Duplicate of the existing leaks.

Number of known duplicates.

When the leak has been accessible or seen for the first time.

When the leak has been accessible or seen for the last time.

The link where the leak is (or was) accessible at first-seen.

When the information available in the leak was created. It’s usually before the first-seen.

Raw data as received by the AIL sensor compressed and encoded in Base64.

The AIL sensor uuid where the leak was processed and analysed.

A description of the leak which could include the potential victim(s) or description of the leak.

AIS Administrative Area represented using ISO-3166-2.

AIS Country represented using ISO-3166-1_alpha-2.

AIS IndustryType. ['Chemical Sector', 'Commercial Facilities Sector', 'Communications Sector', 'Critical Manufacturing Sector', 'Dams Sector', 'Defense Industrial Base Sector', 'Emergency Services Sector', 'Energy Sector', 'Financial Services Sector', 'Food and Agriculture Sector', 'Government Facilities Sector', 'Healthcare and Public Health Sector', 'Information Technology Sector', 'Nuclear Reactors, Materials, and Waste Sector', 'Transportation Systems Sector', 'Water and Wastewater Systems Sector', 'Other']

AIS Organisation Name.

Comment about the set of android permission(s)

Android permission ['ACCESS_CHECKIN_PROPERTIES', 'ACCESS_COARSE_LOCATION', 'ACCESS_FINE_LOCATION', 'ACCESS_LOCATION_EXTRA_COMMANDS', 'ACCESS_NETWORK_STATE', 'ACCESS_NOTIFICATION_POLICY', 'ACCESS_WIFI_STATE', 'ACCOUNT_MANAGER', 'ADD_VOICEMAIL', 'ANSWER_PHONE_CALLS', 'BATTERY_STATS', 'BIND_ACCESSIBILITY_SERVICE', 'BIND_APPWIDGET', 'BIND_AUTOFILL_SERVICE', 'BIND_CARRIER_MESSAGING_SERVICE', 'BIND_CHOOSER_TARGET_SERVICE', 'BIND_CONDITION_PROVIDER_SERVICE', 'BIND_DEVICE_ADMIN', 'BIND_DREAM_SERVICE', 'BIND_INCALL_SERVICE', 'BIND_INPUT_METHOD', 'BIND_MIDI_DEVICE_SERVICE', 'BIND_NFC_SERVICE', 'BIND_NOTIFICATION_LISTENER_SERVICE', 'BIND_PRINT_SERVICE', 'BIND_QUICK_SETTINGS_TILE', 'BIND_REMOTEVIEWS', 'BIND_SCREENING_SERVICE', 'BIND_TELECOM_CONNECTION_SERVICE', 'BIND_TEXT_SERVICE', 'BIND_TV_INPUT', 'BIND_VISUAL_VOICEMAIL_SERVICE', 'BIND_VOICE_INTERACTION', 'BIND_VPN_SERVICE', 'BIND_VR_LISTENER_SERVICE', 'BIND_WALLPAPER', 'BLUETOOTH', 'BLUETOOTH_ADMIN', 'BLUETOOTH_PRIVILEGED', 'BODY_SENSORS', 'BROADCAST_PACKAGE_REMOVED', 'BROADCAST_SMS', 'BROADCAST_STICKY', 'BROADCAST_WAP_PUSH', 'CALL_PHONE', 'CALL_PRIVILEGED', 'CAMERA', 'CAPTURE_AUDIO_OUTPUT', 'CAPTURE_SECURE_VIDEO_OUTPUT', 'CAPTURE_VIDEO_OUTPUT', 'CHANGE_COMPONENT_ENABLED_STATE', 'CHANGE_CONFIGURATION', 'CHANGE_NETWORK_STATE', 'CHANGE_WIFI_MULTICAST_STATE', 'CHANGE_WIFI_STATE', 'CLEAR_APP_CACHE', 'CONTROL_LOCATION_UPDATES', 'DELETE_CACHE_FILES', 'DELETE_PACKAGES', 'DIAGNOSTIC', 'DISABLE_KEYGUARD', 'DUMP', 'EXPAND_STATUS_BAR', 'FACTORY_TEST', 'GET_ACCOUNTS', 'GET_ACCOUNTS_PRIVILEGED', 'GET_PACKAGE_SIZE', 'GET_TASKS', 'GLOBAL_SEARCH', 'INSTALL_LOCATION_PROVIDER', 'INSTALL_PACKAGES', 'INSTALL_SHORTCUT', 'INSTANT_APP_FOREGROUND_SERVICE', 'INTERNET', 'KILL_BACKGROUND_PROCESSES', 'LOCATION_HARDWARE', 'MANAGE_DOCUMENTS', 'MANAGE_OWN_CALLS', 'MASTER_CLEAR', 'MEDIA_CONTENT_CONTROL', 'MODIFY_AUDIO_SETTINGS', 'MODIFY_PHONE_STATE', 'MOUNT_FORMAT_FILESYSTEMS', 'MOUNT_UNMOUNT_FILESYSTEMS', 'NFC', 'PACKAGE_USAGE_STATS', 'PERSISTENT_ACTIVITY', 'PROCESS_OUTGOING_CALLS', 'READ_CALENDAR', 'READ_CALL_LOG', 'READ_CONTACTS', 'READ_EXTERNAL_STORAGE', 'READ_FRAME_BUFFER', 'READ_INPUT_STATE', 'READ_LOGS', 'READ_PHONE_NUMBERS', 'READ_PHONE_STATE', 'READ_SMS', 'READ_SYNC_SETTINGS', 'READ_SYNC_STATS', 'READ_VOICEMAIL', 'REBOOT', 'RECEIVE_BOOT_COMPLETED', 'RECEIVE_MMS', 'RECEIVE_SMS', 'RECEIVE_WAP_PUSH', 'RECORD_AUDIO', 'REORDER_TASKS', 'REQUEST_COMPANION_RUN_IN_BACKGROUND', 'REQUEST_COMPANION_USE_DATA_IN_BACKGROUND', 'REQUEST_DELETE_PACKAGES', 'REQUEST_IGNORE_BATTERY_OPTIMIZATIONS', 'REQUEST_INSTALL_PACKAGES', 'RESTART_PACKAGES', 'SEND_RESPOND_VIA_MESSAGE', 'SEND_SMS', 'SET_ALARM', 'SET_ALWAYS_FINISH', 'SET_ANIMATION_SCALE', 'SET_DEBUG_APP', 'SET_PREFERRED_APPLICATIONS', 'SET_PROCESS_LIMIT', 'SET_TIME', 'SET_TIME_ZONE', 'SET_WALLPAPER', 'SET_WALLPAPER_HINTS', 'SIGNAL_PERSISTENT_PROCESSES', 'STATUS_BAR', 'SYSTEM_ALERT_WINDOW', 'TRANSMIT_IR', 'UNINSTALL_SHORTCUT', 'UPDATE_DEVICE_STATS', 'USE_FINGERPRINT', 'USE_SIP', 'VIBRATE', 'WAKE_LOCK', 'WRITE_APN_SETTINGS', 'WRITE_CALENDAR', 'WRITE_CALL_LOG', 'WRITE_CONTACTS', 'WRITE_EXTERNAL_STORAGE', 'WRITE_GSERVICES', 'WRITE_SECURE_SETTINGS', 'WRITE_SETTINGS', 'WRITE_SYNC_SETTINGS', 'WRITE_VOICEMAIL']

An attachment to support the annotation

Initial creation of the annotation

Format of the annotation ['text', 'markdown', 'asciidoctor', 'MultiMarkdown', 'GFM', 'pandoc', 'Fountain', 'CommonWork', 'kramdown-rfc2629', 'rfc7328', 'Extra']

Last update of the annotation

Reference(s) to the annotation

Raw text of the annotation

Type of the annotation ['Annotation', 'Executive Summary', 'Introduction', 'Conclusion', 'Disclaimer', 'Keywords', 'Acknowledgement', 'Other', 'Copyright', 'Authors', 'Logo', 'Full Report']

Description of the anonymisation technique or tool used

Encryption function or algorithm used to anonymise the attribute ['aes128', 'aes-128-cbc', 'aes-128-cfb', 'aes-128-cfb1', 'aes-128-cfb8', 'aes-128-ctr', 'aes-128-ecb', 'aes-128-ofb', 'aes192', 'aes-192-cbc', 'aes-192-cfb', 'aes-192-cfb1', 'aes-192-cfb8', 'aes-192-ctr', 'aes-192-ecb', 'aes-192-ofb', 'aes-256-cfb', 'aes-256-cfb1', 'aes-256-cfb8', 'aes-256-ctr', 'aes-256-ecb', 'aes-256-ofb', 'bf', 'bf-cbc', 'bf-cfb', 'bf-ecb', 'bf-ofb', 'blowfish', 'camellia128', 'camellia-128-cbc', 'camellia-128-cfb', 'camellia-128-cfb1', 'camellia-128-cfb8', 'camellia-128-ctr', 'camellia-128-ecb', 'camellia-128-ofb', 'camellia192', 'camellia-192-cbc', 'camellia-192-cfb', 'camellia-192-cfb1', 'camellia-192-cfb8', 'camellia-192-ctr', 'camellia-192-ecb', 'camellia-192-ofb', 'camellia256', 'camellia-256-cbc', 'camellia-256-cfb', 'camellia-256-cfb1', 'camellia-256-cfb8', 'camellia-256-ctr', 'camellia-256-ecb', 'camellia-256-ofb', 'cast', 'cast5-cbc', 'cast5-cfb', 'cast5-ecb', 'cast5-ofb', 'cast-cbc', 'des', 'des3', 'des-cbc', 'des-cfb', 'des-ecb', 'des-ede', 'des-ede3', 'des-ede3-cbc', 'des-ede3-cfb', 'des-ede3-ofb', 'des-ede-cbc', 'des-ede-cfb', 'des-ede-ofb', 'des-ofb', 'desx', 'gost89', 'gost89-cnt', 'idea', 'idea-cbc', 'idea-cfb', 'idea-ecb', 'idea-ofb', 'rc2', 'rc2-40-cbc', 'rc2-64-cbc', 'rc2-cbc', 'rc2-cfb', 'rc2-ecb', 'rc2-ofb', 'rc4', 'rc4-40', 'rc4-64', 'rc5', 'rc5-cbc', 'rc5-cfb', 'rc5-ecb', 'rc5-ofb', 'seed', 'seed-cbc', 'seed-cfb', 'seed-ecb', 'seed-ofb', 'sm4', 'sm4-cbc', 'sm4-cfb', 'sm4-ctr', 'sm4-ecb', 'sm4-ofb']

Initialisation vector for the encryption function used to anonymise the attribute

Key (such as a PSK in a keyed-hash-function) used to anonymise the attribute

Keyed-hash function used to anonymise the attribute ['hmac-sha1', 'hmac-md5', 'hmac-sha256', 'hmac-sha384', 'hmac-sha512']

Level of knowledge of the organisation who created this object ['Only the anonymised data is known', 'Deanonymised data is known']

Anonymisation (or pseudo-anonymisation) method(s) used ["hiding - Attribute is replaced with a constant value (typically 0) of the same size. Sometimes called 'black marker'.", 'hash - A hash function maps each attribute to a new (not necessarily unique) attribute.', 'permutation - Maps each original value to a unique new value.', "prefix-preserving - Any two values that had the same n-bit prefix before anonymisation will still have the same n-bit prefix as each other after anonymization. (Would be more accurately called 'prefix-relationship-preserving', because the actual prefix values are not preserved.) ", 'shift - Adds a fixed offset to each value/attribute.', 'enumeration - Map each original value to a new value such that their ordering is preserved.', 'partitioning - Possible values are partitioned into meaningful sets; actual values are replaced with a fixed value from the same set. E.g., TCP port numbers 0 to 1023 are replaced with 0, and 1024 to 65535 replaced with 65535.', 'updated - Checksums are recalculated to reflect changes made to other fields.', 'truncation - Field is shortened, losing data at the end.', 'encryption - Attribute is encrypted.']

Regular expression to perfom the anonymisation (reversible or not)

Autonomous System Number

Country code of the main location of the autonomous system

Description of the autonomous system

The outbound routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format

First time the ASN was seen

The inbound IPv4 routing policy of the AS in RFC 2622 – Routing Policy Specification Language (RPSL) format

Last time the ASN was seen

This attribute performs the same function as the export attribute above. The difference is that mp-export allows both IPv4 and IPv6 address families to be specified. The export is described in RFC 4012 – Routing Policy Specification Language next generation (RPSLng), section 4.5. format

The inbound IPv4 or IPv6 routing policy of the AS in RFC 4012 – Routing Policy Specification Language next generation (RPSLng), section 4.5. format

Subnet announced

CAPEC ID.

Name of the attack pattern.

Prerequisites for the attack pattern to succeed.

External references

Weakness related to the attack pattern.

Solutions for the attack pattern to be countered.

Summary description of the attack pattern.

Content type

Digest algorithm

Issuer of the certificate

Program name

Signature algorithm ['SHA1_WITH_RSA_ENCRYPTION', 'SHA256_WITH_RSA_ENCRYPTION']

Free text description of the signer info

Url

Version of the certificate

Datetime

Name of detection signature

Name of antivirus software

Free text value to attach to the file

ABA routing transit number

Account number

A field to freely describe the bank account details.

The balance of the account after the suspicious transaction was processed.

Final beneficiary of the bank account.

Comment about the final beneficiary.

Branch code or name

Client number as seen by the bank.

When the account was closed.

Comments about the bank account.

Currency of the account. ['USD', 'EUR']

When the balance was reported.

IBAN of the bank account.

Institution code of the bank.

Name of the bank or financial organisation.

A flag to define if this account belong to a non-banking organisation. If set to true, it’s a non-banking organisation.

When the account was opened.

Account type. ['A - Business', 'B - Personal Current', 'C - Savings', 'D - Trust Account', 'E - Trading Account', 'O - Other']

Report code of the bank account. ['CTR Cash Transaction Report', 'STR Suspicious Transaction Report', 'EFT Electronic Funds Transfer', 'IFT International Funds Transfer', 'TFR Terror Financing Report', 'BCR Border Cash Report', 'UTR Unusual Transaction Report', 'AIF Additional Information File – Can be used for example to get full disclosure of transactions of an account for a period of time without reporting it as a CTR.', 'IRI Incoming Request for Information – International', 'ORI Outgoing Request for Information – International', 'IRD Incoming Request for Information – Domestic', 'ORD Outgoing Request for Information – Domestic']

Account status at the time of the transaction processed. ['A - Active', 'B - Inactive', 'C - Dormant']

SWIFT or BIC as defined in ISO 9362.

A description of the bank account.

Country code of the main location of the attacking autonomous system

BGP Hijack details

Detected Autonomous System Number

Last time the Prefix hijack was seen

Expected Autonomous System Number

First time the Prefix hijack was seen

Subnet announced

Archive of the original document (Internet Archive, Archive.is, etc).

Initial creation of the blog post.

Site linked by the blog post.

Safe site linked by the blog post.

Original link into the blog post (Supposed harmless).

Last update of the blog post.

Raw post.

When the blog post was removed.

Title of blog post.

Type of blog post. ['Medium', 'WordPress', 'Blogger', 'Tumbler', 'LiveJournal', 'Forum', 'Other']

Original URL location of the blog post (potentially malicious).

Username who posted the blog post.

Username who are quoted into the blog post.

Is the username account verified by the operator of the blog platform. ['Verified', 'Unverified', 'Unknown']

A Bitcoin transactional address

Date and time of transaction

A Bitcoin transaction number in a sequence of transactions

Value in BTC at date/time displayed in field 'time'

Value in EUR with conversion rate as of date/time displayed in field 'time'

Value in USD with conversion rate as of date/time displayed in field 'time'

Value of received BTC

Value of sent BTC

Value in BTC at date/time displayed in field 'time'

Date and time of lookup/conversion

A Bitcoin wallet address

The group listing of intended recipients of the alert message. (1) Required when <scope> is “Private”, optional when <scope> is “Public” or “Restricted”. (2) Each recipient SHALL be identified by an identifier or an address. (3) Multiple space-delimited addresses MAY be included. Addresses including whitespace MUST be enclosed in double-quotes.

The code denoting the special handling of the alert message.

The identifier of the alert message in a number or string uniquely identifying this message, assigned by the sender.

The group listing naming the referent incident(s) of the alert message. (1) Used to collate multiple messages referring to different aspects of the same incident. (2) If multiple incident identifiers are referenced, they SHALL be separated by whitespace. Incident names including whitespace SHALL be surrounded by double-quotes.

The code denoting the nature of the alert message. ['Alert', 'Update', 'Cancel', 'Ack', 'Error']

The text describing the purpose or significance of the alert message.

The group listing identifying earlier message(s) referenced by the alert message. (1) The extended message identifier(s) (in the form sender,identifier,sent) of an earlier CAP message or messages referenced by this one. (2) If multiple messages are referenced, they SHALL be separated by whitespace.

The text describing the rule for limiting distribution of the restricted alert message.

The code denoting the intended distribution of the alert message. ['Public', 'Restricted', 'Private']

The identifier of the sender of the alert message which identifies the originator of this alert. Guaranteed by assigner to be unique globally; e.g., may be based on an Internet domain name.

The time and date of the origination of the alert message.

The text identifying the source of the alert message. The particular source of this alert; e.g., an operator or a specific device.

The code denoting the appropriate handling of the alert message. ['Actual', 'Exercise', 'System', 'Test', 'Draft']

The text describing the intended audience of the alert message.

The code denoting the category of the subject event of the alert message. ['Geo', 'Met', 'Safety', 'Security', 'Rescue', 'Fire', 'Health', 'Env', 'Transport', 'Infra', 'CBRNE', 'Other']

The code denoting the certainty of the subject event of the alert message. For backward compatibility with CAP 1.0, the deprecated value of “Very Likely” SHOULD be treated as equivalent to “Likely”. ['Likely', 'Possible', 'Unlikely', 'Unknown']

The text describing the contact for follow-up and confirmation of the alert message.

The text describing the subject event of the alert message.

The effective time of the information of the alert message.

The text denoting the type of the subject event of the alert message.

A system-specific code identifying the event type of the alert message.

The expiry time of the information of the alert message.

The text headline of the alert message.

The text describing the recommended action to be taken by recipients of the alert message.

The code denoting the language of the info sub-element of the alert message.

The expected time of the beginning of the subject event of the alert message.

A system-specific additional parameter associated with the alert message.

The code denoting the type of action recommended for the target audience. ['Shelter', 'Evacuate', 'Prepare', 'Execute', 'Avoid', 'Monitor', 'Assess', 'AllClear', 'None']

The text naming the originator of the alert message.

The code denoting the severity of the subject event of the alert message. ['Extreme', 'Severe', 'Moderate', 'Minor', 'Unknown']

The code denoting the urgency of the subject event of the alert message. ['Immediate', 'Expected', 'Future', 'Past', 'Unknown']

The identifier of the hyperlink associating additional information with the alert message.

The base-64 encoded data content of the resource file.

The code representing the digital digest (“hash”) computed from the resource file (OPTIONAL).

The identifier of the MIME content type and sub-type describing the resource file.

The text describing the type and content of the resource file.

The integer indicating the size of the resource file.

The identifier of the hyperlink for the resource file.

Bitcoin address used as a payment destination in a cryptocurrency

Monero address used as a payment destination in a cryptocurrency

Current balance of address

First time this payment destination address has been seen

Last time this payment destination address has been seen

Last time the balances and totals have been updated

The (uppercase) symbol of the cryptocurrency used. Symbol should be from https://coinmarketcap.com/all/views/all/ ['BTC', 'ETH', 'BCH', 'XRP', 'MIOTA', 'DASH', 'BTG', 'LTC', 'ADA', 'XMR', 'ETC', 'NEO', 'NEM', 'EOS', 'XLM', 'BCC', 'LSK', 'OMG', 'QTUM', 'ZEC', 'USDT', 'HSR', 'STRAT', 'WAVES', 'PPT', 'ETN']

Free text value

Total balance received

Total balance sent

Total transactions performed

Description of the command functionalities

Location of the command functionality ['Bundled', 'Module', 'Libraries', 'Unknown']

How the commands are triggered ['Local', 'Network', 'Unknown']

description of the command

command code

Full cookie

Name of the cookie (if splitted)

Value of the cookie (if splitted)

Expiration date/time of the cookie

True if send only through HTTP

Path defined in the cookie

True if cookie is sent over TLS

A description of the cookie.

Type of cookie and how it’s used in this specific object. ['Session management', 'Personalization', 'Tracking', 'Exfiltration', 'Malicious Payload', 'Beaconing']

Cortex report object (full report) in JSON

Cortex analyser/worker name

Name of the cortex server

When the Cortex analyser was started

Result of the cortex job

Cortex summary object (summary) in JSON

URL to the Cortex job

Cortex Taxonomy Level ['info', 'safe', 'suspicious', 'malicious']

Cortex Taxonomy Namespace

Cortex Taxonomy Predicate

Cortex Taxonomy Value

The estimated cost of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']

A description of the course of action.

The estimated efficacy of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']

The estimated impact of applying the course of action. ['High', 'Medium', 'Low', 'None', 'Unknown']

The name used to identify the course of action.

The objective of the course of action.

The stage of the threat management lifecycle that the course of action is applicable to. ['Remedy', 'Response', 'Further Analysis Required']

The type of the course of action. ['Perimeter Blocking', 'Internal Blocking', 'Redirection', 'Redirection (Honey Pot)', 'Hardening', 'Patching', 'Eradication', 'Rebuilding', 'Training', 'Monitoring', 'Physical Access Restrictions', 'Logical Access Restrictions', 'Public Disclosure', 'Diplomatic Actions', 'Policy Actions', 'Other']

the number of active cases.

the number of confirmed cases. For Hubei Province: from Feb 13 (GMT +8), we report both clinically diagnosed and lab-confirmed cases. For lab-confirmed cases only (Before Feb 17), please refer to https://github.com/CSSEGISandData/COVID-19/tree/master/who_covid_19_situation_reports.

country/region name conforming to WHO (will be updated).

US County (US Only)

the number of deaths.

Federal Information Processing Standard county code (US Only)

Approximate latitude of the entry

Approximate longitude of the entry

province name; US/Canada/Australia/ - city name, state/province name; Others - name of the event (e.g., "Diamond Princess" cruise ship); other countries - blank.

the number of recovered cases.

Time of the last update that day (UTC)

Name of the Chinese city, in Chinese.

Current number of confirmed cases

Total number of confirmed cases.

Total number of cured cases.

Total number of deaths.

Approximate time of the update (~hour)

Comment, in chinese

Current number of confirmed cases

Name of the Chinese province, in Chinese.

Total number of confirmed cases.

Total number of cured cases.

Total number of deaths.

Approximate time of the update (~hour)

SSH compression algorithm supported in the session

Destination IP address of the session

Destination port of the session

SSH symmetric encryption algorithm supported in the session

Eventid of the session in the cowrie honeypot

HASSH of the client SSH session following Salesforce algorithm

Input of the session

isError

SSH public-key algorithm supported in the session

SSH MAC supported in the sesssion

Message of the cowrie honeypot

Password

Protocol used in the cowrie honeypot

Cowrie sensor name

Session id

Source IP address of the session

Source port of the session

System origin in cowrie honeypot

When the event happened

Username related to the password(s)

Format of the password(s) ['clear-text', 'hashed', 'encrypted', 'unknown']

Mention of any notification(s) towards the potential owner(s) of the credential(s) ['victim-notified', 'service-notified', 'none']

Origin of the credential(s) ['bruteforce-scanning', 'malware-analysis', 'memory-analysis', 'network-analysis', 'leak', 'unknown']

Password

A description of the credential(s)

Type of password(s) ['password', 'api-key', 'encryption-key', 'unknown']

Username related to the password(s)

Name of the bank which have issued the card

Card security code (CSC, CVD, CVV, CVC and SPC) as embossed or printed on the card.

credit-card number as encoded on the card.

A description of the card.

Maximum date of validity

International Issuer Number (First eight digits of the credit card number

Initial date of validity or issued date.

Name of the card owner.

Version of the card.

Curve Parameter - Gx in decimal

Curve Parameter - Gy in decimal

Curve Parameter - B in decimal

Length of the Curve in bits

RSA public exponent

Curve type of the ECDSA cryptographic materials ['Anomalous', 'M-221', 'E-222', 'NIST P-224', 'Curve1174', 'Curve25519', 'BN(2,254)', 'brainpoolP256t1', 'ANSSI FRP256v1', 'NIST P-256', 'secp256k1', 'E-382', 'M-383', 'Curve383187', 'brainpoolP384t1', 'NIST P-384', 'Curve41417', 'Ed448-Goldilocks', 'M-511', 'E-521']

Curve Parameter - G in decimal

Generic symmetric key (please precise the type)

Modulus Parameter - in hexadecimal - no 0x, no :

Curve Parameter - N in decimal

Origin of the cryptographic materials ['mathematical-attack', 'exhaustive-search', 'bruteforce-attack', 'malware-extraction', 'memory-interception', 'network-interception', 'leak', 'unknown']

Prime Parameter - P in decimal

Private part of the cryptographic materials in PEM format

Prime Parameter - Q in decimal

RSA modulus size in bits

A description of the cryptographic materials.

Type of crytographic materials ['RSA', 'DSA', 'ECDSA', 'RC4', 'XOR', 'unknown']

Curve Parameter - X in decimal

Curve Parameter - Y in decimal

File classification - number

File classification

Original filename

Size of the file

First seen timestamp of the file

Last seen timestamp of the file

Client creation date UTC

Client id

Client name

Client creation date

First seen on machine

Last seen on machine

Client last seen UTC

Machine UID

Machine name

Path of observable

textual comment about the item

What is the implementer is gaining by deceiving the user ['registration', 'personal data', 'money', 'contacts', 'audience']

Who is the vendor / holder of the item

Location where to find the item

A screencapture or a screengrab of the item at work

Date and time when first-seen

who are the user of the item

Destination domain (victim)

Destination port of the attack

Beginning of the attack

Destination IP (victim)

IP address originating the attack

End of the attack

Protocol used for the attack ['TCP', 'UDP', 'ICMP', 'IP']

Port originating the attack

Description of the DDoS

Bits per second

Packets per second