MISP Objects

When the information available in the leak was created. It’s usually before the first-seen.

The link where the leak is (or was) accessible at first-seen.

A description of the leak which could include the potential victim(s) or description of the leak.

Type of information leak as discovered and classified by an AIL module.

When the leak has been accessible or seen for the first time.

The AIL sensor uuid where the leak was processed and analysed.

When the leak has been accessible or seen for the last time.

Type of cookie and how it’s used in this specific object.

Value of the cookie (if splitted)

Name of the cookie (if splitted)

A description of the cookie.

Full cookie

Packets per second

Description of the DDoS

Destination port of the attack

Port originating the attack

Protocol used for the attack

End of the attack

Beginning of the attack

IP address originating the attack

Bits per second

Destination ID (victim)

Domain name

First time the tuple has been seen

IP Address

A description of the tuple

Last time the tuple has been seen

Header operating system application binary interface (ABI)

Number of sections

Free text value to attach to the ELF

Type of ELF

Address of the entry point

Architecture of the ELF file

Secure Hash Algorithm 2 (384 bits)

Secure Hash Algorithm 2 (224 bits)

Name of the section

Secure Hash Algorithm 2 (256 bits)

Type of the section

Fuzzy hash using context triggered piecewise hashes (CTPH)

Entropy of the whole section

Secure Hash Algorithm 2 (224 bits)

[Insecure] Secure Hash Algorithm 1 (160 bits)

Secure Hash Algorithm 2 (512 bits)

Secure Hash Algorithm 2 (256 bits)

Free text value to attach to the section

[Insecure] MD5 hash (128 bits)

Size of the section, in bytes

Flag of the section

X-Mailer generally tells the program that was used to draft and send the original email

Message ID

Display name of the sender

Identifies a particular conversation thread

Date the email has been sent

Subject

Destination email address

Email address the reply will be sent to

Full headers

Attachment

MIME Boundary

Sender email address

Display name of the receiver

Secure Hash Algorithm 2 (384 bits)

Secure Hash Algorithm 2 (224 bits)

Fuzzy hash by Trend Micro: Locality Sensitive Hash

Secure Hash Algorithm 2 (256 bits)

Fuzzy hash using context triggered piecewise hashes (CTPH)

Entropy of the whole file

Pattern that can be found in the file

Secure Hash Algorithm 2 (224 bits)

The file itself (binary)

[Insecure] Secure Hash Algorithm 1 (160 bits)

Secure Hash Algorithm 2 (512 bits)

Secure Hash Algorithm 2 (256 bits)

Free text value to attach to the file

[Insecure] MD5 hash (128 bits)

Size of the file, in bytes

Filename on disk

Authenticode executable signature hash

Mime type

The longitude is the decimal value of the longitude in the World Geodetic System 84 (WGS84) reference

Region.

The latitude is the decimal value of the latitude in the World Geodetic System 84 (WGS84) reference.

A generic description of the location.

When the location was seen for the first time.

City.

The altitude is the decimal value of the altitude in the World Geodetic System 84 (WGS84) reference.

Country.

When the location was seen for the last time.

The user agent string of the user agent

The domain name of the server

HTTP Proxy Username

The MIME type of the body of the request

Full HTTP Request URL

HTTP Proxy Password

This is the address of the previous web page from which a link to the currently requested page was followed

HTTP Method invoked (one of GET, POST, PUT, HEAD, DELETE, OPTIONS, CONNECT)

An HTTP cookie previously sent by the server with Set-Cookie

HTTP Basic Authentication Password

Request URI

HTTP Request comment

HTTP Basic Authentication Username

Description of the tuple

Destination port

Source port

First time the tuple has been seen

IP Address

Last time the tuple has been seen

Number of sections

Binary’s name

Address of the entry point

Free text value to attach to the Mach-O file

Type of Mach-O

Secure Hash Algorithm 2 (384 bits)

Secure Hash Algorithm 2 (224 bits)

Name of the section

Secure Hash Algorithm 2 (256 bits)

Fuzzy hash using context triggered piecewise hashes (CTPH)

Entropy of the whole section

Secure Hash Algorithm 2 (224 bits)

[Insecure] Secure Hash Algorithm 1 (160 bits)

Secure Hash Algorithm 2 (512 bits)

Secure Hash Algorithm 2 (256 bits)

Free text value to attach to the section

[Insecure] MD5 hash (128 bits)

Size of the section, in bytes

Last time that the unique tuple (rrname, rrtype, rdata) record has been seen by the passive DNS

Resource Record type as seen by the passive DNS

Origin of the Passive DNS response

Resource Record name of the queried resource

Sensor information where the record was seen

Resource records of the queried resource

Last time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import

First time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import

First time that the unique tuple (rrname, rrtype, rdata) has been seen by the passive DNS

How many authoritative DNS answers were received at the Passive DNS Server’s collectors with exactly the given set of values as answers

Best estimate of the apex of the zone where this data is authoritative

CompanyName in the resources

FileDescription in the resources

InternalFilename in the resources

ProductVersion in the resources

Lang ID in the resources

Type of PE

OriginalFilename in the resources

Address of the entry point

Fuzzy Hash (ssdeep) calculated from the import table

Number of sections

Hash (md5) calculated from the import table

LegalCopyright in the resources

Free text value to attach to the PE

Hash of the structural information about a sample. See https://www.usenix.org/legacy/event/leet09/tech/full_papers/wicherski/wicherski_html/

Name of the section and position of the section in the PE

Compilation timestamp defined in the PE header

FileVersion in the resources

ProductName in the resources

Secure Hash Algorithm 2 (384 bits)

Secure Hash Algorithm 2 (224 bits)

Name of the section

Secure Hash Algorithm 2 (256 bits)

Fuzzy hash using context triggered piecewise hashes (CTPH)

Characteristic of the section

Entropy of the whole section

Secure Hash Algorithm 2 (224 bits)

[Insecure] Secure Hash Algorithm 1 (160 bits)

Secure Hash Algorithm 2 (512 bits)

Secure Hash Algorithm 2 (256 bits)

Free text value to attach to the section

[Insecure] MD5 hash (128 bits)

Size of the section, in bytes

A usually unique International Mobile Subscriber Identity (IMSI) is allocated to each mobile subscriber in the GSM/UMTS/EPS system. IMSI can also refer to International Mobile Station Identity in the ITU nomenclature.

Temporary Mobile Subscriber Identities (TMSI) to visiting mobile subscribers can be allocated.

A description of the phone.

When the phone has been accessible or seen for the first time.

Globally Unique Temporary UE Identity (GUTI) is a temporary identification to not reveal the phone (user equipment in 3GPP jargon) composed of GUMMEI and the M-TMSI.

International Mobile Equipment Identity (IMEI) is a number, usually unique, to identify 3GPP and iDEN mobile phones, as well as some satellite phones.

Globally Unique MME Identifier (GUMMEI) is composed from MCC, MNC and MME Identifier (MMEI).

MSISDN (pronounced as /'em es ai es di en/ or misden) is a number uniquely identifying a subscription in a GSM or a UMTS mobile network. Simply put, it is the mapping of the telephone number to the SIM card in a mobile/cellular phone. This abbreviation has a several interpretations, the most common one being Mobile Station International Subscriber Directory Number.

Serial Number.

When the phone has been accessible or seen for the last time.

Graph export in G>raph Modelling Language format

Shortest path to the first time the binary calls CreateThread

Amount of callbacks (functions started as thread)

Amount of API call reference that does not resolve to a function offset

Amount of referenced strings

Total amount of API calls

Amount of not referenced strings

Description of the r2graphity object

Ratio: amount of referenced strings per kilobyte of code section

Amount of calls to GetProcAddress

Amount of API calls outside of code section (glob var, dynamic API)

Amount of calls to CreateThread

Total amount of functions in the file.

Amount of memory allocations

Average size of a callback

Amount of API calls inside a code section

Radare2 commit ID used to generate this object

Ratio: amount of API calls per kilobyte of code section

Amount of API calls not ending in a function (Radare2 bug, probalby)

Amount of dangling strings (string with a code cross reference, that is not within a function. Radare2 failed to detect that function.)

Largest callback

Ratio: amount of functions per kilobyte of code section

Name of the registry key

Hive used to store the registry key (file on disk)

Last time the registry key has been modified

Registry value type

Full key path

Data stored in the registry key

router’s nickname.

IP address of the Tor node seen.

parsed version of tor, this is None if the relay’s using a new versioning scheme.

router’s publication time. This can be different from first-seen and last-seen.

router’s fingerprint.

Tor node description.

list of flag associated with the node.

Tor node comment.

When the Tor node designed by the IP address has been seen for the first time.

versioning information reported by the node.

Raw document from the consensus.

When the Tor node designed by the IP address has been seen for the last time.

Full domain

Fragment identifier is a short string of characters that refers to a resource that is subordinate to another, primary resource.

Query (after path, preceded by '?')

Full URL

Port number

Domain without Top-Level Domain

Subdomain

Path (between hostname:port and query)

Credential (username, password)

Description of the URL

First time this URL has been seen

Scheme

Last time this URL has been seen

Full hostname

Top-Level Domain

Summary of the vulnerability

Last modification date

Description of the vulnerability

External references

Vulnerability ID (generally CVE, but not necessarely)

The vulnerable configuration is described in CPE format

Initial publication date

Registar of the whois entry

Initial creation of the whois entry

Registrant name

Domain of the whois entry

Full whois entry

Registrant phone number

Registrant email address

Expiration of the whois entry

Last update of the whois entry

Algorithm of the public key

Exponent of the public key

Free text description of hte certificate

Length of the public key (in bits)

Certificate invalid after that date

Subject of the certificate

Version of the certificate

Serial number of the certificate

Issuer of the certificate

Secure Hash Algorithm 2 (256 bits)

[Insecure] Secure Hash Algorithm 1 (160 bits)

[Insecure] MD5 hash (128 bits)

Certificate invalid before that date

Raw certificate base64 encoded

Modulus of the public key