Commit Graph

9 Commits (9e41395073999fd950c5bcc2e2a7325e17ef2a69)

Author SHA1 Message Date
Alexandre Dulaunoy 9e41395073 chg: [api] add /info entrypoint to give details about the version of threat actor galaxy loaded 2020-01-08 13:32:33 +01:00
Alexandre Dulaunoy a8de744ca1
chg: [server] query logging added 2020-01-07 11:00:18 +01:00
Alexandre Dulaunoy ef4660a92d
chg: [api] return proper error if the query format is incorrect 2020-01-07 10:52:24 +01:00
Alexandre Dulaunoy f559c93c08
chg: [misp-galaxy] updated to the latest version 2020-01-07 10:46:02 +01:00
Alexandre Dulaunoy c938d94dd0 chg: [doc] include the GET entry point to get threat-actor by UUID 2020-01-06 16:15:56 +01:00
Alexandre Dulaunoy ce71307801 chg: [api] default content-type is set to JSON 2020-01-06 16:01:33 +01:00
Alexandre Dulaunoy d9897caf61 chg: [api] a simple GET has been added to get a threat-actor per UUID in a single get request
curl --silent http://localhost:8889/get/0286e80e-b0ed-464f-ad62-beec8536d0cb  | jq .
{
  "description": "We have investigated their intrusions since 2013 and have been battling them nonstop over the last year at several large telecommunications and technology companies. The determination of this China-based adversary is truly impressive: they are like a dog with a bone.\nHURRICANE PANDA’s preferred initial vector of compromise and persistence is a China Chopper webshell – a tiny and easily obfuscated 70 byte text file that consists of an ‘eval()’ command, which is then used to provide full command execution and file upload/download capabilities to the attackers. This script is typically uploaded to a web server via a SQL injection or WebDAV vulnerability, which is often trivial to uncover in a company with a large external web presence.\nOnce inside, the adversary immediately moves on to execution of a credential theft tool such as Mimikatz (repacked to avoid AV detection). If they are lucky to have caught an administrator who might be logged into that web server at the time, they will have gained domain administrator credentials and can now roam your network at will via ‘net use’ and ‘wmic’ commands executed through the webshell terminal.",
  "meta": {
    "attribution-confidence": "50",
    "country": "CN",
    "refs": [
      "http://www.crowdstrike.com/blog/cyber-deterrence-in-action-a-story-of-one-long-hurricane-panda-campaign/",
      "https://blog.confiant.com/uncovering-2017s-largest-malvertising-operation-b84cd38d6b85",
      "https://blog.confiant.com/zirconium-was-one-step-ahead-of-chromes-redirect-blocker-with-0-day-2d61802efd0d"
    ],
    "synonyms": [
      "Black Vine",
      "TEMP.Avengers",
      "Zirconium",
      "APT 31",
      "APT31"
    ]
  },
  "related": [
    {
      "dest-uuid": "a653431d-6a5e-4600-8ad3-609b5af57064",
      "tags": [
        "estimative-language:likelihood-probability=\"likely\""
      ],
      "type": "similar"
    },
    {
      "dest-uuid": "066d25c1-71bd-4bd4-8ca7-edbba00063f4",
      "tags": [
        "estimative-language:likelihood-probability=\"likely\""
      ],
      "type": "similar"
    },
    {
      "dest-uuid": "103ebfd8-4280-4027-b61a-69bd9967ad6c",
      "tags": [
        "estimative-language:likelihood-probability=\"likely\""
      ],
      "type": "similar"
    }
  ],
  "uuid": "0286e80e-b0ed-464f-ad62-beec8536d0cb",
  "value": "Hurricane Panda"
}
2020-01-06 15:45:14 +01:00
Alexandre Dulaunoy fb6781ef6f chg: [doc] public API url added https://www.misp-project.org/tai/ 2020-01-06 15:22:32 +01:00
Alexandre Dulaunoy cbacc92ba9 new: [initial] A simple ReST server to lookup threat actors (by name, synonym or UUID) and returning the corresponding MISP galaxy information about the known threat actors. 2020-01-06 14:29:31 +01:00