TOP SECRET

Information and material the unauthorised disclosure of which could cause exceptionally grave prejudice to the essential interests of the European Union or of one or more of the Member States.

SECRET UE/EU SECRET

Information and material the unauthorised disclosure of which could seriously harm the essential interests of the European Union or of one or more of the Member States.

CONFIDENTIEL UE/EU CONFIDENTIAL

Information and material the unauthorised disclosure of which could harm the essential interests of the European Union or of one or more of the Member States.

RESTREINT UE/EU RESTRICTED

Information and material the unauthorised disclosure of which could be disadvantageous to the interests of the European Union or of one or more of the Member States.

System(s) infected by known malware

The presence of any of the types of malware was detected in a system.

Dissemination of malware by email

Malware attached to a message or email message containing link to malicious URL.

Hosting of malware on web page

Hosting of malware on web page

Web page disseminating one or various types of malware.

Replication and spreading of a worm

System infected by a worm trying to infect other systems.

Connection to (a) suspicious port(s) linked to specific malware

System attempting to gain access to a port normally linked to a specific type of malware.

Connection to (a) suspicious system(s) linked to specific malware

System attempting to gain access to an IP address or URL normally linked to a specific type of malware, e.g. C&C or a distribution page for components linked to a specific botnet.

Flood of requests

Mass mailing of requests (network packets, emails, etc…​) from one single source to a specific service, aimed at affecting its normal functioning.

Exploit or tool aimed at exhausting resources (network, processing capacity, sessions, etc…​)

One single source using specially designed software to affect the normal functioning of a specific service, by exploiting a vulnerability.

Packet flooding

Mass mailing of requests (network packets, emails, etc…​) from various sources to a specific service, aimed at affecting its normal functioning.

Exploit or tool distribution aimed at exhausting resources

Various sources using specially designed software to affect the normal functioning of a specific service, by exploiting a vulnerability.

Vandalism

Logical and physical activities which – although they are not aimed at causing damage to information or at preventing its transmission among systems – have this effect.

Intentional disruption of data transmission and processing mechanisms

Logical and physical activities aimed at causing damage to information or at preventing its transmission among systems.

System probe

Single system scan searching for open ports or services using these ports for responding.

Network scanning

Scanning a network aimed at identifying systems which are active in the same network.

DNS zone transfer

Transfer of a specific DNS zone.

Wiretapping

Logical or physical interception of communications.

Dissemination of phishing emails

Mass emailing aimed at collecting data for phishing purposes with regard to the victims.

Hosting phishing sites

Hosting web sites for phishing purposes.

Aggregation of information gathered through phishing schemes

Collecting data obtained through phishing attacks on web pages, email accounts, etc…​

Exploit attempt

Unsuccessful use of a tool exploiting a specific vulnerability of the system.

SQL injection attempt

Unsuccessful attempt to manipulate or read the information of a database by using the SQL injection technique.

XSS attempt

Unsuccessful attempts to perform attacks by using cross-site scripting techniques.

File inclusion attempt

Unsuccessful attempt to include files in the system under attack by using file inclusion techniques.

Brute force attempt

Unsuccessful login attempt by using sequential credentials for gaining access to the system.

Password cracking attempt

Attempt to acquire access credentials by breaking the protective cryptographic keys.

Dictionary attack attempt

Unsuccessful login attempt by using system access credentials previously loaded into a dictionary.

Use of a local or remote exploit

Successful use of a tool exploiting a specific vulnerability of the system.

SQL injection

Manipulation or reading of information contained in a database by using the SQL injection technique.

XSS

Attacks performed with the use of cross-site scripting techniques.

File inclusion

Inclusion of files into a system under attack with the use of file inclusion techniques.

Control system bypass