MISP Objects

When the information available in the leak was created. It’s usually before the first-seen.

The link where the leak is (or was) accessible at first-seen.

Type of information leak as discovered and classified by an AIL module. ['Credential', 'CreditCards', 'Mail', 'Onion', 'Phone', 'Keys']

When the leak has been accessible or seen for the first time.

A description of the leak which could include the potential victim(s) or description of the leak.

When the leak has been accessible or seen for the last time.

The AIL sensor uuid where the leak was processed and analysed.

Datetime

Free text value to attach to the file

Name of antivirus software

Name of detection signature

Full cookie

Type of cookie and how it’s used in this specific object. ['Session management', 'Personalization', 'Tracking', 'Exfiltration', 'Malicious Payload', 'Beaconing']

A description of the cookie.

Name of the cookie (if splitted)

Value of the cookie (if splitted)

Origin of the credential(s) ['bruteforce-scanning', 'malware-analysis', 'memory-analysis', 'network-analysis', 'leak', 'unknown']

A description of the credential(s)

Format of the password(s) ['clear-text', 'hashed', 'encrypted', 'unknown']

Password

Type of password(s) ['password', 'api-key', 'encryption-key', 'unknown']

Username related to the password(s)

Mention of any notification(s) towards the potential owner(s) of the credential(s) ['victim-notified', 'service-notified', 'none']

A description of the card.

Version of the card.

Name of the card owner.

Initial date of validity or issued date.

Card security code (CSC, CVD, CVV, CVC and SPC) as embossed or printed on the card.

credit-card number as encoded on the card.

Maximum date of validity

Packets per second

Protocol used for the attack ['TCP', 'UDP', 'ICMP', 'IP']

Destination ID (victim)

Beginning of the attack

Bits per second

IP address originating the attack

Description of the DDoS

Port originating the attack

End of the attack

Destination port of the attack

Domain name

First time the tuple has been seen

A description of the tuple

IP Address

Last time the tuple has been seen

Free text value to attach to the ELF

Address of the entry point

Number of sections

Type of ELF ['CORE', 'DYNAMIC', 'EXECUTABLE', 'HIPROC', 'LOPROC', 'NONE', 'RELOCATABLE']

Architecture of the ELF file ['None', 'M32', 'SPARC', 'i386', 'ARCH_68K', 'ARCH_88K', 'IAMCU', 'ARCH_860', 'MIPS', 'S370', 'MIPS_RS3_LE', 'PARISC', 'VPP500', 'SPARC32PLUS', 'ARCH_960', 'PPC', 'PPC64', 'S390', 'SPU', 'V800', 'FR20', 'RH32', 'RCE', 'ARM', 'ALPHA', 'SH', 'SPARCV9', 'TRICORE', 'ARC', 'H8_300', 'H8_300H', 'H8S', 'H8_500', 'IA_64', 'MIPS_X', 'COLDFIRE', 'ARCH_68HC12', 'MMA', 'PCP', 'NCPU', 'NDR1', 'STARCORE', 'ME16', 'ST100', 'TINYJ', 'x86_64', 'PDSP', 'PDP10', 'PDP11', 'FX66', 'ST9PLUS', 'ST7', 'ARCH_68HC16', 'ARCH_68HC11', 'ARCH_68HC08', 'ARCH_68HC05', 'SVX', 'ST19', 'VAX', 'CRIS', 'JAVELIN', 'FIREPATH', 'ZSP', 'MMIX', 'HUANY', 'PRISM', 'AVR', 'FR30', 'D10V', 'D30V', 'V850', 'M32R', 'MN10300', 'MN10200', 'PJ', 'OPENRISC', 'ARC_COMPACT', 'XTENSA', 'VIDEOCORE', 'TMM_GPP', 'NS32K', 'TPC', 'SNP1K', 'ST200', 'IP2K', 'MAX', 'CR', 'F2MC16', 'MSP430', 'BLACKFIN', 'SE_C33', 'SEP', 'ARCA', 'UNICORE', 'EXCESS', 'DXP', 'ALTERA_NIOS2', 'CRX', 'XGATE', 'C166', 'M16C', 'DSPIC30F', 'CE', 'M32C', 'TSK3000', 'RS08', 'SHARC', 'ECOG2', 'SCORE7', 'DSP24', 'VIDEOCORE3', 'LATTICEMICO32', 'SE_C17', 'TI_C6000', 'TI_C2000', 'TI_C5500', 'MMDSP_PLUS', 'CYPRESS_M8C', 'R32C', 'TRIMEDIA', 'HEXAGON', 'ARCH_8051', 'STXP7X', 'NDS32', 'ECOG1', 'ECOG1X', 'MAXQ30', 'XIMO16', 'MANIK', 'CRAYNV2', 'RX', 'METAG', 'MCST_ELBRUS', 'ECOG16', 'CR16', 'ETPU', 'SLE9X', 'L10M', 'K10M', 'AARCH64', 'AVR32', 'STM8', 'TILE64', 'TILEPRO', 'CUDA', 'TILEGX', 'CLOUDSHIELD', 'COREA_1ST', 'COREA_2ND', 'ARC_COMPACT2', 'OPEN8', 'RL78', 'VIDEOCORE5', 'ARCH_78KOR', 'ARCH_56800EX', 'BA1', 'BA2', 'XCORE', 'MCHP_PIC', 'INTEL205', 'INTEL206', 'INTEL207', 'INTEL208', 'INTEL209', 'KM32', 'KMX32', 'KMX16', 'KMX8', 'KVARC', 'CDP', 'COGE', 'COOL', 'NORC', 'CSR_KALIMBA', 'AMDGPU']

Header operating system application binary interface (ABI) ['AIX', 'ARM', 'AROS', 'C6000_ELFABI', 'C6000_LINUX', 'CLOUDABI', 'FENIXOS', 'FREEBSD', 'GNU', 'HPUX', 'HURD', 'IRIX', 'MODESTO', 'NETBSD', 'NSK', 'OPENBSD', 'OPENVMS', 'SOLARIS', 'STANDALONE', 'SYSTEMV', 'TRU64']

Flag of the section ['ALLOC', 'EXCLUDE', 'EXECINSTR', 'GROUP', 'HEX_GPREL', 'INFO_LINK', 'LINK_ORDER', 'MASKOS', 'MASKPROC', 'MERGE', 'MIPS_ADDR', 'MIPS_LOCAL', 'MIPS_MERGE', 'MIPS_NAMES', 'MIPS_NODUPES', 'MIPS_NOSTRIP', 'NONE', 'OS_NONCONFORMING', 'STRINGS', 'TLS', 'WRITE', 'XCORE_SHF_CP_SECTION']

Secure Hash Algorithm 2 (256 bits)

Free text value to attach to the section

Secure Hash Algorithm 2 (256 bits)

[Insecure] Secure Hash Algorithm 1 (160 bits)

Secure Hash Algorithm 2 (224 bits)

Secure Hash Algorithm 2 (224 bits)

Type of the section ['NULL', 'PROGBITS', 'SYMTAB', 'STRTAB', 'RELA', 'HASH', 'DYNAMIC', 'NOTE', 'NOBITS', 'REL', 'SHLIB', 'DYNSYM', 'INIT_ARRAY', 'FINI_ARRAY', 'PREINIT_ARRAY', 'GROUP', 'SYMTAB_SHNDX', 'LOOS', 'GNU_ATTRIBUTES', 'GNU_HASH', 'GNU_VERDEF', 'GNU_VERNEED', 'GNU_VERSYM', 'HIOS', 'LOPROC', 'ARM_EXIDX', 'ARM_PREEMPTMAP', 'HEX_ORDERED', 'X86_64_UNWIND', 'MIPS_REGINFO', 'MIPS_OPTIONS', 'MIPS_ABIFLAGS', 'HIPROC', 'LOUSER', 'HIUSER']

Secure Hash Algorithm 2 (512 bits)

[Insecure] MD5 hash (128 bits)

Entropy of the whole section

Name of the section

Fuzzy hash using context triggered piecewise hashes (CTPH)

Size of the section, in bytes

Secure Hash Algorithm 2 (384 bits)

Identifies a particular conversation thread

Display name of the sender

MIME Boundary

Email address the reply will be sent to

Full headers

Message ID

Carbon copy

Message return path

Destination email address

Subject

Sender email address

Date the email has been sent

Attachment

X-Mailer generally tells the program that was used to draft and send the original email

Display name of the receiver

State of the file ['Harmless', 'Signed', 'Revoked', 'Expired', 'Trusted']

Secure Hash Algorithm 2 (256 bits)

Free text value to attach to the file

Secure Hash Algorithm 2 (256 bits)

[Insecure] Secure Hash Algorithm 1 (160 bits)

Fuzzy hash by Trend Micro: Locality Sensitive Hash

Fuzzy hash using context triggered piecewise hashes (CTPH)

Secure Hash Algorithm 2 (224 bits)

Pattern that can be found in the file

Secure Hash Algorithm 2 (512 bits)

[Insecure] MD5 hash (128 bits)

Entropy of the whole file

Secure Hash Algorithm 2 (224 bits)

The file itself (binary)

Authenticode executable signature hash

Size of the file, in bytes

Filename on disk

Mime type

Secure Hash Algorithm 2 (384 bits)

Region.

The altitude is the decimal value of the altitude in the World Geodetic System 84 (WGS84) reference.

The longitude is the decimal value of the longitude in the World Geodetic System 84 (WGS84) reference

Country.

When the location was seen for the first time.

A generic description of the location.

The latitude is the decimal value of the latitude in the World Geodetic System 84 (WGS84) reference.

When the location was seen for the last time.

City.

The domain name of the server

This is the address of the previous web page from which a link to the currently requested page was followed

HTTP Proxy Username

HTTP Proxy Password

HTTP Method invoked (one of GET, POST, PUT, HEAD, DELETE, OPTIONS, CONNECT)

Request URI

An HTTP cookie previously sent by the server with Set-Cookie

The MIME type of the body of the request

Full HTTP Request URL

HTTP Basic Authentication Username

HTTP Basic Authentication Password

HTTP Request comment

The user agent string of the user agent

Destination port

First time the tuple has been seen

Description of the tuple

Source port

IP Address

Last time the tuple has been seen

Destination IP address

First seen of the SSL/TLS handshake

Source IP Address

Hash identifying source

Last seen of the SSL/TLS handshake

Type of detected software ie software, malware

Binary’s name

Number of sections

Free text value to attach to the Mach-O file

Type of Mach-O ['BUNDLE', 'CORE', 'DSYM', 'DYLIB', 'DYLIB_STUB', 'DYLINKER', 'EXECUTE', 'FVMLIB', 'KEXT_BUNDLE', 'OBJECT', 'PRELOAD']

Address of the entry point

Secure Hash Algorithm 2 (256 bits)

Free text value to attach to the section

Secure Hash Algorithm 2 (256 bits)

[Insecure] Secure Hash Algorithm 1 (160 bits)

Secure Hash Algorithm 2 (224 bits)

Secure Hash Algorithm 2 (224 bits)

Secure Hash Algorithm 2 (512 bits)

[Insecure] MD5 hash (128 bits)

Entropy of the whole section

Name of the section

Fuzzy hash using context triggered piecewise hashes (CTPH)

Size of the section, in bytes

Secure Hash Algorithm 2 (384 bits)

Username who are quoted into the microblog post

Raw post

Last update of the microblog post

Original URL location of the microblog post

Link into the microblog post

Initial creation of the microblog post

Type of the microblog post ['Twitter', 'Facebook', 'LinkedIn', 'Reddit', 'Google+', 'Instagram', 'Forum', 'Other']

Username who posted the microblog post

When the microblog post was removed

Direction of this flow ['Ingress', 'Egress']

First packet seen in this flow

Source AS number for this flow

IP address destination of the netflow

Bytes counted in this flow

Last packet seen in this flow

IP version of this flow

Source port of the netflow

Protocol used for this flow ['TCP', 'UDP', 'ICMP', 'IP']

Destination AS number for this flow

Packets counted in this flow

TCP flags of the flow

Flows counted in this flow

Destination port of the netflow

IP address source of the netflow

ICMP type of the flow (if the traffic is ICMP)

IP protocol number of this flow

Last time that the unique tuple (rrname, rrtype, rdata) record has been seen by the passive DNS

Resource Record name of the queried resource

First time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import

Best estimate of the apex of the zone where this data is authoritative

Sensor information where the record was seen

Resource records of the queried resource

Resource Record type as seen by the passive DNS ['A', 'AAAA', 'CNAME', 'PTR', 'SOA', 'TXT', 'DNAME', 'NS', 'SRV', 'RP', 'NAPTR', 'HINFO', 'A6']

Origin of the Passive DNS response

First time that the unique tuple (rrname, rrtype, rdata) has been seen by the passive DNS

Last time that the unique tuple (rrname, rrtype, rdata) record has been seen via master file import

How many authoritative DNS answers were received at the Passive DNS Server’s collectors with exactly the given set of values as answers

Raw text of the paste or post

Original source of the paste or post. ['pastebin.com', 'pastebin.com_pro', 'pastie.org', 'slexy.org', 'gist.github.com', 'codepad.org', 'safebin.net', 'hastebin.com', 'ghostbin.com']

Link to the original source of the paste or post.

When the paste has been accessible or seen for the first time.

Title of the paste or post.

When the paste has been accessible or seen for the last time.

FileVersion in the resources

Free text value to attach to the PE

Fuzzy Hash (ssdeep) calculated from the import table

Hash of the structural information about a sample. See https://www.usenix.org/legacy/event/leet09/tech/full_papers/wicherski/wicherski_html/

Address of the entry point

ProductVersion in the resources

Compilation timestamp defined in the PE header

FileDescription in the resources

Hash (md5) calculated from the import table

ProductName in the resources

CompanyName in the resources

Lang ID in the resources

Name of the section and position of the section in the PE

Number of sections

InternalFilename in the resources

Type of PE ['exe', 'dll', 'driver', 'unknown']

OriginalFilename in the resources

LegalCopyright in the resources

Secure Hash Algorithm 2 (256 bits)

Free text value to attach to the section

Secure Hash Algorithm 2 (256 bits)

[Insecure] Secure Hash Algorithm 1 (160 bits)

Secure Hash Algorithm 2 (224 bits)

Secure Hash Algorithm 2 (224 bits)

Characteristic of the section ['read', 'write', 'executable']

Secure Hash Algorithm 2 (512 bits)

[Insecure] MD5 hash (128 bits)

Entropy of the whole section

Name of the section ['.rsrc', '.reloc', '.rdata', '.data', '.text']

Fuzzy hash using context triggered piecewise hashes (CTPH)

Size of the section, in bytes

Secure Hash Algorithm 2 (384 bits)

Middle name of a natural person

The gender of a natural person. ['Male', 'Female', 'Other', 'Prefer not to say']

Place of birth of a natural person.

The country in which the passport was issued.

A description of the person or identity.

The expiration date of a passport.

First name of a natural person.

Last name of a natural person.

The passport number of a natural person.

The nationality of a natural person.

Date of birth of a natural person (in YYYY-MM-DD format).

The Redress Control Number is the record identifier for people who apply for redress through the DHS Travel Redress Inquiry Program (DHS TRIP). DHS TRIP is for travelers who have been repeatedly identified for additional screening and who want to file an inquiry to have erroneous information corrected in DHS systems.

A usually unique International Mobile Subscriber Identity (IMSI) is allocated to each mobile subscriber in the GSM/UMTS/EPS system. IMSI can also refer to International Mobile Station Identity in the ITU nomenclature.

Serial Number.

MSISDN (pronounced as /'em es ai es di en/ or misden) is a number uniquely identifying a subscription in a GSM or a UMTS mobile network. Simply put, it is the mapping of the telephone number to the SIM card in a mobile/cellular phone. This abbreviation has a several interpretations, the most common one being Mobile Station International Subscriber Directory Number.

When the phone has been accessible or seen for the first time.

International Mobile Equipment Identity (IMEI) is a number, usually unique, to identify 3GPP and iDEN mobile phones, as well as some satellite phones.

Globally Unique MME Identifier (GUMMEI) is composed from MCC, MNC and MME Identifier (MMEI).

Globally Unique Temporary UE Identity (GUTI) is a temporary identification to not reveal the phone (user equipment in 3GPP jargon) composed of GUMMEI and the M-TMSI.

A description of the phone.

When the phone has been accessible or seen for the last time.

Temporary Mobile Subscriber Identities (TMSI) to visiting mobile subscribers can be allocated.

Radare2 commit ID used to generate this object

Amount of calls to CreateThread

Amount of memory allocations

Shortest path to the first time the binary calls CreateThread

Ratio: amount of API calls per kilobyte of code section

Amount of API calls not ending in a function (Radare2 bug, probalby)

Amount of API calls outside of code section (glob var, dynamic API)

Amount of dangling strings (string with a code cross reference, that is not within a function. Radare2 failed to detect that function.)

Description of the r2graphity object

Amount of API call reference that does not resolve to a function offset

Largest callback

Total amount of API calls

Amount of not referenced strings

Amount of referenced strings

Graph export in G>raph Modelling Language format

Total amount of functions in the file.

Average size of a callback

Ratio: amount of functions per kilobyte of code section

Amount of calls to GetProcAddress

Amount of callbacks (functions started as thread)

Ratio: amount of referenced strings per kilobyte of code section

Amount of API calls inside a code section

A description of the regular expression.

Type of the regular expression syntax. ['PCRE', 'PCRE2', 'POSIX BRE', 'POSIX ERE']

regexp

Data stored in the registry key

Registry value type ['REG_NONE', 'REG_SZ', 'REG_EXPAND_SZ', 'REG_BINARY', 'REG_DWORD', 'REG_DWORD_LITTLE_ENDIAN', 'REG_DWORD_BIG_ENDIAN', 'REG_LINK', 'REG_MULTI_SZ', 'REG_RESOURCE_LIST', 'REG_FULL_RESOURCE_DESCRIPTOR', 'REG_RESOURCE_REQUIREMENTS_LIST', 'REG_QWORD', 'REG_QWORD_LITTLE_ENDIAN']

Last time the registry key has been modified

Name of the registry key

Full key path

Hive used to store the registry key (file on disk)

Case number

Free text summary of the report

ticket-number of the RTIR ticket

Queue of the RTIR ticket ['incident', 'investigations', 'blocks', 'incident reports']

Status of the RTIR ticket ['new', 'open', 'stalled', 'resolved', 'rejected', 'deleted']

Classification of the RTIR ticket

Constituency of the RTIR ticket

IPs automatically extracted from the RTIR ticket

Subject of the RTIR ticket

Tor node description.

list of flag associated with the node.

router’s publication time. This can be different from first-seen and last-seen.

router’s fingerprint.

versioning information reported by the node.

IP address of the Tor node seen.

parsed version of tor, this is None if the relay’s using a new versioning scheme.

When the Tor node designed by the IP address has been seen for the first time.

Tor node comment.

Raw document from the consensus.

When the Tor node designed by the IP address has been seen for the last time.

router’s nickname.

Query (after path, preceded by '?')

Subdomain

Full URL

Domain without Top-Level Domain

Full hostname

Fragment identifier is a short string of characters that refers to a resource that is subordinate to another, primary resource.

Full domain

Top-Level Domain

Scheme ['http', 'https', 'ftp', 'gopher', 'sip']

Path (between hostname:port and query)

Last time this URL has been seen

Credential (username, password)

First time this URL has been seen

Description of the URL

Port number

The list of sectors that the victim belong to ['agriculture', 'aerospace', 'automotive', 'communications', 'construction', 'defence', 'education', 'energy', 'engineering', 'entertainment', 'financial\xadservices', 'government\xadnational', 'government\xadregional', 'government\xadlocal', 'government\xadpublic\xadservices', 'healthcare', 'hospitality\xadleisure', 'infrastructure', 'insurance', 'manufacturing', 'mining', 'non\xadprofit', 'pharmaceuticals', 'retail', 'technology', 'telecommunications', 'transportation', 'utilities']

The list of regions or locations from the victim targeted. ISO 3166 should be used.

Description of the victim

The type of entity being targeted. ['individual', 'group', 'organization', 'class', 'unknown']

The name of the victim targeted. The name can be an organisation or a group of organisations.

The list of roles targeted within the victim.

Detection Ratio

First Submission

Community Score

Permalink Reference

Last Submission

External references

Last modification date

Initial publication date

Vulnerability ID (generally CVE, but not necessarely)

Description of the vulnerability

Summary of the vulnerability

The vulnerable configuration is described in CPE format

Initial creation of the whois entry

Registrant phone number

Domain of the whois entry

Registrant email address

Expiration of the whois entry

Registrar of the whois entry

Registrant name

Full whois entry

Last update of the whois entry

Raw certificate base64 encoded

Certificate invalid after that date

Issuer of the certificate

Version of the certificate

Secure Hash Algorithm 2 (256 bits)

Subject of the certificate

[Insecure] Secure Hash Algorithm 1 (160 bits)

Length of the public key (in bits)

Serial number of the certificate

Certificate invalid before that date

Algorithm of the public key

[Insecure] MD5 hash (128 bits)

Exponent of the public key

Free text description of hte certificate

Modulus of the public key

Yara rule generated from -y.

Wide yara rule generated from -yh.

A description of Yara rule generated.

Whitelist name used to generate the rules.

yabin.py and regex.txt version used for the generation of the yara rules.