spam

Spam or ‘unsolicited bulk e-mail’, meaning that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having identical content.

Harmful Speech

Discretization or discrimination of somebody (e.g. cyber stalking, racism and threats against one or more individuals) May be found on a forum, email, tweet etc…

Child/Sexual/Violence/…​

Any Child pornography, glorification of violence, may be found on a website, forum, email, tweet etc…

Virus

Malicious code that replicate itself and infects the computer and files;

Worm

Malware that self-replicates and spread itself to other computers in the network without any user interaction;

Ransomware

Ransomware is a type of malicious software from cryptovirology that blocks access to the victim’s data or threatens to publish it until a ransom is paid.

Trojan/Malware

This category regroups many common malware types (Banking, POS, Mining malware).

Spyware/Rat

This category regroups malware types and tools that may have a bigger impact on the breached infrastructure and usually need further investigations (Common Spyware/Rat, State sponsored malwares, StealersHacking tool).

Dialer

Computer program used to identify the phone numbers that can successfully make a connection with a computer modem. Use this category to classify overpriced SMS sent by malicious mobile application.

Rootkit

Malware, which alter the standard functionality of an operating system in order to do its malicious actions in a stealthy way. In practice, Rootkits hijacks systems functions in order to alter the returning values to hide themselves from simple analysis tools.

Scanning

Attacks that send requests to a system to discover weak points. This also includes some kinds of testing processes to gather information about hosts, services and accounts. Examples: fingerd, DNS querying, ICMP, SMTP (EXPN, RCPT,).

Sniffing

Observing and recording network traffic (wiretapping).

Social Engineering

Gathering information from a human being in a non-technical way (eg, lies, tricks, bribes, or threats).

Exploiting known vulnerabilities

An attempt to compromise a system or to disrupt any service by exploiting vulnerabilities with a standardised identifier such as CVE name (eg, buffer overflow, backdoors, cross side scripting, etc).

Login attempts

Multiple login attempts (guessing / cracking of passwords, brute force).

New attack signature

An attempt using an unknown exploit.

Privileged Account Compromise

A successful full compromise of a system or application (service). This can have been caused remotely by a known or new vulnerability, but also by an unauthorized local access.

Unprivileged Account Compromise

A successful compromise of a system or application (service). This can have been caused remotely by a known or new vulnerability, but also by an unauthorized local access. The intruded did not achieve to escale his privileges locally.

Botnet member

The compromised asset is also being part of a botnet. This is reserved mainly for public web servers. See malicious code in priority for workstations or internal server’s compromise. For example, phpmailer, etc…

Domain Compromise

The whole domain is compromised; this is commonly used for active directory and detected by a “pass the ticket” attack or a discovery of “ad dumps” files.

Application Compromise

An application is compromised; the attacker possess an uncontrolled access to data, server, and assets used by this application (CMDB, DB, Backend services, etc.).

DoS

An attacker attempts to prevent legitimate users from accessing information or services.

DDoS

Form of electronic attack involving multiple computers, which send repeated requests (HTTP requests, pings, TCP or UDP Flood) to a server to load it down and render the service inaccessible for a period of time.

Sabotage

Deliberate and malicious acts that result in the disruption of the normal processes and functions or the destruction or damage of equipment or information.

Outage (no malice)

Unavailability of the system but done with no malice.

Unauthorised access to information

Any access to unauthorized data. It may be access of data on improperly restricted server share or database exfiltered by using a SQLi.

Unauthorised modification of information

Unauthorized tampering of data on files, documents or database.

Copyright

Selling or installing copies of unlicensed commercial software or other copyright protected materials (Warez).

Masquerade

Types of attacks in which one entity illegitimately assumes the identity of another in order to benefit from it. This attack may be used for president fraud requesting transactions.

Phishing

Masquerading as another entity in order to persuade the user to reveal a private credential.

Open for abuse

Open resolvers, world readable printers, vulnerability apparent from Nessus etc scans, virus, signatures not up to date, etc. This includes for example default SNMP community or default password on any application.

Regulator

All lack about regulator rules (CSSF, GDPR, etc.).

Standard

All lack about standards certification of the company (ISO27000, NIS, ISAE3402, etc.).

Security policy

All lack about the internal security policy of the company.

Other

All lack that do not fit in one of previous categories should be put on this class.

other

All incidents that do not fit in one of the given categories should be put into this class. If the number of incidents in this category increases, it is an indicator that the classification scheme must be revised.

Goals

If the actor is part of a larger organized operation they may be receiving their goals from a higher level source or handler. Depending on how organized and sophisticated the adversary’s campaigns are, these goals may not even be shared with the operator(s) themselves. In cases of non-targeted threat actors, this may be much less organized or distributed. Goals are nearly impossible to detect (directly) but they’re almost always the toughest question C-level leaders ask about post-breach. "Who was it and why?" These kinds of questions can never truthfully be answered unless you’re operating at Detection Maturity Level 8 against your adversary and can prove reliably that you know what their goals are. Short of that, it’s guessing at what the adversary’s true intentions were based on behavioral observations made at lower DMLs (e.g. data stolen, directories listed, employees or programs targeted, etc). I anticipate less than a handful of organizations truly operate at this level, consistently, against the threat actors they face because it’s nearly impossible to detect based on goals alone.

Strategy

Tactics

To successfully operate at DML-6, one must be able to reliably detect a tactic being employed regardless of the Technique or Procedure used by the adversary, the Tools they chose to use, or the Artifacts and Atomic Indicators left behind as a result of employing the tactic. While this may sound impossible on the surface, it absolutely is possible. In nearly all cases, tactics are not detected directly by a single indicator or artifact serving as the smoking gun, or a single detection signature or analytic technique. Tactics become known only after observation of multiple activities in aggregate, with respect to time and circumstance. As a result, detection of tactics are usually done by skilled analysts, rather than technical correlation or analytics systems.

Techniques

From a maturity perspective, being able to detect an adversary’s techniques is superior to being able to detect their procedures. The primary difference being techniques are specific to an individual. So when respecting this distinction, the ability to detect a specific actor operating within your environment by technique exclusively is an advantage. The best analogy to this is a rifled barrel, which leaves uniquely identifiable characteristics in the side of a bullet. Because of this, ballistics specialists can forensically match a spent round to the exact weapon from which it was fired with a high degree of certainty. Not just any weapon by calibur or model, but the exact weapon used to fire that specific round. Human beings are creatures of habit, and most adversaries aren’t aware of the fact that every time they attack they’re leaving evidence of their personal techniques behind for us to find. The same applies for the tool builders writing the tools these adversaries use. It’s our obligation to find these distinctions and ensure we’re looking for them. It’s personal behavior and habits that are the hardest for humans to change, so put the hurt on your adversaries by finding creative ways to detect their behaviors and habits in your environment.

Procedures

Given today’s detection technology, and readily available correlation and analytics techniques, it’s amazing that more organizations haven’t reached Detection Maturity Level 4 for most of their adversaries. Procedures are one of the most effective ways of detecting adversary activity and can really inflict the most pain against lesser experienced "B-teams". In it’s most simple form, detecting a procedure is as simple as detecting a sequence of two or more of the individual steps employed by the actor. The goal here is to isolate activities that the adversary appears to perform methodically, two or more times during an incident.

Tools

Being able to detect at DML-3 means you can reliably detect the adversary’s tools, regardless of minor functionality changes to the tool, or the Artifacts or Atomic Indicators it may leave behind. Detecting tools falls into two main areas. The first is detecting the transfer and presence of the tool. This includes being able to observe the tool being transferred over the network, being able to locate it sitting at rest on a file system, or being able to identify it loaded in memory. The second, and more important area of tool detection, is detecting the tool reliably by functionality. For example, let’s take a given webshell that has 25 functions. If we want to claim DML-3 level detection for this webshell we have to exercise each of those 25 functions and understand what each of them do. What do they look like at the host, network, and event log level when they are exercised? We then aim to build detections for as many of those 25 functions across those data domains as we possibly can, reliably, balancing false positives and other constraints. The reason behind this is simple, we want to be able to detect this version of the tool and as many future variants of the tool as we can by function that it performs. If the adversary decides to change up 5 of the 25 functions for which we have detections, we’re still detecting the entire tool. In order for the adversary to use this tool completely undetected in our environment, they’ll be forced to change every one of those functions; or at least the ones that we were able to reliably build detections against.

Host & Network Artifacts

DML-2 is where most organizations spend too much of their resources; attempting to collect what they call "threat intelligence" in the form of Host & Network Artifacts. The reality is, these are merely just indicators that are observed either during or after the attack. They’re like symptoms of the flu but not the flu itself. I often use the analogy "chasing the vapor trail" when I think of DML-2 because chasing after Host & Network Artifacts is much like chasing the vapor trail behind an aircraft. We know the enemy aircraft is up there in front of us somewhere, if we just keep chasing this vapor trial we’ll eventually catch up to the aircraft and find our enemy right? Wrong. Having a mature detection and response program means your operating above DML-2 and you’re actually locked onto the aircraft itself. You know how it operates, you know what it’s capabilities are, you know the Tactics, Techniques, and Procedures of it’s pilot and you can almost predict what it’s next moves might be. This is precisely why good Cyber Intelligence Analysts will almost never attribute activity to a specific threat actor, group, or country based on just Host & Network Artifacts alone; they understand this DML concept and realize when they’re likely just staring at the vapor trail. They understand that in reality the vapor trail (indicators) could be from any number of aircraft (tools), with any number of pilots (actors) behind the stick.

Atomic IOCs

These are the atomic particles that make up Host & Network artifacts. If you’re detecting at Detection Maturity Level 1, it means you are probably taking "feeds of intel" from various sharing organizations and vendors in the form of lists, like domains and IP addresses, and feeding them into your detection technologies. Let me be clear on my position here. There are a few, and I mean a very precious few, circumstances where this makes sense and can be done reliably. These are edge cases where specific atomic indicators have a high enough "shelf life" where it makes sense to go ahead and create detection capabilities from them. Examples of this include unique strings found inside a binary, or perhaps an adversary is foolish enough to sit on the same recon, delivery, C2, or exfiltration infrastructure allowing you to detect reliably on their domain names or IP addresses. These might be viable cases where detecting on atomic indicator alone makes sense. Unfortunately, for the remaining 99% of the time, attempting to detect on this kind of data is suboptimal, for a number of reasons.

None or Unknown

For organizations who either don’t operate at DML-1 or higher, or they don’t even know where they operate on this scale, we have Detection Maturity Level - 0. Instead of pointing out all the negative things associated with this level, I’ll take the high road and lend a bit of positive encouragement. Congratulations, you are at ground zero. It can only get better from here.

(PAP:RED) Non-detectable actions only. Recipients may not use PAP:RED information on the network. Only passive actions on logs, that are not detectable from the outside.

(PAP:AMBER) Passive cross check. Recipients may use PAP:AMBER information for conducting online checks, like using services provided by third parties (e.g. VirusTotal), or set up a monitoring honeypot.

(PAP:GREEN) Active actions allowed. Recipients may use PAP:GREEN information to ping the target, block incoming/outgoing traffic from/to the target or specifically configure honeypots to interact with the target.

(PAP:WHITE) No restrictions in using this information.

Brute force

Access was gained through systematic trial of credentials in bulk.

Password guessing

Access was gained through guessing passwords through trial and error.

Remote desktop application

Access was gained through an application designed for remote access.

Stolen credentials

Access was gained with stolen credentials.

Pass the hash

Access was gained through use of an existing known hash.

Default credentials

Access was gained through use of the system’s default credentials.

Shell

Access was gained through the use of a shell.

Other

Access was gained through another method.

Anti-Corruption and transparency

The organization campaigns, or takes other actions against corruption and transparency.

Anti-War / Anti-Violence

The organization campaigns, or takes other actions against war

Culture

The organization campaigns or acts to promote cultural events

Economic Change

Issues of economic policy, wealth distribution, etc.

Education

The organization is concerned with some form of education

Election Monitoring

The organization is an election monitor, or involved in election monitoring

Environment

The organization campaigns or acts to protect the environment

Freedom of Expression

The organization is concerned with freedom of speech issues

Freedom Tool Development

The organization develops tools for use in defending or extending digital rights

Funding

Health Issues

The organization prevents epidemic illness or acts on curing them

Human Rights Issues

relating to the detection, recording, exposure, or challenging of abuses of human rights

Internet and Telecoms

Issues of digital rights in electronic communications

LGBT / Gender / Sexuality

Issues relating to the Lesbian, Gay, Bi, Transgender community

Policy

The organization is a policy think-tank, or policy advocate

Politics

The organization takes a strong political view or is a political entity

Privacy

Issues relating to the individual’s reasonable right to privacy

Rapid Response

The organization provides rapid response type capability for civil society

Refugees

Issues relating to displaced people

Security

Issues relating to physical or information security

Women’s Rights

Issues pertaining to inequality between men and women, or issues of particular relevance to women

Youth Rights

Issues of particular relevance to youth

Informed ISP/Hosting Service Provider

Informed Registrar

Informed Registrant

Informed abuse-contact (domain)

Informed abuse-contact (IP)

Informed legal department

Completely reliable

No doubt of authenticity, trustworthiness, or competency; has a history of complete reliability

Associated numerical value="100"

Usually reliable

Minor doubt about authenticity, trustworthiness, or competency; has a history of valid information most of the time

Associated numerical value="75"

Fairly reliable

Doubt of authenticity, trustworthiness, or competency but has provided valid information in the past

Associated numerical value="50"

Not usually reliable

Significant doubt about authenticity, trustworthiness, or co mpetency but has provided valid information in the past

Associated numerical value="25"

Unreliable

Lacking in authenticity, trustworthiness, and competency; history of invalid information

Reliability cannot be judged

No basis exists for evaluating the reliability of the source

Associated numerical value="50"

Deliberatly deceptive

Confirmed by other sources

Confirmed by other independent sources; logical in itself; Consistent with other information on the subject

Associated numerical value="100"

Probably true

Not confirmed; logical in itself; consistent with other information on the subject

Associated numerical value="75"

Possibly true

Not confirmed; reasonably logical in itself; agrees with some other information on the subject

Associated numerical value="50"

Doubtful

Not confirmed; possible but not logical ; no other information on the subject

Associated numerical value="25"

Improbable

Not confirmed; not logical in itself; contradicted by other information on the subject

Truth cannot be judged

No basis exists for evaluating the validity of the information

Associated numerical value="50"

Infrastructure ownership and status is unknown

Infrastructure compromised by or in the benefit of the adversary

Infrastructure own and operated by the adversary

Only passive requests shall be performed to avoid detection by the adversary

Take down requests can be performed in order to deactivate the adversary infrastructure

Monitoring requests are ongoing on the adversary infrastructure

Law enforcement requests are ongoing on the adversary infrastructure

Infrastructure state is unknown or cannot be evaluated

Infrastructure state is active and actively used by the adversary

Infrastructure state is known to be down

Infrastructure usage by the adversary is unknown

Infrastructure used as proxy between the target and the adversary

Infrastructure used by the adversary to store information related to his campaigns

Infrastructure used to distribute exploit towards target(s)

Infrastructure used by the adversary as Virtual Private Network to hide activities and reduce the traffic analysis surface

Panel used by the adversary to control or maintain his infrastructure

Traffic Distribution Systems including exploit delivery or/and web monetization channels

WHITE

GREEN

AMBER

EVERYONE

USG

NONE

true

false

Is_Proprietary

Not_Proprietary

Less than 1 year

Associated numerical value="1"

Between 1 and 5 years

Associated numerical value="2"

Between 5 and 10 years

Associated numerical value="3"

Between 10 and 20 years

Associated numerical value="4"

More than 20 years

Associated numerical value="5"

x86-32 & x86-64

ARM & ARM-64

mips & mips-64

PowerPC

Less than 1 year

Associated numerical value="1"

Between 1 and 5 years

Associated numerical value="2"

Between 5 and 10 years

Associated numerical value="3"

Between 10 and 20 years

Associated numerical value="4"

More than 20 years

Associated numerical value="5"

Current Microsoft Windows system

GNU/linux derivative OS

Current IOS

Current Apple OS

Current Android OS

BSD

Inter-protocol exploitations

Common vulnerabilities as SQL injections, CSRF, XSS, CSP bypasses, etc.

De-obfuscation of Javascript payloads

Less than 1 year

Associated numerical value="1"

Between 1 and 5 years

Associated numerical value="2"

Between 5 and 10 years

Associated numerical value="3"

Between 10 and 20 years

Associated numerical value="4"

More than 20 years

Associated numerical value="5"

Less than 1 year

Associated numerical value="1"

Between 1 and 5 years

Associated numerical value="2"

Between 5 and 10 years

Associated numerical value="3"

Between 10 and 20 years

Associated numerical value="4"

More than 20 years

Associated numerical value="5"

Cat1

Minimal Exposure - Passive Collection: CAT 1 actions provide the least exposure of an indicator, either through adversary observation or disclosure. Usage of the indicator is restricted to passive monitoring on Government or Cleared Partner networks, or through a classified passive capability or Operation. CAT 1 actions do not interact with or affect malicious network traffic.

Cat2

Moderate Exposure - Government or Cleared Partner Internal Active Collection: CAT 2 actions expose the usage of an indicator through non-disruptive collection techniques which require interactions with an adversary, within Government or Cleared Partner networks. While it is not the intent to disrupt the adversary it is possible that an adversary may discover they are subject to such techniques.

Cat3

Moderate Exposure - Government or Cleared Partner Internal Countermeasures: CAT 3 actions expose the usage of an indicator through inward-facing countermeasures. Malicious network traffic is affected in some manner, however the results are not directly observable to the adversary or external parties and is, therefore, more difficult to attribute as a deliberate action. Usage of the indicator is restricted to Government and Cleared Partner networks, or a classified capability or Operation. This implies a lower likelihood for non-approved disclosures.

Cat4

Moderate Exposure - Government Actions on External Networks: CAT 4 actions expose the usage of an indicator through actions which occur on internet accessible networks, without the authorization of the network or information owner. Such actions are conducted as classified Operations under the auspices of national legislative and compliance provisions. Action consequences are observable to the adversary and other, public parties and it is possible they may be attributed as Government sanctioned actions.

Cat5

High Exposure - Public Actions Which Enable Internal Countermeasures: CAT 5 actions expose the usage of an indicator through the public release of information which enables internal actions on networks not owned and controlled by the Government (i.e. industry, commercial or foreign governments). These actions are official public releases and are attributable as Government sanctioned actions.

Cat6

High Exposure - Actions on Adversary Infrastructure: CAT 6 actions expose the usage of an indicator through actions which occur on adversary owned networks, without the authorization of the network or information owner. Such actions are conducted as classified Operations under the auspices of national legislative and compliance provisions. Action consequences are observable to the adversary, and possibly other public parties, and it is possible they may deduce this as FVEY action.

Known Good/Safe

Known Bad/Malicious

Not yet known

Beacon

A host infected with malware is connecting to threat actor owned infrastructure.

Browser based exploitation

A browser component is being exploited in order to infect a host.

Dos

An attack in which the goal is to disrupt access to a host or resource.

Email

Malicious emails sent to a department (baiting, content delivery, phishing).

Exfiltration

Unauthorized transfer of data from a target’s network to a location a threat actor controls.

Generic event

Represents a collection of virtually identical events within a range of time.

Improper usage

Technology used in a way that compromises security or violates policy.

Malware artifacts

Signs of the presence of malware observed on a host.

Malware download

Malware was transferred (downloaded/uploaded) to a host.

Phishing

Information or credentials disclosed to a threat actor.

Remote access

A threat actor is attempting to or succeeding in remotely logging in to a host.

Remote exploitation

A threat actor is attempting to exploit vulnerabilities remotely.

Scan

A threat actor is scanning the network.

Scraping

Represents a collection of virtually identical scraping events within a range of time.

Traffic interception

Represents a collection of virtually identical traffic interception events within a range of time.

Goc credential disclosure

Credentials for a GoC system or user were disclosed.

Personal credential disclosure

Credentials not related to a GoC system or user were disclosed.

Personal information disclosure

Information about a person or persons was disclosed.

None

No information was disclosed.

Other

Information other than credentials and personal information was disclosed.

C2

Domain is being used as command-and-control infrastructure.

Proxy

Domain is being used as a proxy.

Seeded

Domain has been seeded with malware or other malicious code.

Wateringhole

Domain is being used a wateringhole.

Cloud infrastructure

Domain is hosted on cloud infrastructure.

Name server

Domain is a name server.

Sinkholed

Domain is being re-directed to a sinkhole.

Spam

Unsolicited or junk email named after a Monty Python sketch.

Content\-delivery\-attack

Email contained malicious content or attachments.

Phishing

Email designed to trick the recipient into providing sensitive information.

Baiting

Email designed to trick the recipient into providing sensitive information.

Unknown

Type of email was unknown.

Sql injection

Exploitation occurred due to malicious SQL queries being executed against a database.

Directory traversal

Exploitation occurred through a directory traversal attack allowing access to a restricted directory.

Remote file inclusion

Exploitation occurred due to vulnerabilities allowing malicious files to be sent.

Code injection

Exploitation occurred due to malicious code being injected.

Other

Other.

C2

IP address is a command-and-control server.

Proxy

IP address is a proxy server.

Seeded

IP address has been seeded with malware or other malicious code.

Wateringhole

IP address is a wateringhole.

Cloud infrastructure

IP address is part of cloud infrastructure.

Network gateway

IP address is a network gateway.

Server

IP address is a server of some type.

Dns server

IP address is a DNS server.

Smtp server

IP address is a mail server.

Web server

IP address is a web server.

File server

IP address is a file server.

Database server

IP address is a database server.

Security appliance

IP address is a security appliance of some type.

Tor node

IP address is a node of the TOR anonymization system.

Sinkhole

IP address is a sinkhole.

Router

IP address is a router device.

Non-malicious

Non-malicious is not malicious or suspicious.

Suspicious

Suspicious is not non-malicious and not malicious.

Malicious

Malicious is not non-malicious or suspicious.

Exploit kit

Toolkit used to attack vulnerabilities in systems.

First stage

Malware used in the initial phase of an attack and commonly used to retrieve a second stage.

Second stage

Typical more complex malware retrieved by first stage malware.

Scanner

Malware used to look for common vulnerabilities or running software.

Downloader

Malware used to retrieve additional malware or tools.

Proxy

Malware used to proxy traffic on an infected host.

Reverse proxy

If you choose this option please provide a description of what it is to the ALFRED PO.

Webshell

Malware uploaded to a web server allowing remote access to an attacker.

Ransomware

Malware used to hold infected host’s data hostage, typically through encryption until a payment is made to the attackers.

Adware

Malware used to display ads to the infected host.

Spyware

Malware used to collect information from the infected host, such as credentials.

Virus

Malware that propogates by inserting a copy of itself into another program.

Worm

Standalone malware that propogates by copying itself..

Trojan

Malware that looks like legitimate software but hides malicious code.

Rootkit

Malware that can hide the existance of other malware by modifying operating system functions.

Keylogger

Malware that runs in the background, capturing keystrokes from a user unknowingly for exfiltration.

Browser hijacker

Malware that re-directs or otherwise intercepts Internet browsing by the user.

Unauthorized usage

Usage of the system or resource was without appropriate permission or authorization.

Misconfiguration

System or resource is misconfigured.

Lack of encryption

System or resources has insufficient encryption or no encryption.

Vulnerable software

System or resource has software with known vulnerabilities.

Privilege escalation

System or resource was exploited to gain higher privilege level.

Other

Other.

Anti-virus

Anti-Virus

Content filtering system

Content Filtering System

Dynamic defense

Dynamic Defense

Insufficient privileges

Insufficient Privileges

Ids

Intrusion Detection System

Sink hole / take down by third party

Sink Hole / Take Down by Third Party

Isp

Internet Service Provider

Invalid credentials

Invalid Credentials

Not vulnerable

No mitigation was required because the system was not vulnerable to the attack.

Other

Other

Unknown

Unknown

User

User

Subscriber

Subscriber.

Internet

Internet.

Cse

Communications Security Establishment.

Nsa

National Security Agency.

Gchq

Government Communications Headquarters.

Asd

Australian Signals Directorate.

Gcsb

Government Communications Security Bureau.

Open source

Originated from publically available information.

3rd party

Originated from a 3rd party organization.

Other

Other.

Open port

Scan was looking for open ports corresponding to common applications or protocols.

Icmp

Scan was attempting to enumerate devices through the ICMP protocol.

Os fingerprinting

Scan was looking for operating system information through unique characteristics in responses.

Web

Scan was enumerating or otherwise traversing web hosts.

Other

Other.

Reconnaissance

An actor attempted or succeeded in gaining information that may be used to identify and/or compromise systems or data.

Attempted compromise

An actor attempted affecting the confidentiality, integrity or availability of a system.

Exploited

A vulnerability was successfully exploited.

Application:cms

Content Management System.

Application:bash

BASH script.

Application:acrobat reader

Adobe Acrobat Reader.

Application:ms excel

Microsoft Excel.

Application:other

Other Application.

Language:sql

Structured Query Language.

Language:php

PHP: Hypertext Preprocessor.

Language:javascript

JavaScript.

Language:other

Other Language.

Protocol:dns

Domain Name System.

Protocol:ftp

File Transfer Protocol.

Protocol:http

Hyper Text Transfer Protocol.

Protocol:icmp

Internet Control Message Protocol.

Protocol:ntp

Network Time Protocol.

Protocol:rdp

Remote Desktop Protocol.

Protocol:smb

Server Message Block.

Protocol:snmp

Simple Network Management Protocol.

Protocol:ssl

Secure Sockets Layer.

Protocol:telnet

Network Virtual Terminal Protocol.

Protocol:sip

Session Initiation Protocol.

Spam

System compromise

Scan

Denial of Service

Copyright issue

Phishing

Malware

XSS

Vulnerability

Fastflux

SQL Injection

Information leak

Scam

Cryptojacking

Locker

Screenlocker

Wiper

Finance

ICT

Individual

Industry

Medical

Services

Undefined

Request a binary sample

Request a deobfuscated sample of the shared sample

Request additional samples compared to the original analysis to build a competitive analysis on the reversing aspect

Request related samples required for further analysis

Request additional static analysis or reversing on the information shared

Request detection signature from

Request more contextual information

Request an abuse contact to report to

Request more historical information from

Request complementary validation

Request about the target(s) including field of activities or companies

Request further technical or tactical analysis

Request for generic additional information

Sadistic/bestiality: (a) Pictures showing a child being tied, bound, beaten, whipped, or otherwise subjected to something that implies pain; (b) Pictures where an animal is involved in some form of sexual behavior with a child

Gross assault: Grossly obscene pictures of sexual assault, involving penetrative sex, masturbation, or oral sex involving an adult

Assault: Pictures of children being subjected to a sexual assault, involving digital touching, involving an adult

Explicit sexual activity: Involves touching, mutual and self-masturbation, oral sex, and intercourse by child, not involving an adult

Explicit erotic posing: Emphasizing genital areas where the child is posing either naked, partially clothed, or fully clothed

Erotic posing: Deliberately posed pictures of fully or partially clothed or naked children in sexualized or provocative poses

Posing: Deliberately posed pictures of children fully or partially clothed or naked (where the amount, context, and organization suggests sexual interest)

Erotica: Surreptitiously taken photographs of children in play areas or other safe environments showing either underwear or varying degrees of nakedness

Nudist: Pictures of naked or seminaked children in appropriate nudist settings, and from legitimate sources

Indicative: Nonerotic and nonsexualized pictures showing children in their underwear, swimming costumes, and so on, from either commercial sources or family albums; pictures of children playing in normal settings, in which the context or organization of pictures by the collector indicates inappropriateness

Denial of service / Distributed Denial of service

Forensics work

Attempted or successful destruction, corruption, or disclosure of sensitive corporate information or Intellectual Property

Compromised host (root account, Trojan, rootkit), network device, application, user account.

Theft / Fraud / Human Safety / Child Porn

Reconnaissance or Suspicious activity originating from inside the Company corporate network, excluding malware

Reconnaissance or Suspicious Activity originating from outside the Company corporate network (partner network, Internet), excluding malware.

A virus or worm typically affecting multiple corporate devices. This does not include compromised hosts that are being actively controlled by an attacker via a backdoor or Trojan.

Spoofed email, SPAM, and other email security-related events.

Security consulting unrelated to any confirmed incident

Violation of various policies

Incident affecting critical systems or information with potential to be revenue or customer impacting.

Incident affecting non-critical systems or information, not revenue or customer impacting. Employee investigations that are time sensitive should typically be classified at this level.

Possible incident, non-critical systems. Incident or employee investigations that are not time sensitive. Long-term investigations involving extensive research and/or detailed forensic work.

Extremely Sensitive

Sensitive

Not Sensitive

Generated within the company during incident/case related investigations or forensic analysis or via malware reversing, validated by humans and highly contextualized.

Generated within the company, validated by a human prior to sharing, data points have been contextualized (to a degree) e.g. IPs are related to C2 or drop site.

Generated within the company by automated means without human interaction e.g., by malware sandbox, honeypots, IDS, etc.

Information gathered by an analyst/incident responder/forensic expert/etc.

Information coming out of honeypots.

Information coming out of sandboxes.

Information coming out of email infrastructure.

Information from outside the company.

If none of the other origins applies.

Origin of the data unknown.

Plan activity

Associated numerical value="10"

Conduct research & analysis

Associated numerical value="11"

Develop resources & capabilities

Associated numerical value="12"

Acquire victim & specific knowledge

Associated numerical value="13"

Complete preparations

Associated numerical value="14"

Deploy capability

Associated numerical value="20"

Interact with intended victim

Associated numerical value="21"

Exploit vulnerabilities

Associated numerical value="22"

Deliver malicious capabilities

Associated numerical value="23"

Establish controlled access

Associated numerical value="30"

Hide

Associated numerical value="31"

Expand presence

Associated numerical value="32"

Refine focus of activity

Associated numerical value="33"

Establish persistence

Associated numerical value="34"

Enable other operations

Associated numerical value="40"

Deny access

Associated numerical value="41"

Extract data

Associated numerical value="42"

Alter data and/or computer, network or system behavior

Associated numerical value="43"

Destroy HW/SW/data

Associated numerical value="44"

Regulated data

Data which is regulated under a specific regulation or law such as PII, SPD, PCI or PHI.

Commercially confidential information (CCI)

Data which represents a specific commercial value and is confidential to an organisation such as trade secrets, customer accounts.

Financially sensitive information (FSI)

Data which represents a specific financial value to an organisation such as payroll, investment information.

Valuation sensitive information (VSI)

Data which is sensitive to the valuation of an organisation such as inside information (as defined by a Financial Services Authority).

Sensitive information

Data which is sensitive such as email or letters.

Amplification attack

Reflected and Spoofed attack

Slow Read attack

Flooding attack

Large POST HTTP attack

STRENG GEHEIM

Kenntnisnahme durch Unbefugte kann den Bestand oder lebenswichtige Interessen der Bundesrepublik Deutschland oder eines ihrer Länder gefährden.

GEHEIM

Kenntnisnahme durch Unbefugte kann die Sicherheit der Bundesrepublik Deutschland oder eines ihrer Länder gefährden oder ihren Interessen schweren Schaden zufügen.

VS-VERTRAULICH

Kenntnisnahme durch Unbefugte kann für die Interessen der Bundesrepublik Deutschland oder eines ihrer Länder schädlich sein.

VS-NUR FÜR DEN DIENSTGEBRAUCH

Kenntnisnahme durch Unbefugte kann für die Interessen der Bundesrepublik Deutschland oder eines ihrer Länder nachteilig sein.

Dummy

Platzhalter.

Chemical

Commercial Facilities

Communications

Critical Manufacturing

Dams

Defense Industrial Base

Emergency services

energy

Financial Services

Food and Agriculture

Government Facilities

Healthcare and Public Health

Information Technology

Nuclear

Transportation Systems

Water and water systems

An adversary is the actor/organization responsible for utilizing a capability against the victim to achieve their intent.

The capability describes the tools and/or techniques of the adversary used in the event. It includes all means to affect the victim from the most manual “unsophisticated” methods (e.g., manual password guessing) to the most sophisticated automated techniques.

The infrastructure feature describes the physical and/or logical communication structures the adversary uses to deliver a capability, maintain control of capabilities (e.g., commandand-control/C2), and effect results from the victim (e.g., exfiltrate data). As with the other features, the infrastructure can be as specific or broad as necessary. Examples include: Internet Protocol (IP) addresses, domain names, e-mail addresses, Morse code flashes from a phone’s voice-mail light watched from across a street, USB devices found in a parking lot and inserted into a workstation, or the compromising emanations from hardware (e.g., Van Eck Phreaking) being collected by a nearby listening post.

A victim is the target of the adversary and against whom vulnerabilities and exposures are exploited and capabilities used. A victim can be described in whichever way necessary and appropriate: organization, person, target email address, IP address, domain, etc. However, it is useful to define the victim persona and their assets separately as they serve different analytic functions. Victim personae are useful in non-technical analysis such as cyber-victimology and social-political centered approaches whereas victim assets are associated with common technical approaches such as vulnerability analysis..

RESTRICTED

CONFIDENTIAL

SECRET

TOP SECRET

UNCLASSIFIED

CONFIDENTIAL

SECRET

TOP SECRET

UNCLASSIFIED

ENDSEAL

ECRU

NONBOOK

HCS

HCS-O

HCS-P

KLONDIKE

KDK BLUEFISH

KDK IDITAROD

KDK KANDIK

RESERVE

SPECIAL INTELLIGENCE

SI-GAMMA

TALENT KEYHOLE

Document claims compliance with all rules encoded in ISM for documents produced by the US Federal Government. This is the minimum set of rules for US documents to adhere to, and all US documents should claim compliance with USGov.

Document claims compliance with all rules encoded in ISM for documents produced by the US Intelligence Community. Documents that claim compliance with USIC MUST also claim compliance with USGov.

Document claims compliance with all rules encoded in ISM for documents produced by the US Department of Defense. Documents that claim compliance with USDOD MUST also claim compliance with USGov.

Document claims compliance with an authority other than the USGov, USIC, or USDOD.

RESTRICTED DATA

RD-CRITICAL NUCLEAR WEAPON DESIGN INFORMATION

FORMERLY RESTRICTED DATA

DoD CONTROLLED NUCLEAR INFORMATION

DoE CONTROLLED NUCLEAR INFORMATION

TRANSCLASSIFIED FOREIGN NUCLEAR INFORMATION

FISA Warning statement

IMCON Warning statement

Controled Nuclear Weapon Design Information Warning statement

RD Warning statement

FRD Warning statement

LIMDIS caveat

LES Notice

LES-NF Notice

DSEN Notice

DoD Distribution statement A from DoD Directive 5230.24

DoD Distribution statement B from DoD Directive 5230.24

DoD Distribution statement C from DoD Directive 5230.24

DoD Distribution statement D from DoD Directive 5230.24

DoD Distribution statement E from DoD Directive 5230.24

DoD Distribution statement F from DoD Directive 5230.24

DoD Distribution statement X from DoD Directive 5230.24

US Person info Notice

Indicates that an instance document must abide by rules pertaining to ORIGINATOR CONTROLLED data issued prior to Executive Order 13526.

Indicates that the contents of this notice specify the contact information for a required point-of-contact.

COMSEC Notice

NAVAL NUCLEAR PROPULSION INFORMATION

LIMITED DISTRIBUTION

EXCLUSIVE DISTRIBUTION

NO DISTRIBUTION

SENSITIVE BUT UNCLASSIFIED

SENSITIVE BUT UNCLASSIFIED NOFORN

LAW ENFORCEMENT SENSITIVE

LAW ENFORCEMENT SENSITIVE NOFORN

SENSITIVE SECURITY INFORMATION

NATO Atomal mark

NATO Bohemia mark

NATO Balk mark

RISK SENSITIVE

FOR OFFICIAL USE ONLY

ORIGINATOR CONTROLLED

ORIGINATOR CONTROLLED US GOVERNMENT

CONTROLLED IMAGERY

NOT RELEASABLE TO FOREIGN NATIONALS

CAUTION-PROPRIETARY INFORMATION INVOLVED

AUTHORIZED FOR RELEASE TO

RELEASABLE BY INFORMATION DISCLOSURE OFFICIAL

DEA SENSITIVE

FOREIGN INTELLIGENCE SURVEILLANCE ACT

AUTHORIZED FOR DISPLAY BUT NOT RELEASE TO

Registered & active

Domain name is registered and DNS is delegated

Registered & inactive

Domain name is registered and DNS is not delegated

Registered & suspended

Domain name is registered & DNS delegation is temporarily removed by the registry

Not registered

Domain name is not registered and open for registration

Not registrable

Domain is not registered and cannot be registered

Grace period

Domain is deleted and still reserved for previous owner

Criminal registration

Domain name is registered for criminal purposes

Compromised webserver

Webserver is compromised for criminal purposes

Compromised DNS

Compromised authoritative DNS or compromised delegation

Sinkhole

Domain Name is sinkholed for research, detection, LE

No loss

Less than 25K EUR

Less than 50K EUR

Less than 100K EUR

Less than 1 million EUR

Less than 10 million EUR

Less than 100 million EUR

Less than 1 billion EUR

More than 1 billion EUR

No gain

Less than 25K EUR

Less than 50K EUR

Less than 100K EUR

Less than 1 million EUR

Less than 10 million EUR

Less than 100 million EUR

Less than 1 billion EUR

More than 1 billion EUR

spam

Or 'Unsolicited Bulk Email', this means that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having a functionally comparable content.

Harmful Speech

Discreditation or discrimination of somebody e.g. cyber stalking, racism and threats against one or more individuals).

Child/Sexual/Violence/…​

Child Pornography, glorification of violence, …​

Virus

Worm

Trojan

Spyware

Dialer

Rootkit

Malware

Botnet drone

Ransomware

Malware configuration

C&C

Scanning

Attacks that send requests to a system to discover weak points. This includes also some kind of testing processes to gather information about hosts, services and accounts. Examples: fingerd, DNS querying, ICMP, SMTP (EXPN, RCPT, …​), port scanning.

Sniffing

Observing and recording of network traffic (wiretapping).

Social Engineering

Gathering information from a human being in a non-technical way (e.g. lies, tricks, bribes, or threats).

Exploiting of known Vulnerabilities

An attempt to compromise a system or to disrupt any service by exploiting vunerabilities with a standardised identifier such as CVE name (e.g. buffer overflow, backdoor, cross site scripting, etc.)

Login attempts

Multiple login attempts (Guessing / cracking of passwords, brute force).

New attack signature

An attempt using an unknown exploit.

Privileged Account Compromise

Unprivileged Account Compromise

Application Compromise

Bot

defacement

compromised

backdoor

DoS

Denial of Service.

DDoS

Distributed Denial of Service.

Sabotage

Sabotage.

Outage (no malice)

Outage (no malice).

Unauthorised access to information

Unauthorised modification of information

dropzone

Unauthorized use of resources

Using resources for unauthorized purposes including profit-making ventures (E.g. the use of e-mail to participate in illegal profit chain letters or pyramid schemes).

Copyright

Offering or Installing copies of unlicensed commercial software or other copyright protected materials (Warez).

Masquerade

Type of attacks in which one entity illegitimately assumes the identity of another in order to benefit from it.

Phishing

Masquerading as another entity in order to persuade the user to reveal a private credential.

Open for abuse

blacklist

unknown

other

Test

Fraud

Fraud committed by humans.

Fraud committed by employees

Fraud committed by employees or others that are in relation with entities, who have access to entities' information and IT assets.

Sabotage

Intentional actions (non-fulfilment or defective fulfilment of personal duties) aimed to cause disruption or damage to IT assets.

Vandalism

Act of physically damaging IT assets.

Theft (of devices, storage media and documents)

Stealing information or IT assets. Robbery.

Theft of mobile devices (smartphones/ tablets)

Taking away another person’s property in the form of mobile devices, for example smartphones, tablets.

Theft of fixed hardware

Taking away another person’s hardware property (except mobile devices), which often contains business-sensitive data.

Theft of documents

Stealing documents from private/company archives, often for the purpose of re-sale or to achieve personal benefits.

Theft of backups

Stealing media devices, on which copies of essential information are kept.

Information leak /sharing

Sharing information with unauthorised entities. Loss of information confidentiality due to intentional human actions (e.g., information leak may occur due to loss of paper copies of confidential information).

Unauthorized physical access / Unauthorised entry to premises

Unapproved access to facility.

Coercion, extortion or corruption

Actions following acts of coercion, extortion or corruption.

Damage from the warfare

Threats of direct impact of warfare activities.

Terrorist attack

Threats from terrorists.

Information leak /sharing due to human error

Information leak / sharing caused by humans, due to their mistakes.

Accidental leaks/sharing of data by employees

Unintentional distribution of private or sensitive data to an unauthorized entity by a staff member.

Leaks of data via mobile applications

Threat of leaking private data (a result of using applications for mobile devices).

Leaks of data via Web applications

Threat of leaking important information using web applications.

Leaks of information transferred by network

Threat of eavesdropping of unsecured network traffic.

Erroneous use or administration of devices and systems

Information leak / sharing / damage caused by misuse of IT assets (lack of awareness of application features) or wrong / improper IT assets configuration or management.

Loss of information due to maintenance errors / operators' errors

Threat of loss of information by incorrectly performed maintenance of devices or systems or other operator activities.

Loss of information due to configuration/ installation error

Threat of loss of information due to errors in installation or system configuration.

Increasing recovery time

Threat of unavailability of information due to errors in the use of backup media and increasing information recovery time.

Loss of information due to user errors

Threat of unavailability of information or damage to IT assets caused by user errors (using IT infrastructure) or IT software recovery time.

Using information from an unreliable source

Bad decisions based on unreliable sources of information or unchecked information.

Unintentional change of data in an information system

Loss of information integrity due to human error (information system user mistake).

Inadequate design and planning or improper adaptation

Threats caused by improper IT assets or business processes design (inadequate specifications of IT products, inadequate usability, insecure interfaces, policy/procedure flows, design errors).

Damage caused by a third party

Threats of damage to IT assets caused by third party.

Security failure caused by third party

Threats of damage to IT assets caused by breach of security regulations by third party.

Damages resulting from penetration testing

Threats to information systems caused by conducting IT penetration tests inappropriately.

Loss of information in the cloud

Threats of losing information or data stored in the cloud.

Loss of (integrity of) sensitive information

Threats of losing information or data, or changing information classified as sensitive.

Loss of integrity of certificates

Threat of losing integrity of certificates used for authorisation services

Loss of devices, storage media and documents

Threats of unavailability (losing) of IT assets and documents.

Loss of devices/ mobile devices

Threat of losing mobile devices.

Loss of storage media

Threat of losing data-storage media.

Loss of documentation of IT Infrastructure

Threat of losing important documentation.

Destruction of records

Threats of unavailability (destruction) of data and records (information) stored in devices and storage media.

Infection of removable media

Threat of loss of important data due to using removable media, web or mail infection.

Abuse of storage

Threat of loss of records by improper /unauthorised use of storage devices.

Disaster (natural earthquakes, floods, landslides, tsunamis, heavy rains, heavy snowfalls, heavy winds)

Large scale natural disasters.

Fire

Threat of fire.

Pollution, dust, corrosion

Threat of disruption of work of IT systems (hardware) due to pollution, dust or corrosion (arising from the air).

Thunderstrike

Threat of damage to IT hardware caused by thunder strike (overvoltage).

Water

Threat of damage to IT hardware caused by water.

Explosion

Threat of damage to IT hardware caused by explosion.

Dangerous radiation leak

Threat of damage to IT hardware caused by radiation leak.

Unfavourable climatic conditions

Threat of disruption of work of IT systems due to climatic conditions that have a negative effect on hardware.

Loss of data or accessibility of IT infrastructure as a result of heightened humidity

Threat of disruption of work of IT systems due to high humidity.

Lost of data or accessibility of IT infrastructure as a result of very high temperature

Threat of disruption of work of IT systems due to high or low temperature.

Threats from space / Electromagnetic storm

Threats of the negative impact of solar radiation to satellites and radio wave communication systems - electromagnetic storm.

Wildlife

Threat of destruction of IT assets caused by animals: mice, rats, birds.

Failure of devices or systems

Threat of failure of IT hardware and/or software assets or its parts.

Failure of data media

Threat of failure of data media.

Hardware failure

Threat of failure of IT hardware.

Failure of applications and services

Threat of failure of software/applications or services.

Failure of parts of devices (connectors, plug-ins)

Threat of failure of IT equipment or its part.

Failure or disruption of communication links (communication networks)

Threat of failure or malfunction of communications links.

Failure of cable networks

Threat of failure of communications links due to problems with cable network.

Failure of wireless networks

Threat of failure of communications links due to problems with wireless networks.

Failure of mobile networks

Threat of failure of communications links due to problems with mobile networks.

Failure or disruption of main supply

Threat of failure or disruption of supply required for information systems.

Failure or disruption of power supply

Threat of failure or malfunction of power supply.

Failure of cooling infrastructure

Threat of failure of IT assets due to improper work of cooling infrastructure.

Failure or disruption of service providers (supply chain)

Threat of failure or disruption of third party services required for proper operation of information systems.

Malfunction of equipment (devices or systems)

Threat of malfunction of IT hardware and/or software assets or its parts (i.e. improper working parameters, jamming, rebooting).

Absence of personnel

Unavailability of key personnel and their competences.

Strike

Unavailability of staff due to a strike (large scale absence of personnel).

Loss of support services

Unavailability of support services required for proper operation of the information system.

Internet outage

Unavailability of the Internet connection.

Network outage

Unavailability of communication links.

Outage of cable networks

Threat of lack of communications links due to problems with cable network.

Outage of short-range wireless networks

Threat of lack of communications links due to problems with wireless networks (802.11 networks, Bluetooth, NFC etc.).

Outages of long-range wireless networks

Threat of lack of communications links due to problems with mobile networks like cellular network (3G, LTE, GSM etc.) or satellite links.

War driving

Threat of locating and possibly exploiting connection to the wireless network.

Intercepting compromising emissions

Threat of disclosure of transmitted information using interception and analysis of compromising emission.

Interception of information

Threat of interception of information which is improperly secured in transmission or by improper actions of staff.

Corporate espionage

Threat of obtaining information secrets by dishonest means.

Nation state espionage

Threats of stealing information by nation state espionage (e.g. China based governmental espionage, NSA from USA).

Information leakage due to unsecured Wi-Fi, rogue access points

Threat of obtaining important information by insecure network rogue access points etc.

Interfering radiation

Threat of failure of IT hardware or transmission connection due to electromagnetic induction or electromagnetic radiation emitted by an outside source.

Replay of messages

Threat in which valid data transmission is maliciously or fraudulently repeated or delayed.

Network Reconnaissance, Network traffic manipulation and Information gathering

Threat of identifying information about a network to find security weaknesses.

Man in the middle/ Session hijacking

Threats that relay or alter communication between two parties.

Violation of rules and regulations / Breach of legislation

Threat of financial or legal penalty or loss of trust of customers and collaborators due to violation of law or regulations.

Failure to meet contractual requirements

Threat of financial penalty or loss of trust of customers and collaborators due to failure to meet contractual requirements.

Failure to meet contractual requirements by third party

Threat of financial penalty or loss of trust of customers and collaborators due to a third party’s failure to meet contractual requirements

Unauthorized use of IPR protected resources

Threat of financial or legal penalty or loss of trust of customers and collaborators due to improper/illegal use of IPR protected material (IPR- Intellectual Property Rights.

Illegal usage of File Sharing services

Threat of financial or legal penalty or loss of trust of customers and collaborators due to improper/illegal use of file sharing services.

Abuse of personal data

Threat of illegal use of personal data.

Judiciary decisions/court order

Threat of financial or legal penalty or loss of trust of customers and collaborators due to judiciary decisions/court order.

Identity theft (Identity Fraud/ Account)

Threat of identity theft action.

Credentials-stealing trojans

Threat of identity theft action by malware computer programs.

Receiving unsolicited E-mail

Threat of receiving unsolicited email which affects information security and efficiency.

SPAM

Threat of receiving unsolicited, undesired, or illegal email messages.

Unsolicited infected e-mails

Threat emanating from unwanted emails that may contain infected attachments or links to malicious / infected web sites.

Denial of service

Threat of service unavailability due to massive requests for services.

Distributed denial of network service (DDoS) (network layer attack i.e. Protocol exploitation / Malformed packets / Flooding / Spoofing)

Threat of service unavailability due to a massive number of requests for access to network services from malicious clients.

Distributed denial of application service (DDoS) (application layer attack i.e. Ping of Death / XDoS / WinNuke / HTTP Floods)

Threat of service unavailability due to massive requests sent by multiple malicious clients.

Distributed DoS (DDoS) to both network and application services (amplification/reflection methods i.e. NTP/ DNS /…​/ BitTorrent)

Threat of creating a massive number of requests, using multiplication/amplification methods.

Malicious code/ software/ activity

Search Engine Poisoning

Threat of deliberate manipulation of search engine indexes.

Exploitation of fake trust of social media

Threat of malicious activities making use of trusted social media.

Worms/ Trojans

Threat of malware computer programs (trojans/worms).

Rootkits

Threat of stealthy types of malware software.

Mobile malware

Threat of mobile malware programs.

Infected trusted mobile apps

Threat of using mobile malware software that is recognised as trusted one.

Elevation of privileges

Threat of exploiting bugs, design flaws or configuration oversights in an operating system or software application to gain elevated access to resources.

Web application attacks / injection attacks (Code injection: SQL, XSS)

Threat of utilizing custom web applications embedded within social media sites, which can lead to installation of malicious code onto computers to be used to gain unauthorized access.

Spyware or deceptive adware

Threat of using software that aims to gather information about a person or organization without their knowledge.

Viruses

Threat of infection by viruses.

Rogue security software/ Rogueware / Scareware

Threat of internet fraud or malicious software that mislead users into believing there is a virus on their computer, and manipulates them to pay money for fake removal tool.

Ransomware

Threat of infection of computer system or device by malware that restricts access to it and demands that the user pay a ransom to remove the restriction.

Exploits/Exploit Kits

Threat to IT assets due to the use of web available exploits or exploits software.

Social Engineering

Threat of social engineering type attacks (target: manipulation of personnel behaviour).

Phishing attacks

Threat of an email fraud method in which the perpetrator sends out legitimate-looking email in an attempt to gather personal and financial information from recipients. Typically, the messages appear to come from well-known and trustworthy websites.

Spear phishing attacks

Spear-phishing is a targeted e-mail message that has been crafted to create fake trust and thus lure the victim to unveil some business or personal secrets that can be abused by the adversary.

Abuse of Information Leakage

Threat of leaking important information.

Leakage affecting mobile privacy and mobile applications

Threat of leaking important information due to using malware mobile applications.

Leakage affecting web privacy and web applications

Threat of leakage important information due to using malware web applications.

Leakage affecting network traffic

Threat of leaking important information in network traffic.

Leakage affecting cloud computing

Threat of leaking important information in cloud computing.

Generation and use of rogue certificates

Threat of use of rogue certificates.

Loss of (integrity of) sensitive information

Threat of loss of sensitive information due to loss of integrity.

Man in the middle / Session hijacking

Threat of attack consisting in the exploitation of the web session control mechanism, which is normally managed by a session token.

Social Engineering / signed malware

Threat of install fake trust signed software (malware) e.g. fake OS updates.

Fake SSL certificates

Threat of attack due to malware application signed by a certificate that is typically inherently trusted by an endpoint.

Manipulation of hardware and software

Threat of unauthorised manipulation of hardware and software.

Anonymous proxies

Threat of unauthorised manipulation by anonymous proxies.

Abuse of computing power of cloud to launch attacks (cybercrime as a service)

Threat of using large computing powers to generate attacks on demand.

Abuse of vulnerabilities, 0-day vulnerabilities

Threat of attacks using 0-day or known IT assets vulnerabilities.

Access of web sites through chains of HTTP Proxies (Obfuscation)

Threat of bypassing the security mechanism using HTTP proxies (bypassing the website blacklist).

Access to device software

Threat of unauthorised manipulation by access to device software.

Alternation of software

Threat of unauthorized modifications to code or data, attacking its integrity.

Rogue hardware

Threat of manipulation due to unauthorized access to hardware.

Manipulation of information

Threat of intentional data manipulation to mislead information systems or somebody or to cover other nefarious activities (loss of integrity of information).

Repudiation of actions

Threat of intentional data manipulation to repudiate action.

Address space hijacking (IP prefixes)

Threat of the illegitimate takeover of groups of IP addresses.

Routing table manipulation

Threat of route packets of network to IP addresses other than that was intended via sender by unauthorised manipulation of routing table.

DNS poisoning / DNS spoofing / DNS Manipulations

Threat of falsification of DNS information.

Falsification of record

Threat of intentional data manipulation to falsify records.

Autonomous System hijacking

Threat of overtaking by the attacker the ownership of a whole autonomous system and its prefixes despite origin validation.

Autonomous System manipulation

Threat of manipulation by the attacker of a whole autonomous system in order to perform malicious actions.

Falsification of configurations

Threat of intentional manipulation due to falsification of configurations.

Misuse of audit tools

Threat of nefarious actions performed using audit tools (discovery of security weaknesses in information systems)

Misuse of information/ information systems (including mobile apps)

Threat of nefarious action due to misuse of information / information systems.

Unauthorized activities

Threat of nefarious action due to unauthorised activities.

Unauthorised use or administration of devices and systems

Threat of nefarious action due to unauthorised use of devices and systems.

Unauthorised use of software

Threat of nefarious action due to unauthorised use of software.

Unauthorized access to the information systems-or-networks (IMPI Protocol / DNS Registrar Hijacking)

Threat of unauthorised access to the information systems / network.

Network Intrusion

Threat of unauthorised access to network.

Unauthorized changes of records

Threat of unauthorised changes of information.

Unauthorized installation of software

Threat of unauthorised installation of software.

Web based attacks (Drive-by download / malicious URLs / Browser based attacks)

Threat of installation of unwanted malware software by misusing websites.

Compromising confidential information (data breaches)

Threat of data breach.

Hoax

Threat of loss of IT assets security due to cheating.

False rumour and/or fake warning

Threat of disruption of work due to rumours and/or a fake warning.

Remote activity (execution)

Threat of nefarious action by attacker remote activity.

Remote Command Execution

Threat of nefarious action due to remote command execution.

Remote Access Tool (RAT)

Threat of infection of software that has a remote administration capabilities allowing an attacker to control the victim’s computer.

Botnets / Remote activity

Threat of penetration by software from malware distribution.

Targeted attacks (APTs etc.)

Threat of sophisticated, targeted attack which combine many attack techniques.

Mobile malware (exfiltration)

Threat of mobile software that aims to gather information about a person or organization without their knowledge.

Spear phishing attacks (targeted)

Threat of attack focused on a single user or department within an organization, coming from someone within the company in a position of trust and requesting information such as login, IDs and passwords.

Installation of sophisticated and targeted malware

Threat of malware delivered by sophisticated and targeted software.

Watering Hole attacks

Threat of malware residing on the websites which a group often uses.

Failed business process

Threat of damage or loss of IT assets due to improperly executed business process.

Brute force

Threat of unauthorised access via systematically checking all possible keys or passwords until the correct one is found.

Abuse of authorizations

Threat of using authorised access to perform illegitimate actions.

Almost no chance - remote - 01-05%

Very unlikely - highly improbable - 05-20%

Associated numerical value="5"

Unlikely - improbable (improbably) - 20-45%

Associated numerical value="20"

Roughly even change - roughly even odds - 45-55%

Associated numerical value="45"

Likely - probable (probably) - 55-80%

Associated numerical value="55"

Very likely - highly probable - 80-95%

Associated numerical value="80"

Almost certain(ly) - nearly certain - 95-99%

Associated numerical value="95"

Low

Uncorroborated information from good or marginal sources. Many assumptions. Mostly weak logical inferences, minimal methods application. Glaring intelligence gaps exist. Terms or expressions used: 'Possible', 'Could, may, might', 'Cannot judge, unclear.'

Moderate

Partially corroborated information from good sources. Several assumptions. Mix of strong and weak inferences and methods. Minimum intelligence gaps exist. Terms or expressions used: 'Likely, unlikely', 'Probable, improbable' 'Anticipate, appear'.

High

Well-corroborated information from proven sources. Minimal assumptions. Strong logical inferences and methods. No or minor intelligence gaps exist. Terms or expressions used: 'Will, will not', 'Almost certainly, remote', 'Highly likely, highly unlikely', 'Expect, assert, affirm'.

Transport

Energy

Health

Financial market operators

Banking

e-commerce platforms

Internet payment

cloud computing

search engines

social networks

application stores

Public Administrations

Energy

Transport Sector

Banking

Financial market operators

Health

Drinking Water Supply and Distribution

Digital Infrastructure

Electricity Sub Sector

Oil Sub Sector

Gas Sub Sector

Air Transport Sub Sector

Rail Transport Sub Sector

Water Transport Sub Sector

Road Transport Sub Sector

Bank Credit Institutions Sub Sector

Operators of Financial Trading Sub Sector

Financial Central Counterparty Sub Sector

Healthcare Provider Sub Sector

Water Supply Sub Sector

Water Distribution Sub Sector

IXPs Sub Sector

DNS Service Provider Sub Sector

TLD Name Registry Sub Sector

Online Marketplace Sub Sector

Online Search Engine Sub Sector

Cloud Computing Service Sub Sector

TRES SECRET UE/EU TOP SECRET

Information and material the unauthorised disclosure of which could cause exceptionally grave prejudice to the essential interests of the European Union or of one or more of the Member States.

SECRET UE/EU SECRET

Information and material the unauthorised disclosure of which could seriously harm the essential interests of the European Union or of one or more of the Member States.

CONFIDENTIEL UE/EU CONFIDENTIAL

Information and material the unauthorised disclosure of which could harm the essential interests of the European Union or of one or more of the Member States.

RESTREINT UE/EU RESTRICTED

Information and material the unauthorised disclosure of which could be disadvantageous to the interests of the European Union or of one or more of the Member States.

System(s) infected by known malware

The presence of any of the types of malware was detected in a system.

Dissemination of malware by email

Malware attached to a message or email message containing link to malicious URL.

Hosting of malware on web page

Hosting of malware on web page

Web page disseminating one or various types of malware.

Replication and spreading of a worm

System infected by a worm trying to infect other systems.

Connection to (a) suspicious port(s) linked to specific malware

System attempting to gain access to a port normally linked to a specific type of malware.

Connection to (a) suspicious system(s) linked to specific malware

System attempting to gain access to an IP address or URL normally linked to a specific type of malware, e.g. C&C or a distribution page for components linked to a specific botnet.

Flood of requests

Mass mailing of requests (network packets, emails, etc…​) from one single source to a specific service, aimed at affecting its normal functioning.

Exploit or tool aimed at exhausting resources (network, processing capacity, sessions, etc…​)

One single source using specially designed software to affect the normal functioning of a specific service, by exploiting a vulnerability.

Packet flooding

Mass mailing of requests (network packets, emails, etc…​) from various sources to a specific service, aimed at affecting its normal functioning.

Exploit or tool distribution aimed at exhausting resources

Various sources using specially designed software to affect the normal functioning of a specific service, by exploiting a vulnerability.

Vandalism

Logical and physical activities which – although they are not aimed at causing damage to information or at preventing its transmission among systems – have this effect.

Intentional disruption of data transmission and processing mechanisms

Logical and physical activities aimed at causing damage to information or at preventing its transmission among systems.

System probe

Single system scan searching for open ports or services using these ports for responding.

Network scanning

Scanning a network aimed at identifying systems which are active in the same network.

DNS zone transfer

Transfer of a specific DNS zone.

Wiretapping

Logical or physical interception of communications.

Dissemination of phishing emails

Mass emailing aimed at collecting data for phishing purposes with regard to the victims.

Hosting phishing sites

Hosting web sites for phishing purposes.

Aggregation of information gathered through phishing schemes

Collecting data obtained through phishing attacks on web pages, email accounts, etc…​

Exploit attempt

Unsuccessful use of a tool exploiting a specific vulnerability of the system.

SQL injection attempt

Unsuccessful attempt to manipulate or read the information of a database by using the SQL injection technique.

XSS attempt

Unsuccessful attempts to perform attacks by using cross-site scripting techniques.

File inclusion attempt

Unsuccessful attempt to include files in the system under attack by using file inclusion techniques.

Brute force attempt

Unsuccessful login attempt by using sequential credentials for gaining access to the system.

Password cracking attempt

Attempt to acquire access credentials by breaking the protective cryptographic keys.

Dictionary attack attempt

Unsuccessful login attempt by using system access credentials previously loaded into a dictionary.

Use of a local or remote exploit

Successful use of a tool exploiting a specific vulnerability of the system.

SQL injection

Manipulation or reading of information contained in a database by using the SQL injection technique.

XSS

Attacks performed with the use of cross-site scripting techniques.

File inclusion

Inclusion of files into a system under attack with the use of file inclusion techniques.

Control system bypass

Unauthorised access to a system or component by bypassing an access control system in place.

Theft of access credentials

Unauthorised access to a system or component by using stolen access credentials.

Unauthorised access to a system

Unauthorised access to a system or component.

Unauthorised access to information

Unauthorised access to a set of information.

Data exfiltration

Unauthorised access to and sharing of a specific set of information.

Modification of information

Unauthorised changes to a specific set of information.

Deletion of information

Unauthorised deleting of a specific set of information.

Misuse or unauthorised use of resources

Use of institutional resources for purposes other than those intended.

Illegitimate use of the name of an institution or third party

Using the name of an institution without permission to do so.

Email flooding

Sending an unusually large quantity of email messages.

Sending an unsolicited message

Sending an email message that was unsolicited or unwanted by the recipient.

Distribution or sharing of copyright protected content

Distribution or sharing of content protected by copyright and related rights.

Dissemination of content forbidden by law (publicly prosecuted offences)

Distribution or sharing of illegal content such as child pornography, racism, xenophobia, etc…​

Other unspecified event

Other unlisted events.

Undetermined

Field aimed at the classification of unprocessed events, which have remained undetermined from the beginning.

Infection

Infecting one or various systems with a specific type of malware.

Distribution

Infecting one or various systems with a specific type of malware.

C&C

Infecting one or various systems with a specific type of malware.

Undetermined

DoS/DDoS

Disruption of the processing and response capacity of systems and networks in order to render them inoperative.

Sabotage

Premeditated action to damage a system, interrupt a process, change or delete information, etc.

Scanning

Active and passive gathering of information on systems or networks.

Sniffing

Unauthorised monitoring and reading of network traffic.

Phishing

Attempt to gather information on a user or a system through phishing methods.

Exploitation of vulnerability

Attempt to intrude by exploiting a vulnerability in a system, component or network.

Login attempt

Attempt to log in to services or authentication / access control mechanisms.

Exploitation of vulnerability

Actual intrusion by exploiting a vulnerability in the system, component or network.

Compromising an account

Actual intrusion in a system, component or network by compromising a user or administrator account.

Unauthorised access

Unauthorised access to a particular set of information

Unauthorised modification/deletion

Unauthorised change or elimination of a particular set of information

Misuse or unauthorised use of resources

Use of institutional resources for purposes other than those intended.

Illegitimate use of the name of a third party

Use of the name of an institution without permission to do so.

SPAM

Copyright

Distribution and sharing of copyright protected content.

Dissemination of content forbidden by law.

Child pornography, racism and apology of violence.

Other

analytic debates within the organisation

Devil’s advocates methodology

competitive analysis

interdisciplinary brainstorming

intra-office peer review

Outside expertise review

Incident Report

Incident

Investigation

Countermeasure

General

Exercise

2018

5th pan European cyber crisis exercise, Cyber Europe 2018 (CE2018)

2016

4th pan-European cyber exercise, Cyber Europe 2016

Spring 2018

The sixth iteration of the Cyber Storm exercise series, Cyber Storm VI, is scheduled for Spring 2018

2017

Locked Shields 2017

2018

Locked Shields 2018

2020

Cyber-Angriff auf die deutsche Stromversorgung

2017

NATO Cyber Coalition 2017

2018

NATO Cyber Coalition 2018

2017

PACE17 will focus on four key areas, namely situational awareness, effectiveness of our instruments to counter cyber threats at EU level, speed of reaction and appropriate reactivity of our crisis response mechanisms, as well as our capacity to communicate fast and in a coordinated way. The exercise will be followed by an evaluation phase, to identify lessons learned and improve our toolbox.

2018

Low

The risk of having false positives in the tagged value is low.

Associated numerical value="25"

Medium

The risk of having false positives in the tagged value is medium.

Associated numerical value="50"

High

The risk of having false positives in the tagged value is high.

Associated numerical value="75"

executable

executable

executable

executable

executable

executable

executable

executable

executable

executable

executable

executable

executable

executable

executable

executable

executable

executable

executable

internet

internet

internet

internet

internet

internet

internet

internet

internet

phone and tablet

phone and tablet

phone and tablet

phone and tablet

phone and tablet

image

image

image

image

image

image

image

image

image

image

image

image

image

image

image

image

image

video and audio

video and audio

video and audio

video and audio

video and audio

video and audio

video and audio

video and audio

video and audio

video and audio

video and audio

video and audio

video and audio

video and audio

video and audio

video and audio

video and audio

video and audio

video and audio

document

document

document

document

document

document

document

document

document

document

document

document

document

document

document

document

document

bundle

bundle

bundle

bundle

bundle

bundle

bundle

bundle

bundle

bundle

bundle

bundle

bundle

bundle

bundle

bundle

bundle

bundle

code

code

code

code

code

code

code

code

code

code

code

code

code

code

apple

apple

apple

apple

apple

apple

apple

miscellaneous

miscellaneous

miscellaneous

miscellaneous

Explicitly personal

Name, address, phone number, SSN, government-issued ID (e.g., Jane Smith, 123 Main Street, 555-555-5555)

Potentially identifiable

Unique device ID, license plate, medical record number, cookie, IP address (e.g., MAC address 68:A8:6D:35:65:03)

Not readily identifiable

Same as Potentially Identifiable except data are also protected by safeguards and controls (e.g., hashed MAC addresses & legal representations)

Key coded

Clinical or research datasets where only curator retains key (e.g., Jane Smith, diabetes, HgB 15.1 g/dl = Csrk123)

Pseudonymous

Unique, artificial pseudonyms replace direct identifiers (e.g., HIPAA Limited Datasets, John Doe = 5L7T LX619Z) (unique sequence not used anywhere else)

Protected pseudonymous

Same as Pseudonymous, except data are also protected by safeguards and controls

De-identified

Data are suppressed, generalized, perturbed, swapped, etc. (e.g., GPA: 3.2 = 3.0-3.5, gender: female = gender: male)

Protected de-identified

Same as De-Identified, except data are also protected by safeguards and controls

Anonymous

For example, noise is calibrated to a data set to hide whether an individual is present or not (differential privacy)

Aggregated anonymous

Very highly aggregated data (e.g., statistical data, census data, or population data that 52.6% of Washington, DC residents are women)

TRES SECRET DEFENSE

SECRET DEFENSE

CONFIDENTIEL DEFENSE

SECRET

CONFIDENTIEL

DIFFUSION RESTREINTE

NON CLASSIFIEES

Racial or ethnic origin

Political opinions

Religious or philosophical beliefs

Trade union membership

Genetic data

Genetic data means personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question.

Biometric data

Biometric data for the purpose of uniquely identifying a natural person. Biometric data means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data.

Health

Data concerning health. Data concerning health means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.

Sex life or sexual orientation

Data concerning a natural person’s sex life or sexual orientation

(Distributed) Denial of Service

Exploit attack

Information gathering

Insider attack

Interception attack

Manipulation attack

Physical attack

Spoofing

Mailbox Hacking (CLI Spoofing)

IMEI Reprogramming

Call Forwarding Fraud

Call Conference / Multi-Party Calls

HLR Tampering / Switch Manipulation

SIM Card Cloning

False Base Station Attack

Spamming (SMS & IP services)

Phishing and Pharming

Mobile Malware

Fraud Risks associated with Voice over IP Services

PBX Hacking

Fraud Risks Associated with M2M Services

Data Charing Bypass

Subscription Fraud

Proxy Fraud

Account Takeover

Call Selling

Direct Debug Fraud

Credit Card Fraud (Card Present)

Credit Card Not Present Transactions

Cheque Fraud

Dealer Fraud

False Agent / Remote Activation Fraud

Theft and Handling Stolen Goods

Handset Subsidy Loss

Remote Order Fraud

Premium Rate / Audiotext Services Fraud (PRS)

Roaming Fraud

International Revenue Share Fraud

Inbound Roaming Fraud Risk to VPMN

Interconnect Abuse (GSM Gateways)

Refiling

Mobile to Fixed Network Gateways Abuse

False Answer / False Ring

Social Engineering

Internal Fraud

Normal Business Fraud and Crime

Brand Name / Logo Abuse

M-Commerce Provider Content Fraud

M-Commerce Provider PRS Fraud

Content Theft

Wangiri

Airtime Reseller Fraud

Prepaid Services Fraud - General

HLR Profile Manipulation

Manual Recharging

Generation of Abusive Calls

Scratch Card Abuse

Mobile Station

Mobile Equipment Radio

High Interaction Level

Exposed functionality of the honeypot is not limited.

Medium Interaction Level

Exposed functionality of the honeypot is limited to the service without exposing the full operating system.

low Interaction Level

Exposed functionality being limited. For example, a simulated SSH server of a honeypot is not able to authenticate against a valid login/password combination.

No interaction capabilities

No exposed functionality in the honeypot.

Learns from attack interaction

Learns from attack interaction

Network capture

The honeypot collects raw network capture.

Events

The honeypot collects data about something that has happened or took place, a change in state.

Attacks

The honeypot collects malicious activity.

Intrusions

The honeypot collects malicious activity that leads to a security failure.

None

The honeypot does not collect events, attacks, or intrusions.

Block

Attacker’s actions are identified and blocked. The attack never reaches the target.

Defuse

The attack reaches the target, but is manipulated in a way that it fails against the target.

Slow Down

Attacker is slowed down in his actions of spreading malicious activity.

None

No action is taken to limit the intruder’s spread of malicious activity against other systems.

Distributed

The honeypot is or appears to be composed of multiple systems.

Stand-Alone

The honeypot is or appears to be one system.

Network Interface

The honeypot can be directly communicated with via a network interface.

Non-Network Hardware Interface

Examples: Printer port, CDROM drives, USB connections.

Software API

The honeypot can be interacted with via a software API.

Server

The honeypot is passively awaiting requests from clients.

Client

The honeypot is actively initiating requests to servers.

Recipients MAY use this information in commercial products or services.

Recipients MUST NOT use this information in commercial products or services.

An external-reference value is required

Recipients MUST encrypt the information received when it is retransmitted or redistributed.

Recipients MAY encrypt the information received when it is retransmitted or redistributed.

Recipients MUST encrypt the information received when it is stored at rest.

Recipients MAY encrypt the information received when it is stored at rest.

Recipients MUST contact the Providers before acting upon the information received.

Recipients MUST contact the Providers before acting upon the information received.

Recipients MAY conduct actions on the information received that are only visible on the Recipients internal networks and systems, and MUST NOT conduct actions that are visible outside of the Recipients networks and systems, or visible to third parties.

Recipients MAY conduct indirect, or passive, actions on the information received that are externally visible and MUST NOT conduct direct, or active, actions.

Recipients MAY conduct direct, or active, actions on the information received that are externally visible.

Recipients MAY notify affected parties of a potential compromise or threat.

Recipients MUST NOT notify affected parties of potential compromise or threat.

Personal for identified recipients only.

Limited sharing on the basis of need-to-know.

Community wide sharing.

Unlimited sharing.

Recipients MAY attribute the Provider when redistributing the information received.

Recipients MUST attribute the Provider when redistributing the information received.

Recipients MUST NOT attribute the Provider when redistributing the information received.

Recipients MAY obfuscate information about the specific affected parties.

Recipients MUST obfuscate information about the specific affected parties.

Recipients MUST NOT obfuscate information about the specific affected parties.

Recipients MAY resell the information received.

Recipients MUST NOT resell the information received unmodified or in a semantically equivalent format.

A start-date value is required

An end-date value is required

A reference value is required

A name value is required

A version value is required

An id value is required

The attribute/event describes something that is legitly used, but seems to be compromised by 3rd parties to be used for malicious activities. Consider this if blocking is your course of action.

The attribute/event describes something legitly used, that does not show signes of compromise or misuse.

The attribute/event describes something where it is not 100% clear if it is used only legitly.

The attribute/event describes something that is definitly used maliciously.

The attribute/event describes something that seems to be used maliciously, but there is no 100% proof.

The attribute/event is invalid or wrong in respect to the situation described by the event.

The attribute/event is irrelevant to your organization or CTI process.

The nature of the attribute/event cannot be further determined. Use this only as a last resort.

The attribute/event was not vetted but passed through for operational reasons. A result might be higher false-positive rates.

0

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34