MISP Objects

The AIL sensor uuid where the leak was processed and analysed.

When the leak has been accessible or seen for the first time.

When the leak has been accessible or seen for the last time.

Type of information leak as discovered and classified by an AIL module.

When the information available in the leak was created. It’s usually before the first-seen.

A description of the leak which could include the potential victim(s) or description of the leak.

The link where the leak is (or was) accessible at first-seen.

Value of the cookie (if splitted)

Type of cookie and how it’s used in this specific object.

Name of the cookie (if splitted)

A description of the cookie.

Full cookie

Initial date of validity or issued date.

Maximum date of validity

A description of the card.

credit-card number as encoded on the card.

yabin.py and regex.txt version used for the generation of the yara rules.

Card security code as embossed or printed on the card.

Name of the card owner.

Protocol used for the attack

Beginning of the attack

Packets per second

Bits per second

Destination ID (victim)

IP address originating the attack

End of the attack

Destination port of the attack

Description of the DDoS

Port originating the attack

IP Address

Domain name

First time the tuple has been seen

A description of the tuple

Last time the tuple has been seen

Architecture of the ELF file

Address of the entry point

Header operating system application binary interface (ABI)

Type of ELF

Free text value to attach to the ELF

Number of sections

Secure Hash Algorithm 2 (256 bits)

Secure Hash Algorithm 2 (384 bits)

Size of the section, in bytes

Secure Hash Algorithm 2 (512 bits)

[Insecure] Secure Hash Algorithm 1 (160 bits)

[Insecure] MD5 hash (128 bits)

Entropy of the whole section

Type of the section

Fuzzy hash using context triggered piecewise hashes (CTPH)

Name of the section

Secure Hash Algorithm 2 (256 bits)

Secure Hash Algorithm 2 (224 bits)

Secure Hash Algorithm 2 (224 bits)

Flag of the section

Free text value to attach to the section

Subject

Full headers

Email address the reply will be sent to

Identifies a particular conversation thread

Display name of the sender

Display name of the receiver

Date the email has been sent

Attachment

Message ID

Destination email address

Sender email address

MIME Boundary

X-Mailer generally tells the program that was used to draft and send the original email

Secure Hash Algorithm 2 (256 bits)

Secure Hash Algorithm 2 (384 bits)

Size of the file, in bytes

Secure Hash Algorithm 2 (512 bits)

[Insecure] Secure Hash Algorithm 1 (160 bits)

Pattern that can be found in the file

[Insecure] MD5 hash (128 bits)

Entropy of the whole file

The file itself (binary)

Fuzzy hash using context triggered piecewise hashes (CTPH)

Secure Hash Algorithm 2 (256 bits)

Authenticode executable signature hash

Secure Hash Algorithm 2 (224 bits)

Secure Hash Algorithm 2 (224 bits)

Fuzzy hash by Trend Micro: Locality Sensitive Hash

Mime type

Free text value to attach to the file

Filename on disk

The latitude is the decimal value of the latitude in the World Geodetic System 84 (WGS84) reference.

When the location was seen for the first time.

Region.

The altitude is the decimal value of the altitude in the World Geodetic System 84 (WGS84) reference.

City.

Country.

The longitude is the decimal value of the longitude in the World Geodetic System 84 (WGS84) reference

A generic description of the location.

When the location was seen for the last time.

HTTP Basic Authentication Password

HTTP Proxy Password

HTTP Basic Authentication Username

HTTP Method invoked (one of GET, POST, PUT, HEAD, DELETE, OPTIONS, CONNECT)

Full HTTP Request URL

HTTP Proxy Username

The MIME type of the body of the request

Request URI

The domain name of the server

The user agent string of the user agent

An HTTP cookie previously sent by the server with Set-Cookie

This is the address of the previous web page from which a link to the currently requested page was followed

HTTP Request comment

IP Address

First time the tuple has been seen

Last time the tuple has been seen

Destination port

Description of the tuple

Source port

Binary’s name

Number of sections

Type of Mach-O

Free text value to attach to the Mach-O file

Address of the entry point

Secure Hash Algorithm 2 (256 bits)

Secure Hash Algorithm 2 (384 bits)

Size of the section, in bytes

Secure Hash Algorithm 2 (512 bits)

[Insecure] Secure Hash Algorithm 1 (160 bits)

[Insecure] MD5 hash (128 bits)

Entropy of the whole section

Fuzzy hash using context triggered piecewise hashes (CTPH)

Name of the section

Secure Hash Algorithm 2 (256 bits)

Secure Hash Algorithm 2 (224 bits)

Secure Hash Algorithm 2 (224 bits)

Free text value to attach to the section

First time that the unique tuple (rrname, rrtype, rdata) has been seen by the passive DNS

Sensor information where the record was seen

First time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import

Best estimate of the apex of the zone where this data is authoritative

Resource records of the queried resource

Last time that the unique tuple (rrname, rrtype, rdata) record has been seen by the passive DNS

Last time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import

Resource Record type as seen by the passive DNS

Resource Record name of the queried resource

How many authoritative DNS answers were received at the Passive DNS Server’s collectors with exactly the given set of values as answers

Origin of the Passive DNS response

Fuzzy Hash (ssdeep) calculated from the import table

OriginalFilename in the resources

Compilation timestamp defined in the PE header

Lang ID in the resources

Hash of the structural information about a sample. See https://www.usenix.org/legacy/event/leet09/tech/full_papers/wicherski/wicherski_html/

FileVersion in the resources

Hash (md5) calculated from the import table

Type of PE

CompanyName in the resources

Address of the entry point

FileDescription in the resources

InternalFilename in the resources

LegalCopyright in the resources

ProductName in the resources

Name of the section and position of the section in the PE

ProductVersion in the resources

Free text value to attach to the PE

Number of sections

Secure Hash Algorithm 2 (256 bits)

Secure Hash Algorithm 2 (384 bits)

Size of the section, in bytes

Secure Hash Algorithm 2 (512 bits)

[Insecure] Secure Hash Algorithm 1 (160 bits)

[Insecure] MD5 hash (128 bits)

Entropy of the whole section

Fuzzy hash using context triggered piecewise hashes (CTPH)

Name of the section

Characteristic of the section

Secure Hash Algorithm 2 (256 bits)

Secure Hash Algorithm 2 (224 bits)

Secure Hash Algorithm 2 (224 bits)

Free text value to attach to the section

Globally Unique MME Identifier (GUMMEI) is composed from MCC, MNC and MME Identifier (MMEI).

MSISDN (pronounced as /'em es ai es di en/ or misden) is a number uniquely identifying a subscription in a GSM or a UMTS mobile network. Simply put, it is the mapping of the telephone number to the SIM card in a mobile/cellular phone. This abbreviation has a several interpretations, the most common one being Mobile Station International Subscriber Directory Number.

Serial Number.

A usually unique International Mobile Subscriber Identity (IMSI) is allocated to each mobile subscriber in the GSM/UMTS/EPS system. IMSI can also refer to International Mobile Station Identity in the ITU nomenclature.

Temporary Mobile Subscriber Identities (TMSI) to visiting mobile subscribers can be allocated.

When the phone has been accessible or seen for the first time.

Globally Unique Temporary UE Identity (GUTI) is a temporary identification to not reveal the phone (user equipment in 3GPP jargon) composed of GUMMEI and the M-TMSI.

International Mobile Equipment Identity (IMEI) is a number, usually unique, to identify 3GPP and iDEN mobile phones, as well as some satellite phones.

A description of the phone.

When the phone has been accessible or seen for the last time.

Amount of calls to CreateThread

Amount of dangling strings (string with a code cross reference, that is not within a function. Radare2 failed to detect that function.)

Amount of referenced strings

Amount of memory allocations

Amount of API call reference that does not resolve to a function offset

Radare2 commit ID used to generate this object

Ratio: amount of API calls per kilobyte of code section

Description of the r2graphity object

Amount of calls to GetProcAddress

Average size of a callback

Amount of API calls inside a code section

Amount of not referenced strings

Amount of callbacks (functions started as thread)

Ratio: amount of functions per kilobyte of code section

Largest callback

Amount of API calls not ending in a function (Radare2 bug, probalby)

Ratio: amount of referenced strings per kilobyte of code section

Graph export in G>raph Modelling Language format

Amount of API calls outside of code section (glob var, dynamic API)

Shortest path to the first time the binary calls CreateThread

Total amount of functions in the file.

Total amount of API calls

Hive used to store the registry key (file on disk)

Registry value type

Data stored in the registry key

Full key path

Last time the registry key has been modified

Name of the registry key

router’s nickname.

parsed version of tor, this is None if the relay’s using a new versioning scheme.

Raw document from the consensus.

router’s fingerprint.

list of flag associated with the node.

When the Tor node designed by the IP address has been seen for the first time.

versioning information reported by the node.

Tor node description.

router’s publication time. This can be different from first-seen and last-seen.

IP address of the Tor node seen.

Tor node comment.

When the Tor node designed by the IP address has been seen for the last time.

Subdomain

Fragment identifier is a short string of characters that refers to a resource that is subordinate to another, primary resource.

Credential (username, password)

Path (between hostname:port and query)

Query (after path, preceded by '?')

Port number

Full hostname

First time this URL has been seen

Domain without Top-Level Domain

Full URL

Full domain

Last time this URL has been seen

Top-Level Domain

Description of the URL

Scheme

Last modification date

Initial publication date

Vulnerability ID (generally CVE, but not necessarely)

External references

The vulnerable configuration is described in CPE format

Description of the vulnerability

Summary of the vulnerability

Registrant email address

Registrant name

Registrant phone number

Expiration of the whois entry

Domain of the whois entry

Registar of the whois entry

Last update of the whois entry

Full whois entry

Initial creation of the whois entry

Subject of the certificate

[Insecure] MD5 hash (128 bits)

Version of the certificate

Exponent of the public key

Length of the public key (in bits)

Secure Hash Algorithm 2 (256 bits)

Serial number of the certificate

Issuer of the certificate

Certificate invalid after that date

Raw certificate base64 encoded

Algorithm of the public key

Modulus of the public key

[Insecure] Secure Hash Algorithm 1 (160 bits)

Certificate invalid before that date

Free text description of hte certificate

Yara rule generated from -y.

Whitelist name used to generate the rules.

Wide yara rule generated from -yh.

yabin.py and regex.txt version used for the generation of the yara rules.

A description of Yara rule generated.