MISP Objects

When the leak has been accessible or seen for the last time.

Type of information leak as discovered and classified by an AIL module.

A description of the leak which could include the potential victim(s) or description of the leak.

When the information available in the leak was created. It’s usually before the first-seen.

The AIL sensor uuid where the leak was processed and analysed.

The link where the leak is (or was) accessible at first-seen.

When the leak has been accessible or seen for the first time.

Value of the cookie (if splitted)

Type of cookie and how it’s used in this specific object.

Full cookie

A description of the cookie.

Name of the cookie (if splitted)

A description of the card.

yabin.py and regex.txt version used for the generation of the yara rules.

Name of the card owner.

Maximum date of validity

credit-card number as encoded on the card.

Initial date of validity or issued date.

Card security code as embossed or printed on the card.

Packets per second

Protocol used for the attack

End of the attack

Port originating the attack

Description of the DDoS

Destination port of the attack

Destination ID (victim)

IP address originating the attack

Beginning of the attack

Bits per second

Domain name

Last time the tuple has been seen

IP Address

A description of the tuple

First time the tuple has been seen

Type of ELF

Free text value to attach to the ELF

Header operating system application binary interface (ABI)

Architecture of the ELF file

Number of sections

Address of the entry point

[Insecure] Secure Hash Algorithm 1 (160 bits)

Size of the section, in bytes

Secure Hash Algorithm 2 (256 bits)

Fuzzy hash using context triggered piecewise hashes (CTPH)

Secure Hash Algorithm 2 (224 bits)

Flag of the section

Secure Hash Algorithm 2 (256 bits)

Type of the section

Name of the section

Secure Hash Algorithm 2 (384 bits)

[Insecure] MD5 hash (128 bits)

Secure Hash Algorithm 2 (224 bits)

Entropy of the whole section

Secure Hash Algorithm 2 (512 bits)

Free text value to attach to the section

MIME Boundary

X-Mailer generally tells the program that was used to draft and send the original email

Sender email address

Attachment

Full headers

Message ID

Identifies a particular conversation thread

Date the email has been sent

Email address the reply will be sent to

Subject

Display name of the receiver

Display name of the sender

Destination email address

Filename on disk

[Insecure] Secure Hash Algorithm 1 (160 bits)

Authenticode executable signature hash

Mime type

The file itself (binary)

Size of the file, in bytes

Pattern that can be found in the file

Secure Hash Algorithm 2 (256 bits)

Fuzzy hash using context triggered piecewise hashes (CTPH)

Secure Hash Algorithm 2 (224 bits)

Entropy of the whole file

Fuzzy hash by Trend Micro: Locality Sensitive Hash

Free text value to attach to the file

Secure Hash Algorithm 2 (384 bits)

[Insecure] MD5 hash (128 bits)

Secure Hash Algorithm 2 (224 bits)

Secure Hash Algorithm 2 (256 bits)

Secure Hash Algorithm 2 (512 bits)

Country.

When the location was seen for the last time.

A generic description of the location.

City.

Region.

When the location was seen for the first time.

The altitude is the decimal value of the altitude in the World Geodetic System 84 (WGS84) reference.

The latitude is the decimal value of the latitude in the World Geodetic System 84 (WGS84) reference.

The longitude is the decimal value of the longitude in the World Geodetic System 84 (WGS84) reference

HTTP Method invoked (one of GET, POST, PUT, HEAD, DELETE, OPTIONS, CONNECT)

Request URI

HTTP Basic Authentication Password

HTTP Proxy Password

The user agent string of the user agent

The MIME type of the body of the request

HTTP Basic Authentication Username

This is the address of the previous web page from which a link to the currently requested page was followed

An HTTP cookie previously sent by the server with Set-Cookie

HTTP Request comment

HTTP Proxy Username

The domain name of the server

Full HTTP Request URL

Last time the tuple has been seen

Source port

Description of the tuple

Destination port

First time the tuple has been seen

IP Address

Number of sections

Address of the entry point

Type of Mach-O

Binary’s name

Free text value to attach to the Mach-O file

[Insecure] Secure Hash Algorithm 1 (160 bits)

Size of the section, in bytes

Secure Hash Algorithm 2 (256 bits)

Fuzzy hash using context triggered piecewise hashes (CTPH)

Secure Hash Algorithm 2 (224 bits)

Secure Hash Algorithm 2 (256 bits)

Name of the section

Secure Hash Algorithm 2 (384 bits)

[Insecure] MD5 hash (128 bits)

Secure Hash Algorithm 2 (224 bits)

Entropy of the whole section

Secure Hash Algorithm 2 (512 bits)

Free text value to attach to the section

First time that the unique tuple (rrname, rrtype, rdata) has been seen by the passive DNS

Resource records of the queried resource

Last time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import

Resource Record name of the queried resource

Sensor information where the record was seen

How many authoritative DNS answers were received at the Passive DNS Server’s collectors with exactly the given set of values as answers

Resource Record type as seen by the passive DNS

Last time that the unique tuple (rrname, rrtype, rdata) record has been seen by the passive DNS

First time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import

Origin of the Passive DNS response

Best estimate of the apex of the zone where this data is authoritative

FileVersion in the resources

Type of PE

InternalFilename in the resources

Name of the section and position of the section in the PE

Compilation timestamp defined in the PE header

Number of sections

ProductVersion in the resources

FileDescription in the resources

Hash (md5) calculated from the import table

Lang ID in the resources

CompanyName in the resources

Free text value to attach to the PE

LegalCopyright in the resources

OriginalFilename in the resources

Hash of the structural information about a sample. See https://www.usenix.org/legacy/event/leet09/tech/full_papers/wicherski/wicherski_html/

ProductName in the resources

Address of the entry point

Fuzzy Hash (ssdeep) calculated from the import table

[Insecure] Secure Hash Algorithm 1 (160 bits)

Size of the section, in bytes

Characteristic of the section

Secure Hash Algorithm 2 (256 bits)

Fuzzy hash using context triggered piecewise hashes (CTPH)

Secure Hash Algorithm 2 (224 bits)

Secure Hash Algorithm 2 (256 bits)

Name of the section

Secure Hash Algorithm 2 (384 bits)

[Insecure] MD5 hash (128 bits)

Secure Hash Algorithm 2 (224 bits)

Entropy of the whole section

Secure Hash Algorithm 2 (512 bits)

Free text value to attach to the section

Place of birth of a natural person.

Last name of a natural person.

Date of birth of a natural person (in YYYY-MM-DD format).

First name of a natural person.

The Redress Control Number is the record identifier for people who apply for redress through the DHS Travel Redress Inquiry Program (DHS TRIP). DHS TRIP is for travelers who have been repeatedly identified for additional screening and who want to file an inquiry to have erroneous information corrected in DHS systems.

The gender of a natural person.

The expiration date of a passport.

A description of the person or identity.

The country in which the passport was issued.

The nationality of a natural person.

The passport number of a natural person.

Middle name of a natural person

MSISDN (pronounced as /'em es ai es di en/ or misden) is a number uniquely identifying a subscription in a GSM or a UMTS mobile network. Simply put, it is the mapping of the telephone number to the SIM card in a mobile/cellular phone. This abbreviation has a several interpretations, the most common one being Mobile Station International Subscriber Directory Number.

Globally Unique MME Identifier (GUMMEI) is composed from MCC, MNC and MME Identifier (MMEI).

A description of the phone.

A usually unique International Mobile Subscriber Identity (IMSI) is allocated to each mobile subscriber in the GSM/UMTS/EPS system. IMSI can also refer to International Mobile Station Identity in the ITU nomenclature.

Globally Unique Temporary UE Identity (GUTI) is a temporary identification to not reveal the phone (user equipment in 3GPP jargon) composed of GUMMEI and the M-TMSI.

International Mobile Equipment Identity (IMEI) is a number, usually unique, to identify 3GPP and iDEN mobile phones, as well as some satellite phones.

When the phone has been accessible or seen for the first time.

When the phone has been accessible or seen for the last time.

Temporary Mobile Subscriber Identities (TMSI) to visiting mobile subscribers can be allocated.

Serial Number.

Amount of API calls outside of code section (glob var, dynamic API)

Amount of dangling strings (string with a code cross reference, that is not within a function. Radare2 failed to detect that function.)

Ratio: amount of functions per kilobyte of code section

Amount of memory allocations

Graph export in G>raph Modelling Language format

Ratio: amount of referenced strings per kilobyte of code section

Radare2 commit ID used to generate this object

Amount of API calls inside a code section

Total amount of functions in the file.

Amount of calls to GetProcAddress

Amount of callbacks (functions started as thread)

Average size of a callback

Largest callback

Total amount of API calls

Amount of referenced strings

Amount of calls to CreateThread

Description of the r2graphity object

Amount of API calls not ending in a function (Radare2 bug, probalby)

Shortest path to the first time the binary calls CreateThread

Amount of API call reference that does not resolve to a function offset

Amount of not referenced strings

Ratio: amount of API calls per kilobyte of code section

Name of the registry key

Last time the registry key has been modified

Registry value type

Hive used to store the registry key (file on disk)

Data stored in the registry key

Full key path

Raw document from the consensus.

router’s nickname.

When the Tor node designed by the IP address has been seen for the first time.

When the Tor node designed by the IP address has been seen for the last time.

list of flag associated with the node.

Tor node description.

parsed version of tor, this is None if the relay’s using a new versioning scheme.

Tor node comment.

router’s publication time. This can be different from first-seen and last-seen.

versioning information reported by the node.

router’s fingerprint.

IP address of the Tor node seen.

Full URL

Scheme

Subdomain

Fragment identifier is a short string of characters that refers to a resource that is subordinate to another, primary resource.

First time this URL has been seen

Query (after path, preceded by '?')

Full hostname

Top-Level Domain

Port number

Last time this URL has been seen

Description of the URL

Domain without Top-Level Domain

Credential (username, password)

Full domain

Path (between hostname:port and query)

Description of the vulnerability

Vulnerability ID (generally CVE, but not necessarely)

Last modification date

External references

Summary of the vulnerability

The vulnerable configuration is described in CPE format

Initial publication date

Expiration of the whois entry

Last update of the whois entry

Registrant name

Registrant email address

Registrant phone number

Full whois entry

Initial creation of the whois entry

Domain of the whois entry

Registar of the whois entry

Exponent of the public key

Algorithm of the public key

Version of the certificate

Certificate invalid after that date

[Insecure] Secure Hash Algorithm 1 (160 bits)

Modulus of the public key

Issuer of the certificate

[Insecure] MD5 hash (128 bits)

Serial number of the certificate

Secure Hash Algorithm 2 (256 bits)

Free text description of hte certificate

Subject of the certificate

Raw certificate base64 encoded

Length of the public key (in bits)

Certificate invalid before that date

Yara rule generated from -y.

yabin.py and regex.txt version used for the generation of the yara rules.

Whitelist name used to generate the rules.

Wide yara rule generated from -yh.

A description of Yara rule generated.