spam

Spam or ‘unsolicited bulk e-mail’, meaning that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having identical content.

Harmful Speech

Discretization or discrimination of somebody (e.g. cyber stalking, racism and threats against one or more individuals) May be found on a forum, email, tweet etc…

Child/Sexual/Violence/…​

Any Child pornography, glorification of violence, may be found on a website, forum, email, tweet etc…

Virus

Malicious code that replicate itself and infects the computer and files;

Worm

Malware that self-replicates and spread itself to other computers in the network without any user interaction;

Ransomware

Ransomware is a type of malicious software from cryptovirology that blocks access to the victim’s data or threatens to publish it until a ransom is paid.

Trojan/Malware

This category regroups many common malware types (Banking, POS, Mining malware).

Spyware/Rat

This category regroups malware types and tools that may have a bigger impact on the breached infrastructure and usually need further investigations (Common Spyware/Rat, State sponsored malwares, StealersHacking tool).

Dialer

Computer program used to identify the phone numbers that can successfully make a connection with a computer modem. Use this category to classify overpriced SMS sent by malicious mobile application.

Rootkit

Malware, which alter the standard functionality of an operating system in order to do its malicious actions in a stealthy way. In practice, Rootkits hijacks systems functions in order to alter the returning values to hide themselves from simple analysis tools.

Scanning

Attacks that send requests to a system to discover weak points. This also includes some kinds of testing processes to gather information about hosts, services and accounts. Examples: fingerd, DNS querying, ICMP, SMTP (EXPN, RCPT,).

Sniffing

Observing and recording network traffic (wiretapping).

Social Engineering

Gathering information from a human being in a non-technical way (eg, lies, tricks, bribes, or threats).

Exploiting known vulnerabilities

An attempt to compromise a system or to disrupt any service by exploiting vulnerabilities with a standardised identifier such as CVE name (eg, buffer overflow, backdoors, cross side scripting, etc).

Login attempts

Multiple login attempts (guessing / cracking of passwords, brute force).

New attack signature

An attempt using an unknown exploit.

Privileged Account Compromise

A successful full compromise of a system or application (service). This can have been caused remotely by a known or new vulnerability, but also by an unauthorized local access.

Unprivileged Account Compromise

A successful compromise of a system or application (service). This can have been caused remotely by a known or new vulnerability, but also by an unauthorized local access. The intruded did not achieve to escale his privileges locally.

Botnet member

The compromised asset is also being part of a botnet. This is reserved mainly for public web servers. See malicious code in priority for workstations or internal server’s compromise. For example, phpmailer, etc…

Domain Compromise

The whole domain is compromised; this is commonly used for active directory and detected by a “pass the ticket” attack or a discovery of “ad dumps” files.

Application Compromise

An application is compromised; the attacker possess an uncontrolled access to data, server, and assets used by this application (CMDB, DB, Backend services, etc.).

DoS

An attacker attempts to prevent legitimate users from accessing information or services.

DDoS

Form of electronic attack involving multiple computers, which send repeated requests (HTTP requests, pings, TCP or UDP Flood) to a server to load it down and render the service inaccessible for a period of time.

Sabotage

Deliberate and malicious acts that result in the disruption of the normal processes and functions or the destruction or damage of equipment or information.

Outage (no malice)

Unavailability of the system but done with no malice.

Unauthorised access to information

Any access to unauthorized data. It may be access of data on improperly restricted server share or database exfiltered by using a SQLi.

Unauthorised modification of information

Unauthorized tampering of data on files, documents or database.

Copyright

Selling or installing copies of unlicensed commercial software or other copyright protected materials (Warez).

Masquerade

Types of attacks in which one entity illegitimately assumes the identity of another in order to benefit from it. This attack may be used for president fraud requesting transactions.

Phishing

Masquerading as another entity in order to persuade the user to reveal a private credential.

Open for abuse

Open resolvers, world readable printers, vulnerability apparent from Nessus etc scans, virus, signatures not up to date, etc. This includes for example default SNMP community or default password on any application.

Regulator

All lack about regulator rules (CSSF, GDPR, etc.).

Standard

All lack about standards certification of the company (ISO27000, NIS, ISAE3402, etc.).

Security policy

All lack about the internal security policy of the company.

Other

All lack that do not fit in one of previous categories should be put on this class.

other

All incidents that do not fit in one of the given categories should be put into this class. If the number of incidents in this category increases, it is an indicator that the classification scheme must be revised.

Goals

If the actor is part of a larger organized operation they may be receiving their goals from a higher level source or handler. Depending on how organized and sophisticated the adversary’s campaigns are, these goals may not even be shared with the operator(s) themselves. In cases of non-targeted threat actors, this may be much less organized or distributed. Goals are nearly impossible to detect (directly) but they’re almost always the toughest question C-level leaders ask about post-breach. "Who was it and why?" These kinds of questions can never truthfully be answered unless you’re operating at Detection Maturity Level 8 against your adversary and can prove reliably that you know what their goals are. Short of that, it’s guessing at what the adversary’s true intentions were based on behavioral observations made at lower DMLs (e.g. data stolen, directories listed, employees or programs targeted, etc). I anticipate less than a handful of organizations truly operate at this level, consistently, against the threat actors they face because it’s nearly impossible to detect based on goals alone.

Strategy

Tactics

To successfully operate at DML-6, one must be able to reliably detect a tactic being employed regardless of the Technique or Procedure used by the adversary, the Tools they chose to use, or the Artifacts and Atomic Indicators left behind as a result of employing the tactic. While this may sound impossible on the surface, it absolutely is possible. In nearly all cases, tactics are not detected directly by a single indicator or artifact serving as the smoking gun, or a single detection signature or analytic technique. Tactics become known only after observation of multiple activities in aggregate, with respect to time and circumstance. As a result, detection of tactics are usually done by skilled analysts, rather than technical correlation or analytics systems.

Techniques

From a maturity perspective, being able to detect an adversary’s techniques is superior to being able to detect their procedures. The primary difference being techniques are specific to an individual. So when respecting this distinction, the ability to detect a specific actor operating within your environment by technique exclusively is an advantage. The best analogy to this is a rifled barrel, which leaves uniquely identifiable characteristics in the side of a bullet. Because of this, ballistics specialists can forensically match a spent round to the exact weapon from which it was fired with a high degree of certainty. Not just any weapon by calibur or model, but the exact weapon used to fire that specific round. Human beings are creatures of habit, and most adversaries aren’t aware of the fact that every time they attack they’re leaving evidence of their personal techniques behind for us to find. The same applies for the tool builders writing the tools these adversaries use. It’s our obligation to find these distinctions and ensure we’re looking for them. It’s personal behavior and habits that are the hardest for humans to change, so put the hurt on your adversaries by finding creative ways to detect their behaviors and habits in your environment.

Procedures

Given today’s detection technology, and readily available correlation and analytics techniques, it’s amazing that more organizations haven’t reached Detection Maturity Level 4 for most of their adversaries. Procedures are one of the most effective ways of detecting adversary activity and can really inflict the most pain against lesser experienced "B-teams". In it’s most simple form, detecting a procedure is as simple as detecting a sequence of two or more of the individual steps employed by the actor. The goal here is to isolate activities that the adversary appears to perform methodically, two or more times during an incident.

Tools

Being able to detect at DML-3 means you can reliably detect the adversary’s tools, regardless of minor functionality changes to the tool, or the Artifacts or Atomic Indicators it may leave behind. Detecting tools falls into two main areas. The first is detecting the transfer and presence of the tool. This includes being able to observe the tool being transferred over the network, being able to locate it sitting at rest on a file system, or being able to identify it loaded in memory. The second, and more important area of tool detection, is detecting the tool reliably by functionality. For example, let’s take a given webshell that has 25 functions. If we want to claim DML-3 level detection for this webshell we have to exercise each of those 25 functions and understand what each of them do. What do they look like at the host, network, and event log level when they are exercised? We then aim to build detections for as many of those 25 functions across those data domains as we possibly can, reliably, balancing false positives and other constraints. The reason behind this is simple, we want to be able to detect this version of the tool and as many future variants of the tool as we can by function that it performs. If the adversary decides to change up 5 of the 25 functions for which we have detections, we’re still detecting the entire tool. In order for the adversary to use this tool completely undetected in our environment, they’ll be forced to change every one of those functions; or at least the ones that we were able to reliably build detections against.

Host & Network Artifacts

DML-2 is where most organizations spend too much of their resources; attempting to collect what they call "threat intelligence" in the form of Host & Network Artifacts. The reality is, these are merely just indicators that are observed either during or after the attack. They’re like symptoms of the flu but not the flu itself. I often use the analogy "chasing the vapor trail" when I think of DML-2 because chasing after Host & Network Artifacts is much like chasing the vapor trail behind an aircraft. We know the enemy aircraft is up there in front of us somewhere, if we just keep chasing this vapor trial we’ll eventually catch up to the aircraft and find our enemy right? Wrong. Having a mature detection and response program means your operating above DML-2 and you’re actually locked onto the aircraft itself. You know how it operates, you know what it’s capabilities are, you know the Tactics, Techniques, and Procedures of it’s pilot and you can almost predict what it’s next moves might be. This is precisely why good Cyber Intelligence Analysts will almost never attribute activity to a specific threat actor, group, or country based on just Host & Network Artifacts alone; they understand this DML concept and realize when they’re likely just staring at the vapor trail. They understand that in reality the vapor trail (indicators) could be from any number of aircraft (tools), with any number of pilots (actors) behind the stick.

Atomic IOCs

These are the atomic particles that make up Host & Network artifacts. If you’re detecting at Detection Maturity Level 1, it means you are probably taking "feeds of intel" from various sharing organizations and vendors in the form of lists, like domains and IP addresses, and feeding them into your detection technologies. Let me be clear on my position here. There are a few, and I mean a very precious few, circumstances where this makes sense and can be done reliably. These are edge cases where specific atomic indicators have a high enough "shelf life" where it makes sense to go ahead and create detection capabilities from them. Examples of this include unique strings found inside a binary, or perhaps an adversary is foolish enough to sit on the same recon, delivery, C2, or exfiltration infrastructure allowing you to detect reliably on their domain names or IP addresses. These might be viable cases where detecting on atomic indicator alone makes sense. Unfortunately, for the remaining 99% of the time, attempting to detect on this kind of data is suboptimal, for a number of reasons.

None or Unknown

For organizations who either don’t operate at DML-1 or higher, or they don’t even know where they operate on this scale, we have Detection Maturity Level - 0. Instead of pointing out all the negative things associated with this level, I’ll take the high road and lend a bit of positive encouragement. Congratulations, you are at ground zero. It can only get better from here.

(PAP:RED) Non-detectable actions only. Recipients may not use PAP:RED information on the network. Only passive actions on logs, that are not detectable from the outside.

(PAP:AMBER) Passive cross check. Recipients may use PAP:AMBER information for conducting online checks, like using services provided by third parties (e.g. VirusTotal), or set up a monitoring honeypot.

(PAP:GREEN) Active actions allowed. Recipients may use PAP:GREEN information to ping the target, block incoming/outgoing traffic from/to the target or specifically configure honeypots to interact with the target.

(PAP:WHITE) No restrictions in using this information.

Anti-Corruption and transparency

The organization campaigns, or takes other actions against corruption and transparency.

Anti-War / Anti-Violence

The organization campaigns, or takes other actions against war

Culture

The organization campaigns or acts to promote cultural events

Economic Change

Issues of economic policy, wealth distribution, etc.

Education

The organization is concerned with some form of education

Election Monitoring

The organization is an election monitor, or involved in election monitoring

Environment

The organization campaigns or acts to protect the environment

Freedom of Expression

The organization is concerned with freedom of speech issues

Freedom Tool Development

The organization develops tools for use in defending or extending digital rights

Funding

Health Issues

The organization prevents epidemic illness or acts on curing them

Human Rights Issues

relating to the detection, recording, exposure, or challenging of abuses of human rights

Internet and Telecoms

Issues of digital rights in electronic communications

LGBT / Gender / Sexuality

Issues relating to the Lesbian, Gay, Bi, Transgender community

Policy

The organization is a policy think-tank, or policy advocate

Politics

The organization takes a strong political view or is a political entity

Privacy

Issues relating to the individual’s reasonable right to privacy

Rapid Response

The organization provides rapid response type capability for civil society

Refugees

Issues relating to displaced people

Security

Issues relating to physical or information security

Women’s Rights

Issues pertaining to inequality between men and women, or issues of particular relevance to women

Youth Rights

Issues of particular relevance to youth

Informed ISP/Hosting Service Provider

Informed Registrar

Informed Registrant

Informed abuse-contact (domain)

Informed abuse-contact (IP)

Informed legal department

Completely reliable

Associated numerical value="100"

Usually reliable

Associated numerical value="75"

Fairly reliable

Associated numerical value="50"

Not usually reliable

Associated numerical value="25"

Unreliable

Reliability cannot be judged

Confirmed by other sources

Associated numerical value="100"

Probably true

Associated numerical value="75"

Possibly true

Associated numerical value="50"

Doubtful

Associated numerical value="25"

Improbable

Truth cannot be judged

Infrastructure ownership and status is unknown

Infrastructure compromised by or in the benefit of the adversary

Infrastructure own and operated by the adversary

Only passive requests shall be performed to avoid detection by the adversary

Take down requests can be performed in order to deactivate the adversary infrastructure

Monitoring requests are ongoing on the adversary infrastructure

Law enforcement requests are ongoing on the adversary infrastructure

Infrastructure state is unknown or cannot be evaluated

Infrastructure state is active and actively used by the adversary

Infrastructure state is known to be down

Infrastructure usage by the adversary is unknown

Infrastructure used as proxy between the target and the adversary

Infrastructure used by the adversary to store information related to his campaigns

Infrastructure used to distribute exploit towards target(s)

Infrastructure used by the adversary as Virtual Private Network to hide activities and reduce the traffic analysis surface

Panel used by the adversary to control or maintain his infrastructure

Traffic Distribution Systems including exploit delivery or/and web monetization channels

WHITE

GREEN

AMBER

EVERYONE

USG

NONE

true

false

Is_Proprietary

Not_Proprietary

Less than 1 year

Associated numerical value="1"

Between 1 and 5 years

Associated numerical value="2"

Between 5 and 10 years

Associated numerical value="3"

Between 10 and 20 years

Associated numerical value="4"

More than 20 years

Associated numerical value="5"

x86-32 & x86-64

ARM & ARM-64

mips & mips-64

PowerPC

Less than 1 year

Associated numerical value="1"

Between 1 and 5 years

Associated numerical value="2"

Between 5 and 10 years

Associated numerical value="3"

Between 10 and 20 years

Associated numerical value="4"

More than 20 years

Associated numerical value="5"

Current Microsoft Windows system

GNU/linux derivative OS

Current IOS

Current Apple OS

Current Android OS

BSD

Inter-protocol exploitations

Common vulnerabilities as SQL injections, CSRF, XSS, CSP bypasses, etc.

De-obfuscation of Javascript payloads

Less than 1 year

Associated numerical value="1"

Between 1 and 5 years

Associated numerical value="2"

Between 5 and 10 years

Associated numerical value="3"

Between 10 and 20 years

Associated numerical value="4"

More than 20 years

Associated numerical value="5"

Less than 1 year

Associated numerical value="1"

Between 1 and 5 years

Associated numerical value="2"

Between 5 and 10 years

Associated numerical value="3"

Between 10 and 20 years

Associated numerical value="4"

More than 20 years

Associated numerical value="5"

Known Good/Safe

Known Bad/Malicious

Not yet known

Spam

System compromise

Scan

Denial of Service

Copyright issue

Phishing

Malware

XSS

Vulnerability

Fastflux

SQL Injection

Information leak

Scam

Cryptojacking

Finance

ICT

Individual

Industry

Medical

Services

Undefined

Request a binary sample

Request a deobfuscated sample of the shared sample

Request additional samples compared to the original analysis to build a competitive analysis on the reversing aspect

Request related samples required for further analysis

Request additional static analysis or reversing on the information shared

Request detection signature from

Request more contextual information

Request an abuse contact to report to

Request more historical information from

Request complementary validation

Request about the target(s) including field of activities or companies

Request further technical or tactical analysis

Request for generic additional information

Denial of service / Distributed Denial of service

Forensics work

Attempted or successful destruction, corruption, or disclosure of sensitive corporate information or Intellectual Property

Compromised host (root account, Trojan, rootkit), network device, application, user account.

Theft / Fraud / Human Safety / Child Porn

Reconnaissance or Suspicious activity originating from inside the Company corporate network, excluding malware

Reconnaissance or Suspicious Activity originating from outside the Company corporate network (partner network, Internet), excluding malware.

A virus or worm typically affecting multiple corporate devices. This does not include compromised hosts that are being actively controlled by an attacker via a backdoor or Trojan.

Spoofed email, SPAM, and other email security-related events.

Security consulting unrelated to any confirmed incident

Violation of various policies

Incident affecting critical systems or information with potential to be revenue or customer impacting.

Incident affecting non-critical systems or information, not revenue or customer impacting. Employee investigations that are time sensitive should typically be classified at this level.

Possible incident, non-critical systems. Incident or employee investigations that are not time sensitive. Long-term investigations involving extensive research and/or detailed forensic work.

Extremely Sensitive

Sensitive

Not Sensitive

Generated within the company during incident/case related investigations or forensic analysis or via malware reversing, validated by humans and highly contextualized.

Generated within the company, validated by a human prior to sharing, data points have been contextualized (to a degree) e.g. IPs are related to C2 or drop site.

Generated within the company by automated means without human interaction e.g., by malware sandbox, honeypots, IDS, etc.

Information gathered by an analyst/incident responder/forensic expert/etc.

Information coming out of honeypots.

Information coming out of sandboxes.

Information coming out of email infrastructure.

Information from outside the company.

If none of the other origins applies.

Origin of the data unknown.

Plan activity

Associated numerical value="10"

Conduct research & analysis

Associated numerical value="11"

Develop resources & capabilities

Associated numerical value="12"

Acquire victim & specific knowledge

Associated numerical value="13"

Complete preparations

Associated numerical value="14"

Deploy capability

Associated numerical value="20"

Interact with intended victim

Associated numerical value="21"

Exploit vulnerabilities

Associated numerical value="22"

Deliver malicious capabilities

Associated numerical value="23"

Establish controlled access

Associated numerical value="30"

Hide

Associated numerical value="31"

Expand presence

Associated numerical value="32"

Refine focus of activity

Associated numerical value="33"

Establish persistence

Associated numerical value="34"

Enable other operations

Associated numerical value="40"

Deny access

Associated numerical value="41"

Extract data

Associated numerical value="42"

Alter data and/or computer, network or system behavior

Associated numerical value="43"

Destroy HW/SW/data

Associated numerical value="44"

Amplification attack

Reflected and Spoofed attack

Slow Read attack

Flooding attack

Large POST HTTP attack

STRENG GEHEIM

Kenntnisnahme durch Unbefugte kann den Bestand oder lebenswichtige Interessen der Bundesrepublik Deutschland oder eines ihrer Länder gefährden.

GEHEIM

Kenntnisnahme durch Unbefugte kann die Sicherheit der Bundesrepublik Deutschland oder eines ihrer Länder gefährden oder ihren Interessen schweren Schaden zufügen.

VS-VERTRAULICH

Kenntnisnahme durch Unbefugte kann für die Interessen der Bundesrepublik Deutschland oder eines ihrer Länder schädlich sein.

VS-NUR FÜR DEN DIENSTGEBRAUCH

Kenntnisnahme durch Unbefugte kann für die Interessen der Bundesrepublik Deutschland oder eines ihrer Länder nachteilig sein.

Dummy

Platzhalter.

Chemical

Commercial Facilities

Communications

Critical Manufacturing

Dams

Defense Industrial Base

Emergency services

energy

Financial Services

Food and Agriculture

Government Facilities

Healthcare and Public Health

Information Technology

Nuclear

Transportation Systems

Water and water systems

An adversary is the actor/organization responsible for utilizing a capability against the victim to achieve their intent.

The capability describes the tools and/or techniques of the adversary used in the event. It includes all means to affect the victim from the most manual “unsophisticated” methods (e.g., manual password guessing) to the most sophisticated automated techniques.

The infrastructure feature describes the physical and/or logical communication structures the adversary uses to deliver a capability, maintain control of capabilities (e.g., commandand-control/C2), and effect results from the victim (e.g., exfiltrate data). As with the other features, the infrastructure can be as specific or broad as necessary. Examples include: Internet Protocol (IP) addresses, domain names, e-mail addresses, Morse code flashes from a phone’s voice-mail light watched from across a street, USB devices found in a parking lot and inserted into a workstation, or the compromising emanations from hardware (e.g., Van Eck Phreaking) being collected by a nearby listening post.

A victim is the target of the adversary and against whom vulnerabilities and exposures are exploited and capabilities used. A victim can be described in whichever way necessary and appropriate: organization, person, target email address, IP address, domain, etc. However, it is useful to define the victim persona and their assets separately as they serve different analytic functions. Victim personae are useful in non-technical analysis such as cyber-victimology and social-political centered approaches whereas victim assets are associated with common technical approaches such as vulnerability analysis..

RESTRICTED

CONFIDENTIAL

SECRET

TOP SECRET

UNCLASSIFIED

CONFIDENTIAL

SECRET

TOP SECRET

UNCLASSIFIED

ENDSEAL

ECRU

NONBOOK

HCS

HCS-O

HCS-P

KLONDIKE

KDK BLUEFISH

KDK IDITAROD

KDK KANDIK

RESERVE

SPECIAL INTELLIGENCE

SI-GAMMA

TALENT KEYHOLE

Document claims compliance with all rules encoded in ISM for documents produced by the US Federal Government. This is the minimum set of rules for US documents to adhere to, and all US documents should claim compliance with USGov.

Document claims compliance with all rules encoded in ISM for documents produced by the US Intelligence Community. Documents that claim compliance with USIC MUST also claim compliance with USGov.

Document claims compliance with all rules encoded in ISM for documents produced by the US Department of Defense. Documents that claim compliance with USDOD MUST also claim compliance with USGov.

Document claims compliance with an authority other than the USGov, USIC, or USDOD.

RESTRICTED DATA

RD-CRITICAL NUCLEAR WEAPON DESIGN INFORMATION

FORMERLY RESTRICTED DATA

DoD CONTROLLED NUCLEAR INFORMATION

DoE CONTROLLED NUCLEAR INFORMATION

TRANSCLASSIFIED FOREIGN NUCLEAR INFORMATION

FISA Warning statement

IMCON Warning statement

Controled Nuclear Weapon Design Information Warning statement

RD Warning statement

FRD Warning statement

LIMDIS caveat

LES Notice

LES-NF Notice

DSEN Notice

DoD Distribution statement A from DoD Directive 5230.24

DoD Distribution statement B from DoD Directive 5230.24

DoD Distribution statement C from DoD Directive 5230.24

DoD Distribution statement D from DoD Directive 5230.24

DoD Distribution statement E from DoD Directive 5230.24

DoD Distribution statement F from DoD Directive 5230.24

DoD Distribution statement X from DoD Directive 5230.24

US Person info Notice

Indicates that an instance document must abide by rules pertaining to ORIGINATOR CONTROLLED data issued prior to Executive Order 13526.

Indicates that the contents of this notice specify the contact information for a required point-of-contact.

COMSEC Notice

NAVAL NUCLEAR PROPULSION INFORMATION

LIMITED DISTRIBUTION

EXCLUSIVE DISTRIBUTION

NO DISTRIBUTION

SENSITIVE BUT UNCLASSIFIED

SENSITIVE BUT UNCLASSIFIED NOFORN

LAW ENFORCEMENT SENSITIVE

LAW ENFORCEMENT SENSITIVE NOFORN

SENSITIVE SECURITY INFORMATION

NATO Atomal mark

NATO Bohemia mark

NATO Balk mark

RISK SENSITIVE

FOR OFFICIAL USE ONLY

ORIGINATOR CONTROLLED

ORIGINATOR CONTROLLED US GOVERNMENT

CONTROLLED IMAGERY

NOT RELEASABLE TO FOREIGN NATIONALS

CAUTION-PROPRIETARY INFORMATION INVOLVED

AUTHORIZED FOR RELEASE TO

RELEASABLE BY INFORMATION DISCLOSURE OFFICIAL

DEA SENSITIVE

FOREIGN INTELLIGENCE SURVEILLANCE ACT

AUTHORIZED FOR DISPLAY BUT NOT RELEASE TO

Registered & active

Domain name is registered and DNS is delegated

Registered & inactive

Domain name is registered and DNS is not delegated

Registered & suspended

Domain name is registered & DNS delegation is temporarily removed by the registry

Not registered

Domain name is not registered and open for registration

Not registrable

Domain is not registered and cannot be registered

Grace period

Domain is deleted and still reserved for previous owner

Criminal registration

Domain name is registered for criminal purposes

Compromised webserver

Webserver is compromised for criminal purposes

Compromised DNS

Compromised authoritative DNS or compromised delegation

Sinkhole

Domain Name is sinkholed for research, detection, LE

No loss

Less than 25K EUR

Less than 50K EUR

Less than 100K EUR

Less than EUR 1 000 000

No gain

Less than 25K EUR

Less than 50K EUR

Less than 100K EUR

Less than EUR 1 000 000

spam

Or 'Unsolicited Bulk Email', this means that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having a functionally comparable content.

Harmful Speech

Discreditation or discrimination of somebody e.g. cyber stalking, racism and threats against one or more individuals).

Child/Sexual/Violence/…​

Child Pornography, glorification of violence, …​

Virus

Worm

Trojan

Spyware

Dialer

Rootkit

Malware

Botnet drone

Ransomware

Malware configuration

C&C

Scanning

Attacks that send requests to a system to discover weak points. This includes also some kind of testing processes to gather information about hosts, services and accounts. Examples: fingerd, DNS querying, ICMP, SMTP (EXPN, RCPT, …​), port scanning.

Sniffing

Observing and recording of network traffic (wiretapping).

Social Engineering

Gathering information from a human being in a non-technical way (e.g. lies, tricks, bribes, or threats).

Exploiting of known Vulnerabilities

An attempt to compromise a system or to disrupt any service by exploiting vunerabilities with a standardised identifier such as CVE name (e.g. buffer overflow, backdoor, cross site scripting, etc.)

Login attempts

Multiple login attempts (Guessing / cracking of passwords, brute force).

New attack signature

An attempt using an unknown exploit.

Privileged Account Compromise

Unprivileged Account Compromise

Application Compromise

Bot

defacement

compromised

backdoor

DoS

Denial of Service.

DDoS

Distributed Denial of Service.

Sabotage

Sabotage.

Outage (no malice)

Outage (no malice).

Unauthorised access to information

Unauthorised modification of information

dropzone

Unauthorized use of resources

Using resources for unauthorized purposes including profit-making ventures (E.g. the use of e-mail to participate in illegal profit chain letters or pyramid schemes).

Copyright

Offering or Installing copies of unlicensed commercial software or other copyright protected materials (Warez).

Masquerade

Type of attacks in which one entity illegitimately assumes the identity of another in order to benefit from it.

Phishing

Masquerading as another entity in order to persuade the user to reveal a private credential.

Open for abuse

blacklist

unknown

other

Test

Fraud

Fraud committed by humans.

Fraud committed by employees

Fraud committed by employees or others that are in relation with entities, who have access to entities' information and IT assets.

Sabotage

Intentional actions (non-fulfilment or defective fulfilment of personal duties) aimed to cause disruption or damage to IT assets.

Vandalism

Act of physically damaging IT assets.

Theft (of devices, storage media and documents)

Stealing information or IT assets. Robbery.

Theft of mobile devices (smartphones/ tablets)

Taking away another person’s property in the form of mobile devices, for example smartphones, tablets.

Theft of fixed hardware

Taking away another person’s hardware property (except mobile devices), which often contains business-sensitive data.

Theft of documents

Stealing documents from private/company archives, often for the purpose of re-sale or to achieve personal benefits.

Theft of backups

Stealing media devices, on which copies of essential information are kept.

Information leak /sharing

Sharing information with unauthorised entities. Loss of information confidentiality due to intentional human actions (e.g., information leak may occur due to loss of paper copies of confidential information).

Unauthorized physical access / Unauthorised entry to premises

Unapproved access to facility.

Coercion, extortion or corruption

Actions following acts of coercion, extortion or corruption.

Damage from the warfare

Threats of direct impact of warfare activities.

Terrorist attack

Threats from terrorists.

Information leak /sharing due to human error

Information leak / sharing caused by humans, due to their mistakes.

Accidental leaks/sharing of data by employees

Unintentional distribution of private or sensitive data to an unauthorized entity by a staff member.

Leaks of data via mobile applications

Threat of leaking private data (a result of using applications for mobile devices).

Leaks of data via Web applications

Threat of leaking important information using web applications.

Leaks of information transferred by network

Threat of eavesdropping of unsecured network traffic.

Erroneous use or administration of devices and systems

Information leak / sharing / damage caused by misuse of IT assets (lack of awareness of application features) or wrong / improper IT assets configuration or management.

Loss of information due to maintenance errors / operators' errors

Threat of loss of information by incorrectly performed maintenance of devices or systems or other operator activities.

Loss of information due to configuration/ installation error

Threat of loss of information due to errors in installation or system configuration.

Increasing recovery time

Threat of unavailability of information due to errors in the use of backup media and increasing information recovery time.

Loss of information due to user errors

Threat of unavailability of information or damage to IT assets caused by user errors (using IT infrastructure) or IT software recovery time.

Using information from an unreliable source

Bad decisions based on unreliable sources of information or unchecked information.

Unintentional change of data in an information system

Loss of information integrity due to human error (information system user mistake).

Inadequate design and planning or improper adaptation

Threats caused by improper IT assets or business processes design (inadequate specifications of IT products, inadequate usability, insecure interfaces, policy/procedure flows, design errors).

Damage caused by a third party

Threats of damage to IT assets caused by third party.

Security failure caused by third party

Threats of damage to IT assets caused by breach of security regulations by third party.

Damages resulting from penetration testing

Threats to information systems caused by conducting IT penetration tests inappropriately.

Loss of information in the cloud

Threats of losing information or data stored in the cloud.

Loss of (integrity of) sensitive information

Threats of losing information or data, or changing information classified as sensitive.

Loss of integrity of certificates

Threat of losing integrity of certificates used for authorisation services

Loss of devices, storage media and documents

Threats of unavailability (losing) of IT assets and documents.

Loss of devices/ mobile devices

Threat of losing mobile devices.

Loss of storage media

Threat of losing data-storage media.

Loss of documentation of IT Infrastructure

Threat of losing important documentation.

Destruction of records

Threats of unavailability (destruction) of data and records (information) stored in devices and storage media.

Infection of removable media

Threat of loss of important data due to using removable media, web or mail infection.

Abuse of storage

Threat of loss of records by improper /unauthorised use of storage devices.

Disaster (natural earthquakes, floods, landslides, tsunamis, heavy rains, heavy snowfalls, heavy winds)

Large scale natural disasters.

Fire

Threat of fire.

Pollution, dust, corrosion

Threat of disruption of work of IT systems (hardware) due to pollution, dust or corrosion (arising from the air).

Thunderstrike

Threat of damage to IT hardware caused by thunder strike (overvoltage).

Water

Threat of damage to IT hardware caused by water.

Explosion

Threat of damage to IT hardware caused by explosion.

Dangerous radiation leak

Threat of damage to IT hardware caused by radiation leak.

Unfavourable climatic conditions

Threat of disruption of work of IT systems due to climatic conditions that have a negative effect on hardware.

Loss of data or accessibility of IT infrastructure as a result of heightened humidity

Threat of disruption of work of IT systems due to high humidity.

Lost of data or accessibility of IT infrastructure as a result of very high temperature

Threat of disruption of work of IT systems due to high or low temperature.

Threats from space / Electromagnetic storm

Threats of the negative impact of solar radiation to satellites and radio wave communication systems - electromagnetic storm.

Wildlife

Threat of destruction of IT assets caused by animals: mice, rats, birds.

Failure of devices or systems

Threat of failure of IT hardware and/or software assets or its parts.

Failure of data media

Threat of failure of data media.

Hardware failure

Threat of failure of IT hardware.

Failure of applications and services

Threat of failure of software/applications or services.

Failure of parts of devices (connectors, plug-ins)

Threat of failure of IT equipment or its part.

Failure or disruption of communication links (communication networks)

Threat of failure or malfunction of communications links.

Failure of cable networks

Threat of failure of communications links due to problems with cable network.

Failure of wireless networks

Threat of failure of communications links due to problems with wireless networks.

Failure of mobile networks

Threat of failure of communications links due to problems with mobile networks.

Failure or disruption of main supply

Threat of failure or disruption of supply required for information systems.

Failure or disruption of power supply

Threat of failure or malfunction of power supply.

Failure of cooling infrastructure

Threat of failure of IT assets due to improper work of cooling infrastructure.

Failure or disruption of service providers (supply chain)

Threat of failure or disruption of third party services required for proper operation of information systems.

Malfunction of equipment (devices or systems)

Threat of malfunction of IT hardware and/or software assets or its parts (i.e. improper working parameters, jamming, rebooting).

Absence of personnel

Unavailability of key personnel and their competences.

Strike

Unavailability of staff due to a strike (large scale absence of personnel).

Loss of support services

Unavailability of support services required for proper operation of the information system.

Internet outage

Unavailability of the Internet connection.

Network outage

Unavailability of communication links.

Outage of cable networks

Threat of lack of communications links due to problems with cable network.

Outage of short-range wireless networks

Threat of lack of communications links due to problems with wireless networks (802.11 networks, Bluetooth, NFC etc.).

Outages of long-range wireless networks

Threat of lack of communications links due to problems with mobile networks like cellular network (3G, LTE, GSM etc.) or satellite links.

War driving

Threat of locating and possibly exploiting connection to the wireless network.

Intercepting compromising emissions

Threat of disclosure of transmitted information using interception and analysis of compromising emission.

Interception of information

Threat of interception of information which is improperly secured in transmission or by improper actions of staff.

Corporate espionage

Threat of obtaining information secrets by dishonest means.

Nation state espionage

Threats of stealing information by nation state espionage (e.g. China based governmental espionage, NSA from USA).

Information leakage due to unsecured Wi-Fi, rogue access points

Threat of obtaining important information by insecure network rogue access points etc.

Interfering radiation

Threat of failure of IT hardware or transmission connection due to electromagnetic induction or electromagnetic radiation emitted by an outside source.

Replay of messages

Threat in which valid data transmission is maliciously or fraudulently repeated or delayed.

Network Reconnaissance, Network traffic manipulation and Information gathering

Threat of identifying information about a network to find security weaknesses.

Man in the middle/ Session hijacking

Threats that relay or alter communication between two parties.

Violation of rules and regulations / Breach of legislation

Threat of financial or legal penalty or loss of trust of customers and collaborators due to violation of law or regulations.

Failure to meet contractual requirements

Threat of financial penalty or loss of trust of customers and collaborators due to failure to meet contractual requirements.

Failure to meet contractual requirements by third party

Threat of financial penalty or loss of trust of customers and collaborators due to a third party’s failure to meet contractual requirements

Unauthorized use of IPR protected resources

Threat of financial or legal penalty or loss of trust of customers and collaborators due to improper/illegal use of IPR protected material (IPR- Intellectual Property Rights.

Illegal usage of File Sharing services

Threat of financial or legal penalty or loss of trust of customers and collaborators due to improper/illegal use of file sharing services.

Abuse of personal data

Threat of illegal use of personal data.

Judiciary decisions/court order

Threat of financial or legal penalty or loss of trust of customers and collaborators due to judiciary decisions/court order.

Identity theft (Identity Fraud/ Account)

Threat of identity theft action.

Credentials-stealing trojans

Threat of identity theft action by malware computer programs.

Receiving unsolicited E-mail

Threat of receiving unsolicited email which affects information security and efficiency.

SPAM

Threat of receiving unsolicited, undesired, or illegal email messages.

Unsolicited infected e-mails

Threat emanating from unwanted emails that may contain infected attachments or links to malicious / infected web sites.

Denial of service

Threat of service unavailability due to massive requests for services.

Distributed denial of network service (DDoS) (network layer attack i.e. Protocol exploitation / Malformed packets / Flooding / Spoofing)

Threat of service unavailability due to a massive number of requests for access to network services from malicious clients.

Distributed denial of application service (DDoS) (application layer attack i.e. Ping of Death / XDoS / WinNuke / HTTP Floods)

Threat of service unavailability due to massive requests sent by multiple malicious clients.

Distributed DoS (DDoS) to both network and application services (amplification/reflection methods i.e. NTP/ DNS /…​/ BitTorrent)

Threat of creating a massive number of requests, using multiplication/amplification methods.

Malicious code/ software/ activity

Search Engine Poisoning

Threat of deliberate manipulation of search engine indexes.

Exploitation of fake trust of social media

Threat of malicious activities making use of trusted social media.

Worms/ Trojans

Threat of malware computer programs (trojans/worms).

Rootkits

Threat of stealthy types of malware software.

Mobile malware

Threat of mobile malware programs.

Infected trusted mobile apps

Threat of using mobile malware software that is recognised as trusted one.

Elevation of privileges

Threat of exploiting bugs, design flaws or configuration oversights in an operating system or software application to gain elevated access to resources.

Web application attacks / injection attacks (Code injection: SQL, XSS)

Threat of utilizing custom web applications embedded within social media sites, which can lead to installation of malicious code onto computers to be used to gain unauthorized access.

Spyware or deceptive adware

Threat of using software that aims to gather information about a person or organization without their knowledge.

Viruses

Threat of infection by viruses.

Rogue security software/ Rogueware / Scareware

Threat of internet fraud or malicious software that mislead users into believing there is a virus on their computer, and manipulates them to pay money for fake removal tool.

Ransomware

Threat of infection of computer system or device by malware that restricts access to it and demands that the user pay a ransom to remove the restriction.

Exploits/Exploit Kits

Threat to IT assets due to the use of web available exploits or exploits software.

Social Engineering

Threat of social engineering type attacks (target: manipulation of personnel behaviour).

Phishing attacks

Threat of an email fraud method in which the perpetrator sends out legitimate-looking email in an attempt to gather personal and financial information from recipients. Typically, the messages appear to come from well-known and trustworthy websites.

Spear phishing attacks

Spear-phishing is a targeted e-mail message that has been crafted to create fake trust and thus lure the victim to unveil some business or personal secrets that can be abused by the adversary.

Abuse of Information Leakage

Threat of leaking important information.

Leakage affecting mobile privacy and mobile applications

Threat of leaking important information due to using malware mobile applications.

Leakage affecting web privacy and web applications

Threat of leakage important information due to using malware web applications.

Leakage affecting network traffic

Threat of leaking important information in network traffic.

Leakage affecting cloud computing

Threat of leaking important information in cloud computing.

Generation and use of rogue certificates

Threat of use of rogue certificates.

Loss of (integrity of) sensitive information

Threat of loss of sensitive information due to loss of integrity.

Man in the middle / Session hijacking

Threat of attack consisting in the exploitation of the web session control mechanism, which is normally managed by a session token.

Social Engineering / signed malware

Threat of install fake trust signed software (malware) e.g. fake OS updates.

Fake SSL certificates

Threat of attack due to malware application signed by a certificate that is typically inherently trusted by an endpoint.

Manipulation of hardware and software

Threat of unauthorised manipulation of hardware and software.

Anonymous proxies

Threat of unauthorised manipulation by anonymous proxies.

Abuse of computing power of cloud to launch attacks (cybercrime as a service)

Threat of using large computing powers to generate attacks on demand.

Abuse of vulnerabilities, 0-day vulnerabilities

Threat of attacks using 0-day or known IT assets vulnerabilities.

Access of web sites through chains of HTTP Proxies (Obfuscation)

Threat of bypassing the security mechanism using HTTP proxies (bypassing the website blacklist).

Access to device software

Threat of unauthorised manipulation by access to device software.

Alternation of software

Threat of unauthorized modifications to code or data, attacking its integrity.

Rogue hardware

Threat of manipulation due to unauthorized access to hardware.

Manipulation of information

Threat of intentional data manipulation to mislead information systems or somebody or to cover other nefarious activities (loss of integrity of information).

Repudiation of actions

Threat of intentional data manipulation to repudiate action.

Address space hijacking (IP prefixes)

Threat of the illegitimate takeover of groups of IP addresses.

Routing table manipulation

Threat of route packets of network to IP addresses other than that was intended via sender by unauthorised manipulation of routing table.

DNS poisoning / DNS spoofing / DNS Manipulations

Threat of falsification of DNS information.

Falsification of record

Threat of intentional data manipulation to falsify records.

Autonomous System hijacking

Threat of overtaking by the attacker the ownership of a whole autonomous system and its prefixes despite origin validation.

Autonomous System manipulation

Threat of manipulation by the attacker of a whole autonomous system in order to perform malicious actions.

Falsification of configurations

Threat of intentional manipulation due to falsification of configurations.

Misuse of audit tools

Threat of nefarious actions performed using audit tools (discovery of security weaknesses in information systems)

Misuse of information/ information systems (including mobile apps)

Threat of nefarious action due to misuse of information / information systems.

Unauthorized activities

Threat of nefarious action due to unauthorised activities.

Unauthorised use or administration of devices and systems

Threat of nefarious action due to unauthorised use of devices and systems.

Unauthorised use of software

Threat of nefarious action due to unauthorised use of software.

Unauthorized access to the information systems-or-networks (IMPI Protocol / DNS Registrar Hijacking)

Threat of unauthorised access to the information systems / network.

Network Intrusion

Threat of unauthorised access to network.

Unauthorized changes of records

Threat of unauthorised changes of information.

Unauthorized installation of software

Threat of unauthorised installation of software.

Web based attacks (Drive-by download / malicious URLs / Browser based attacks)

Threat of installation of unwanted malware software by misusing websites.

Compromising confidential information (data breaches)

Threat of data breach.

Hoax

Threat of loss of IT assets security due to cheating.

False rumour and/or fake warning

Threat of disruption of work due to rumours and/or a fake warning.

Remote activity (execution)

Threat of nefarious action by attacker remote activity.

Remote Command Execution

Threat of nefarious action due to remote command execution.

Remote Access Tool (RAT)

Threat of infection of software that has a remote administration capabilities allowing an attacker to control the victim’s computer.

Botnets / Remote activity

Threat of penetration by software from malware distribution.

Targeted attacks (APTs etc.)

Threat of sophisticated, targeted attack which combine many attack techniques.

Mobile malware (exfiltration)

Threat of mobile software that aims to gather information about a person or organization without their knowledge.

Spear phishing attacks (targeted)

Threat of attack focused on a single user or department within an organization, coming from someone within the company in a position of trust and requesting information such as login, IDs and passwords.

Installation of sophisticated and targeted malware

Threat of malware delivered by sophisticated and targeted software.

Watering Hole attacks

Threat of malware residing on the websites which a group often uses.

Failed business process

Threat of damage or loss of IT assets due to improperly executed business process.

Brute force

Threat of unauthorised access via systematically checking all possible keys or passwords until the correct one is found.

Abuse of authorizations

Threat of using authorised access to perform illegitimate actions.

Almost no chance - remote - 01-05%

Very unlikely - highly improbable - 05-20%

Associated numerical value="5"

Unlikely - improbable (improbably) - 20-45%

Associated numerical value="20"

Roughly even change - roughly even odds - 45-55%

Associated numerical value="45"

Likely - probable (probably) - 55-80%

Associated numerical value="55"

Very likely - highly probable - 80-95%

Associated numerical value="80"

Almost certain(ly) - nearly certain - 95-99%

Associated numerical value="95"

Low

Uncorroborated information from good or marginal sources. Many assumptions. Mostly weak logical inferences, minimal methods application. Glaring intelligence gaps exist. Terms or expressions used: 'Possible', 'Could, may, might', 'Cannot judge, unclear.'

Moderate

Partially corroborated information from good sources. Several assumptions. Mix of strong and weak inferences and methods. Minimum intelligence gaps exist. Terms or expressions used: 'Likely, unlikely', 'Probable, improbable' 'Anticipate, appear'.

High

Well-corroborated information from proven sources. Minimal assumptions. Strong logical inferences and methods. No or minor intelligence gaps exist. Terms or expressions used: 'Will, will not', 'Almost certainly, remote', 'Highly likely, highly unlikely', 'Expect, assert, affirm'.

Transport

Energy

Health

Financial market operators

Banking

e-commerce platforms

Internet payment

cloud computing

search engines

social networks

application stores

Public Administrations

Energy

Transport Sector

Banking

Financial market operators

Health

Drinking Water Supply and Distribution

Digital Infrastructure

Electricity Sub Sector

Oil Sub Sector

Gas Sub Sector

Air Transport Sub Sector

Rail Transport Sub Sector

Water Transport Sub Sector

Water Transport Sub Sector

Bank Credit Institutions Sub Sector

Operators of Financial Trading Sub Sector

Financial Central Counterparty Sub Sector

Healthcare Provider Sub Sector

Water Supply Sub Sector

Water Distribution Sub Sector

IXPs Sub Sector

DNS Service Provider Sub Sector

TLD Name Registry Sub Sector

Online Marketplace Sub Sector

Online Search Engine Sub Sector

Cloud Computing Service Sub Sector

TRES SECRET UE/EU TOP SECRET

Information and material the unauthorised disclosure of which could cause exceptionally grave prejudice to the essential interests of the European Union or of one or more of the Member States.

SECRET UE/EU SECRET

Information and material the unauthorised disclosure of which could seriously harm the essential interests of the European Union or of one or more of the Member States.

CONFIDENTIEL UE/EU CONFIDENTIAL

Information and material the unauthorised disclosure of which could harm the essential interests of the European Union or of one or more of the Member States.

RESTREINT UE/EU RESTRICTED

Information and material the unauthorised disclosure of which could be disadvantageous to the interests of the European Union or of one or more of the Member States.

System(s) infected by known malware

The presence of any of the types of malware was detected in a system.

Dissemination of malware by email

Malware attached to a message or email message containing link to malicious URL.

Hosting of malware on web page

Hosting of malware on web page

Web page disseminating one or various types of malware.

Replication and spreading of a worm

System infected by a worm trying to infect other systems.

Connection to (a) suspicious port(s) linked to specific malware

System attempting to gain access to a port normally linked to a specific type of malware.

Connection to (a) suspicious system(s) linked to specific malware

System attempting to gain access to an IP address or URL normally linked to a specific type of malware, e.g. C&C or a distribution page for components linked to a specific botnet.

Flood of requests

Mass mailing of requests (network packets, emails, etc…​) from one single source to a specific service, aimed at affecting its normal functioning.

Exploit or tool aimed at exhausting resources (network, processing capacity, sessions, etc…​)

One single source using specially designed software to affect the normal functioning of a specific service, by exploiting a vulnerability.

Packet flooding

Mass mailing of requests (network packets, emails, etc…​) from various sources to a specific service, aimed at affecting its normal functioning.

Exploit or tool distribution aimed at exhausting resources

Various sources using specially designed software to affect the normal functioning of a specific service, by exploiting a vulnerability.

Vandalism

Logical and physical activities which – although they are not aimed at causing damage to information or at preventing its transmission among systems – have this effect.

Intentional disruption of data transmission and processing mechanisms

Logical and physical activities aimed at causing damage to information or at preventing its transmission among systems.

System probe

Single system scan searching for open ports or services using these ports for responding.

Network scanning

Scanning a network aimed at identifying systems which are active in the same network.

DNS zone transfer

Transfer of a specific DNS zone.

Wiretapping

Logical or physical interception of communications.

Dissemination of phishing emails

Mass emailing aimed at collecting data for phishing purposes with regard to the victims.

Hosting phishing sites

Hosting web sites for phishing purposes.

Aggregation of information gathered through phishing schemes

Collecting data obtained through phishing attacks on web pages, email accounts, etc…​

Exploit attempt

Unsuccessful use of a tool exploiting a specific vulnerability of the system.

SQL injection attempt

Unsuccessful attempt to manipulate or read the information of a database by using the SQL injection technique.

XSS attempt

Unsuccessful attempts to perform attacks by using cross-site scripting techniques.

File inclusion attempt

Unsuccessful attempt to include files in the system under attack by using file inclusion techniques.

Brute force attempt

Unsuccessful login attempt by using sequential credentials for gaining access to the system.

Password cracking attempt

Attempt to acquire access credentials by breaking the protective cryptographic keys.

Dictionary attack attempt

Unsuccessful login attempt by using system access credentials previously loaded into a dictionary.

Use of a local or remote exploit

Successful use of a tool exploiting a specific vulnerability of the system.

SQL injection

Manipulation or reading of information contained in a database by using the SQL injection technique.

XSS

Attacks performed with the use of cross-site scripting techniques.

File inclusion

Inclusion of files into a system under attack with the use of file inclusion techniques.

Control system bypass

Unauthorised access to a system or component by bypassing an access control system in place.

Theft of access credentials

Unauthorised access to a system or component by using stolen access credentials.

Unauthorised access to a system

Unauthorised access to a system or component.

Unauthorised access to information

Unauthorised access to a set of information.

Data exfiltration

Unauthorised access to and sharing of a specific set of information.

Modification of information

Unauthorised changes to a specific set of information.

Deletion of information

Unauthorised deleting of a specific set of information.

Misuse or unauthorised use of resources

Use of institutional resources for purposes other than those intended.

Illegitimate use of the name of an institution or third party

Using the name of an institution without permission to do so.

Email flooding

Sending an unusually large quantity of email messages.

Sending an unsolicited message

Sending an email message that was unsolicited or unwanted by the recipient.

Distribution or sharing of copyright protected content

Distribution or sharing of content protected by copyright and related rights.

Dissemination of content forbidden by law (publicly prosecuted offences)

Distribution or sharing of illegal content such as child pornography, racism, xenophobia, etc…​

Other unspecified event

Other unlisted events.

Undetermined

Field aimed at the classification of unprocessed events, which have remained undetermined from the beginning.

Infection

Infecting one or various systems with a specific type of malware.

Distribution

Infecting one or various systems with a specific type of malware.

C&C

Infecting one or various systems with a specific type of malware.

Undetermined

DoS/DDoS

Disruption of the processing and response capacity of systems and networks in order to render them inoperative.

Sabotage

Premeditated action to damage a system, interrupt a process, change or delete information, etc.

Scanning

Active and passive gathering of information on systems or networks.

Sniffing

Unauthorised monitoring and reading of network traffic.

Phishing

Attempt to gather information on a user or a system through phishing methods.

Exploitation of vulnerability

Attempt to intrude by exploiting a vulnerability in a system, component or network.

Login attempt

Attempt to log in to services or authentication / access control mechanisms.

Exploitation of vulnerability

Actual intrusion by exploiting a vulnerability in the system, component or network.

Compromising an account

Actual intrusion in a system, component or network by compromising a user or administrator account.

Unauthorised access

Unauthorised access to a particular set of information

Unauthorised modification/deletion

Unauthorised change or elimination of a particular set of information

Misuse or unauthorised use of resources

Use of institutional resources for purposes other than those intended.

Illegitimate use of the name of a third party

Use of the name of an institution without permission to do so.

SPAM

Copyright

Distribution and sharing of copyright protected content.

Dissemination of content forbidden by law.

Child pornography, racism and apology of violence.

Other

analytic debates within the organisation

Devil’s advocates methodlogy

competitive analysis

interdisciplinary brainstorming

intra-office peer review

Outside expertise review

TRES SECRET DEFENSE

SECRET DEFENSE

CONFIDENTIEL DEFENSE

SECRET

CONFIDENTIEL

DIFFUSION RESTREINTE

NON CLASSIFIEES

High Interaction Level

Exposed functionality of the honeypot is not limited.

low Interaction Level

Exposed functionality being limited. For example, a simulated SSH server of a honeypot is not able to authenticate against a valid login/password combination

Events

The honeypot collects data about something that has happened or took place, a change in state.

Attacks

The honeypot collects malicious activity.

Intrusions

The honeypot collects malicious activity that leads to a security failure.

None

The honeypot does not collect events, attacks, or intrusions.

Block

Attacker’s actions are identified and blocked. The attack never reaches the target.

Defuse

The attack reaches the target, but is manipulated in a way that it fails against the target.

Slow Down

Attacker is slowed down in his actions of spreading malicious activity.

None

No action is taken to limit the intruder’s spread of malicious activity against other systems.

Distributed

The honeypot is or appears to be composed of multiple systems.

Stand-Alone

The honeypot is or appears to be one system.

Network Interface

The honeypot can be directly communicated with via a network interface.

Non-Network Hardware Interface

Examples: Printer port, CDROM drives, USB connections.

Software API

The honeypot can be interacted with via a software API.

Server

The honeypot is passively awaiting requests from clients.

Client

The honeypot is actively initiating requests to servers.

Recipients MAY use this information in commercial products or services.

Recipients MUST NOT use this information in commercial products or services.

An external-reference value is required

Recipients MUST encrypt the information received when it is retransmitted or redistributed.

Recipients MAY encrypt the information received when it is retransmitted or redistributed.

Recipients MUST encrypt the information received when it is stored at rest.

Recipients MAY encrypt the information received when it is stored at rest.

Recipients MUST contact the Providers before acting upon the information received.

Recipients MUST contact the Providers before acting upon the information received.

Recipients MAY conduct actions on the information received that are only visible on the Recipients internal networks and systems, and MUST NOT conduct actions that are visible outside of the Recipients networks and systems, or visible to third parties.

Recipients MAY conduct indirect, or passive, actions on the information received that are externally visible and MUST NOT conduct direct, or active, actions.

Recipients MAY conduct direct, or active, actions on the information received that are externally visible.

Recipients MAY notify affected parties of a potential compromise or threat.

Recipients MUST NOT notify affected parties of potential compromise or threat.

Personal for identified recipients only.

Limited sharing on the basis of need-to-know.

Community wide sharing.

Unlimited sharing.

Recipients MAY attribute the Provider when redistributing the information received.

Recipients MUST attribute the Provider when redistributing the information received.

Recipients MUST NOT attribute the Provider when redistributing the information received.

Recipients MAY obfuscate information about the specific affected parties.

Recipients MUST obfuscate information about the specific affected parties.

Recipients MUST NOT obfuscate information about the specific affected parties.

Recipients MAY resell the information received.

Recipients MUST NOT resell the information received unmodified or in a semantically equivalent format.

A start-date value is required

An end-date value is required

A reference value is required

A name value is required

A version value is required

An id value is required

Confirmed

The incident is confirmed and response is underway following incident response procedure of the organisation.

Deferred

The incident is deferred due to resource constraints, information type or external reasons.

Unidentified

The incident is unidentified because some assets, ressources or context is missing to go a state which can be handled following the incident response response procedure.

Transferred

The incident is transferred to another organisations for further processing or incident handling.

Discarded

The incident is discarded due to resource constraints, information type or external reasons.

Silently discarded

The incident is silently discarded due to resource constraints, information type or external reasons.

Insufficient data

When insufficient data is available to explain an ambiguous (i.e., not definitively hostile or benign) indicator, the incident may be dispositioned as Insufficient Data.

Faulty indicator

A false positive where an investigation reveals that the source indicator used as the basis for incident detection was a Faulty Indicator.

Misconfiguration

A false positive where an event that appeared to be malicious activity was subsequently disproven and determined to be a Misconfiguration (malfunction) of a system.

Scan or Probe

Reconnaissance activity which Scanned or Probed for the presence of a vulnerability which may be later exploited to gain unauthorized access.

Failed

A Failed attempt to gain unauthorized access, conduct a denial of service, install malicious code, or misuse an IT resource, typically because a security control prevented it from succeeding.

Refuted

Any other circumstance where a suspected incident was determined to not be an incident and was Refuted.

Duplicate

An incident may be a Dup l icate of another record in the Incident Management System, and should be merged with the existing workflow.

Forged domain or brand names impersonating or imitating legitimate and genuine names

Forged domains are addresses very close to the domain names legitimately filed with registration companies or organizations (forged domains are harmful only when actively used to entice customers to the website for fraudulent purposes). It also includes domain names that imitate another domain name or a brand.

Wholly or partly forged websites (excluding parking pages) spoiling company’s image or business

Forged websites correspond to two main threats (forgery of sites in order to steal personal data such as account identifiers and passwords, forgery of services in order to capitalize on a brand and to generate turnover that creates unfair competition). In this case, reference is often made to phishing (1st usage) or pharming.

Not requested received bulk messages (spam) targeting organization’s registered users

Spam are messages received in company’s or organization’s messaging systems in the framework of mass and not individualized campaigns, luring into clicking dangerous URLs (possibly Trojan laden) or enticing to carry out harmful to concerned individual actions.

Phishing targeting company’s customers' workstations spoiling company’s image or business

Phishing involves a growing number of business sectors (financial organizations, e-commerce sites, online games, social sites etc.). It includes attacks via e-mail with messages that contain either malicious URL links (to forged websites) or malicious URL links (to malware laden genuine websites).

Spear phishing or whaling carried out using social engineering and targeting organization’s specific registered users

Spear phishing are "spoofed" and customized messages looking like a usual professional relationship or an authority, and asking to click on or open dangerous URL links or dangerous attachments (malware laden).

Intrusion attempts on externally accessible servers

Attempts are here systematic scans (excluding network reconnaissance) and abnormal and suspicious requests on externally accessible servers, detected by an IDS/IPS or not.

Intrusion on externally accessible servers

Intrusion usually targets servers that host personal data (including data subject to regulations such as PCI DSS, for example). 3 objectives or motivations can be found wherever an intrusion exists: data theft (see before), installation of transfer links towards unlawful and rogue websites, getting a permanent internal access by installation of a backdoor for further purposes. This indicator does not include the figures from the Defacement and Misappropriation indicators, both of which however starting with an intrusion. However, it includes all means and methods to get access to servers, i.e. purely technical means (such as Command execution/injection attack) or identity usurpation to log on an admin or user account (see ETSI GS ISI 002 [4] specifications).

Intrusions on internal servers

This kind of incident typically comes after a PC malware installation or an intrusion on an externally accessible server often followed by a lateral movement. This indicator does not include the figures from the Misappropriation indicator which may however start with an intrusion on an internal server. This indicator includes the so-called APTs (Advanced Persistent Threats), which constitute however only a small part of this indicator. APTs are long lasting and stealthy incidents with large compromises of data through outbound links, which is not the case of most incidents of the IEX_INT.3 type. This type of incident is often the result of targeted attacks.

Obvious and visible websites defacements

Obvious defacements measures the defacement of homepages and of the most consulted pages of sites.

Servers resources misappropriation by external attackers

This indicator measures the amount of resources of servers misappropriated by an external attacker after a successful intrusion (on an externally accessible or an internal server).

Denial of service attacks on websites

This indicator measures denial-of-service attacks against websites, carried out either by sending of harmful requests (DoS), by sending a massive flow coming from multiple distributed sites (DDoS) or via other techniques. Due to the current state of the art of attack detection, the indicator is limited to DDoS attacks.

Attempts to install malware on workstations

Malware installation attempts are detected by current conventional means (Antivirus and base IPS) and blocked by the same means. This indicator (which includes desktop and laptop PC based workstations, but does not include the different types of other workstations and mobile smart devices) provides an approximate insight into the malicious external pressure suffered in this regard. This indicator should be associated with indicator on successful malware installation in order to assess the actual effectiveness of conventional detection and blockage means in the fight against malware.

Attempts to install malware on servers

Malware installation attempts are detected by current conventional means (antivirus and base IPS) and blocked by the same means. This indicator gives an approximate insight into the malicious external pressure suffered in this regard. This indicator should be associated with indicator on successful malware installation in order to assess the actual effectiveness of conventional detection and blockage means in the fight against malware.

Malware installed on workstations

Malware could be not detected by conventional means (lack of activation or appropriate update), or noninventoried and/or specific very stealthy incidents, most of the time not detectable by conventional means (AV and standard IPS), consequently requiring other supplementary detection means (network or WS load, outbound links, advanced network devices as DPI tools, users themselves reporting to help desks). This indicator (which includes desktop and laptop Windows-based workstations, but does not include the different types of other workstations and mobile smart devices) therefore applies to both classical viruses and worms, as well as all new malware such as Trojan horses (which are defined as malware meant to data theft or malicious transactions) or bots (which are defined here as vectors for spam or DDoS attacks).

Malware installed on internal servers

Malware could be not detected by conventional means (lack of activation or of appropriate update), or noninventoried and/or specific very stealthy incidents, most of the time not detectable by conventional means (AV and standard IPS), consequently requiring other supplementary detection means (network or server load, outbound links, advanced network devices as DPI tools, administrators themselves). This indicator therefore applies to both classical viruses and worms, as well as all new malware such as Trojan horses (which are defined as malware meant to data theft or malicious transactions)

Human intrusion into the organization’s perimeter

This indicator measures illicit entrance of individuals into security perimeter.

Workstations accidental breakdowns or malfunctions

Breakdowns or malfunctions apply to both hardware and software, caused by system errors (components failure or bugs).

Servers accidental breakdowns or malfunctions

Breakdowns or malfunctions apply to both hardware and software, caused by system errors (components failure or bugs).

Mainframes accidental breakdowns or malfunctions

Breakdowns or malfunctions apply to both hardware and software, caused by system errors (components failure or bugs).

Networks accidental breakdowns or malfunctions

Breakdowns or malfunctions apply to both hardware and software, caused by system errors (components failure or bugs).

Delivery of email to wrong recipient

This indicator measures errors from the sender when selecting or typing email addresses leading to misdelivery incidents. Consequences may be very serious when confidentiality is critical.

Loss (or theft) of mobile devices belonging to the organization

This indicator measures the loss of all types of systems containing sensitive or not information belonging to the organization, whether encrypted or not (laptop computers, USB tokens, CD-ROMs, diskettes, magnetic tapes, smartphones, tablets, etc.). In some cases, it could be difficult to differentiate losses from thefts.

Downtime or malfunction of the log production function with possible legal impact

This type of event could have two main causes: an accidental system malfunction or a system manipulation error by an administrator. Logs taken into account here are systems logs and applications logs of all servers.

Absence of possible tracking of the person involved in a security event with possible legal impact

Concerns unique data related to a given and known to organization user (identifier tied to application software or directory). This indicator is a sub-set of indicator IMF_LOG.1.

Downtime or malfunction of the log production function for recordings with evidential value for access to or handling of information that, at this level, is subject to law or regulatory requirements

This indicator primarily relates to Personal Identifiable Information (PII) protected by privacy laws, to information falling under the PCI-DSS regulation, to information falling under European regulation in the area of breach notification (Telcos and ISPs to begin with), and to information about electronic exchanges between employees and the exterior (electronic messaging and Internet connection). This indicator does not include possible difficulties pertaining to proof forwarding from field operations to governance (state-of-the-art unavailable). This indicator is a sub-set of indicator IMF_LOG.1, but can be identical to this one in advanced organizations.

User impersonation

A person within the organization impersonates a registered user (employee, partner, contractor, external service provider) using identifier, passwords or authentication devices that had previously been obtained in an illicit manner (using a social engineering technique or not). This measures cases of usurpation for malicious purposes, and not ones that relate to user-friendly usage. Moreover, assumption is made that ID/Password is the main way of authentication

Privilege escalation by exploitation of software or configuration vulnerability on an externally accessible server

Exploited vulnerabilities are typically tied to the underlying OS that supports the Web application, exploited notably through injection of additional characters in URL links. This behaviour specifically involves external service providers and company’s business partners that wish to access additional information or to launch unlawful actions (for example, service providers seeking information about their competitors). This type of behaviour is less frequent amongst employees, since it is often easier to get the same results by means of social engineering methods.

Privilege escalation on a server or central application by social engineering

It is often easier to get the same results by means of social engineering methods than with technical means. Help desk teams are often involved in this kind of behaviour.

Illicitly granting administrator privileges generally comes from simple errors or more worrisome negligence on the part of the administrators (malicious action is rarer). The case of forgotten temporary rights (see next indicator), is not included in this indicator.

Use on a server or central application of time-limited granted rights after the planned period

This indicator measures situations where time-limited user accounts (created for training, problem resolution, emergency access, test, etc.) are still in use after the initial planned period.

Abuse of privileges by an administrator on a server or central application

The motivation of rights usurpation by an administrator is often the desire to breach the confidentiality of sensitive data (for example, human resources data). This indicator is similar to the indicator IDB_RGH.6 (but with consequences that may be however often potentially more serious).

Abuse of privileges by an operator or a plain user on a server or central application

This indicator applies for example to authorized users having access to personal identifiable information aboutcelebrities with no real need for their job (thereby violating the "right to know").

Illicit use on a server or central application of rights not removed after departure or position change within the organization

This indicator also takes into account the problem of generic accounts (whose password might have been changed each time a user knowing this password is leaving organization).

Server resources misappropriation by an internal source

This indicators measures misappropriation of on-line IT resources for one’s own use (personal, association etc.).

Access to hacking Website

This indicator measures unauthorized access to a hacking Website from an internal workstation

Deactivating of logs recording by an administrator

This event is generally decided and deployed by an administrator in order to improve performance of the system under his/her responsibility (illicit voluntary stoppage). This indicator is a reduced subset of indicator IUS_RGH.5

Exploitation of a software vulnerability without available patch

This indicators measures security incidents that are the result of an exploitation of a disclosed software vulnerability that has no available patch (with or without an applied workaround measure). It is used to assess the intensity of the exploitation of recently disclosed software vulnerabilities (zero day or not). Patching here applies only to standard software (excluding bespoke software), and the scope is limited to workstations (OS, browsers and various add-ons and plug-ins, office automation standard software).

Exploitation of a non-patched software vulnerability

This indicators measures security incidents that are the result of the exploitation of a non-patched software vulnerability though a patch exists. It is used to assess effectiveness or application of patching-related organization and processes and tools (patching not launched). It is linked with indicator VOR_VNP.2 that is intended to assess problems of exceeding the "time limit for the window of exposure to risks". It has the same limitations as IWH_VNP.1 regarding scope.

Exploitation of a poorly-patched software vulnerability

This indicator measures security incidents that are the result of the exploitation of a poorly patched software vulnerability. It is used to assess effectiveness of patching-related organization and processes and tools (process launched but patch not operational - Cf. no reboot, etc.). It is linked with indicator VOR_VNP.1, IWH_VNP.1 and IWH_VNP.2. It has the same limitations as IWH_VNP.1 regarding scope.

Exploitation of a configuration flaw

This indicator measures security incidents that are the result of the exploitation of a configuration flaw on servers or workstations. A configuration flaw should be considered as a nonconformity against state-of-the-art security policy.

Not categorized security incidents

This indicator measures all types of incidents that are new and/or a complex combination of more basic incidents and cannot be fully qualified and therefore precisely categorized.

Security incidents on non-inventoried and/or not managed assets

This indicator measures security incidents tied to assets (on servers) non-inventoried and not managed by appointed teams. It is a key indicator insofar as a high percentage of incidents corresponds with this indicator on average in the profession (according to some public surveys).

Server accessed by an administrator with unsecure protocols

This indicator measures the use of insecure protocols set up by an administrator to get access to organizationbased externally accessible servers making an external intrusion possible. Insecure protocol means unencrypted, without time-out, with poor authentication means etc. (for example Telnet).

P2P client in a workstation

This indicator measures the installation of P2P clients set up by a user on its professional workstation with the risk of partial or full sharing of the workstation content. It applies to workstations that are either connected to the organization’s network from within the organization or directly connected to the public network from outside (notably home). There is a high risk of accidental sharing (in one quarter of all cases) of files that may host confidential company data. It is most often carried out through HTTP channel (proposed on all of these services).

VoIP clients in a workstation

This indicator measures VoIP clients installed by a user on his/hers own workstation in order to use a peer-to-peer service. It applies to workstations connected to an organization’s network from within the organization or directly connected to the public network from outside (notably home). The associated risk is to exchange dangerous Office documents. It is most often carried out through HTTP channel (proposed on all of these services).

Outbound connection dangerously set up

This indicator measures outbound connection dangerously set up to get remote access to the company’s internal network without using an inbound VPN link and a focal access point with possible exploitation by an external intruder. The outbound connection method consists for example in using a GoToMyPC™ software or a LogMeIn® software or a computer to computer connection in tunnel mode.

Not compliant laptop computer used to establish a connection

This indicator measures remote or local connection to the organization’s internal network from a roaming laptop computer that is organization-owned and is configured with weak parameters. In this situation and in case of the existence of a software to check compliance of roaming computers, another related software blocks the connection in principle and prevents its continuation.

Other unsecure protocols used

This indicator measures other unsecure or dangerous protocols set up with similar behaviours. The other cases are the other than the 5 previous ones (VBH_PRC.1 to VBH_PRC.5). It relates to dangerous or abusive usages, i.e. situations where usages are not required and where other more secure solutions exist.

Outbound controls bypassed to access Internet

This indicator measures the detection of Internet access from the internal network by means that bypass the outbound security devices. It primarily relates to Internet accesses from a perimeter area or to tunnelling (SSL port 443) or to straight accesses (via an ADSL link or public Wi-Fi access points and the telephone network) or to accesses via Smartphones connected to the workstation. The main underlying motivation is to prevent user tracking.

Anonymization site used to access Internet

This indicator measures the detection of anonymous Internet access from an internal workstation through an anonymization site. The goal is to maintain free access and to avoid organization’s filtering of accesses to forbidden websites.

Files recklessly downloaded

This indicator measures the download of files from an external website that is not known (no reputation) within the profession to an internal workstation. "No reputation" can be assessed by information provided by URL outbound filtering devices.

Personal public instant messaging account used for business file exchanges

This indicator measures the use of personal public instant messaging accounts for business exchanges with outside. This file exchange method has to be avoided due to network AV software bypassing and to identify lesser effectiveness of AV software.

Personal public messaging account used for business file exchanges

This indicator measures the use of personal public messaging accounts for business file exchanges with the exterior. The risk is to expose information to external attackers.

Workstations accessed in administrator mode

This indicator measures access to workstations in administrator mode without authorization.

Personal storage devices used

This indicator measures the use personal storage devices on a professional workstation to input or output information or software. Mobile or removable personal storage devices include USB tokens, smartphones, tablets, etc. It is not applicable to personal devices authorized by security policy (Cf. VBH_WTI.3 and BYOD).

Personal devices used without compartmentalization (BYOD)

This indicator measures the lack of or the removal of basic security measures meant to compartmentalize professional activities on personal devices. Personal devices (BYOD) include PCs, tablets, smartphones, etc.

Not encrypted sensitive files exported

This indicator measures the lack of encryption of sensitive files uploaded from a professional workstation to professional mobile or removable storage devices.

Personal software used

This indicator measures the presence of personal software on a professional workstation that does not comply with the corporate security policy. It corresponds with all types of local unauthorized software (with a user licence or not), such as common personal software (games, office automation etc.) or more dangerous ones (hacking etc.). It should be added that VBH_PRC.2 and VBH_PRC.3 are a share of this indicator, and that this indicator is a subset of VBH_WTI.1.

Mailbox or Internet access with admin mode

This indicator applies to users using their admin account on a workstation.to access their own mailbox or Internet. This behaviour is particularly dangerous since malware (through attached pieces on email or drive-by download on Web browser) are far easier to install on the workstation in this case.

Weak passwords used

The required strength of passwords depends on the organization’s security policy, but usable general recommendations in ISO/IEC 27002 [2].

Passwords not changed

This indicators measures password not changed in due periodic time (case of changes not periodically imposed). Situations in which changes are not periodically imposed by accessed systems themselves remain fairly frequent within organizations (apart from Active Directory), the figure being around 25 % of the cases on average.

Administrator passwords not changed

This indicators measures password not changed in due periodic time by an administrator in charge of an account used by automated applications and processes (case of changes not periodically imposed). Situations in which changes are not periodically imposed by accessed systems themselves remain fairly frequent within organizations (apart from Active Directory), the figure being around 25 % of the cases on average.

Not compliant user rights granted illicitly by an administrator

This indicator measures the granting of not compliant user rights by an administrator outside any official procedure. This vulnerability may originate with an error, negligence or malice.

Human weakness exploited by a spear phishing message meant to entice or appeal to do something possibly harmful to the organization

This vulnerability typically includes clicking on an Internet link or opening an attached document

This vulnerability applies to discussions through on-line media leading to leakage of personal identifiable information (PII) or various business details to be used later (notably for identity usurpation)

Web applications software vulnerabilities

This indicators measures software vulnerabilities detected in Web applications running on externally accessible servers.

OS software vulnerabilities regarding servers

This indicators measures software vulnerabilities detected in OS running on externally accessible servers.

Web browsers software vulnerabilities

This indicators measures software vulnerabilities detected in Web browsers running on workstations.

Dangerous or illicit services on externally accessible servers

This indicator measures the presence of illicit and dangerous system services running on an externally accessible server.

Insufficient size of the space allocated for logs

Such event could cause an overflow in case of quick series of unusual actions.

Weak firewall filtering rules

This indicator measures the gaps between the active firewall filtering rules and the security policy.

Workstation wrongly configured

This indicator measures the use of workstation with a disabled or lacking update AV and/or FW. The lack of update includes signature file older than x days (generally at least 6 days).

Autorun feature enabled on workstations

This indicator measures the presence of Autorun feature enabled on workstations.

Access rights configuration not compliant with the security policy

This indicator measures access rights configuration that are not compliant with corporate security policy. This indicator is more reliable in case of existence of a central repository of user rights within organization (and of an IAM achievement)

Not compliant access rights on logs

This indicator measures non-compliant access rights on logs in servers which are sensitive and/or subject to regulations. This situation representing a key weakness since the necessary high confidence in the produced logs has been reduced to nothing. This indicator is a subset of VCF_UAC.1.

Generic and shared administrator accounts

This indicator measures generic and shared administration accounts that are unnecessary or accounts that are necessary but without patronage. It concerns operating systems, databases and applications.

Accounts without owners

This indicator measures accounts without owners that have not been erased. These are accounts that have no more assigned users (for example after internal transfer or departure of the users from organization).

Inactive accounts

This indicator measures accounts inactive for at least 2 months that have not been disabled. These accounts are not used by their users due to prolonged but not definitive absence (long term illness, maternity, etc.), with the exclusion of messaging accounts (which should remain accessible to users from their home).

Malfunction of server-hosted sensitive data safeguards

On servers hosting sensitive data with respect to availability, it concerns malfunctions of safeguards due to lack of periodic testing. This kind of event may be very serious since usually put trust is betrayed in a critical function.

Full unavailability of IDS/IPS

Many causes are possible, including deliberate disconnection by a network administrator (to streamline operations or since IDS/IPS output is deemed too difficult to use), unwitting disconnection (error by a network administrator), breakdown, software malfunction, etc.

Wi-Fi devices installed on the network without any official authorization

Many causes are possible, including for example local decisions for easier access of mobile users, rogue user behaviours or workstations configured as access points.

Remote access points used to gain unauthorized access

This indicator is interesting to assess whether such accesses are localized (local areas, countries, etc.) or involve the whole organization or are increasing and spreading to whole organization.

Devices or servers connected to the organization’s network without being registered and managed

According to some convergent studies, this event may be at the origin of some 70 % of all security incidents associated to malice.

Not operational physical access control means

This indicator includes access to protected internal areas. The 1st cause is the lack of effective control of users at software level. The 2nd cause is hardware breakdown of a component in the chain.

Discovery of attacks

This indicator measures stealthy security incidents difficult to detect. As most studies show, the time to discovery is often several months, time frame especially used to steal sensitive data. Incidents taken into account here are IEX_INT.3, IEX_MLW.3 and IEX_MLW.4. This indicator give landmarks regarding what may be deemed excessive, i.e. with an assumption which is above one week.

Excessive time of window of risk exposure

This indicator measures situations in which the time of the window of risk exposure exceeds the time limit expressed in security policy. The window of risks exposure is the period of time between the public disclosure of a software vulnerability and the actual and checked application of a patch that corresponds with the vulnerability’s remediation (independently of the time needed for the vendor to provide the patch). This indicator only applies to workstations (OS, application software and browsers), and to critical vulnerabilities (as publicly determined via the CVSS scale) that require an action as quickly as possible.

Rate of not patched systems

This indicator measures the rate of not patched systems for detected critical software vulnerabilities (see VOR_VNP.1 for criticality definition). Not patched systems to be taken into account are the ones which are not patched beyond the time limit defined in security policy. This indicator only applies to workstations (OS, application software and browsers).

Rate of not reconfigured systems

This indicator measures the rate of not reconfigured systems for detected critical configuration vulnerabilities. Configuration vulnerabilities are either non-conformities relative to a level 3 security policy, or discrepancies relative to a state-of-the-art available within the profession (and that can correspond with a configuration master produced by a vendor and applied within the organization). This indicator only applies to workstations (OS, application software and browsers). Not reconfigured systems to be taken into account are the ones which are not reconfigured beyond the time limit defined in security policy.

Reaction plans launched without experience feedback

This indicator applies to plans for responding to incidents formalized in security policy launched without experience feedback.

Reaction plans unsuccessfully launched

This indicator measures failure in the performance of plans, leading to non-recovery of incidents and to subsequent possible launch of an escalation procedure.

Launch of new IT projects without information classification

This indicator measures the launch of new IT projects without information classification. Availability of a classification model and scheme within the organization would make easier this task.

Launch of new specific IT projects without risk analysis

This indicator measures the launch of new specific IT projects without performing a full risk analysis.

This indicator measures the launch of new IT projects of a standard type without identification of vulnerabilities and threats and of related security measures. For these IT projects, potential implementation of a simplified risk analysis method or of pre-defined security profiles can be applied.

Average cost to tackle a critical security incident

The average cost taken into account includes the following kinds of overhead: disruption to business operations (increased operating costs, etc.), fraud (money, etc.) and incident recovery costs (technical individual time, asset replacement, etc.). It does not include possible (generally very heavy) breach notification costs to customers and enforcement bodies (according to US and recently EU laws or regulations).

Average time of Websites downtime due to whole security incidents

Applies to all 4 classes, but main security incidents concerned are malfunctions or breakdowns (software or hardware), DoS or DDoS attacks and Website defacements.

Average time of Websites downtime due to successful malicious attacks

This indicator is a subset of the previous one (IMP_TIM.1) focusing on 3 possible classes (IEX, IUS, IMD).

Average time of Websites downtime due to malfunctions or unintentional security incidents

This indicator is a subset of IMP_TIM.1 focusing on one class (IMF).

Research, identification and selection of targets, often represented as crawling Internet websites such as conference proceedings and mailing lists for email addresses, social relationships, or information on specific technologies.

Coupling a remote access trojan with an exploit into a deliverable payload, typically by means of an automated tool (weaponizer). Increasingly, client application data files such as Adobe Portable Document Format (PDF) or Microsoft Office documents serve as the weaponized deliverable.

Transmission of the weapon to the targeted environment. The three most prevalent delivery vectors for weaponized payloads by APT actors, as observed by the Lockheed Martin Computer Incident Response Team (LM-CIRT) for the years 2004-2010, are email attachments, websites, and USB removable media.

After the weapon is delivered to victim host, exploitation triggers intruders' code. Most often, exploitation targets an application or operating system vulnerability, but it could also more simply exploit the users themselves or leverage an operating system feature that auto-executes code.

Installation of a remote access trojan or backdoor on the victim system allows the adversary to maintain persistence inside the environment.

Typically, compromised hosts must beacon outbound to an Internet controller server to establish a C2 channel. APT malware especially requires manual interaction rather than conduct activity automatically. Once the C2 channel establishes, intruders have 'hands on the keyboard' access inside the target environment.

Only now, after progressing through the first six phases, can intruders take actions to achieve their original objectives. Typically, this objective is data exfiltration which involves collecting, encrypting and extracting information from the victim environment; violations of data integrity or availability are potential objectives as well. Alternatively, the intruders may only desire access to the initial victim box for use as a hop point to compromise additional systems and move laterally inside the network.

Falling

Falling

100

Publishing

Publishing

75

Propagating

Propagating

50

Discovering

Discovering

25

Virus

Worm

Trojan

Ransomware

Rootkit

Downloader

Adware

Spyware

Botnet

No obfuscation is used

encryption

oligomorphism

metamorphism

stealth

armouring

tunneling

XOR

BASE64

ROT13

No payload

Non-Destructive

Destructive

Dropper

In memory

In memory temporarily

Only a part loaded in memory temporarily

Not in memory

As a user level process

As a process in the kernel

tag to hide from the user-interface.

tag to hide from the API.

block

OpenPGP Fingerprint

Completely confident

Associated numerical value="100"

Usually confident

Associated numerical value="75"

Fairly confident

Associated numerical value="50"

Rarely confident

Associated numerical value="25"

Unconfident

Confidence cannot be evaluated

No risk

Harmless information. (CEUS threat level)

Low risk

Low risk which can include mass-malware. (CEUS threat level)

Associated numerical value="25"

Medium risk

Medium risk which can include targeted attacks (e.g. APT). (CEUS threat level)

Associated numerical value="50"

High risk

High risk which can include highly sophisticated attacks or 0-day attack. (CEUS threat level)

Associated numerical value="100"

Generated automatically without human verification

Associated numerical value="100"

Generated automatically but verified by a human

Associated numerical value="50"

Output of human analysis

misp2stix

Adware - Software that shows you extra promotions that you cannot control as you use your PC

A type of trojan that gives a malicious hacker access to and control of your PC

A type of detection based on file actions that are often associated with malicious activity

A program than makes changes to your Internet browser without your permission

A program that can be used to automatically create malware files

When a number of PCs are made to access a website, network or server repeatedly within a given time period. The aim of the attack is to overload the target so that it crashes and can’t respond

A program that makes unauthorized telephone calls. These calls may be charged at a premium rate and cost you a lot of money

When a target PC or server is deliberately overloaded so that it doesn’t work for any visitors anymore

A piece of code that uses software vulnerabilities to access information on your PC or install malware

A type of tool that can be used to allow and maintain unauthorized access to your PC

A program that pretends to do something malicious but actually doesn’t actually do anything harmful. For example, some joke programs pretend to delete files or format disks

The program that makes misleading or fraudulent claims about files, registry entries or other items on your PC

A commercial program that monitors what you do on your PC. This can include monitoring what keys you press; your email or instant messages; your voice or video conversations; and your banking details and passwords. It can also take screenshots as you use your PC

Software that you may or may not want installed on your PC

Potentially Unwanted Applications. Characteristics of unwanted software can include depriving users of adequate choice or control over what the software does to the computer, preventing users from removing the software, or displaying advertisements without clearly identifying their source.

A type of malware that is used steal your personal information, such as user names and passwords. It often works along with a keylogger that collects and sends information about what keys you press and websites you visit to a malicious hacker

A detection for malicious programs that seize control of the computer on which they are installed. This trojan usually locks the screen and prevents the user from using the computer. It usually displays an alert message.

A program that gives someone access to your PC from a remote location. This type of program is often installed by the computer owner

Software that pretends to be an antivirus program but doesn’t actually provide any security. This type of software usually gives you a lot of alerts about threats on your PC that don’t exist. It also tries to convince you to pay for its services

A program that changes your PC settings

A program that installs unwanted software on your PC at the same time as the software you are trying to install, without adequate consent

A trojan that sends large numbers of spam emails. It may also describe the person or business responsible for sending spam

A type of trojan that makes fake emails that look like they are from a legitimate source

A program that collects your personal information, such as your browsing history, and uses it without adequate consent

A type of software that may have a legitimate purpose, but which may also be abused by malware authors

A trojan is a program that tries to look innocent, but is actually a malicious application. Unlike a virus or a worm , a trojan doesn’t spread by itself. Instead they try to look innocent to convince you to download and install them. Once installed, a trojan can steal your personal information, download more malware, or give a malicious hacker access to your PC

A type of trojan that can use your PC to click on websites or applications. They are usually used to make money for a malicious hacker by clicking on online advertisements and making it look like the website gets more traffic than it does. They can also be used to skew online polls, install programs on your PC, or make unwanted software appear more popular than it is

A type of trojan that installs other malicious files, including malware, onto your PC. It can download the files from a remote PC or install them directly from a copy that is included in its file.

A type of trojan that installs other malicious files, including malware, onto your PC. It can download the files from a remote PC or install them directly from a copy that is included in its file.

A type of trojan that sends information about your PC to a malicious hacker. It is similar to a password stealer

A type of trojan that installs a proxy server on your PC. The server can be configured so that when you use the Internet, any requests you make are sent through a server controlled by a malicious hacker.

A program that collects your personal information, such as your browsing history, and uses it without adequate consent.

A detection that is used mostly for malware components, or tools used for malware-related actions, such as rootkits.

A type of malware. Viruses spread on their own by attaching their code to other programs, or copying themselves across systems and networks.

A type of malware that spreads to other PCs. Worms may spread using one or more of the following methods: Email programs, Instant messaging programs, File-sharing programs, Social networking sites, Network shares, Removable drives with Autorun enabled, Software vulnerabilities

Android operating system

MS-DOS platform

Psion devices

FreeBSD platform

iPhone operating system

Linux platform

MAC 9.x platform or earlier

MacOS X or later

OS2 platform

Palm operating system

System V-based Unix platforms

Unix platforms 4.1.3 or earlier

Symbian operatings system

General Unix platforms

Win16 (3.1) platform

Windows 2000 platform

Windows 32-bit platform

Windows 64-bit platform

Windows 95, 98 and ME platforms

Windows 98 platform only

Windows CE platform

WinNT

Advanced Business Application Programming scripts

ALisp scripts

AmiPro script

American National Standards Institute scripts

compiled Apple scripts

Active Server Pages scripts

AutoIT scripts

Basic scripts

Basic scripts

Corelscript scripts

HTML Application scripts

HTML Application scripts

Install scripts

mIRC/pIRC scripts

Java binaries (classes)

Javascript scripts

LOGO scripts

MapBasic scripts

Monad shell scripts

Perl scripts

Hypertext Preprocessor scripts

Python scripts

SAP platform scripts

Shell scripts

Visual Basic for Applications scripts

Visual Basic scripts

Winbatch scripts

Windows Help scripts

Windows registry scripts

Access 97, 2000, XP, 2003, 2007, and 2010 macros

macro scripting

Office 97, 2000, XP, 2003, 2007, and 2010 macros - those that affect Word, Excel, and Powerpoint

PowerPoint 97, 2000, XP, 2003, 2007, and 2010 macros

Visio5 macros

Word1Macro

Word2Macro

Word 97, 2000, XP, 2003, 2007, and 2010 macros

Word 95 macros

Excel 97, 2000, XP, 2003, 2007, and 2010 macros

Excel formulas

Excel 95 macros

XML metafile of Windows Media .asf files

HyperCard Apple scripts

MIME packets

Novell Netware files

Quicktime files

StarBasic (Staroffice XML) files

Shockwave Flash files

MS SQL server files

XML files

Adware - Software that shows you extra promotions that you cannot control as you use your PC

A type of trojan that gives a malicious hacker access to and control of your PC

A type of detection based on file actions that are often associated with malicious activity

A program than makes changes to your Internet browser without your permission

A program that can be used to automatically create malware files

When a number of PCs are made to access a website, network or server repeatedly within a given time period. The aim of the attack is to overload the target so that it crashes and can’t respond

A program that makes unauthorized telephone calls. These calls may be charged at a premium rate and cost you a lot of money

When a target PC or server is deliberately overloaded so that it doesn’t work for any visitors anymore

A piece of code that uses software vulnerabilities to access information on your PC or install malware

A type of tool that can be used to allow and maintain unauthorized access to your PC

A program that pretends to do something malicious but actually doesn’t actually do anything harmful. For example, some joke programs pretend to delete files or format disks

The program that makes misleading or fraudulent claims about files, registry entries or other items on your PC

A commercial program that monitors what you do on your PC. This can include monitoring what keys you press; your email or instant messages; your voice or video conversations; and your banking details and passwords. It can also take screenshots as you use your PC

Software that you may or may not want installed on your PC

Potentially Unwanted Applications. Characteristics of unwanted software can include depriving users of adequate choice or control over what the software does to the computer, preventing users from removing the software, or displaying advertisements without clearly identifying their source.

A type of malware that is used steal your personal information, such as user names and passwords. It often works along with a keylogger that collects and sends information about what keys you press and websites you visit to a malicious hacker

A detection for malicious programs that seize control of the computer on which they are installed. This trojan usually locks the screen and prevents the user from using the computer. It usually displays an alert message.

A program that gives someone access to your PC from a remote location. This type of program is often installed by the computer owner

Software that pretends to be an antivirus program but doesn’t actually provide any security. This type of software usually gives you a lot of alerts about threats on your PC that don’t exist. It also tries to convince you to pay for its services

A program that changes your PC settings

A program that installs unwanted software on your PC at the same time as the software you are trying to install, without adequate consent

A trojan that sends large numbers of spam emails. It may also describe the person or business responsible for sending spam

A type of trojan that makes fake emails that look like they are from a legitimate source

A program that collects your personal information, such as your browsing history, and uses it without adequate consent

A type of software that may have a legitimate purpose, but which may also be abused by malware authors

A trojan is a program that tries to look innocent, but is actually a malicious application. Unlike a virus or a worm , a trojan doesn’t spread by itself. Instead they try to look innocent to convince you to download and install them. Once installed, a trojan can steal your personal information, download more malware, or give a malicious hacker access to your PC

A type of trojan that can use your PC to click on websites or applications. They are usually used to make money for a malicious hacker by clicking on online advertisements and making it look like the website gets more traffic than it does. They can also be used to skew online polls, install programs on your PC, or make unwanted software appear more popular than it is

A type of trojan that installs other malicious files, including malware, onto your PC. It can download the files from a remote PC or install them directly from a copy that is included in its file.

A type of trojan that installs other malicious files, including malware, onto your PC. It can download the files from a remote PC or install them directly from a copy that is included in its file.

A type of trojan that sends information about your PC to a malicious hacker. It is similar to a password stealer

A type of trojan that installs a proxy server on your PC. The server can be configured so that when you use the Internet, any requests you make are sent through a server controlled by a malicious hacker.

A program that collects your personal information, such as your browsing history, and uses it without adequate consent.

A detection that is used mostly for malware components, or tools used for malware-related actions, such as rootkits.

A type of malware. Viruses spread on their own by attaching their code to other programs, or copying themselves across systems and networks.

A type of malware that spreads to other PCs. Worms may spread using one or more of the following methods: Email programs, Instant messaging programs, File-sharing programs, Social networking sites, Network shares, Removable drives with Autorun enabled, Software vulnerabilities

Android operating system

MS-DOS platform

Psion devices

FreeBSD platform

iPhone operating system

Linux platform

MAC 9.x platform or earlier

MacOS X or later

OS2 platform

Palm operating system

System V-based Unix platforms

Unix platforms 4.1.3 or earlier

Symbian operatings system

General Unix platforms

Win16 (3.1) platform

Windows 2000 platform

Windows 32-bit platform

Windows 64-bit platform

Windows 95, 98 and ME platforms

Windows 98 platform only

Windows CE platform

WinNT

Advanced Business Application Programming scripts

ALisp scripts

AmiPro script

American National Standards Institute scripts

compiled Apple scripts

Active Server Pages scripts

AutoIT scripts

Basic scripts

Basic scripts

Corelscript scripts

HTML Application scripts

HTML Application scripts

Install scripts

mIRC/pIRC scripts

Java binaries (classes)

Javascript scripts

LOGO scripts

MapBasic scripts

Monad shell scripts

Perl scripts

Hypertext Preprocessor scripts

Python scripts

SAP platform scripts

Shell scripts

Visual Basic for Applications scripts

Visual Basic scripts

Winbatch scripts

Windows Help scripts

Windows registry scripts

Access 97, 2000, XP, 2003, 2007, and 2010 macros

macro scripting

Office 97, 2000, XP, 2003, 2007, and 2010 macros - those that affect Word, Excel, and Powerpoint

PowerPoint 97, 2000, XP, 2003, 2007, and 2010 macros

Visio5 macros

Word1Macro

Word2Macro

Word 97, 2000, XP, 2003, 2007, and 2010 macros

Word 95 macros

Excel 97, 2000, XP, 2003, 2007, and 2010 macros

Excel formulas

Excel 95 macros

XML metafile of Windows Media .asf files

HyperCard Apple scripts

MIME packets

Novell Netware files

Quicktime files

StarBasic (Staroffice XML) files

Shockwave Flash files

MS SQL server files

XML files

2008 - A family of trojans that often pose as downloadable media codecs. When installed, Win32/Zlob displays frequent pop-up advertisements for rogue security software

2008 - A multiplecomponent family of programs that deliver pop-up advertisements and may download and execute arbitrary files. Vundo is often installed as a browser helper object (BHO) without a user’s consent

2008 - multi-component malware family that displays pop-up advertisements for rogue security software

2008 - A trojan that downloads and executes arbitrary files, usually to send spam. Win32/Cutwail has also been observed to transmit Win32/Newacc

2008 - a backdoor trojan that allows an attacker access and control of the compromised computer. This trojan may connect with remote web sites and SMTP servers.

2008 - An attacker tool that automatically registers new e-mail accounts on Hotmail, AOL, Gmail, Lycos and other account service providers, using a Web service to decode CAPTCHA protection.

2008 - A trojan that transmits CAPTCHA images to a botnet, in what is believed to be an effort to improve the botnet’s ability to detect characters and break CAPTCHAs more successfully

2008 - A family of worms that spread through mapped drives in order to steal login and account details for popular online games.

2008 - A large family of password-stealing trojans that target confidential data, such as account information, from massively multiplayer online games

2008 - A family of trojans that steals online game passwords and sends this captured data to remote sites.

2008 - A collection of trojans that steal information such as passwords for online games, usually by reading information directly from running processes in memory. Different variants target different processes.

2008 - a loosely-related family of trojans that attempt to steal passwords for popular online games. Detections containing the name Win32/Corripio are generic, and hence may be reported for a large number of different malicious password-stealing trojans that are otherwise behaviorally dissimilar.

2008 - A family of malware that steals information from online games.

2008 - A family of trojans that sends account information from popular online games to a remote server. They may also download and execute arbitrary files.

2008 - A family of trojans that steals online game passwords and sends this captured data to remote sites.

2008 - A family of trojan downloaders that installs rogue security software.

2008 - Adware that monitors the user’s Web-browsing activity and displays pop-up advertisements related to the Internet sites the user is viewing.

2008 - Adware that displays targeted advertising to affected users while they browse the Internet, based on search terms entered into search engines.

2008 - A rogue security software family that claims to scan for malware and then demands that the user pay to remove nonexistent threats. Some variants unlawfully use Microsoft logos and trademarks.

2008 - A rogue security software family that claims to scan for malware and then demands that the user pay to remove non-existent threats. It appears to be based on Win32/SpySheriff

2008 - Adware that displays a dynamic toolbar and targeted pop-up ads based on its monitoring of Web-browsing activity.

2008 - A generic detection for a number of trojans that may perform different malicious functions. The behaviors exhibited by this family are highly variable

2008 - A detection for malicious Windows Media files that can be used to encourage users to download and execute arbitrary files on an affected machine.

2008 - A Chinese language Web browser toolbar that delivers pop-up and contextual advertisements, blocks certain other advertisements, and changes the Internet Explorer search page

2008 - A detection for various threats written in the Visual Basic programming language.

2008 - A program that displays misleading security alerts in order to convince users to purchase rogue security software. It may be installed by Win32/Renos or manually by a computer user.

2008 - An adware family that may display advertisements in connection with the use of a 'free music player' from the site 'PlayMP3z.biz.'

2008 - a family of Trojans that may download and run other malicious software or may steal user data and send it to the attacker via HTTP POST or email. The Win32/Tibs family frequently downloads Trojans belonging to the Win32/Harnig and Win32/Passalert families, both of which are families of Trojan downloaders which may in turn download and run other malicious software

2008 - Adware that displays targeted search results and pop-up advertisements based on terms that the user enters for Web searches. The pop-up advertisements may include adult content.

2008 - a worm that attempts to spread by copying itself to newly attached media (such as USB memory devices or network drives). It also contains backdoor functionality that allows an attacker unauthorized access to an affected computer

2008 - A program that displays misleading warning messages in order to convince users to purchase a product that removes spyware

2008 - A program that locates various registry entries, Windows prefetch content, and other types of data, identifies them as privacy violations, and urges the user to purchase the product to fix them.

2008 - a trojan that modifies Web browser settings, adds Web browser bookmarks to advertisements, updates itself and delivers pop-up and contextual advertisements.

2008 - a multicomponent family of trojans that downloads and executes arbitrary files. Some variants of this family may install a toolbar. observed to use the Win32/Slenfbot worm as a means of distribution.

2008 - CAPTCHA Breaker typically delivered through an executable application that masquerades as an illegal software crack or key generator

2008 - A family of worms that can spread via instant messaging programs, and may spread via removable drives. They also contain backdoor functionality that allows unauthorized access to an affected machine. This worm does not spread automatically upon installation but must be ordered to spread by a remote attacker.

2008 - A multicomponent family of rootkitenabled backdoor trojans, developed to aid in the distribution of spam. Recent variants appear to be associated with the incidence of rogue security programs.

2008 - a family of trojans that are sometimes installed by exploits of a vulnerability documented in Microsoft Security Bulletin MS08-067.

2008 - A family of trojans that display fake warnings of spyware or malware in an attempt to lure the user into installing or paying money to register rogue security products such as Win32/FakeXPA.

2008 - This virus spreads by attaching its code to other files on your PC or network. Some of the infected programs might no longer run correctly. Attempts to send personal information to a remote address. It may spread via e-mail, network shares, or peer-to-peer file sharing.

2008 - A trojan that exploits a vulnerability in Adobe Flash Player to download malicious files. Adobe has published security bulletin APSB08-11 addressing the vulnerability.

2008 - A group of threats, written in JavaScript, that attempt to exploit multiple vulnerabilities on affected computers in order to download, execute or otherwise run arbitrary code. The malicious JavaScript may be hosted on compromised or malicious websites, embedded in specially crafted PDF files, or could be called by other malicious scripts.

2008 - a family of mass-mailing e-mail and network worms. The Win32/Wukill worm spreads to root directories on certain local and mapped drives. The worm also spreads by sending a copy of itself as an attachment to e-mail addresses found on the infected computer.

2008 - A detection for a Javascript file that exploits a known vulnerability in the Microsoft Access Snapshot Viewer ActiveX Control.

2008 - The threat is a piece of JavaScript code that is inserted on bad or hacked websites. It can direct your browser to a website you don’t want to go to. You might see the detection for this threat if you visit a bad or hacked website, or if you open an email message.

2008 - a detection for a proof-of-concept JavaScript obfuscation technique, which was originally published in 2002 in the sixth issue of 29A, an early online magazine for virus creators

2008 - A detection for certain malicious JavaScript code injected in HTML pages. The virus will execute on user computers that visit compromised websites.

2008 - A P2P file-sharing client that uses the decentralized Gnutella network. Free versions of BearShare have come bundled with advertising supported and other potentially unwanted software.

2008 - A program that redirects Web search results to other Web sites and may display various advertisements to users while browsing Web sites.

2008 - An Internet browser search toolbar that may be installed by other third-party software, such as a peer-to-peer file sharing application. It may modify Internet explorer search settings and display unwanted advertisements.

2008 - Commercial remote administration software that can be used to control a computer. These programs are typically installed by the computer owner or administrator and should only be removed if unexpected

2008 - A remote access program that can be used to control a computer. This program is typically installed by the computer owner or administrator, and should only be removed if unexpected.

2008 - A remote administration tool that can be used to control a computer. These programs are typically installed by the computer owner or administrator and should only be removed if unexpected

2008 - A remote control program that allows full control of the computer. These programs are typically installed by the computer owner or administrator and should only be removed if unexpected

2008 - A detection for the DameWare Mini Remote Control tools. This program was detected by definitions prior to 1.147.1889.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors. Microsoft has released definition 1.147.1889.0 which no longer detects this program.

2008 - A detection that is triggered by modified (that is, edited and re-packed) remote control programs based on DameWare Mini Remote Control, a commercial software product

2008 - A program that may display advertisements and redirect user searches to a certain website. It may also download malicious or unwanted content into the system without user consent.

2008 - A family with a worm component and a virus component. The worm component spreads by email and by exploiting a vulnerability addressed by Microsoft Security Bulletin MS01-020. The virus component may infect .exe, .scr, and HTML files.

2008 - A family of polymorphic file infectors that target executable files with the extensions .scr or .exe. They may execute a damaging payload that deletes files with certain extensions and terminates security-related processes and services.

2008 - A detection for programs that use a combination of obfuscation techniques to hinder analysis or detection by antivirus scanners

2008 - a detection of malicious code that attempts to exploit a vulnerability in the Microsoft Virtual Machine (VM). This flaw enables attackers to execute arbitrary code on a user’s machine such as writing, downloading and executing additional malware. This vulnerability is addressed by update MS03-011, released in 2003.

2008 - A family of worms that spreads by copying itself to the mapped drives of an infected computer. The mapped drives may include network or removable drives.

2008 - A worm that spreads through removable drives, such as USB memory sticks. It may contain an IRC-based backdoor enabling the computer to be controlled remotely by an attacker

2008 - a family of mass-mailing e-mail worms. The worm spreads by sending a copy of itself as an e-mail attachment to e-mail addresses that it gathers from files on the infected computer. It can also copy itself to USB and pen drives. Win32/Brontok can disable antivirus and security software, immediately terminate certain applications, and cause Windows to restart immediately when certain applications run. The worm may also conduct denial of service (DoS) attacks against certain Web sites

2008 - A rogue security software family that may falsely claim that the user’s computer is infected and encourages the user to buy a product for cleaning the alleged malware from the computer

2008 - A trojan that may upload computer operating system details to a remote Web site, download additional malware, and terminate debugging utilities

2008 - A program that displays false and misleading malware alerts to convince users to purchase rogue security software. This program also displays a fake Windows Security Center message

2008 - A family of trojan droppers that install a distributed P2P downloader trojan. This downloader trojan in turn downloads an e-mail worm component.

2008 - A family of backdoor trojans that allows attackers to control the computer through an IRC channel

2008 - A large family of backdoor trojans that drops malicious software and connects to IRC servers via a backdoor to receive commands from attackers.

2008 - A program that displays targeted search results and pop-up advertisements based on terms that the user enters for Web searches. The pop-up advertisements may include adult content

2008 - A management tool that allows a computer to be controlled remotely. It can be installed for legitimate purposes, but can also be installed from a remote location by an attacker.

2008 - A family of software that provides the ability to search for adult content on local disk. It may also install other potentially unwanted software, such as programs that display pop-up ads.

2008 - A trojan that downloads and executes arbitrary files. It is sometimes distributed by ASX/Wimad.

2008 - This is a generic detection for trojans that install and run malware on your PC. These trojans have been deliberately created in a complex way to hide their purpose and make them difficult to analyze.

2008 - A family of data-stealing trojans that captures banking credentials such as account numbers and passwords from computer users and relays them to the attacker. Most variants target customers of Brazilian banks; some variants target customers of other banks.

2008 - a family of password-stealing trojans. This trojan gathers private user data such as passwords from the host computer and sends the data to the attacker at a preset e-mail address. The Win32/Ldpinch trojans use their own Simple Mail Transfer Protocol (SMTP) engine or a web-based proxy for sending the e-mail, thus copies of the sent e-mail will not appear in the affected user’s e-mail client.

2008 - a family of adware that displays pop-up advertisements and contacts a remote server to download updates

2008 - a family of polymorphic file infectors that targets computers running Microsoft Windows. The virus infects .exe and .scr executable files on the local file system and on writeable network shares. In turn, the infected executable files perform operations that cause other .exe and .scr files to become infected.

2008 - an indicator that the computer’s HOSTS file may have been modified by malicious or potentially unwanted software

2008 - A data-stealing trojan that gathers confidential information such as user names, passwords, and credit card data from incoming and outgoing Internet traffic. It may also download malicious data and modify DNS settings.

2008 - This program was detected by definitions prior to 1.159.567.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors. Microsoft has released definition 1.159.567.0 which no longer detects this program.

2008 - A trojan that attempts to exploit a vulnerability in Adobe Flash Player. In the wild, this trojan has been used to download and execute arbitrary files, including other malware.

2008 - A family of Trojans that installs themselves as Browser Helper Objects (BHOs), and connects to the Internet without user consent. They also terminate specific security services, and download additional malware to the computer.

2008 - This program was detected by definitions prior to 1.159.567.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors. Microsoft has released definition 1.159.567.0 which no longer detects this program.

2008 - A program that may falsely claim that the user’s system is infected and encourages the user to buy a promoted product for cleaning the alleged malware from the computer.

2008 - A program, that may be distributed in the form of a freeware application, that displays advertisements, downloads additional files, and uses stealth to hide its presence

2008 - A trojan that downloads and executes arbitrary files. It may be distributed by as a Microsoft Office Outlook addon used to display emoticons or other animated icons within e-mail messages.

2008 - delivers advertisements, and as the name suggests, rotates advertisements among sponsors. AdRotator contacts remote Web sites in order to deliver updated content. This application also displays fake error messages that encourage users to download and install additional applications.

2008 - A family of trojans that display pop-up advertisements depending on the user’s keywords and browsing history. Its variants can monitor the user’s activities, download applications, and send system information back to a remote server.

2008 - A family of Trojans that monitor and redirect Internet traffic, gather system information and download unwanted software such as Win32/Renos and Win32/SpySheriff. Win32/Busky may be installed by a Web browser exploit or other vulnerability when visiting a malicious Web site.

2008 - This program was detected by definitions prior to 1.173.303.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors.

2008 - This program was detected by definitions prior to 1.175.2037.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors.

2008 - Detected by definitions prior to 1.155.995.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors. Microsoft has released definition 1.155.995.0 which no longer detects this program.

2008 - A family of backdoor trojans that allows attackers to control infected computers. After a computer is infected, the trojan connects to an internet relay chat (IRC) server and joins a channel to receive commands from attackers.

2008 - This threat can download and run files on your PC.

2008 - This threat can perform a number of actions of a malicious hacker’s choice on your PC.

2008 - This program was detected by definitions prior to 1.175.1834.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors.

2008 - virus infects executable files, such as files with a .exe extension. When an infected file runs, the virus tries to run the original content of the file while it infects other executable files on your PC. This threat might have got on your PC if you inserted a removable disk or accessed a network connection that was infected.

2008 - An adware that redirects web browsing to advertising or search sites.

2008 - a DLL component which may be utilized by adware or malicious programs in order to monitor an affected user’s Internet usage and to capture sensitive information. Win32/RuPass has been distributed as a 420,352 byte DLL file, with the file name 'ConnectionServices.dll'.

2008 - Modifies the user’s browser to deliver targeted advertisements when the user enters search keywords. It may also replace or override web browser error pages that would otherwise be displayed when unresolvable web addresses are entered into the browser’s address bar.

2008 - Software that displays advertisements and tracks anonymous usage information in exchange for a free online gaming experience at the Web address 'gamevance.com.'

2008 - is a browser helper object (BHO) that takes advantage of invalid or mistyped URLs entered in the address bar by redirecting the browser to Web sites containing adware

2008 - This program was detected by definitions prior to 1.175.2037.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors.

2008 - A Trojan that lowers security settings, delivers advertisements, and sends system and network configuration details to a remote Web site.

2008 - The tool can capture your activity on your PC (such as the keys you press when typing in passwords) and might send this information to a hacker.

2008 - A family of trojans that uses a dropper to install one or more backdoor files and sometimes installs a password stealer or other malicious programs.

2008 - enables Chinese keyword searching in Internet Explorer and adds support for other applications to use Chinese domain names that registered with CNNIC. Also contains a kernel driver that protects its files and registry settings from being modified or deleted

2008 - May display advertisement pop-ups, and download programs from predefined Web sites. When installed, Win32/MotePro runs as a Web Browser Helper Object (BHO).

2008 - Installs a browser helper object (BHO) that redirects Internet Explorer searches to a Chinese search portal. CnsMin may be installed without adequate user consent. It may prevent its files from being removed or restore files that have been previously removed.

2008 - A detection for an address line search tool. This program was detected by definitions prior to 1.153.956.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors. Microsoft has released definition 1.153.956.0 which no longer detects this program.

2008 - This program was detected by definitions prior to 1.175.1915.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors.

2008 - This program was detected by definitions prior to 1.175.1834.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors.

2008 - a DLL file which is usually introduced to an affected system as a component of BrowserModifier:Win32/BaiduSobar. It may display unwanted pop-ups and advertisements on the affected system.

2008 - A trojan dialer program that connects to a premium number, or attempts to connect to adult websites via particular phone numbers without your permission, connects to remote hosts without user consent.

2008 - A dialer program that may attempt to dial a premium number, thus possibly resulting in international phone charges for the user.

2008 - A family of backdoor Trojans that allows a remote attacker to download and run arbitrary programs, and which may upload computer configuration information and other potentially sensitive data to remote Web sites.

2008 - A family of worms that targets certain versions of Microsoft Windows. The worm spreads using a Japanese peer-to-peer file-sharing application named Winny. The worm creates a copy of itself with a deceptive file name in the Winny upload folder so that it can be downloaded by other Winny users.

2008 - A program that monitors an affected user’s Internet usage and reports this usage to a remote server. Win32/RewardNetwork may be visible as an Internet Explorer toolbar.

2008 - A family of file infecting viruses that target and infect .exe and .scr files accessed on infected systems. Win32/Virut also opens a backdoor by connecting to an IRC server

2008 - A multi-threaded, polymorphic network worm capable of spreading to other computers connected to a local area network (LAN) and performing denial-of-service (DoS) attacks against targeted remote Web sites.

2008 - This virus spreads by attaching its code to other files on your PC or network. Some of the infected programs might no longer run correctly.

2008 - A generic detection for a variety of threats.

2008 - A mass-mailing worm that spreads by e-mailing itself to addresses found on an infected computer. Some variants contain a backdoor component and perform DoS attacks.

2008 - A virus that spreads by infecting executable files, by inserting itself into .RAR archive files, and by sending a copy of itself as an attachment to e-mail addresses found on the infected computer. This virus has a date-activated, file damaging payload, and may connect to a remote server and accept commands from an attacker.

2008 - A generic detection for specially formed IFrame tags that point to remote websites that contain malicious content.

2008 - This threat is classified as a mass-mailing worm. A mass mailing email worm is self-contained malicious code that propagates by sending itself through e-mail. Typically, a mass mailing email worm uses its own SMTP engine to send itself, thus copies of the sent worm will not appear in the infected user’s outgoing or sent email folders. Technical details are currently not available.

2008 - This threat downloads and installs other programs, including other malware, onto your PC without your consent.

2008 - This threat can perform a number of actions of a malicious hacker’s choice on your PC.

2008 - A worm that spreads by exploiting a vulnerability addressed by Security Bulletin MS08-067. Some variants also spread via removable drives and by exploiting weak passwords. It disables several important system services and security products and downloads arbitrary files.

2009 - A family of mass-mailing worms that targets computers running certain versions of Windows. It can spread as an e-mail attachment and through an Internet Relay Chat (IRC) channel. The worm can download, overwrite, delete, infect, and run files on the infected computer.

2009 - A generic detection for VBScript code that is known to be automatically generated by a particular malware tool.

2009 - A memory resident worm that spreads through a vulnerability present in computers running either MSDE 2000 or SQL Server that have not applied Microsoft Security Bulletin MS02-039.

2009 - A family of network worms that exploit a vulnerability addressed by security bulletin MS03-039. The worm may attempt Denial of Service (DoS) attacks on some server sites or create a backdoor on the infected system

2009 - A family of network worms that exploit a vulnerability fixed by security bulletin MS04-011. The worm spreads by randomly scanning IP addresses for vulnerable machines and infecting any that are found

2009 - A family of worms that spread by exploiting a vulnerability addressed by Microsoft Security Bulletin MS01-020. The worm compromises security by sharing the C drive and creating a Guest account with administrator permissions.

2009 - A family of massmailing worms that spread through e-mail. Some variants also spread through P2P networks. It acts as a backdoor trojan and can sometimes be used to launch DoS attacks against specific Web sites

2009 - A worm that spreads by e-mailing itself to addresses found on an infected computer. Some variants also spread through peer-to-peer (P2P) networks. Bagle acts as a backdoor trojan and can be used to distribute other malicious software.

2009 - A family of rogue security software programs that have been distributed with several different names. The user interface varies to reflect each variant’s individual branding

2009 - A multicomponent family of malware used to compromise computers and use them to perform various malicious tasks. It spreads through the internal messaging systems of popular social networking sites

2009 - a family of specially crafted PDF files that exploits vulnerabilities in Adobe Acrobat and Adobe Reader. The files contain malicious JavaScript that executes when opened with a vulnerable program.

2009 - a browser modifier that redirects users when invalid Web site addresses or search terms are entered in the Windows Internet Explorer address bar

2009 - A trojan that steals password details from an infected computer by monitoring network traffic associated with FTP connections.

2009 - A rogue security software family that impersonates the Windows Security Center. It may display product names or logos in an apparently unlawful attempt to impersonate Microsoft products

2009 - A trojan that is used to send spam. It also has the ability to download and execute arbitrary files, harvest e-mail addresses from the local machine, perform denial-of-service attacks, proxy network traffic, and sniff passwords

2009 - This threat can perform a number of actions of a malicious hacker’s choice on your PC.

2009 - A family of worms that spreads via email, removable drives, Peer-to-Peer (P2P) and network shares. This worm may also drop and execute other malware.

2009 - A mass-mailing network worm that targets certain versions of Microsoft Windows. The worm spreads through e-mail attachments and writeable network shares. It is designed to corrupt the content of specific files on the third day of every month.

2009 - A macro worm that spreads via e-mail and by infecting Word documents and templates. It is designed to work in Word 97 and Word 2000, and it uses Outlook to reach new targets through e-mail

2009 - A family of multicomponent trojans that download and execute additional malicious files. While downloading, some variants display a video from the Web site 'youtube.com' presumably to distract the user

2009 - A family of trojans that steals online game passwords and sends them to remote sites.

2009 - a polymorphic virus that infects Windows executable files. Apart from spreading through file infection, it also attempts to spread through e-mail attachments, network shares, removable drives and by CD-burning. It also contains a date-based payload that encrypts files with particular extensions.

2009 - A family of trojans that steals login information for popular online games. The gathered information is then sent to remote websites.

2009 - a family of programs that claims to scan for malware and displays fake warnings of 'malicious programs and viruses'. They then inform the user that they need to pay money to register the software in order to remove these non-existent threats.

2009 - This family of rogue security programs pretend to scan your PC for malware, and often report lots of infections. The program will say you have to pay for it before it can fully clean your PC. However, the program hasn’t really detected any malware at all and isn’t really an antivirus or antimalware scanner. It just looks like one so you’ll send money to the people who made the program. Some of these programs use product names or logos that unlawfully impersonate Microsoft products.

2009 - A downloader that can access and execute arbitrary files from a remote host. Bredolab has been observed to download several other malware families to infected computers

2009 - A trojan that downloads other malware from predefined Web sites. Rugzip may itself be installed by other malware. Once it has performed its malicious routines, it deletes itself to avoid detection.

2009 - A rogue security family that falsely claims that the affected computer is infected with malware and encourages the user to buy a promoted product it claims will clean the computer.

2009 - A trojan that downloads malware known as 'SpywareIsolator' a rogue security software program.

2009 - A family of backdoor trojans that allow unauthorized access to and control of an affected machine. Poisonivy attempts to hide by injecting itself into other processes