Commit Graph

9 Commits (0fe4fb361bb0a4d1ad531de99f89a2767273526b)

Author SHA1 Message Date
DocArmoryTech 14376c39c7
Parameterise listening port and address
Uses tornado.options to `define` the port and ip address on which tai-server listens.

Default options maintain current functionality (i.e. listen on 0.0.0.0:8889)
2020-11-03 11:51:01 +00:00
Alexandre Dulaunoy 1153d5cd17
chg: [tai-server] proper handling for non-existing threat-actor in queried country 2020-05-29 11:44:20 +02:00
Alexandre Dulaunoy d883cea43a
new: [query] country search added against the threat actor db
curl --silent -d '{"country":"IR"}' -H "Content-Type: application/json" -X POST http://127.0.0.1:8889/query | jq .
2020-05-28 10:13:04 +02:00
Alexandre Dulaunoy 9e41395073 chg: [api] add /info entrypoint to give details about the version of threat actor galaxy loaded 2020-01-08 13:32:33 +01:00
Alexandre Dulaunoy a8de744ca1
chg: [server] query logging added 2020-01-07 11:00:18 +01:00
Alexandre Dulaunoy ef4660a92d
chg: [api] return proper error if the query format is incorrect 2020-01-07 10:52:24 +01:00
Alexandre Dulaunoy ce71307801 chg: [api] default content-type is set to JSON 2020-01-06 16:01:33 +01:00
Alexandre Dulaunoy d9897caf61 chg: [api] a simple GET has been added to get a threat-actor per UUID in a single get request
curl --silent http://localhost:8889/get/0286e80e-b0ed-464f-ad62-beec8536d0cb  | jq .
{
  "description": "We have investigated their intrusions since 2013 and have been battling them nonstop over the last year at several large telecommunications and technology companies. The determination of this China-based adversary is truly impressive: they are like a dog with a bone.\nHURRICANE PANDA’s preferred initial vector of compromise and persistence is a China Chopper webshell – a tiny and easily obfuscated 70 byte text file that consists of an ‘eval()’ command, which is then used to provide full command execution and file upload/download capabilities to the attackers. This script is typically uploaded to a web server via a SQL injection or WebDAV vulnerability, which is often trivial to uncover in a company with a large external web presence.\nOnce inside, the adversary immediately moves on to execution of a credential theft tool such as Mimikatz (repacked to avoid AV detection). If they are lucky to have caught an administrator who might be logged into that web server at the time, they will have gained domain administrator credentials and can now roam your network at will via ‘net use’ and ‘wmic’ commands executed through the webshell terminal.",
  "meta": {
    "attribution-confidence": "50",
    "country": "CN",
    "refs": [
      "http://www.crowdstrike.com/blog/cyber-deterrence-in-action-a-story-of-one-long-hurricane-panda-campaign/",
      "https://blog.confiant.com/uncovering-2017s-largest-malvertising-operation-b84cd38d6b85",
      "https://blog.confiant.com/zirconium-was-one-step-ahead-of-chromes-redirect-blocker-with-0-day-2d61802efd0d"
    ],
    "synonyms": [
      "Black Vine",
      "TEMP.Avengers",
      "Zirconium",
      "APT 31",
      "APT31"
    ]
  },
  "related": [
    {
      "dest-uuid": "a653431d-6a5e-4600-8ad3-609b5af57064",
      "tags": [
        "estimative-language:likelihood-probability=\"likely\""
      ],
      "type": "similar"
    },
    {
      "dest-uuid": "066d25c1-71bd-4bd4-8ca7-edbba00063f4",
      "tags": [
        "estimative-language:likelihood-probability=\"likely\""
      ],
      "type": "similar"
    },
    {
      "dest-uuid": "103ebfd8-4280-4027-b61a-69bd9967ad6c",
      "tags": [
        "estimative-language:likelihood-probability=\"likely\""
      ],
      "type": "similar"
    }
  ],
  "uuid": "0286e80e-b0ed-464f-ad62-beec8536d0cb",
  "value": "Hurricane Panda"
}
2020-01-06 15:45:14 +01:00
Alexandre Dulaunoy cbacc92ba9 new: [initial] A simple ReST server to lookup threat actors (by name, synonym or UUID) and returning the corresponding MISP galaxy information about the known threat actors. 2020-01-06 14:29:31 +01:00