MISP Objects

A description of the leak which could include the potential victim(s) or description of the leak.

When the information available in the leak was created. It’s usually before the first-seen.

When the leak has been accessible or seen for the first time.

The link where the leak is (or was) accessible at first-seen.

Type of information leak as discovered and classified by an AIL module.

When the leak has been accessible or seen for the last time.

The AIL sensor uuid where the leak was processed and analysed.

A description of the cookie.

Name of the cookie (if splitted)

Value of the cookie (if splitted)

Type of cookie and how it’s used in this specific object.

Full cookie

yabin.py and regex.txt version used for the generation of the yara rules.

Maximum date of validity

Card security code as embossed or printed on the card.

credit-card number as encoded on the card.

A description of the card.

Name of the card owner.

Initial date of validity or issued date.

Description of the DDoS

Destination ID (victim)

Beginning of the attack

Protocol used for the attack

IP address originating the attack

Port originating the attack

Bits per second

Destination port of the attack

Packets per second

End of the attack

A description of the tuple

Last time the tuple has been seen

First time the tuple has been seen

IP Address

Domain name

Header operating system application binary interface (ABI)

Free text value to attach to the ELF

Address of the entry point

Type of ELF

Number of sections

Architecture of the ELF file

Flag of the section

Secure Hash Algorithm 2 (256 bits)

Type of the section

Fuzzy hash using context triggered piecewise hashes (CTPH)

[Insecure] MD5 hash (128 bits)

Name of the section

Secure Hash Algorithm 2 (512 bits)

Size of the section, in bytes

Entropy of the whole section

Free text value to attach to the section

Secure Hash Algorithm 2 (384 bits)

Secure Hash Algorithm 2 (224 bits)

[Insecure] Secure Hash Algorithm 1 (160 bits)

Secure Hash Algorithm 2 (224 bits)

Secure Hash Algorithm 2 (256 bits)

Full headers

Attachment

Display name of the sender

Identifies a particular conversation thread

Destination email address

X-Mailer generally tells the program that was used to draft and send the original email

MIME Boundary

Date the email has been sent

Display name of the receiver

Subject

Message ID

Sender email address

Email address the reply will be sent to

Secure Hash Algorithm 2 (256 bits)

Fuzzy hash using context triggered piecewise hashes (CTPH)

The file itself (binary)

[Insecure] MD5 hash (128 bits)

Filename on disk

Secure Hash Algorithm 2 (512 bits)

Size of the file, in bytes

Entropy of the whole file

Free text value to attach to the file

Authenticode executable signature hash

Fuzzy hash by Trend Micro: Locality Sensitive Hash

Mime type

Secure Hash Algorithm 2 (384 bits)

Secure Hash Algorithm 2 (224 bits)

[Insecure] Secure Hash Algorithm 1 (160 bits)

Secure Hash Algorithm 2 (224 bits)

Secure Hash Algorithm 2 (256 bits)

Pattern that can be found in the file

When the location was seen for the last time.

A generic description of the location.

The latitude is the decimal value of the latitude in the World Geodetic System 84 (WGS84) reference.

Region.

Country.

The longitude is the decimal value of the longitude in the World Geodetic System 84 (WGS84) reference

When the location was seen for the first time.

City.

The altitude is the decimal value of the altitude in the World Geodetic System 84 (WGS84) reference.

The domain name of the server

Request URI

Full HTTP Request URL

This is the address of the previous web page from which a link to the currently requested page was followed

HTTP Basic Authentication Password

The user agent string of the user agent

An HTTP cookie previously sent by the server with Set-Cookie

HTTP Request comment

HTTP Basic Authentication Username

HTTP Proxy Password

HTTP Method invoked (one of GET, POST, PUT, HEAD, DELETE, OPTIONS, CONNECT)

The MIME type of the body of the request

HTTP Proxy Username

Description of the tuple

Last time the tuple has been seen

First time the tuple has been seen

Source port

Destination port

IP Address

Number of sections

Free text value to attach to the Mach-O file

Address of the entry point

Binary’s name

Type of Mach-O

Secure Hash Algorithm 2 (256 bits)

Fuzzy hash using context triggered piecewise hashes (CTPH)

[Insecure] MD5 hash (128 bits)

Name of the section

Secure Hash Algorithm 2 (512 bits)

Size of the section, in bytes

Entropy of the whole section

Free text value to attach to the section

Secure Hash Algorithm 2 (384 bits)

Secure Hash Algorithm 2 (224 bits)

[Insecure] Secure Hash Algorithm 1 (160 bits)

Secure Hash Algorithm 2 (224 bits)

Secure Hash Algorithm 2 (256 bits)

Best estimate of the apex of the zone where this data is authoritative

Last time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import

First time that the unique tuple (rrname, rrtype, rdata) has been seen by the passive DNS

Origin of the Passive DNS response

Sensor information where the record was seen

Resource Record type as seen by the passive DNS

Last time that the unique tuple (rrname, rrtype, rdata) record has been seen by the passive DNS

Resource records of the queried resource

How many authoritative DNS answers were received at the Passive DNS Server’s collectors with exactly the given set of values as answers

Resource Record name of the queried resource

First time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import

Address of the entry point

ProductName in the resources

Type of PE

FileVersion in the resources

ProductVersion in the resources

LegalCopyright in the resources

CompanyName in the resources

Hash (md5) calculated from the import table

Lang ID in the resources

Fuzzy Hash (ssdeep) calculated from the import table

Free text value to attach to the PE

FileDescription in the resources

OriginalFilename in the resources

InternalFilename in the resources

Hash of the structural information about a sample. See https://www.usenix.org/legacy/event/leet09/tech/full_papers/wicherski/wicherski_html/

Compilation timestamp defined in the PE header

Number of sections

Name of the section and position of the section in the PE

Secure Hash Algorithm 2 (256 bits)

Fuzzy hash using context triggered piecewise hashes (CTPH)

[Insecure] MD5 hash (128 bits)

Name of the section

Secure Hash Algorithm 2 (512 bits)

Size of the section, in bytes

Entropy of the whole section

Free text value to attach to the section

Characteristic of the section

Secure Hash Algorithm 2 (384 bits)

Secure Hash Algorithm 2 (224 bits)

[Insecure] Secure Hash Algorithm 1 (160 bits)

Secure Hash Algorithm 2 (224 bits)

Secure Hash Algorithm 2 (256 bits)

A description of the phone.

MSISDN (pronounced as /'em es ai es di en/ or misden) is a number uniquely identifying a subscription in a GSM or a UMTS mobile network. Simply put, it is the mapping of the telephone number to the SIM card in a mobile/cellular phone. This abbreviation has a several interpretations, the most common one being Mobile Station International Subscriber Directory Number.

When the phone has been accessible or seen for the last time.

International Mobile Equipment Identity (IMEI) is a number, usually unique, to identify 3GPP and iDEN mobile phones, as well as some satellite phones.

Serial Number.

When the phone has been accessible or seen for the first time.

Globally Unique Temporary UE Identity (GUTI) is a temporary identification to not reveal the phone (user equipment in 3GPP jargon) composed of GUMMEI and the M-TMSI.

Globally Unique MME Identifier (GUMMEI) is composed from MCC, MNC and MME Identifier (MMEI).

A usually unique International Mobile Subscriber Identity (IMSI) is allocated to each mobile subscriber in the GSM/UMTS/EPS system. IMSI can also refer to International Mobile Station Identity in the ITU nomenclature.

Temporary Mobile Subscriber Identities (TMSI) to visiting mobile subscribers can be allocated.

Amount of API calls outside of code section (glob var, dynamic API)

Amount of memory allocations

Ratio: amount of referenced strings per kilobyte of code section

Amount of calls to CreateThread

Largest callback

Radare2 commit ID used to generate this object

Shortest path to the first time the binary calls CreateThread

Amount of callbacks (functions started as thread)

Amount of not referenced strings

Amount of calls to GetProcAddress

Ratio: amount of functions per kilobyte of code section

Ratio: amount of API calls per kilobyte of code section

Amount of API calls not ending in a function (Radare2 bug, probalby)

Amount of referenced strings

Description of the r2graphity object

Average size of a callback

Amount of dangling strings (string with a code cross reference, that is not within a function. Radare2 failed to detect that function.)

Amount of API call reference that does not resolve to a function offset

Total amount of functions in the file.

Total amount of API calls

Amount of API calls inside a code section

Graph export in G>raph Modelling Language format

Hive used to store the registry key (file on disk)

Last time the registry key has been modified

Registry value type

Full key path

Name of the registry key

Data stored in the registry key

Tor node comment.

When the Tor node designed by the IP address has been seen for the last time.

parsed version of tor, this is None if the relay’s using a new versioning scheme.

Raw document from the consensus.

list of flag associated with the node.

versioning information reported by the node.

Tor node description.

router’s nickname.

IP address of the Tor node seen.

router’s fingerprint.

router’s publication time. This can be different from first-seen and last-seen.

When the Tor node designed by the IP address has been seen for the first time.

Full domain

Credential (username, password)

Last time this URL has been seen

Full URL

Fragment identifier is a short string of characters that refers to a resource that is subordinate to another, primary resource.

Subdomain

Full hostname

Description of the URL

Path (between hostname:port and query)

Query (after path, preceded by '?')

Top-Level Domain

Port number

First time this URL has been seen

Domain without Top-Level Domain

Scheme

Description of the vulnerability

External references

Vulnerability ID (generally CVE, but not necessarely)

Initial publication date

Last modification date

Summary of the vulnerability

The vulnerable configuration is described in CPE format

Full whois entry

Registrant email address

Domain of the whois entry

Last update of the whois entry

Registrant phone number

Expiration of the whois entry

Registrant name

Registar of the whois entry

Initial creation of the whois entry

Length of the public key (in bits)

Issuer of the certificate

Raw certificate base64 encoded

Modulus of the public key

[Insecure] Secure Hash Algorithm 1 (160 bits)

Serial number of the certificate

Exponent of the public key

Free text description of hte certificate

Algorithm of the public key

Certificate invalid after that date

Subject of the certificate

Certificate invalid before that date

Secure Hash Algorithm 2 (256 bits)

[Insecure] MD5 hash (128 bits)

Version of the certificate

Yara rule generated from -y.

Whitelist name used to generate the rules.

A description of Yara rule generated.

yabin.py and regex.txt version used for the generation of the yara rules.

Wide yara rule generated from -yh.