1250 lines
126 KiB
XML
1250 lines
126 KiB
XML
|
<stix:STIX_Package
|
||
|
|
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
|
||
|
|
xmlns:cybox="http://cybox.mitre.org/cybox-2"
|
||
|
|
xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
|
||
|
|
xmlns:ASObj="http://cybox.mitre.org/objects#ASObject-1"
|
||
|
|
xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
|
||
|
|
xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1"
|
||
|
|
xmlns:EmailMessageObj="http://cybox.mitre.org/objects#EmailMessageObject-2"
|
||
|
|
xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"
|
||
|
|
xmlns:HTTPSessionObj="http://cybox.mitre.org/objects#HTTPSessionObject-2"
|
||
|
|
xmlns:HostnameObj="http://cybox.mitre.org/objects#HostnameObject-1"
|
||
|
|
xmlns:MutexObj="http://cybox.mitre.org/objects#MutexObject-2"
|
||
|
|
xmlns:PipeObj="http://cybox.mitre.org/objects#PipeObject-2"
|
||
|
|
xmlns:URIObj="http://cybox.mitre.org/objects#URIObject-2"
|
||
|
|
xmlns:WinRegistryKeyObj="http://cybox.mitre.org/objects#WinRegistryKeyObject-2"
|
||
|
|
xmlns:marking="http://data-marking.mitre.org/Marking-1"
|
||
|
|
xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"
|
||
|
|
xmlns:et="http://stix.mitre.org/ExploitTarget-1"
|
||
|
|
xmlns:incident="http://stix.mitre.org/Incident-1"
|
||
|
|
xmlns:indicator="http://stix.mitre.org/Indicator-2"
|
||
|
|
xmlns:ttp="http://stix.mitre.org/TTP-1"
|
||
|
|
xmlns:ta="http://stix.mitre.org/ThreatActor-1"
|
||
|
|
xmlns:stixCommon="http://stix.mitre.org/common-1"
|
||
|
|
xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
|
||
|
|
xmlns:stix-ciqidentity="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1"
|
||
|
|
xmlns:snortTM="http://stix.mitre.org/extensions/TestMechanism#Snort-1"
|
||
|
|
xmlns:stix="http://stix.mitre.org/stix-1"
|
||
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||
|
|
xmlns:="https://rufus.citlab.utoronto.ca"
|
||
|
|
xmlns:xal="urn:oasis:names:tc:ciq:xal:3"
|
||
|
|
xmlns:xnl="urn:oasis:names:tc:ciq:xnl:3"
|
||
|
|
xmlns:xpil="urn:oasis:names:tc:ciq:xpil:3"
|
||
|
|
xsi:schemaLocation="
|
||
|
|
http://cybox.mitre.org/common-2 http://cybox.mitre.org/XMLSchema/common/2.1/cybox_common.xsd
|
||
|
|
http://cybox.mitre.org/cybox-2 http://cybox.mitre.org/XMLSchema/core/2.1/cybox_core.xsd
|
||
|
|
http://cybox.mitre.org/default_vocabularies-2 http://cybox.mitre.org/XMLSchema/default_vocabularies/2.1/cybox_default_vocabularies.xsd
|
||
|
|
http://cybox.mitre.org/objects#ASObject-1 http://cybox.mitre.org/XMLSchema/objects/AS/1.0/AS_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#AddressObject-2 http://cybox.mitre.org/XMLSchema/objects/Address/2.1/Address_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#DomainNameObject-1 http://cybox.mitre.org/XMLSchema/objects/Domain_Name/1.0/Domain_Name_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#EmailMessageObject-2 http://cybox.mitre.org/XMLSchema/objects/Email_Message/2.1/Email_Message_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#FileObject-2 http://cybox.mitre.org/XMLSchema/objects/File/2.1/File_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#HTTPSessionObject-2 http://cybox.mitre.org/XMLSchema/objects/HTTP_Session/2.1/HTTP_Session_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#HostnameObject-1 http://cybox.mitre.org/XMLSchema/objects/Hostname/1.0/Hostname_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#MutexObject-2 http://cybox.mitre.org/XMLSchema/objects/Mutex/2.1/Mutex_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#PipeObject-2 http://cybox.mitre.org/XMLSchema/objects/Pipe/2.1/Pipe_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#URIObject-2 http://cybox.mitre.org/XMLSchema/objects/URI/2.1/URI_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#WinRegistryKeyObject-2 http://cybox.mitre.org/XMLSchema/objects/Win_Registry_Key/2.1/Win_Registry_Key_Object.xsd
|
||
|
|
http://data-marking.mitre.org/Marking-1 http://stix.mitre.org/XMLSchema/data_marking/1.1.1/data_marking.xsd
|
||
|
|
http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1 http://stix.mitre.org/XMLSchema/extensions/marking/tlp/1.1.1/tlp_marking.xsd
|
||
|
|
http://stix.mitre.org/ExploitTarget-1 http://stix.mitre.org/XMLSchema/exploit_target/1.1.1/exploit_target.xsd
|
||
|
|
http://stix.mitre.org/Incident-1 http://stix.mitre.org/XMLSchema/incident/1.1.1/incident.xsd
|
||
|
|
http://stix.mitre.org/Indicator-2 http://stix.mitre.org/XMLSchema/indicator/2.1.1/indicator.xsd
|
||
|
|
http://stix.mitre.org/TTP-1 http://stix.mitre.org/XMLSchema/ttp/1.1.1/ttp.xsd
|
||
|
|
http://stix.mitre.org/ThreatActor-1 http://stix.mitre.org/XMLSchema/threat_actor/1.1.1/threat_actor.xsd
|
||
|
|
http://stix.mitre.org/common-1 http://stix.mitre.org/XMLSchema/common/1.1.1/stix_common.xsd
|
||
|
|
http://stix.mitre.org/default_vocabularies-1 http://stix.mitre.org/XMLSchema/default_vocabularies/1.1.1/stix_default_vocabularies.xsd
|
||
|
|
http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1 http://stix.mitre.org/XMLSchema/extensions/identity/ciq_3.0/1.1.1/ciq_3.0_identity.xsd
|
||
|
|
http://stix.mitre.org/extensions/TestMechanism#Snort-1 http://stix.mitre.org/XMLSchema/extensions/test_mechanism/snort/1.1.1/snort_test_mechanism.xsd
|
||
|
|
http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.1.1/stix_core.xsd
|
||
|
|
urn:oasis:names:tc:ciq:xal:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xAL.xsd
|
||
|
|
urn:oasis:names:tc:ciq:xnl:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xNL.xsd
|
||
|
|
urn:oasis:names:tc:ciq:xpil:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xPIL.xsd" id=":Package-75287c07-daf5-49c6-bf5c-0f33a85d66aa" version="1.1.1" timestamp="2017-02-02T05:22:08.102251+00:00">
|
||
|
|
<stix:STIX_Header>
|
||
|
|
<stix:Title>Export from MISP</stix:Title>
|
||
|
|
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
|
||
|
|
</stix:STIX_Header>
|
||
|
|
<stix:Related_Packages>
|
||
|
|
<stix:Related_Package>
|
||
|
|
<stix:Package id=":STIXPackage-587cf513-b324-485c-b65e-07298e96ca05" version="1.1.1" timestamp="2017-01-31T12:10:57+00:00">
|
||
|
|
<stix:STIX_Header>
|
||
|
|
<stix:Title>Nile Phish - attacks again Egyptian civil society</stix:Title>
|
||
|
|
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
|
||
|
|
</stix:STIX_Header>
|
||
|
|
<stix:Incidents>
|
||
|
|
<stix:Incident id=":incident-587cf513-b324-485c-b65e-07298e96ca05" timestamp="2017-01-31T13:49:48+00:00" xsi:type='incident:IncidentType'>
|
||
|
|
<incident:Title>Nile Phish - attacks again Egyptian civil society</incident:Title>
|
||
|
|
<incident:External_ID source="MISP Event">89</incident:External_ID>
|
||
|
|
<incident:Time>
|
||
|
|
<incident:Incident_Discovery precision="second">2017-01-16T00:00:00+00:00</incident:Incident_Discovery>
|
||
|
|
<incident:Incident_Reported precision="second">2017-01-31T13:49:48+00:00</incident:Incident_Reported>
|
||
|
|
</incident:Time>
|
||
|
|
<incident:Status xsi:type="stixVocabs:IncidentStatusVocab-1.0">Open</incident:Status>
|
||
|
|
<incident:Related_Indicators>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-588778af-cf24-4254-ad98-07288e96ca05" timestamp="2017-01-24T10:54:23+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: account-google.serveftp.com (MISP Attribute #15651)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: account-google.serveftp.com (MISP Attribute #15651)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-588778af-cf24-4254-ad98-07288e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-588778af-cf24-4254-ad98-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">account-google.serveftp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T10:54:23+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-588778af-5724-4ccd-b5f0-07288e96ca05" timestamp="2017-01-24T10:54:23+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: aramex-shipping.servehttp.com (MISP Attribute #15652)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: aramex-shipping.servehttp.com (MISP Attribute #15652)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-588778af-5724-4ccd-b5f0-07288e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-588778af-5724-4ccd-b5f0-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">aramex-shipping.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T10:54:23+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-588778af-ee60-4f45-8efb-07288e96ca05" timestamp="2017-01-24T10:54:23+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: device-activation.servehttp.com (MISP Attribute #15653)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: device-activation.servehttp.com (MISP Attribute #15653)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-588778af-ee60-4f45-8efb-07288e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-588778af-ee60-4f45-8efb-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">device-activation.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T10:54:23+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-588778af-4e10-41de-9d5b-07288e96ca05" timestamp="2017-01-24T10:54:23+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: dropbox-service.serveftp.com (MISP Attribute #15654)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: dropbox-service.serveftp.com (MISP Attribute #15654)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-588778af-4e10-41de-9d5b-07288e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-588778af-4e10-41de-9d5b-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">dropbox-service.serveftp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T10:54:23+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-588778af-4184-41bd-932b-07288e96ca05" timestamp="2017-01-24T10:54:23+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: dropbox-sign.servehttp.com (MISP Attribute #15655)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: dropbox-sign.servehttp.com (MISP Attribute #15655)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-588778af-4184-41bd-932b-07288e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-588778af-4184-41bd-932b-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">dropbox-sign.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T10:54:23+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-588778af-d7e4-4b55-8b85-07288e96ca05" timestamp="2017-01-24T10:54:23+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: dropboxsupport.servehttp.com (MISP Attribute #15656)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: dropboxsupport.servehttp.com (MISP Attribute #15656)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-588778af-d7e4-4b55-8b85-07288e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-588778af-d7e4-4b55-8b85-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">dropboxsupport.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T10:54:23+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-588778af-5614-4198-bfc8-07288e96ca05" timestamp="2017-01-24T10:54:23+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: fedex-mail.servehttp.com (MISP Attribute #15657)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: fedex-mail.servehttp.com (MISP Attribute #15657)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-588778af-5614-4198-bfc8-07288e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-588778af-5614-4198-bfc8-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">fedex-mail.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T10:54:23+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-588778af-d37c-406e-8703-07288e96ca05" timestamp="2017-01-24T10:54:23+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: fedex-shipping.servehttp.com (MISP Attribute #15658)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: fedex-shipping.servehttp.com (MISP Attribute #15658)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-588778af-d37c-406e-8703-07288e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-588778af-d37c-406e-8703-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">fedex-shipping.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T10:54:23+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-588778af-3f6c-4a59-9c2f-07288e96ca05" timestamp="2017-01-24T10:54:23+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: fedex-sign.servehttp.com (MISP Attribute #15659)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: fedex-sign.servehttp.com (MISP Attribute #15659)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-588778af-3f6c-4a59-9c2f-07288e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-588778af-3f6c-4a59-9c2f-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">fedex-sign.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T10:54:23+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-588778af-1708-4caa-bef5-07288e96ca05" timestamp="2017-01-24T10:54:23+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: googledriver-sign.ddns.net (MISP Attribute #15660)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: googledriver-sign.ddns.net (MISP Attribute #15660)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-588778af-1708-4caa-bef5-07288e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-588778af-1708-4caa-bef5-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">googledriver-sign.ddns.net</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T10:54:23+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-588778af-3604-4351-9e9e-07288e96ca05" timestamp="2017-01-24T10:54:23+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: googledrive-sign.servehttp.com (MISP Attribute #15661)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: googledrive-sign.servehttp.com (MISP Attribute #15661)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-588778af-3604-4351-9e9e-07288e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-588778af-3604-4351-9e9e-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">googledrive-sign.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T10:54:23+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-588778af-1470-4b9e-a921-07288e96ca05" timestamp="2017-01-24T10:54:23+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: google-maps.servehttp.com (MISP Attribute #15662)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: google-maps.servehttp.com (MISP Attribute #15662)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-588778af-1470-4b9e-a921-07288e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-588778af-1470-4b9e-a921-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">google-maps.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T10:54:23+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-588778af-2d08-493e-962a-07288e96ca05" timestamp="2017-01-24T10:54:23+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: googlesecure-serv.servehttp.com (MISP Attribute #15663)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: googlesecure-serv.servehttp.com (MISP Attribute #15663)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-588778af-2d08-493e-962a-07288e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-588778af-2d08-493e-962a-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">googlesecure-serv.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T10:54:23+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-588778af-f554-4b11-b19b-07288e96ca05" timestamp="2017-01-24T10:54:23+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: googlesignin.servehttp.com (MISP Attribute #15664)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: googlesignin.servehttp.com (MISP Attribute #15664)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-588778af-f554-4b11-b19b-07288e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-588778af-f554-4b11-b19b-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">googlesignin.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T10:54:23+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-588778af-aaf4-49c7-9028-07288e96ca05" timestamp="2017-01-24T10:54:23+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: googleverify-signin.servehttp.com (MISP Attribute #15665)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: googleverify-signin.servehttp.com (MISP Attribute #15665)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-588778af-aaf4-49c7-9028-07288e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-588778af-aaf4-49c7-9028-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">googleverify-signin.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T10:54:23+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-588778af-ea9c-4be6-a936-07288e96ca05" timestamp="2017-01-24T10:54:23+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailgooglesign.servehttp.com (MISP Attribute #15666)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailgooglesign.servehttp.com (MISP Attribute #15666)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-588778af-ea9c-4be6-a936-07288e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-588778af-ea9c-4be6-a936-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailgooglesign.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T10:54:23+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-588778af-7d08-4995-ae9d-07288e96ca05" timestamp="2017-01-24T10:54:23+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: myaccount.servehttp.com (MISP Attribute #15667)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: myaccount.servehttp.com (MISP Attribute #15667)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-588778af-7d08-4995-ae9d-07288e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-588778af-7d08-4995-ae9d-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">myaccount.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T10:54:23+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-588778af-4754-4997-9fdc-07288e96ca05" timestamp="2017-01-24T10:54:23+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: secure-team.servehttp.com (MISP Attribute #15668)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: secure-team.servehttp.com (MISP Attribute #15668)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-588778af-4754-4997-9fdc-07288e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-588778af-4754-4997-9fdc-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">secure-team.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T10:54:23+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-588778af-7ff4-4200-a7ee-07288e96ca05" timestamp="2017-01-24T10:54:23+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: security-myaccount.servehttp.com (MISP Attribute #15669)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: security-myaccount.servehttp.com (MISP Attribute #15669)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-588778af-7ff4-4200-a7ee-07288e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-588778af-7ff4-4200-a7ee-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">security-myaccount.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T10:54:23+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-588778af-421c-4ab6-8fc9-07288e96ca05" timestamp="2017-01-24T10:54:23+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: verification-acc.servehttp.com (MISP Attribute #15670)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: verification-acc.servehttp.com (MISP Attribute #15670)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-588778af-421c-4ab6-8fc9-07288e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-588778af-421c-4ab6-8fc9-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">verification-acc.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T10:54:23+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-58877af7-e064-4ea8-8048-07288e96ca05" timestamp="2017-01-24T11:04:07+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: dropbox-verfy.servehttp.com (MISP Attribute #15671)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: dropbox-verfy.servehttp.com (MISP Attribute #15671)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-58877af7-e064-4ea8-8048-07288e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-58877af7-e064-4ea8-8048-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">dropbox-verfy.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T11:04:07+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-58877af7-3218-42ee-ab63-07288e96ca05" timestamp="2017-01-24T11:04:07+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: fedex-s.servehttp.com (MISP Attribute #15672)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: fedex-s.servehttp.com (MISP Attribute #15672)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-58877af7-3218-42ee-ab63-07288e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-58877af7-3218-42ee-ab63-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">fedex-s.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T11:04:07+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-58877af7-c9f8-4198-acf2-07288e96ca05" timestamp="2017-01-24T11:04:07+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: watchyoutube.servehttp.com (MISP Attribute #15673)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: watchyoutube.servehttp.com (MISP Attribute #15673)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-58877af7-c9f8-4198-acf2-07288e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-58877af7-c9f8-4198-acf2-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">watchyoutube.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T11:04:07+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-58877ce3-c1c4-40d8-baa5-07298e96ca05" timestamp="2017-01-24T11:12:19+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: verification-team.servehttp.com (MISP Attribute #15674)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: verification-team.servehttp.com (MISP Attribute #15674)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-58877ce3-c1c4-40d8-baa5-07298e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-58877ce3-c1c4-40d8-baa5-07298e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">verification-team.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T11:12:19+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-58877ce3-2fa4-43b0-9be6-07298e96ca05" timestamp="2017-01-24T11:12:19+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: securityteam-notify.servehttp.com (MISP Attribute #15675)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: securityteam-notify.servehttp.com (MISP Attribute #15675)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-58877ce3-2fa4-43b0-9be6-07298e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-58877ce3-2fa4-43b0-9be6-07298e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">securityteam-notify.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T11:12:19+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-58877ce3-fb60-4972-a691-07298e96ca05" timestamp="2017-01-24T11:12:19+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: secure-alert.servehttp.com (MISP Attribute #15676)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: secure-alert.servehttp.com (MISP Attribute #15676)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-58877ce3-fb60-4972-a691-07298e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-58877ce3-fb60-4972-a691-07298e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">secure-alert.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T11:12:19+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-58877ce3-9b20-4e75-a2f1-07298e96ca05" timestamp="2017-01-24T11:12:19+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: quota-notification.servehttp.com (MISP Attribute #15677)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: quota-notification.servehttp.com (MISP Attribute #15677)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-58877ce3-9b20-4e75-a2f1-07298e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-58877ce3-9b20-4e75-a2f1-07298e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">quota-notification.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T11:12:19+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-58877ce3-e2bc-4fc7-b7a0-07298e96ca05" timestamp="2017-01-24T11:12:19+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: notification-team.servehttp.com (MISP Attribute #15678)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: notification-team.servehttp.com (MISP Attribute #15678)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-58877ce3-e2bc-4fc7-b7a0-07298e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-58877ce3-e2bc-4fc7-b7a0-07298e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">notification-team.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T11:12:19+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-58877ce3-5d28-4361-983f-07298e96ca05" timestamp="2017-01-24T11:12:19+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: fedex-notification.servehttp.com (MISP Attribute #15679)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: fedex-notification.servehttp.com (MISP Attribute #15679)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-58877ce3-5d28-4361-983f-07298e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-58877ce3-5d28-4361-983f-07298e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">fedex-notification.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T11:12:19+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-58877ce3-acd4-4365-ac46-07298e96ca05" timestamp="2017-01-24T11:12:19+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: docs-mails.servehttp.com (MISP Attribute #15680)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: docs-mails.servehttp.com (MISP Attribute #15680)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-58877ce3-acd4-4365-ac46-07298e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-58877ce3-acd4-4365-ac46-07298e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">docs-mails.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T11:12:19+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-58877ce3-5b10-49d8-b03d-07298e96ca05" timestamp="2017-01-24T11:12:19+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: restricted-videos.servehttp.com (MISP Attribute #15681)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: restricted-videos.servehttp.com (MISP Attribute #15681)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-58877ce3-5b10-49d8-b03d-07298e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-58877ce3-5b10-49d8-b03d-07298e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">restricted-videos.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T11:12:19+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-58877ce3-f668-4eb1-828a-07298e96ca05" timestamp="2017-01-24T11:12:19+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: dropboxnotification.servehttp.com (MISP Attribute #15682)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: dropboxnotification.servehttp.com (MISP Attribute #15682)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-58877ce3-f668-4eb1-828a-07298e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-58877ce3-f668-4eb1-828a-07298e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">dropboxnotification.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T11:12:19+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5887a880-559c-4680-a403-0bbb8e96ca05" timestamp="2017-01-24T14:18:24+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: moi-gov.serveftp.com (MISP Attribute #15683)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: moi-gov.serveftp.com (MISP Attribute #15683)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5887a880-559c-4680-a403-0bbb8e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-5887a880-559c-4680-a403-0bbb8e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">moi-gov.serveftp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T14:18:24+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5890c466-51f8-425d-850f-07298e96ca05" timestamp="2017-01-31T12:07:50+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: activate-google.servehttp.com (MISP Attribute #15685)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: activate-google.servehttp.com (MISP Attribute #15685)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5890c466-51f8-425d-850f-07298e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-5890c466-51f8-425d-850f-07298e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">activate-google.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-31T12:07:50+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5890c521-f8f4-4df3-ab2c-07298e96ca05" timestamp="2017-01-31T12:10:57+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: googlemaps.servehttp.com (MISP Attribute #15686)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: googlemaps.servehttp.com (MISP Attribute #15686)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5890c521-f8f4-4df3-ab2c-07298e96ca05">
|
||
|
|
<cybox:Object id=":DomainName-5890c521-f8f4-4df3-ab2c-07298e96ca05">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">googlemaps.servehttp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-31T12:10:57+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-587cfa0f-0b54-44f1-9f4c-0bbb8e96ca05" timestamp="2017-01-16T11:51:27+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: 108.61.176.96 (MISP Attribute #15399)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: 108.61.176.96 (MISP Attribute #15399)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-587cfa0f-0b54-44f1-9f4c-0bbb8e96ca05">
|
||
|
|
<cybox:Object id=":Address-587cfa0f-0b54-44f1-9f4c-0bbb8e96ca05">
|
||
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
|
||
|
|
<AddressObj:Address_Value condition="Equals">108.61.176.96</AddressObj:Address_Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-16T11:51:27+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-587cfa22-d240-4c6a-ba53-0bbb8e96ca05" timestamp="2017-01-16T11:51:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: 104.238.191.204 (MISP Attribute #15400)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: 104.238.191.204 (MISP Attribute #15400)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-587cfa22-d240-4c6a-ba53-0bbb8e96ca05">
|
||
|
|
<cybox:Object id=":Address-587cfa22-d240-4c6a-ba53-0bbb8e96ca05">
|
||
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
|
||
|
|
<AddressObj:Address_Value condition="Equals">104.238.191.204</AddressObj:Address_Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-16T11:51:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-587cf53e-ee64-4e85-a4f5-0bbb8e96ca05" timestamp="2017-01-16T11:30:54+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: 176.123.26.42 (MISP Attribute #15358)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: 176.123.26.42 (MISP Attribute #15358)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-587cf53e-ee64-4e85-a4f5-0bbb8e96ca05">
|
||
|
|
<cybox:Object id=":Address-587cf53e-ee64-4e85-a4f5-0bbb8e96ca05">
|
||
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
|
||
|
|
<AddressObj:Address_Value condition="Equals">176.123.26.42</AddressObj:Address_Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-16T11:30:54+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-587cf8ac-c440-4d76-886f-0bbb8e96ca05" timestamp="2017-01-16T11:45:32+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: secure.policy.check@gmail.com (MISP Attribute #15374)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: secure.policy.check@gmail.com (MISP Attribute #15374)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-587cf8ac-c440-4d76-886f-0bbb8e96ca05">
|
||
|
|
<cybox:Object id=":EmailMessage-587cf8ac-c440-4d76-886f-0bbb8e96ca05">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">secure.policy.check@gmail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-16T11:45:32+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-587cf8ac-e780-49b3-8a72-0bbb8e96ca05" timestamp="2017-01-16T11:45:32+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: aramex.shipment@gmail.com (MISP Attribute #15375)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: aramex.shipment@gmail.com (MISP Attribute #15375)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-587cf8ac-e780-49b3-8a72-0bbb8e96ca05">
|
||
|
|
<cybox:Object id=":EmailMessage-587cf8ac-e780-49b3-8a72-0bbb8e96ca05">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">aramex.shipment@gmail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-16T11:45:32+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-587cf8ac-1c68-4978-ad06-0bbb8e96ca05" timestamp="2017-01-16T11:45:32+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: fedex_tracking@outlook.sa (MISP Attribute #15376)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: fedex_tracking@outlook.sa (MISP Attribute #15376)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-587cf8ac-1c68-4978-ad06-0bbb8e96ca05">
|
||
|
|
<cybox:Object id=":EmailMessage-587cf8ac-1c68-4978-ad06-0bbb8e96ca05">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">fedex_tracking@outlook.sa</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-16T11:45:32+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-587cf8ac-5760-44c5-9a0f-0bbb8e96ca05" timestamp="2017-01-16T11:45:32+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: mails.acc.noreply@gmail.com (MISP Attribute #15377)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: mails.acc.noreply@gmail.com (MISP Attribute #15377)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-587cf8ac-5760-44c5-9a0f-0bbb8e96ca05">
|
||
|
|
<cybox:Object id=":EmailMessage-587cf8ac-5760-44c5-9a0f-0bbb8e96ca05">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">mails.acc.noreply@gmail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-16T11:45:32+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-587cf8ac-e788-4294-bc78-0bbb8e96ca05" timestamp="2017-01-16T11:45:32+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: fedex.noreply@gmail.com (MISP Attribute #15378)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: fedex.noreply@gmail.com (MISP Attribute #15378)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-587cf8ac-e788-4294-bc78-0bbb8e96ca05">
|
||
|
|
<cybox:Object id=":EmailMessage-587cf8ac-e788-4294-bc78-0bbb8e96ca05">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">fedex.noreply@gmail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-16T11:45:32+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-587cf8ac-b678-4509-828e-0bbb8e96ca05" timestamp="2017-01-16T11:45:32+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: customerserviceonlineteam@gmail.com (MISP Attribute #15379)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: customerserviceonlineteam@gmail.com (MISP Attribute #15379)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-587cf8ac-b678-4509-828e-0bbb8e96ca05">
|
||
|
|
<cybox:Object id=":EmailMessage-587cf8ac-b678-4509-828e-0bbb8e96ca05">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">customerserviceonlineteam@gmail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-16T11:45:32+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-587cf8ac-cc54-41a3-81d7-0bbb8e96ca05" timestamp="2017-01-16T11:45:32+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: fedexcustomers.service@gmail.com (MISP Attribute #15380)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: fedexcustomers.service@gmail.com (MISP Attribute #15380)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-587cf8ac-cc54-41a3-81d7-0bbb8e96ca05">
|
||
|
|
<cybox:Object id=":EmailMessage-587cf8ac-cc54-41a3-81d7-0bbb8e96ca05">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">fedexcustomers.service@gmail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-16T11:45:32+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-587cf8ac-3f30-4cd6-8821-0bbb8e96ca05" timestamp="2017-01-16T11:45:32+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: elnadeem.org@gmail.com (MISP Attribute #15381)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: elnadeem.org@gmail.com (MISP Attribute #15381)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-587cf8ac-3f30-4cd6-8821-0bbb8e96ca05">
|
||
|
|
<cybox:Object id=":EmailMessage-587cf8ac-3f30-4cd6-8821-0bbb8e96ca05">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">elnadeem.org@gmail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-16T11:45:32+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-587cf8ac-8200-46ea-8b62-0bbb8e96ca05" timestamp="2017-01-16T11:45:32+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: dropbox.noreplay@gmail.com (MISP Attribute #15382)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: dropbox.noreplay@gmail.com (MISP Attribute #15382)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-587cf8ac-8200-46ea-8b62-0bbb8e96ca05">
|
||
|
|
<cybox:Object id=":EmailMessage-587cf8ac-8200-46ea-8b62-0bbb8e96ca05">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">dropbox.noreplay@gmail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-16T11:45:32+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-587cf8ac-814c-4b68-a2ed-0bbb8e96ca05" timestamp="2017-01-16T11:45:32+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: mails.noreply.verify@gmail.com (MISP Attribute #15383)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: mails.noreply.verify@gmail.com (MISP Attribute #15383)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-587cf8ac-814c-4b68-a2ed-0bbb8e96ca05">
|
||
|
|
<cybox:Object id=":EmailMessage-587cf8ac-814c-4b68-a2ed-0bbb8e96ca05">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">mails.noreply.verify@gmail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-16T11:45:32+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-587cf8ac-991c-4110-bbcc-0bbb8e96ca05" timestamp="2017-01-16T11:45:32+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: fedex.mails.shipping@gmail.com (MISP Attribute #15384)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: fedex.mails.shipping@gmail.com (MISP Attribute #15384)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-587cf8ac-991c-4110-bbcc-0bbb8e96ca05">
|
||
|
|
<cybox:Object id=":EmailMessage-587cf8ac-991c-4110-bbcc-0bbb8e96ca05">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">fedex.mails.shipping@gmail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-16T11:45:32+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-587cf8ac-07ac-4f31-b12a-0bbb8e96ca05" timestamp="2017-01-16T11:45:32+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: dropbox.notifications.mails@gmail.com (MISP Attribute #15385)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: dropbox.notifications.mails@gmail.com (MISP Attribute #15385)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-587cf8ac-07ac-4f31-b12a-0bbb8e96ca05">
|
||
|
|
<cybox:Object id=":EmailMessage-587cf8ac-07ac-4f31-b12a-0bbb8e96ca05">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">dropbox.notifications.mails@gmail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-16T11:45:32+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5887755a-551c-49ca-9e41-07288e96ca05" timestamp="2017-01-24T10:40:10+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: dropbox.notfication@gmail.com (MISP Attribute #15649)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: dropbox.notfication@gmail.com (MISP Attribute #15649)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5887755a-551c-49ca-9e41-07288e96ca05">
|
||
|
|
<cybox:Object id=":EmailMessage-5887755a-551c-49ca-9e41-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">dropbox.notfication@gmail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T10:40:10+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5887755a-4b1c-4e2a-96ac-07288e96ca05" timestamp="2017-01-24T10:40:10+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: drive.noreply.mail@gmail.com (MISP Attribute #15650)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: drive.noreply.mail@gmail.com (MISP Attribute #15650)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5887755a-4b1c-4e2a-96ac-07288e96ca05">
|
||
|
|
<cybox:Object id=":EmailMessage-5887755a-4b1c-4e2a-96ac-07288e96ca05">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">drive.noreply.mail@gmail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2017-01-24T10:40:10+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
</incident:Related_Indicators>
|
||
|
|
<incident:Information_Source>
|
||
|
|
<stixCommon:Identity>
|
||
|
|
<stixCommon:Name>citizenlab</stixCommon:Name>
|
||
|
|
</stixCommon:Identity>
|
||
|
|
</incident:Information_Source>
|
||
|
|
<incident:Handling>
|
||
|
|
<marking:Marking>
|
||
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
|
|
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="GREEN"/>
|
||
|
|
</marking:Marking>
|
||
|
|
</incident:Handling>
|
||
|
|
</stix:Incident>
|
||
|
|
</stix:Incidents>
|
||
|
|
</stix:Package>
|
||
|
|
</stix:Related_Package>
|
||
|
|
</stix:Related_Packages>
|
||
|
|
</stix:STIX_Package>
|