10167 lines
1.0 MiB
XML
10167 lines
1.0 MiB
XML
|
<stix:STIX_Package
|
||
|
|
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
|
||
|
|
xmlns:cybox="http://cybox.mitre.org/cybox-2"
|
||
|
|
xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
|
||
|
|
xmlns:ASObj="http://cybox.mitre.org/objects#ASObject-1"
|
||
|
|
xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
|
||
|
|
xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1"
|
||
|
|
xmlns:EmailMessageObj="http://cybox.mitre.org/objects#EmailMessageObject-2"
|
||
|
|
xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"
|
||
|
|
xmlns:HTTPSessionObj="http://cybox.mitre.org/objects#HTTPSessionObject-2"
|
||
|
|
xmlns:HostnameObj="http://cybox.mitre.org/objects#HostnameObject-1"
|
||
|
|
xmlns:MutexObj="http://cybox.mitre.org/objects#MutexObject-2"
|
||
|
|
xmlns:PipeObj="http://cybox.mitre.org/objects#PipeObject-2"
|
||
|
|
xmlns:URIObj="http://cybox.mitre.org/objects#URIObject-2"
|
||
|
|
xmlns:WinRegistryKeyObj="http://cybox.mitre.org/objects#WinRegistryKeyObject-2"
|
||
|
|
xmlns:marking="http://data-marking.mitre.org/Marking-1"
|
||
|
|
xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"
|
||
|
|
xmlns:et="http://stix.mitre.org/ExploitTarget-1"
|
||
|
|
xmlns:incident="http://stix.mitre.org/Incident-1"
|
||
|
|
xmlns:indicator="http://stix.mitre.org/Indicator-2"
|
||
|
|
xmlns:ttp="http://stix.mitre.org/TTP-1"
|
||
|
|
xmlns:ta="http://stix.mitre.org/ThreatActor-1"
|
||
|
|
xmlns:stixCommon="http://stix.mitre.org/common-1"
|
||
|
|
xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
|
||
|
|
xmlns:stix-ciqidentity="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1"
|
||
|
|
xmlns:snortTM="http://stix.mitre.org/extensions/TestMechanism#Snort-1"
|
||
|
|
xmlns:stix="http://stix.mitre.org/stix-1"
|
||
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||
|
|
xmlns:xal="urn:oasis:names:tc:ciq:xal:3"
|
||
|
|
xmlns:xnl="urn:oasis:names:tc:ciq:xnl:3"
|
||
|
|
xmlns:xpil="urn:oasis:names:tc:ciq:xpil:3"
|
||
|
|
xsi:schemaLocation="
|
||
|
|
http://cybox.mitre.org/common-2 http://cybox.mitre.org/XMLSchema/common/2.1/cybox_common.xsd
|
||
|
|
http://cybox.mitre.org/cybox-2 http://cybox.mitre.org/XMLSchema/core/2.1/cybox_core.xsd
|
||
|
|
http://cybox.mitre.org/default_vocabularies-2 http://cybox.mitre.org/XMLSchema/default_vocabularies/2.1/cybox_default_vocabularies.xsd
|
||
|
|
http://cybox.mitre.org/objects#ASObject-1 http://cybox.mitre.org/XMLSchema/objects/AS/1.0/AS_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#AddressObject-2 http://cybox.mitre.org/XMLSchema/objects/Address/2.1/Address_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#DomainNameObject-1 http://cybox.mitre.org/XMLSchema/objects/Domain_Name/1.0/Domain_Name_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#EmailMessageObject-2 http://cybox.mitre.org/XMLSchema/objects/Email_Message/2.1/Email_Message_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#FileObject-2 http://cybox.mitre.org/XMLSchema/objects/File/2.1/File_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#HTTPSessionObject-2 http://cybox.mitre.org/XMLSchema/objects/HTTP_Session/2.1/HTTP_Session_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#HostnameObject-1 http://cybox.mitre.org/XMLSchema/objects/Hostname/1.0/Hostname_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#MutexObject-2 http://cybox.mitre.org/XMLSchema/objects/Mutex/2.1/Mutex_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#PipeObject-2 http://cybox.mitre.org/XMLSchema/objects/Pipe/2.1/Pipe_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#URIObject-2 http://cybox.mitre.org/XMLSchema/objects/URI/2.1/URI_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#WinRegistryKeyObject-2 http://cybox.mitre.org/XMLSchema/objects/Win_Registry_Key/2.1/Win_Registry_Key_Object.xsd
|
||
|
|
http://data-marking.mitre.org/Marking-1 http://stix.mitre.org/XMLSchema/data_marking/1.1.1/data_marking.xsd
|
||
|
|
http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1 http://stix.mitre.org/XMLSchema/extensions/marking/tlp/1.1.1/tlp_marking.xsd
|
||
|
|
http://stix.mitre.org/ExploitTarget-1 http://stix.mitre.org/XMLSchema/exploit_target/1.1.1/exploit_target.xsd
|
||
|
|
http://stix.mitre.org/Incident-1 http://stix.mitre.org/XMLSchema/incident/1.1.1/incident.xsd
|
||
|
|
http://stix.mitre.org/Indicator-2 http://stix.mitre.org/XMLSchema/indicator/2.1.1/indicator.xsd
|
||
|
|
http://stix.mitre.org/TTP-1 http://stix.mitre.org/XMLSchema/ttp/1.1.1/ttp.xsd
|
||
|
|
http://stix.mitre.org/ThreatActor-1 http://stix.mitre.org/XMLSchema/threat_actor/1.1.1/threat_actor.xsd
|
||
|
|
http://stix.mitre.org/common-1 http://stix.mitre.org/XMLSchema/common/1.1.1/stix_common.xsd
|
||
|
|
http://stix.mitre.org/default_vocabularies-1 http://stix.mitre.org/XMLSchema/default_vocabularies/1.1.1/stix_default_vocabularies.xsd
|
||
|
|
http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1 http://stix.mitre.org/XMLSchema/extensions/identity/ciq_3.0/1.1.1/ciq_3.0_identity.xsd
|
||
|
|
http://stix.mitre.org/extensions/TestMechanism#Snort-1 http://stix.mitre.org/XMLSchema/extensions/test_mechanism/snort/1.1.1/snort_test_mechanism.xsd
|
||
|
|
http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.1.1/stix_core.xsd
|
||
|
|
urn:oasis:names:tc:ciq:xal:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xAL.xsd
|
||
|
|
urn:oasis:names:tc:ciq:xnl:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xNL.xsd
|
||
|
|
urn:oasis:names:tc:ciq:xpil:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xPIL.xsd" id=":Package-fdac5431-7aad-4a9a-ae61-c7c7e4ae7513" version="1.1.1" timestamp="2020-06-08T20:01:05.609338+00:00">
|
||
|
|
<stix:STIX_Header>
|
||
|
|
<stix:Title>Export from MISP</stix:Title>
|
||
|
|
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
|
||
|
|
</stix:STIX_Header>
|
||
|
|
<stix:Related_Packages>
|
||
|
|
<stix:Related_Package>
|
||
|
|
<stix:Package id=":STIXPackage-5ede96d1-41fc-4ee7-8a48-7a4a8064ab0b" version="1.1.1" timestamp="2020-06-08T15:57:34+00:00">
|
||
|
|
<stix:STIX_Header>
|
||
|
|
<stix:Title>Dark Basin (MISP Event #147)</stix:Title>
|
||
|
|
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
|
||
|
|
</stix:STIX_Header>
|
||
|
|
<stix:Incidents>
|
||
|
|
<stix:Incident id=":incident-5ede96d1-41fc-4ee7-8a48-7a4a8064ab0b" timestamp="2020-06-08T15:58:17+00:00" xsi:type='incident:IncidentType'>
|
||
|
|
<incident:Title>Dark Basin</incident:Title>
|
||
|
|
<incident:External_ID source="MISP Event">147</incident:External_ID>
|
||
|
|
<incident:Time>
|
||
|
|
<incident:Incident_Discovery precision="second">2020-06-08T00:00:00+00:00</incident:Incident_Discovery>
|
||
|
|
<incident:Incident_Reported precision="second">2020-06-08T15:58:17+00:00</incident:Incident_Reported>
|
||
|
|
</incident:Time>
|
||
|
|
<incident:Status xsi:type="stixVocabs:IncidentStatusVocab-1.0">New</incident:Status>
|
||
|
|
<incident:Related_Indicators>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Attribution</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede982e-23e4-4191-9863-7a498064ab0b" timestamp="2020-06-08T15:57:34+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Attribution: amanda.lovers@mail.com (MISP Attribute #19050)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Description>Attribution: amanda.lovers@mail.com (MISP Attribute #19050)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:57:34+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Attribution</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede982e-bc48-4231-a1ed-7a498064ab0b" timestamp="2020-06-08T15:57:34+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Attribution: amanda.kruetner@mail.com (MISP Attribute #19051)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Description>Attribution: amanda.kruetner@mail.com (MISP Attribute #19051)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:57:34+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Attribution</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede982e-3b90-4fc1-95fc-7a498064ab0b" timestamp="2020-06-08T15:57:34+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Attribution: anurag.breja342@mail.com (MISP Attribute #19052)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Description>Attribution: anurag.breja342@mail.com (MISP Attribute #19052)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:57:34+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Attribution</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede982e-8298-4b08-9fd4-7a498064ab0b" timestamp="2020-06-08T15:57:34+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Attribution: jacktanne@outlook.com (MISP Attribute #19053)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Description>Attribution: jacktanne@outlook.com (MISP Attribute #19053)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:57:34+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Attribution</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede982e-9c50-4452-9aa5-7a498064ab0b" timestamp="2020-06-08T15:57:34+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Attribution: flaviatales@mail.com (MISP Attribute #19054)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Description>Attribution: flaviatales@mail.com (MISP Attribute #19054)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:57:34+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Attribution</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede982e-c9f4-490e-9afd-7a498064ab0b" timestamp="2020-06-08T15:57:34+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Attribution: robert.klein@europe.com (MISP Attribute #19055)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Description>Attribution: robert.klein@europe.com (MISP Attribute #19055)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:57:34+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-f598-4c2e-b774-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: emailauthservice.com (MISP Attribute #18688)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: emailauthservice.com (MISP Attribute #18688)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-f598-4c2e-b774-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-f598-4c2e-b774-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">emailauthservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-3b48-441b-9258-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: chromeperfection.com (MISP Attribute #18944)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: chromeperfection.com (MISP Attribute #18944)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-3b48-441b-9258-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-3b48-441b-9258-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">chromeperfection.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-b984-4338-b5aa-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: emailmappingservice.com (MISP Attribute #18689)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: emailmappingservice.com (MISP Attribute #18689)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-b984-4338-b5aa-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-b984-4338-b5aa-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">emailmappingservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-133c-435b-a17d-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: trustedserviceonline.com (MISP Attribute #18945)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: trustedserviceonline.com (MISP Attribute #18945)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-133c-435b-a17d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-133c-435b-a17d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">trustedserviceonline.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-b078-4d6f-b0ba-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: emailservername299.com (MISP Attribute #18690)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: emailservername299.com (MISP Attribute #18690)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-b078-4d6f-b0ba-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-b078-4d6f-b0ba-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">emailservername299.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-12b8-478f-9a4a-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: browserdirectservice.com (MISP Attribute #18946)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: browserdirectservice.com (MISP Attribute #18946)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-12b8-478f-9a4a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-12b8-478f-9a4a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">browserdirectservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-4c68-4da6-9f19-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: emailvalidateservice.com (MISP Attribute #18691)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: emailvalidateservice.com (MISP Attribute #18691)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-4c68-4da6-9f19-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-4c68-4da6-9f19-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">emailvalidateservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-69a0-414f-9baa-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: browserredirect.com (MISP Attribute #18947)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: browserredirect.com (MISP Attribute #18947)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-69a0-414f-9baa-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-69a0-414f-9baa-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">browserredirect.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-3484-42bd-ad35-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hostemailserver.com (MISP Attribute #18692)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hostemailserver.com (MISP Attribute #18692)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-3484-42bd-ad35-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-3484-42bd-ad35-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hostemailserver.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-27cc-4146-b861-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: optionalblogging.com (MISP Attribute #18948)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: optionalblogging.com (MISP Attribute #18948)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-27cc-4146-b861-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-27cc-4146-b861-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">optionalblogging.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-1408-409d-98b3-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailauthenticatorservice.com (MISP Attribute #18693)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailauthenticatorservice.com (MISP Attribute #18693)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-1408-409d-98b3-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-1408-409d-98b3-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailauthenticatorservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-11b8-463d-8aee-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: selectedmaxstores.com (MISP Attribute #18949)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: selectedmaxstores.com (MISP Attribute #18949)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-11b8-463d-8aee-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-11b8-463d-8aee-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">selectedmaxstores.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-df3c-4741-afa8-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailauthservice399.com (MISP Attribute #18694)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailauthservice399.com (MISP Attribute #18694)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-df3c-4741-afa8-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-df3c-4741-afa8-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailauthservice399.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-4c1c-4135-96a3-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: auditionregistrationonline.com (MISP Attribute #18950)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: auditionregistrationonline.com (MISP Attribute #18950)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-4c1c-4135-96a3-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-4c1c-4135-96a3-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">auditionregistrationonline.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-77a8-419e-8feb-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailcollectorservice.com (MISP Attribute #18695)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailcollectorservice.com (MISP Attribute #18695)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-77a8-419e-8feb-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-77a8-419e-8feb-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailcollectorservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-4e40-4bc5-8730-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: homeforallorphans.com (MISP Attribute #18951)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: homeforallorphans.com (MISP Attribute #18951)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-4e40-4bc5-8730-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-4e40-4bc5-8730-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">homeforallorphans.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-0d58-42d4-8444-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailserverenterprise.com (MISP Attribute #18696)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailserverenterprise.com (MISP Attribute #18696)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-0d58-42d4-8444-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-0d58-42d4-8444-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailserverenterprise.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-a0dc-4952-b5e7-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: knowledgebaseonlineuk.com (MISP Attribute #18952)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: knowledgebaseonlineuk.com (MISP Attribute #18952)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-a0dc-4952-b5e7-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-a0dc-4952-b5e7-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">knowledgebaseonlineuk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-54c4-40da-ab7f-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailservershare.com (MISP Attribute #18697)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailservershare.com (MISP Attribute #18697)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-54c4-40da-ab7f-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-54c4-40da-ab7f-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailservershare.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-a1d4-4af1-b30e-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: promotespritialbelief.com (MISP Attribute #18953)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: promotespritialbelief.com (MISP Attribute #18953)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-a1d4-4af1-b30e-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-a1d4-4af1-b30e-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">promotespritialbelief.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-ba84-4d86-8998-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: networkshareserver.com (MISP Attribute #18698)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: networkshareserver.com (MISP Attribute #18698)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-ba84-4d86-8998-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-ba84-4d86-8998-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">networkshareserver.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-4918-4acf-8bc2-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: getreadytorunhalfmarathon.com (MISP Attribute #18954)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: getreadytorunhalfmarathon.com (MISP Attribute #18954)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-4918-4acf-8bc2-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-4918-4acf-8bc2-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">getreadytorunhalfmarathon.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-6ff4-4891-9efc-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: domainserver399.com (MISP Attribute #18699)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: domainserver399.com (MISP Attribute #18699)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-6ff4-4891-9efc-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-6ff4-4891-9efc-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">domainserver399.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-995c-4825-96e8-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: getsetgoforhealth.com (MISP Attribute #18955)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: getsetgoforhealth.com (MISP Attribute #18955)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-995c-4825-96e8-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-995c-4825-96e8-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">getsetgoforhealth.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-6238-4970-a66e-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hostsecuremail544.com (MISP Attribute #18700)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hostsecuremail544.com (MISP Attribute #18700)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-6238-4970-a66e-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-6238-4970-a66e-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hostsecuremail544.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-b4a4-4b8d-ae21-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: linuxserverfast.com (MISP Attribute #18956)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: linuxserverfast.com (MISP Attribute #18956)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-b4a4-4b8d-ae21-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-b4a4-4b8d-ae21-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">linuxserverfast.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-3aa4-42eb-9d3d-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: shrtnerlnk.com (MISP Attribute #18701)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: shrtnerlnk.com (MISP Attribute #18701)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-3aa4-42eb-9d3d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-3aa4-42eb-9d3d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">shrtnerlnk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-73d8-4115-838f-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: tinyurlshortner.com (MISP Attribute #18957)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: tinyurlshortner.com (MISP Attribute #18957)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-73d8-4115-838f-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-73d8-4115-838f-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">tinyurlshortner.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-ed18-48ee-a223-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailingserver938.com (MISP Attribute #18702)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailingserver938.com (MISP Attribute #18702)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-ed18-48ee-a223-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-ed18-48ee-a223-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailingserver938.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-7b90-41ef-9af5-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: msgrdrg.com (MISP Attribute #18958)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: msgrdrg.com (MISP Attribute #18958)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-7b90-41ef-9af5-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-7b90-41ef-9af5-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">msgrdrg.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-0284-4135-adbb-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: emailserver499.com (MISP Attribute #18703)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: emailserver499.com (MISP Attribute #18703)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-0284-4135-adbb-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-0284-4135-adbb-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">emailserver499.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-ea70-40df-ab83-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: dnsserverprv.com (MISP Attribute #18959)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: dnsserverprv.com (MISP Attribute #18959)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-ea70-40df-ab83-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-ea70-40df-ab83-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">dnsserverprv.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-1c10-41e3-a906-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailserverru2099.com (MISP Attribute #18704)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailserverru2099.com (MISP Attribute #18704)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-1c10-41e3-a906-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-1c10-41e3-a906-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailserverru2099.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-8704-4ba7-b7b8-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: economyservicesil.com (MISP Attribute #18960)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: economyservicesil.com (MISP Attribute #18960)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-8704-4ba7-b7b8-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-8704-4ba7-b7b8-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">economyservicesil.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-650c-4b2f-9da1-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: netsecureserver399.com (MISP Attribute #18705)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: netsecureserver399.com (MISP Attribute #18705)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-650c-4b2f-9da1-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-650c-4b2f-9da1-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">netsecureserver399.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-d554-4553-833a-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: portfoliofasinating.com (MISP Attribute #18961)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: portfoliofasinating.com (MISP Attribute #18961)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-d554-4553-833a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-d554-4553-833a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">portfoliofasinating.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-06d8-4dfd-899b-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: lnkshrtnr.com (MISP Attribute #18706)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: lnkshrtnr.com (MISP Attribute #18706)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-06d8-4dfd-899b-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-06d8-4dfd-899b-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">lnkshrtnr.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-214c-4a18-84c3-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: selectiveservicemax.com (MISP Attribute #18962)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: selectiveservicemax.com (MISP Attribute #18962)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-214c-4a18-84c3-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-214c-4a18-84c3-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">selectiveservicemax.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-abc4-47f7-8141-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: emailsecurenode.com (MISP Attribute #18707)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: emailsecurenode.com (MISP Attribute #18707)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-abc4-47f7-8141-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-abc4-47f7-8141-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">emailsecurenode.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-a520-446a-8154-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: maxlaboratories.com (MISP Attribute #18963)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: maxlaboratories.com (MISP Attribute #18963)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-a520-446a-8154-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-a520-446a-8154-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">maxlaboratories.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-9570-481d-b627-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hostemailsecureserver.com (MISP Attribute #18708)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hostemailsecureserver.com (MISP Attribute #18708)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-9570-481d-b627-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-9570-481d-b627-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hostemailsecureserver.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-1e04-4f54-9d73-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hostfeasta.com (MISP Attribute #18964)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hostfeasta.com (MISP Attribute #18964)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-1e04-4f54-9d73-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-1e04-4f54-9d73-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hostfeasta.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-55b4-4f05-bb4a-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailmarknotes.com (MISP Attribute #18709)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailmarknotes.com (MISP Attribute #18709)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-55b4-4f05-bb4a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-55b4-4f05-bb4a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailmarknotes.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-e1a8-480a-85ca-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: readmytipsntricks.com (MISP Attribute #18965)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: readmytipsntricks.com (MISP Attribute #18965)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-e1a8-480a-85ca-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-e1a8-480a-85ca-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">readmytipsntricks.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-5dd8-4f6b-831e-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: emailhostsecurehk.com (MISP Attribute #18710)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: emailhostsecurehk.com (MISP Attribute #18710)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-5dd8-4f6b-831e-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-5dd8-4f6b-831e-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">emailhostsecurehk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-15f0-4ebc-818d-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: backwaterreservoir.com (MISP Attribute #18966)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: backwaterreservoir.com (MISP Attribute #18966)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-15f0-4ebc-818d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-15f0-4ebc-818d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">backwaterreservoir.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-eb54-4f98-8f5d-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailgatorservice.com (MISP Attribute #18711)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailgatorservice.com (MISP Attribute #18711)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-eb54-4f98-8f5d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-eb54-4f98-8f5d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailgatorservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-6930-47e1-ad77-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: supportserviceeu.com (MISP Attribute #18967)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: supportserviceeu.com (MISP Attribute #18967)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-6930-47e1-ad77-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-6930-47e1-ad77-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">supportserviceeu.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-5ab4-4cec-8481-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: netsecureemailservice.com (MISP Attribute #18712)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: netsecureemailservice.com (MISP Attribute #18712)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-5ab4-4cec-8481-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-5ab4-4cec-8481-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">netsecureemailservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-2c70-49dc-9b5e-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: bellsouthnetwork.com (MISP Attribute #18968)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: bellsouthnetwork.com (MISP Attribute #18968)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-2c70-49dc-9b5e-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-2c70-49dc-9b5e-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">bellsouthnetwork.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-6764-490c-b5a6-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: linkshortnr.com (MISP Attribute #18713)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: linkshortnr.com (MISP Attribute #18713)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-6764-490c-b5a6-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-6764-490c-b5a6-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">linkshortnr.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-886c-4f69-b4d5-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: homeremedytipntricks.com (MISP Attribute #18969)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: homeremedytipntricks.com (MISP Attribute #18969)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-886c-4f69-b4d5-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-886c-4f69-b4d5-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">homeremedytipntricks.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-03f8-4089-9ec3-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailhostingsecurenet.com (MISP Attribute #18714)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailhostingsecurenet.com (MISP Attribute #18714)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-03f8-4089-9ec3-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-03f8-4089-9ec3-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailhostingsecurenet.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-c58c-44a6-9981-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: cathostingservice.com (MISP Attribute #18970)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: cathostingservice.com (MISP Attribute #18970)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-c58c-44a6-9981-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-c58c-44a6-9981-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">cathostingservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-d6fc-4d48-8374-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailtransferserver.com (MISP Attribute #18715)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailtransferserver.com (MISP Attribute #18715)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-d6fc-4d48-8374-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-d6fc-4d48-8374-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailtransferserver.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-792c-42eb-b93e-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: economyfeeds.com (MISP Attribute #18971)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: economyfeeds.com (MISP Attribute #18971)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-792c-42eb-b93e-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-792c-42eb-b93e-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">economyfeeds.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-9de4-416e-82c6-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: emaildeliverysuccess.com (MISP Attribute #18716)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: emaildeliverysuccess.com (MISP Attribute #18716)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-9de4-416e-82c6-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-9de4-416e-82c6-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">emaildeliverysuccess.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-51e8-4732-bf38-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: productdemoservice.com (MISP Attribute #18972)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: productdemoservice.com (MISP Attribute #18972)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-51e8-4732-bf38-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-51e8-4732-bf38-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">productdemoservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-7ca0-4ba3-8d25-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailmarkservice.com (MISP Attribute #18717)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailmarkservice.com (MISP Attribute #18717)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-7ca0-4ba3-8d25-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-7ca0-4ba3-8d25-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailmarkservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-0010-4ce9-aede-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: ultimateresponseservice.com (MISP Attribute #18973)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: ultimateresponseservice.com (MISP Attribute #18973)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-0010-4ce9-aede-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-0010-4ce9-aede-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">ultimateresponseservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-33a0-4ca5-8ef5-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailcommunicationservice.com (MISP Attribute #18718)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailcommunicationservice.com (MISP Attribute #18718)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-33a0-4ca5-8ef5-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-33a0-4ca5-8ef5-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailcommunicationservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-0a28-4f20-a141-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: cyberserverusa.com (MISP Attribute #18974)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: cyberserverusa.com (MISP Attribute #18974)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-0a28-4f20-a141-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-0a28-4f20-a141-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">cyberserverusa.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-7aa0-48bf-ad8b-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailrockservice.com (MISP Attribute #18719)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailrockservice.com (MISP Attribute #18719)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-7aa0-48bf-ad8b-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-7aa0-48bf-ad8b-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailrockservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-06e8-4cda-9533-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: ecoserveraus.com (MISP Attribute #18975)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: ecoserveraus.com (MISP Attribute #18975)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-06e8-4cda-9533-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-06e8-4cda-9533-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">ecoserveraus.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-92e4-4d8e-a145-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: domainemailhostings.com (MISP Attribute #18720)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: domainemailhostings.com (MISP Attribute #18720)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-92e4-4d8e-a145-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-92e4-4d8e-a145-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">domainemailhostings.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-7710-4657-9242-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: forumtechtopic.com (MISP Attribute #18976)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: forumtechtopic.com (MISP Attribute #18976)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-7710-4657-9242-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-7710-4657-9242-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">forumtechtopic.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-51b4-470b-8bc8-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: rockerhostings.com (MISP Attribute #18721)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: rockerhostings.com (MISP Attribute #18721)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-51b4-470b-8bc8-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-51b4-470b-8bc8-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">rockerhostings.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-a838-47c5-b462-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: interserver439.com (MISP Attribute #18977)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: interserver439.com (MISP Attribute #18977)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-a838-47c5-b462-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-a838-47c5-b462-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">interserver439.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-7ff4-4f69-890c-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: basemailservice.com (MISP Attribute #18722)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: basemailservice.com (MISP Attribute #18722)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-7ff4-4f69-890c-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-7ff4-4f69-890c-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">basemailservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-b700-4dd5-8f65-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: nameserver3476.com (MISP Attribute #18978)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: nameserver3476.com (MISP Attribute #18978)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-b700-4dd5-8f65-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-b700-4dd5-8f65-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">nameserver3476.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-2178-458e-a517-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hostmailsecureserver.com (MISP Attribute #18723)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hostmailsecureserver.com (MISP Attribute #18723)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-2178-458e-a517-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-2178-458e-a517-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hostmailsecureserver.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-ed3c-4f42-ba2f-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: onlinemusicstoreuk.com (MISP Attribute #18979)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: onlinemusicstoreuk.com (MISP Attribute #18979)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-ed3c-4f42-ba2f-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-ed3c-4f42-ba2f-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">onlinemusicstoreuk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-ffa4-4456-8d11-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailpostsecureservice.com (MISP Attribute #18724)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailpostsecureservice.com (MISP Attribute #18724)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-ffa4-4456-8d11-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-ffa4-4456-8d11-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailpostsecureservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-b35c-450a-93ba-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: chatserverrussia.com (MISP Attribute #18980)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: chatserverrussia.com (MISP Attribute #18980)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-b35c-450a-93ba-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-b35c-450a-93ba-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">chatserverrussia.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-26c0-48ae-be69-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: strurl.click (MISP Attribute #18725)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: strurl.click (MISP Attribute #18725)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-26c0-48ae-be69-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-26c0-48ae-be69-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">strurl.click</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-b734-45bc-ac73-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: secureemailserver65.com (MISP Attribute #18981)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: secureemailserver65.com (MISP Attribute #18981)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-b734-45bc-ac73-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-b734-45bc-ac73-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">secureemailserver65.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-90f0-4667-8747-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: securemailhost46.com (MISP Attribute #18726)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: securemailhost46.com (MISP Attribute #18726)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-90f0-4667-8747-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-90f0-4667-8747-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">securemailhost46.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-11c4-44d6-8fb5-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: snaphosterservice.com (MISP Attribute #18982)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: snaphosterservice.com (MISP Attribute #18982)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-11c4-44d6-8fb5-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-11c4-44d6-8fb5-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">snaphosterservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-9658-41ca-8e4e-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hostmailsecure.com (MISP Attribute #18727)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hostmailsecure.com (MISP Attribute #18727)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-9658-41ca-8e4e-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-9658-41ca-8e4e-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hostmailsecure.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-4364-4cc2-a094-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: siteadminhk.com (MISP Attribute #18983)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: siteadminhk.com (MISP Attribute #18983)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-4364-4cc2-a094-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-4364-4cc2-a094-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">siteadminhk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-fc84-4a5c-a9b1-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailpostsecure.com (MISP Attribute #18728)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailpostsecure.com (MISP Attribute #18728)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-fc84-4a5c-a9b1-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-fc84-4a5c-a9b1-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailpostsecure.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-e82c-404a-9286-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: nameserverredirect.com (MISP Attribute #18984)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: nameserverredirect.com (MISP Attribute #18984)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-e82c-404a-9286-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-e82c-404a-9286-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">nameserverredirect.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-cdf8-44a2-948a-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailsecurehost.com (MISP Attribute #18729)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailsecurehost.com (MISP Attribute #18729)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-cdf8-44a2-948a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-cdf8-44a2-948a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailsecurehost.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-1da0-4549-96cc-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: affiliatedomainservice.com (MISP Attribute #18985)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: affiliatedomainservice.com (MISP Attribute #18985)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-1da0-4549-96cc-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-1da0-4549-96cc-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">affiliatedomainservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-a3b8-455c-ab4c-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailapiservice.com (MISP Attribute #18730)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailapiservice.com (MISP Attribute #18730)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-a3b8-455c-ab4c-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-a3b8-455c-ab4c-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailapiservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-db3c-441b-afc6-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: siteadmineurope.com (MISP Attribute #18986)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: siteadmineurope.com (MISP Attribute #18986)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-db3c-441b-afc6-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-db3c-441b-afc6-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">siteadmineurope.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-e3dc-4e89-afab-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailchimpservice.com (MISP Attribute #18731)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailchimpservice.com (MISP Attribute #18731)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-e3dc-4e89-afab-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-e3dc-4e89-afab-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailchimpservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-199c-47f6-bb3d-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: sitebloginfo.com (MISP Attribute #18987)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: sitebloginfo.com (MISP Attribute #18987)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-199c-47f6-bb3d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-199c-47f6-bb3d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">sitebloginfo.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-deb8-4412-95d1-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: postmarkapiservice.com (MISP Attribute #18732)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: postmarkapiservice.com (MISP Attribute #18732)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-deb8-4412-95d1-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-deb8-4412-95d1-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">postmarkapiservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-d444-40a9-a6e0-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: xpertdomain.com (MISP Attribute #18988)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: xpertdomain.com (MISP Attribute #18988)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-d444-40a9-a6e0-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-d444-40a9-a6e0-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">xpertdomain.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-bc48-433f-ba2f-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: loginservercheck.com (MISP Attribute #18733)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: loginservercheck.com (MISP Attribute #18733)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-bc48-433f-ba2f-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-bc48-433f-ba2f-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">loginservercheck.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-b878-4327-a297-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: aplsrvrer.com (MISP Attribute #18989)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: aplsrvrer.com (MISP Attribute #18989)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-b878-4327-a297-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-b878-4327-a297-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">aplsrvrer.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-90dc-40ea-9a33-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: checkmailserverhk.com (MISP Attribute #18734)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: checkmailserverhk.com (MISP Attribute #18734)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-90dc-40ea-9a33-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-90dc-40ea-9a33-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">checkmailserverhk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-c86c-4e8e-bb6f-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: bsrvrer.com (MISP Attribute #18990)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: bsrvrer.com (MISP Attribute #18990)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-c86c-4e8e-bb6f-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-c86c-4e8e-bb6f-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">bsrvrer.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-a478-4713-a96a-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: shortlinkcut.com (MISP Attribute #18735)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: shortlinkcut.com (MISP Attribute #18735)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-a478-4713-a96a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-a478-4713-a96a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">shortlinkcut.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-8f54-43b7-83ef-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: csrvrer.com (MISP Attribute #18991)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: csrvrer.com (MISP Attribute #18991)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-8f54-43b7-83ef-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-8f54-43b7-83ef-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">csrvrer.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-0f94-4924-8a79-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: webserverhollandservice.com (MISP Attribute #18736)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: webserverhollandservice.com (MISP Attribute #18736)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-0f94-4924-8a79-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-0f94-4924-8a79-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">webserverhollandservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-0254-48bb-8890-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: dsrvrer.com (MISP Attribute #18992)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: dsrvrer.com (MISP Attribute #18992)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-0254-48bb-8890-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-0254-48bb-8890-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">dsrvrer.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-a3b4-4400-8ce4-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: postserviceemaildomain.com (MISP Attribute #18737)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: postserviceemaildomain.com (MISP Attribute #18737)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-a3b4-4400-8ce4-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-a3b4-4400-8ce4-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">postserviceemaildomain.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-d6c4-4236-ad25-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: esrvrer.com (MISP Attribute #18993)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: esrvrer.com (MISP Attribute #18993)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-d6c4-4236-ad25-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-d6c4-4236-ad25-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">esrvrer.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-e694-4282-9f6a-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: webhostwebcare.com (MISP Attribute #18738)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: webhostwebcare.com (MISP Attribute #18738)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-e694-4282-9f6a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-e694-4282-9f6a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">webhostwebcare.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-d9b0-45f0-892c-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: isrvrer.com (MISP Attribute #18994)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: isrvrer.com (MISP Attribute #18994)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-d9b0-45f0-892c-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-d9b0-45f0-892c-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">isrvrer.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-7628-40c5-86c9-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: santanaservice.com (MISP Attribute #18739)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: santanaservice.com (MISP Attribute #18739)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-7628-40c5-86c9-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-7628-40c5-86c9-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">santanaservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-450c-4d31-a992-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: zsrvrer.com (MISP Attribute #18995)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: zsrvrer.com (MISP Attribute #18995)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-450c-4d31-a992-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-450c-4d31-a992-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">zsrvrer.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-6d40-4201-8e7b-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: emailhostholland.com (MISP Attribute #18740)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: emailhostholland.com (MISP Attribute #18740)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-6d40-4201-8e7b-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-6d40-4201-8e7b-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">emailhostholland.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-0cfc-4388-816d-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: inrsrvrer.com (MISP Attribute #18996)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: inrsrvrer.com (MISP Attribute #18996)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-0cfc-4388-816d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-0cfc-4388-816d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">inrsrvrer.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-96bc-4de2-9a3f-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: maillinkservice.com (MISP Attribute #18741)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: maillinkservice.com (MISP Attribute #18741)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-96bc-4de2-9a3f-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-96bc-4de2-9a3f-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">maillinkservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-9774-4c94-9234-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mnrsrvrer.com (MISP Attribute #18997)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mnrsrvrer.com (MISP Attribute #18997)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-9774-4c94-9234-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-9774-4c94-9234-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mnrsrvrer.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-afd0-4e7b-a76d-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hkdrillonline.com (MISP Attribute #18742)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hkdrillonline.com (MISP Attribute #18742)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-afd0-4e7b-a76d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-afd0-4e7b-a76d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hkdrillonline.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-c684-4c87-9e52-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mvrsrvrer.com (MISP Attribute #18998)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mvrsrvrer.com (MISP Attribute #18998)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-c684-4c87-9e52-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-c684-4c87-9e52-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mvrsrvrer.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-9908-4265-9d9c-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hostsecuremail.com (MISP Attribute #18743)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hostsecuremail.com (MISP Attribute #18743)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-9908-4265-9d9c-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-9908-4265-9d9c-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hostsecuremail.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-9d4c-4204-83e2-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: imgsrvrer.com (MISP Attribute #18999)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: imgsrvrer.com (MISP Attribute #18999)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-9d4c-4204-83e2-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-9d4c-4204-83e2-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">imgsrvrer.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-c774-403d-88f0-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailannounceservice.com (MISP Attribute #18744)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailannounceservice.com (MISP Attribute #18744)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-c774-403d-88f0-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-c774-403d-88f0-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailannounceservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-1f50-44e9-b3a6-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: nrgrsrvrer.com (MISP Attribute #19000)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: nrgrsrvrer.com (MISP Attribute #19000)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-1f50-44e9-b3a6-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-1f50-44e9-b3a6-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">nrgrsrvrer.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-322c-450d-ad4a-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: serverforshort.com (MISP Attribute #18745)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: serverforshort.com (MISP Attribute #18745)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-322c-450d-ad4a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-322c-450d-ad4a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">serverforshort.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-07ac-483b-97b8-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: minrsrvr.com (MISP Attribute #19001)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: minrsrvr.com (MISP Attribute #19001)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-07ac-483b-97b8-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-07ac-483b-97b8-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">minrsrvr.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-b478-4eef-87bf-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hathwaynetwork.com (MISP Attribute #18746)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hathwaynetwork.com (MISP Attribute #18746)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-b478-4eef-87bf-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-b478-4eef-87bf-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hathwaynetwork.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-be08-4f6d-86b8-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: intrsrvrer.com (MISP Attribute #19002)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: intrsrvrer.com (MISP Attribute #19002)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-be08-4f6d-86b8-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-be08-4f6d-86b8-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">intrsrvrer.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-4514-446e-b980-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: servermain43.com (MISP Attribute #18747)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: servermain43.com (MISP Attribute #18747)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-4514-446e-b980-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-4514-446e-b980-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">servermain43.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-6654-47da-adb0-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mail-msrgr.info (MISP Attribute #19003)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mail-msrgr.info (MISP Attribute #19003)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-6654-47da-adb0-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-6654-47da-adb0-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mail-msrgr.info</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-8024-4293-b1ec-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: domainsserver4f.com (MISP Attribute #18748)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: domainsserver4f.com (MISP Attribute #18748)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-8024-4293-b1ec-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-8024-4293-b1ec-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">domainsserver4f.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-7df4-4194-9704-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: com-oa-en-us.com (MISP Attribute #19004)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: com-oa-en-us.com (MISP Attribute #19004)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-7df4-4194-9704-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-7df4-4194-9704-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">com-oa-en-us.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-0440-45bf-af15-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: domainblacklistcheck.com (MISP Attribute #18749)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: domainblacklistcheck.com (MISP Attribute #18749)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-0440-45bf-af15-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-0440-45bf-af15-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">domainblacklistcheck.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-74c4-4434-a43a-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mrgrhr.com (MISP Attribute #19005)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mrgrhr.com (MISP Attribute #19005)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-74c4-4434-a43a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-74c4-4434-a43a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mrgrhr.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-4a5c-467a-93ee-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: serversap54.com (MISP Attribute #18750)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: serversap54.com (MISP Attribute #18750)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-4a5c-467a-93ee-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-4a5c-467a-93ee-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">serversap54.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-c058-4beb-ba35-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: com-nh-en-us.com (MISP Attribute #19006)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: com-nh-en-us.com (MISP Attribute #19006)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-c058-4beb-ba35-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-c058-4beb-ba35-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">com-nh-en-us.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-e4d8-40c7-bb37-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: sapserverhike.com (MISP Attribute #18751)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: sapserverhike.com (MISP Attribute #18751)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-e4d8-40c7-bb37-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-e4d8-40c7-bb37-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">sapserverhike.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-6c8c-46e5-b610-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: com-io-en-us.com (MISP Attribute #19007)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: com-io-en-us.com (MISP Attribute #19007)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-6c8c-46e5-b610-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-6c8c-46e5-b610-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">com-io-en-us.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-b5e8-4554-98f1-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: domainserveractive.com (MISP Attribute #18752)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: domainserveractive.com (MISP Attribute #18752)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-b5e8-4554-98f1-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-b5e8-4554-98f1-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">domainserveractive.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-18c0-4297-9099-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: msrdr.com (MISP Attribute #19008)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: msrdr.com (MISP Attribute #19008)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-18c0-4297-9099-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-18c0-4297-9099-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">msrdr.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-583c-4616-a682-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: netsecurehostingmy.com (MISP Attribute #18753)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: netsecurehostingmy.com (MISP Attribute #18753)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-583c-4616-a682-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-583c-4616-a682-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">netsecurehostingmy.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-ce54-4e66-a5fd-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: msrwr.com (MISP Attribute #19009)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: msrwr.com (MISP Attribute #19009)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-ce54-4e66-a5fd-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-ce54-4e66-a5fd-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">msrwr.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-bf8c-42fc-bc23-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: pageredirectservice.com (MISP Attribute #18754)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: pageredirectservice.com (MISP Attribute #18754)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-bf8c-42fc-bc23-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-bf8c-42fc-bc23-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">pageredirectservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-8898-4c9a-8424-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mgrsr.com (MISP Attribute #19010)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mgrsr.com (MISP Attribute #19010)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-8898-4c9a-8424-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-8898-4c9a-8424-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mgrsr.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-8bac-43ad-88c1-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: emailbaseserverhl.com (MISP Attribute #18755)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: emailbaseserverhl.com (MISP Attribute #18755)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-8bac-43ad-88c1-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-8bac-43ad-88c1-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">emailbaseserverhl.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-d518-4de6-90a3-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: com-en-us.co.uk (MISP Attribute #19011)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: com-en-us.co.uk (MISP Attribute #19011)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-d518-4de6-90a3-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-d518-4de6-90a3-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">com-en-us.co.uk</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-abc8-4549-93d6-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: logincontrolserver.com (MISP Attribute #18756)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: logincontrolserver.com (MISP Attribute #18756)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-abc8-4549-93d6-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-abc8-4549-93d6-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">logincontrolserver.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-2e18-429a-be6d-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: com-er-en-us.com (MISP Attribute #19012)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: com-er-en-us.com (MISP Attribute #19012)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-2e18-429a-be6d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-2e18-429a-be6d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">com-er-en-us.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-dc28-4fac-bc85-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: baseserveremailbg.com (MISP Attribute #18757)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: baseserveremailbg.com (MISP Attribute #18757)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-dc28-4fac-bc85-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-dc28-4fac-bc85-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">baseserveremailbg.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-9e88-4d0c-8afa-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: com-ar-en-us.com (MISP Attribute #19013)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: com-ar-en-us.com (MISP Attribute #19013)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-9e88-4d0c-8afa-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-9e88-4d0c-8afa-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">com-ar-en-us.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-f004-43fc-91f8-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: linkforwrder.com (MISP Attribute #18758)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: linkforwrder.com (MISP Attribute #18758)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-f004-43fc-91f8-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-f004-43fc-91f8-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">linkforwrder.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-f404-4140-99d1-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: secureserver9898.com (MISP Attribute #19014)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: secureserver9898.com (MISP Attribute #19014)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-f404-4140-99d1-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-f404-4140-99d1-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">secureserver9898.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-1060-4d92-a2c9-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailsecureservers.com (MISP Attribute #18759)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailsecureservers.com (MISP Attribute #18759)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-1060-4d92-a2c9-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-1060-4d92-a2c9-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailsecureservers.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-40e8-417c-892e-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: deferrer.website (MISP Attribute #19015)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: deferrer.website (MISP Attribute #19015)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-40e8-417c-892e-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-40e8-417c-892e-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">deferrer.website</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-1d98-411f-854f-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailserveroutlook.com (MISP Attribute #18760)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailserveroutlook.com (MISP Attribute #18760)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-1d98-411f-854f-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-1d98-411f-854f-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailserveroutlook.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-571c-406b-835a-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: look-com.org (MISP Attribute #19016)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: look-com.org (MISP Attribute #19016)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-571c-406b-835a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-571c-406b-835a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">look-com.org</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-6e00-4107-b39f-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: websecurehostings.com (MISP Attribute #18761)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: websecurehostings.com (MISP Attribute #18761)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-6e00-4107-b39f-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-6e00-4107-b39f-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">websecurehostings.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-d024-4581-b7dc-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mail-com.org (MISP Attribute #19017)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mail-com.org (MISP Attribute #19017)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-d024-4581-b7dc-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-d024-4581-b7dc-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mail-com.org</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-d254-42f4-8dce-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: anothershortnr.com (MISP Attribute #18762)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: anothershortnr.com (MISP Attribute #18762)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-d254-42f4-8dce-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-d254-42f4-8dce-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">anothershortnr.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-643c-42d9-bae7-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: ppleid.org (MISP Attribute #19018)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: ppleid.org (MISP Attribute #19018)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-643c-42d9-bae7-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-643c-42d9-bae7-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">ppleid.org</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-83c0-4085-9855-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailserverdirect3994.com (MISP Attribute #18763)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailserverdirect3994.com (MISP Attribute #18763)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-83c0-4085-9855-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-83c0-4085-9855-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailserverdirect3994.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-4f78-44e0-b1d4-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: com-biz.website (MISP Attribute #19019)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: com-biz.website (MISP Attribute #19019)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-4f78-44e0-b1d4-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-4f78-44e0-b1d4-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">com-biz.website</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-898c-4a02-9d5c-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailserver39.com (MISP Attribute #18764)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailserver39.com (MISP Attribute #18764)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-898c-4a02-9d5c-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-898c-4a02-9d5c-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailserver39.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-899c-409f-b5d0-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: com-com-us.com (MISP Attribute #19020)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: com-com-us.com (MISP Attribute #19020)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-899c-409f-b5d0-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-899c-409f-b5d0-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">com-com-us.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-9a00-4765-a6a3-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: emailserver4859.com (MISP Attribute #18765)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: emailserver4859.com (MISP Attribute #18765)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-9a00-4765-a6a3-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-9a00-4765-a6a3-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">emailserver4859.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-e6e8-43d0-9760-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: com-com.website (MISP Attribute #19021)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: com-com.website (MISP Attribute #19021)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-e6e8-43d0-9760-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-e6e8-43d0-9760-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">com-com.website</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-a3b4-404d-aab6-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: linkfollowservice.com (MISP Attribute #18766)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: linkfollowservice.com (MISP Attribute #18766)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-a3b4-404d-aab6-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-a3b4-404d-aab6-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">linkfollowservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-b21c-4c11-afb7-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: com-hl-en-us.com (MISP Attribute #19022)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: com-hl-en-us.com (MISP Attribute #19022)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-b21c-4c11-afb7-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-b21c-4c11-afb7-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">com-hl-en-us.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-d928-4ccf-9dfe-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: netsecuremailhosting.com (MISP Attribute #18767)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: netsecuremailhosting.com (MISP Attribute #18767)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-d928-4ccf-9dfe-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-d928-4ccf-9dfe-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">netsecuremailhosting.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-6964-4b95-96e4-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: com-mail-us.com (MISP Attribute #19023)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: com-mail-us.com (MISP Attribute #19023)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-6964-4b95-96e4-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-6964-4b95-96e4-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">com-mail-us.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-292c-4c75-9e27-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailserviceloginonline.com (MISP Attribute #18768)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailserviceloginonline.com (MISP Attribute #18768)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-292c-4c75-9e27-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-292c-4c75-9e27-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailserviceloginonline.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-d77c-4cf9-8adc-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: com-mail.net (MISP Attribute #19024)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: com-mail.net (MISP Attribute #19024)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-d77c-4cf9-8adc-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-d77c-4cf9-8adc-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">com-mail.net</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-7354-4483-95e8-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailauthorizationservice.com (MISP Attribute #18769)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailauthorizationservice.com (MISP Attribute #18769)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-7354-4483-95e8-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-7354-4483-95e8-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailauthorizationservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-15ec-4c50-8e7e-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: com-us-en-us.com (MISP Attribute #19025)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: com-us-en-us.com (MISP Attribute #19025)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-15ec-4c50-8e7e-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-15ec-4c50-8e7e-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">com-us-en-us.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-ef18-4011-a98e-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailauthservice.com (MISP Attribute #18770)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailauthservice.com (MISP Attribute #18770)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-ef18-4011-a98e-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-ef18-4011-a98e-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailauthservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-2518-4f2b-a1c2-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: webmailmanageruk.com (MISP Attribute #19026)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: webmailmanageruk.com (MISP Attribute #19026)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-2518-4f2b-a1c2-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-2518-4f2b-a1c2-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">webmailmanageruk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-6c6c-4931-8c5a-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: trackserviceonline.xyz (MISP Attribute #18771)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: trackserviceonline.xyz (MISP Attribute #18771)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-6c6c-4931-8c5a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-6c6c-4931-8c5a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">trackserviceonline.xyz</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-5f3c-4034-8163-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: websitemanagerusa.com (MISP Attribute #19027)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: websitemanagerusa.com (MISP Attribute #19027)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-5f3c-4034-8163-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-5f3c-4034-8163-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">websitemanagerusa.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-138c-440a-9b4f-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: affliatedomainservice.com (MISP Attribute #18772)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: affliatedomainservice.com (MISP Attribute #18772)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-138c-440a-9b4f-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-138c-440a-9b4f-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">affliatedomainservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-19e4-4a62-b752-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: transferserver33.com (MISP Attribute #19028)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: transferserver33.com (MISP Attribute #19028)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-19e4-4a62-b752-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-19e4-4a62-b752-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">transferserver33.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-d3ac-4247-822d-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: upgradetravelservice.com (MISP Attribute #18773)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: upgradetravelservice.com (MISP Attribute #18773)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-d3ac-4247-822d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-d3ac-4247-822d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">upgradetravelservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-df18-4891-b6a8-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: websiteadminuk.com (MISP Attribute #19029)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: websiteadminuk.com (MISP Attribute #19029)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-df18-4891-b6a8-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-df18-4891-b6a8-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">websiteadminuk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-a390-4424-8619-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: com-authmail.com (MISP Attribute #18774)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: com-authmail.com (MISP Attribute #18774)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-a390-4424-8619-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-a390-4424-8619-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">com-authmail.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-2214-4607-80a7-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: budgtoffmy.com (MISP Attribute #19030)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: budgtoffmy.com (MISP Attribute #19030)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-2214-4607-80a7-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-2214-4607-80a7-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">budgtoffmy.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-b44c-48af-9023-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: webredirect.click (MISP Attribute #18775)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: webredirect.click (MISP Attribute #18775)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-b44c-48af-9023-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-b44c-48af-9023-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">webredirect.click</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-b2f0-4a05-ba80-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: budgtoffru.com (MISP Attribute #19031)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: budgtoffru.com (MISP Attribute #19031)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-b2f0-4a05-ba80-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-b2f0-4a05-ba80-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">budgtoffru.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-1134-4ece-8e78-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: javaservermy.com (MISP Attribute #18776)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: javaservermy.com (MISP Attribute #18776)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-1134-4ece-8e78-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-1134-4ece-8e78-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">javaservermy.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-9ae8-4036-9084-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: serverforhelplux.com (MISP Attribute #19032)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: serverforhelplux.com (MISP Attribute #19032)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-9ae8-4036-9084-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-9ae8-4036-9084-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">serverforhelplux.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-22b8-40e6-afe3-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailcommute.com (MISP Attribute #18777)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailcommute.com (MISP Attribute #18777)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-22b8-40e6-afe3-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-22b8-40e6-afe3-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailcommute.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-5aa4-4e2b-82b2-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: serverforhelpmy.com (MISP Attribute #19033)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: serverforhelpmy.com (MISP Attribute #19033)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-5aa4-4e2b-82b2-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-5aa4-4e2b-82b2-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">serverforhelpmy.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-e93c-400b-8a1d-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: shortenup.com (MISP Attribute #18778)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: shortenup.com (MISP Attribute #18778)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-e93c-400b-8a1d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-e93c-400b-8a1d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">shortenup.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-f224-46ff-b495-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: linuxbasicru3.com (MISP Attribute #19034)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: linuxbasicru3.com (MISP Attribute #19034)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-f224-46ff-b495-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-f224-46ff-b495-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">linuxbasicru3.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-e350-4f53-baba-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: assuredreturnplan.com (MISP Attribute #18779)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: assuredreturnplan.com (MISP Attribute #18779)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-e350-4f53-baba-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-e350-4f53-baba-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">assuredreturnplan.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-4ac0-4551-a821-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: nigeriaoilleaks.com (MISP Attribute #19035)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: nigeriaoilleaks.com (MISP Attribute #19035)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-4ac0-4551-a821-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-4ac0-4551-a821-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">nigeriaoilleaks.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-da3c-4adb-904b-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: optionaldesigners.com (MISP Attribute #18780)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: optionaldesigners.com (MISP Attribute #18780)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-da3c-4adb-904b-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-da3c-4adb-904b-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">optionaldesigners.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-602c-4aa9-bbb0-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: ondemand.pushthisurl.com (MISP Attribute #19036)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: ondemand.pushthisurl.com (MISP Attribute #19036)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-602c-4aa9-bbb0-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-602c-4aa9-bbb0-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">ondemand.pushthisurl.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-e7d8-4879-aa9c-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: post-manager.com (MISP Attribute #18781)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: post-manager.com (MISP Attribute #18781)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-e7d8-4879-aa9c-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-e7d8-4879-aa9c-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">post-manager.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-a220-4201-9852-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: saferedirect.pw (MISP Attribute #19037)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: saferedirect.pw (MISP Attribute #19037)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-a220-4201-9852-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-a220-4201-9852-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">saferedirect.pw</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-6d20-4054-87fc-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: racksackserveruk.com (MISP Attribute #18782)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: racksackserveruk.com (MISP Attribute #18782)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-6d20-4054-87fc-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-6d20-4054-87fc-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">racksackserveruk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974c-0c50-4fca-ba3b-7a498064ab0b" timestamp="2020-06-08T15:53:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: shortserver1.com (MISP Attribute #19038)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: shortserver1.com (MISP Attribute #19038)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974c-0c50-4fca-ba3b-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974c-0c50-4fca-ba3b-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">shortserver1.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:48+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-dc24-4f46-8aff-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: netgeoserversg.com (MISP Attribute #18783)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: netgeoserversg.com (MISP Attribute #18783)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-dc24-4f46-8aff-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-dc24-4f46-8aff-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">netgeoserversg.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-693c-4ffc-97a6-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: blogserverlx.com (MISP Attribute #18784)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: blogserverlx.com (MISP Attribute #18784)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-693c-4ffc-97a6-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-693c-4ffc-97a6-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">blogserverlx.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-7674-4e17-9971-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: dotnetserverhk.com (MISP Attribute #18785)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: dotnetserverhk.com (MISP Attribute #18785)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-7674-4e17-9971-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-7674-4e17-9971-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">dotnetserverhk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-d768-4621-beeb-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: capitalinvestmentsllp.com (MISP Attribute #18786)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: capitalinvestmentsllp.com (MISP Attribute #18786)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-d768-4621-beeb-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-d768-4621-beeb-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">capitalinvestmentsllp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-b218-498c-9aa8-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: frwrdrurl.com (MISP Attribute #18787)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: frwrdrurl.com (MISP Attribute #18787)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-b218-498c-9aa8-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-b218-498c-9aa8-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">frwrdrurl.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-3930-4de3-8ded-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: offshoretoursntravels.com (MISP Attribute #18788)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: offshoretoursntravels.com (MISP Attribute #18788)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-3930-4de3-8ded-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-3930-4de3-8ded-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">offshoretoursntravels.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-3538-441f-8489-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: shipnyatchholland.com (MISP Attribute #18789)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: shipnyatchholland.com (MISP Attribute #18789)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-3538-441f-8489-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-3538-441f-8489-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">shipnyatchholland.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-4cfc-4fb4-8b9b-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hollandtourandtravel.com (MISP Attribute #18790)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hollandtourandtravel.com (MISP Attribute #18790)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-4cfc-4fb4-8b9b-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-4cfc-4fb4-8b9b-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hollandtourandtravel.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-6b64-457f-86c4-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: tricktravelbooking.com (MISP Attribute #18791)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: tricktravelbooking.com (MISP Attribute #18791)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-6b64-457f-86c4-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-6b64-457f-86c4-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">tricktravelbooking.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-7edc-4931-a120-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hongkongshippingcompany.com (MISP Attribute #18792)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hongkongshippingcompany.com (MISP Attribute #18792)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-7edc-4931-a120-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-7edc-4931-a120-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hongkongshippingcompany.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-9d20-47f0-ae1a-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: offshorecompanyllp.com (MISP Attribute #18793)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: offshorecompanyllp.com (MISP Attribute #18793)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-9d20-47f0-ae1a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-9d20-47f0-ae1a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">offshorecompanyllp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-885c-427b-9a04-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hardcoretechnologiesllp.com (MISP Attribute #18794)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hardcoretechnologiesllp.com (MISP Attribute #18794)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-885c-427b-9a04-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-885c-427b-9a04-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hardcoretechnologiesllp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-6ee8-4c07-a877-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: strongwingtechnologies.com (MISP Attribute #18795)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: strongwingtechnologies.com (MISP Attribute #18795)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-6ee8-4c07-a877-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-6ee8-4c07-a877-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">strongwingtechnologies.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-3634-4a5f-b63d-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: watchmanservice.com (MISP Attribute #18796)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: watchmanservice.com (MISP Attribute #18796)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-3634-4a5f-b63d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-3634-4a5f-b63d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">watchmanservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-1bf8-4a3a-a1a1-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hiretechservicehg.com (MISP Attribute #18797)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hiretechservicehg.com (MISP Attribute #18797)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-1bf8-4a3a-a1a1-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-1bf8-4a3a-a1a1-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hiretechservicehg.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-2930-48c9-b7ec-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: internetmarketingservicehg.com (MISP Attribute #18798)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: internetmarketingservicehg.com (MISP Attribute #18798)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-2930-48c9-b7ec-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-2930-48c9-b7ec-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">internetmarketingservicehg.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-f07c-459d-bbfd-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: prwebsiteuk.com (MISP Attribute #18799)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: prwebsiteuk.com (MISP Attribute #18799)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-f07c-459d-bbfd-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-f07c-459d-bbfd-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">prwebsiteuk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-9504-4c77-90af-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: selectyourgroom.com (MISP Attribute #18800)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: selectyourgroom.com (MISP Attribute #18800)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-9504-4c77-90af-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-9504-4c77-90af-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">selectyourgroom.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-5228-4bc7-ac4a-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: exchangeserverformailing.com (MISP Attribute #18801)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: exchangeserverformailing.com (MISP Attribute #18801)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-5228-4bc7-ac4a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-5228-4bc7-ac4a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">exchangeserverformailing.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-0394-4fcb-ab1d-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: loginservicesmailsonlinesaccounts.com (MISP Attribute #18802)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: loginservicesmailsonlinesaccounts.com (MISP Attribute #18802)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-0394-4fcb-ab1d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-0394-4fcb-ab1d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">loginservicesmailsonlinesaccounts.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-54c4-4074-9a98-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: redirectserviceonline.com (MISP Attribute #18803)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: redirectserviceonline.com (MISP Attribute #18803)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-54c4-4074-9a98-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-54c4-4074-9a98-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">redirectserviceonline.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-ac34-420a-ada9-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: strongbolthostinghk.com (MISP Attribute #18804)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: strongbolthostinghk.com (MISP Attribute #18804)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-ac34-420a-ada9-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-ac34-420a-ada9-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">strongbolthostinghk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-53d4-4528-b91f-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: dotnerserversg.com (MISP Attribute #18805)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: dotnerserversg.com (MISP Attribute #18805)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-53d4-4528-b91f-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-53d4-4528-b91f-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">dotnerserversg.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-8d54-4966-b6ce-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: netserviceru.com (MISP Attribute #18806)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: netserviceru.com (MISP Attribute #18806)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-8d54-4966-b6ce-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-8d54-4966-b6ce-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">netserviceru.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-048c-4ae5-900c-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: sapserverhg.com (MISP Attribute #18807)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: sapserverhg.com (MISP Attribute #18807)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-048c-4ae5-900c-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-048c-4ae5-900c-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">sapserverhg.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-98ac-4c09-a078-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: srvrgruk.com (MISP Attribute #18808)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: srvrgruk.com (MISP Attribute #18808)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-98ac-4c09-a078-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-98ac-4c09-a078-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">srvrgruk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-5e04-4a75-8dde-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: domainformailinguk.com (MISP Attribute #18809)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: domainformailinguk.com (MISP Attribute #18809)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-5e04-4a75-8dde-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-5e04-4a75-8dde-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">domainformailinguk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-5ebc-4d75-a571-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: exchangeserver2345.com (MISP Attribute #18810)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: exchangeserver2345.com (MISP Attribute #18810)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-5ebc-4d75-a571-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-5ebc-4d75-a571-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">exchangeserver2345.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-5740-4f87-978e-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: tnyurlservice.com (MISP Attribute #18811)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: tnyurlservice.com (MISP Attribute #18811)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-5740-4f87-978e-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-5740-4f87-978e-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">tnyurlservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-3340-4c3f-bf88-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: webserver39490.com (MISP Attribute #18812)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: webserver39490.com (MISP Attribute #18812)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-3340-4c3f-bf88-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-3340-4c3f-bf88-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">webserver39490.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-48ac-49f7-aa25-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: webserveroginusa.com (MISP Attribute #18813)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: webserveroginusa.com (MISP Attribute #18813)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-48ac-49f7-aa25-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-48ac-49f7-aa25-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">webserveroginusa.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-f180-4a01-92f0-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: webserverdomaineu.com (MISP Attribute #18814)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: webserverdomaineu.com (MISP Attribute #18814)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-f180-4a01-92f0-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-f180-4a01-92f0-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">webserverdomaineu.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-c100-45b4-81df-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: webserverdomainhk.com (MISP Attribute #18815)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: webserverdomainhk.com (MISP Attribute #18815)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-c100-45b4-81df-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-c100-45b4-81df-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">webserverdomainhk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-ab10-4ab3-a06d-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: webserverdomainuk.com (MISP Attribute #18816)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: webserverdomainuk.com (MISP Attribute #18816)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-ab10-4ab3-a06d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-ab10-4ab3-a06d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">webserverdomainuk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-7edc-4057-baba-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: webserverdomainusa.com (MISP Attribute #18817)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: webserverdomainusa.com (MISP Attribute #18817)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-7edc-4057-baba-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-7edc-4057-baba-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">webserverdomainusa.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-7244-43e1-92cc-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: domainhostnetworkuk.com (MISP Attribute #18818)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: domainhostnetworkuk.com (MISP Attribute #18818)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-7244-43e1-92cc-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-7244-43e1-92cc-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">domainhostnetworkuk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-4de0-4c57-9268-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: domainhostnetworkusa.com (MISP Attribute #18819)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: domainhostnetworkusa.com (MISP Attribute #18819)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-4de0-4c57-9268-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-4de0-4c57-9268-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">domainhostnetworkusa.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-2d00-4dc6-8bb2-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: domainhostworkeu.com (MISP Attribute #18820)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: domainhostworkeu.com (MISP Attribute #18820)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-2d00-4dc6-8bb2-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-2d00-4dc6-8bb2-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">domainhostworkeu.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-eed4-4938-84d1-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: domainlocalhostingeu.com (MISP Attribute #18821)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: domainlocalhostingeu.com (MISP Attribute #18821)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-eed4-4938-84d1-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-eed4-4938-84d1-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">domainlocalhostingeu.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-3594-4998-b9e1-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: domainlocalhostinghk.com (MISP Attribute #18822)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: domainlocalhostinghk.com (MISP Attribute #18822)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-3594-4998-b9e1-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-3594-4998-b9e1-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">domainlocalhostinghk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-44dc-476e-999f-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: domainlocalhostinguk.com (MISP Attribute #18823)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: domainlocalhostinguk.com (MISP Attribute #18823)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-44dc-476e-999f-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-44dc-476e-999f-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">domainlocalhostinguk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-8008-4c91-a16b-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: localhostinguk.com (MISP Attribute #18824)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: localhostinguk.com (MISP Attribute #18824)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-8008-4c91-a16b-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-8008-4c91-a16b-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">localhostinguk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-f528-4693-9214-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: shorturlservice.com (MISP Attribute #18825)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: shorturlservice.com (MISP Attribute #18825)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-f528-4693-9214-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-f528-4693-9214-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">shorturlservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-646c-46fa-b45a-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: onlineloginserviceeu.com (MISP Attribute #18826)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: onlineloginserviceeu.com (MISP Attribute #18826)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-646c-46fa-b45a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-646c-46fa-b45a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">onlineloginserviceeu.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-6ee8-4b70-acdc-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: onlineloginserviceuk.com (MISP Attribute #18827)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: onlineloginserviceuk.com (MISP Attribute #18827)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-6ee8-4b70-acdc-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-6ee8-4b70-acdc-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">onlineloginserviceuk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-c338-4d27-8906-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: onlineloginserviceusa.com (MISP Attribute #18828)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: onlineloginserviceusa.com (MISP Attribute #18828)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-c338-4d27-8906-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-c338-4d27-8906-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">onlineloginserviceusa.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-4178-428d-9a89-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: basichostnetservice.com (MISP Attribute #18829)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: basichostnetservice.com (MISP Attribute #18829)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-4178-428d-9a89-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-4178-428d-9a89-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">basichostnetservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-3bf0-48e4-b015-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: loginservicebasic.com (MISP Attribute #18830)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: loginservicebasic.com (MISP Attribute #18830)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-3bf0-48e4-b015-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-3bf0-48e4-b015-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">loginservicebasic.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-26c8-401d-afe0-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: basichostingrussia.com (MISP Attribute #18831)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: basichostingrussia.com (MISP Attribute #18831)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-26c8-401d-afe0-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-26c8-401d-afe0-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">basichostingrussia.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-7348-4b92-8293-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: bitserverhk.com (MISP Attribute #18832)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: bitserverhk.com (MISP Attribute #18832)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-7348-4b92-8293-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-7348-4b92-8293-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">bitserverhk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-f0c4-4628-a01d-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: openserverholland.com (MISP Attribute #18577)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: openserverholland.com (MISP Attribute #18577)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-f0c4-4628-a01d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-f0c4-4628-a01d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">openserverholland.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-b028-4cd7-b4c3-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: bitserverlux.com (MISP Attribute #18833)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: bitserverlux.com (MISP Attribute #18833)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-b028-4cd7-b4c3-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-b028-4cd7-b4c3-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">bitserverlux.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-0d88-4041-bb35-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: emailseverrus23.com (MISP Attribute #18578)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: emailseverrus23.com (MISP Attribute #18578)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-0d88-4041-bb35-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-0d88-4041-bb35-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">emailseverrus23.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-8ccc-4d1c-96fd-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: selectedservicemy.com (MISP Attribute #18834)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: selectedservicemy.com (MISP Attribute #18834)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-8ccc-4d1c-96fd-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-8ccc-4d1c-96fd-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">selectedservicemy.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-8b1c-4ee5-94be-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: smtpserver389.com (MISP Attribute #18579)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: smtpserver389.com (MISP Attribute #18579)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-8b1c-4ee5-94be-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-8b1c-4ee5-94be-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">smtpserver389.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-f24c-4033-934a-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: selectedserviceru.com (MISP Attribute #18835)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: selectedserviceru.com (MISP Attribute #18835)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-f24c-4033-934a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-f24c-4033-934a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">selectedserviceru.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-8c14-48ff-aa3c-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: pageserver77.com (MISP Attribute #18580)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: pageserver77.com (MISP Attribute #18580)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-8c14-48ff-aa3c-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-8c14-48ff-aa3c-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">pageserver77.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-1050-4a49-a531-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: selectedservicesg.com (MISP Attribute #18836)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: selectedservicesg.com (MISP Attribute #18836)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-1050-4a49-a531-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-1050-4a49-a531-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">selectedservicesg.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-5594-49f9-9ea6-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: euanticorruption.com (MISP Attribute #18581)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: euanticorruption.com (MISP Attribute #18581)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-5594-49f9-9ea6-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-5594-49f9-9ea6-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">euanticorruption.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-dd14-499c-a5c8-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: basicmyoffshore.com (MISP Attribute #18837)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: basicmyoffshore.com (MISP Attribute #18837)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-dd14-499c-a5c8-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-dd14-499c-a5c8-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">basicmyoffshore.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-4134-4408-bffb-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: ablyazovcog.com (MISP Attribute #18582)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: ablyazovcog.com (MISP Attribute #18582)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-4134-4408-bffb-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-4134-4408-bffb-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">ablyazovcog.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-a7e4-469f-a011-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: basicruoffshore.com (MISP Attribute #18838)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: basicruoffshore.com (MISP Attribute #18838)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-a7e4-469f-a011-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-a7e4-469f-a011-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">basicruoffshore.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-ed04-4563-b839-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: ablyazovcriminalgang.com (MISP Attribute #18583)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: ablyazovcriminalgang.com (MISP Attribute #18583)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-ed04-4563-b839-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-ed04-4563-b839-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">ablyazovcriminalgang.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-fff8-4ae5-946a-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: basicsgoffshore.com (MISP Attribute #18839)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: basicsgoffshore.com (MISP Attribute #18839)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-fff8-4ae5-946a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-fff8-4ae5-946a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">basicsgoffshore.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-81ec-4128-9036-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: ablyazovgang.com (MISP Attribute #18584)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: ablyazovgang.com (MISP Attribute #18584)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-81ec-4128-9036-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-81ec-4128-9036-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">ablyazovgang.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-d554-4f2f-a399-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: onlineloginportal.com (MISP Attribute #18840)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: onlineloginportal.com (MISP Attribute #18840)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-d554-4f2f-a399-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-d554-4f2f-a399-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">onlineloginportal.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-b634-4bd2-964f-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: ablyazovcriminals.com (MISP Attribute #18585)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: ablyazovcriminals.com (MISP Attribute #18585)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-b634-4bd2-964f-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-b634-4bd2-964f-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">ablyazovcriminals.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-2e14-46ca-84d1-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: onlineloginportalhk.com (MISP Attribute #18841)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: onlineloginportalhk.com (MISP Attribute #18841)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-2e14-46ca-84d1-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-2e14-46ca-84d1-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">onlineloginportalhk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-969c-4f41-9b29-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: ablyazovcrimestory.com (MISP Attribute #18586)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: ablyazovcrimestory.com (MISP Attribute #18586)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-969c-4f41-9b29-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-969c-4f41-9b29-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">ablyazovcrimestory.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-ab8c-41d3-86e4-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: onlineloginportalmy.com (MISP Attribute #18842)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: onlineloginportalmy.com (MISP Attribute #18842)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-ab8c-41d3-86e4-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-ab8c-41d3-86e4-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">onlineloginportalmy.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-6360-4a3a-ada0-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: ablyazovmafia.com (MISP Attribute #18587)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: ablyazovmafia.com (MISP Attribute #18587)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-6360-4a3a-ada0-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-6360-4a3a-ada0-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">ablyazovmafia.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-25e4-459a-9744-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: onlineloginportalsg.com (MISP Attribute #18843)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: onlineloginportalsg.com (MISP Attribute #18843)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-25e4-459a-9744-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-25e4-459a-9744-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">onlineloginportalsg.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-fb04-40f9-aeff-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: ablyazovcrimesyndicate.com (MISP Attribute #18588)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: ablyazovcrimesyndicate.com (MISP Attribute #18588)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-fb04-40f9-aeff-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-fb04-40f9-aeff-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">ablyazovcrimesyndicate.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-5af4-43e2-afa4-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: personaldoaminru.com (MISP Attribute #18844)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: personaldoaminru.com (MISP Attribute #18844)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-5af4-43e2-afa4-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-5af4-43e2-afa4-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">personaldoaminru.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-930c-472e-a915-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: ablyazovorganisedcrime.com (MISP Attribute #18589)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: ablyazovorganisedcrime.com (MISP Attribute #18589)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-930c-472e-a915-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-930c-472e-a915-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">ablyazovorganisedcrime.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-bfac-49c8-9853-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: personaldoaminsg.com (MISP Attribute #18845)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: personaldoaminsg.com (MISP Attribute #18845)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-bfac-49c8-9853-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-bfac-49c8-9853-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">personaldoaminsg.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-c7dc-42df-859a-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: linkshrtnr22.com (MISP Attribute #18590)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: linkshrtnr22.com (MISP Attribute #18590)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-c7dc-42df-859a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-c7dc-42df-859a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">linkshrtnr22.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-49a4-4739-aceb-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: domainexpertswebuk.com (MISP Attribute #18846)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: domainexpertswebuk.com (MISP Attribute #18846)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-49a4-4739-aceb-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-49a4-4739-aceb-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">domainexpertswebuk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-1394-4cd7-b32d-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: ablyazovangels.com (MISP Attribute #18591)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: ablyazovangels.com (MISP Attribute #18591)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-1394-4cd7-b32d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-1394-4cd7-b32d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">ablyazovangels.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-7680-4679-b122-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: serviceasneed.com (MISP Attribute #18847)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: serviceasneed.com (MISP Attribute #18847)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-7680-4679-b122-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-7680-4679-b122-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">serviceasneed.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-e8f0-4210-a5a8-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: sapserver39j.com (MISP Attribute #18592)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: sapserver39j.com (MISP Attribute #18592)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-e8f0-4210-a5a8-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-e8f0-4210-a5a8-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">sapserver39j.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-92f4-4263-aba5-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: webdomainexperts.com (MISP Attribute #18848)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: webdomainexperts.com (MISP Attribute #18848)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-92f4-4263-aba5-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-92f4-4263-aba5-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">webdomainexperts.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-e538-4957-a77a-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: pageserver299.com (MISP Attribute #18593)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: pageserver299.com (MISP Attribute #18593)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-e538-4957-a77a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-e538-4957-a77a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">pageserver299.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-9d70-42e3-99df-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: buzzoffbul.com (MISP Attribute #18849)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: buzzoffbul.com (MISP Attribute #18849)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-9d70-42e3-99df-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-9d70-42e3-99df-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">buzzoffbul.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-624c-4728-b4e2-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: shadymario.com (MISP Attribute #18594)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: shadymario.com (MISP Attribute #18594)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-624c-4728-b4e2-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-624c-4728-b4e2-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">shadymario.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-7e20-49ed-aa14-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: buzzoffhk.com (MISP Attribute #18850)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: buzzoffhk.com (MISP Attribute #18850)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-7e20-49ed-aa14-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-7e20-49ed-aa14-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">buzzoffhk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-fdd8-48f5-aede-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: emailserver399.com (MISP Attribute #18595)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: emailserver399.com (MISP Attribute #18595)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-fdd8-48f5-aede-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-fdd8-48f5-aede-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">emailserver399.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-4868-4ba6-9d46-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: buzzoffmy.com (MISP Attribute #18851)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: buzzoffmy.com (MISP Attribute #18851)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-4868-4ba6-9d46-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-4868-4ba6-9d46-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">buzzoffmy.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-4a18-483e-889b-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: newserver39.com (MISP Attribute #18596)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: newserver39.com (MISP Attribute #18596)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-4a18-483e-889b-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-4a18-483e-889b-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">newserver39.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-3340-45f1-915d-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: buzzoffru.com (MISP Attribute #18852)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: buzzoffru.com (MISP Attribute #18852)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-3340-45f1-915d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-3340-45f1-915d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">buzzoffru.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-63d0-44ec-8fa7-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: maildeliveryagent.com (MISP Attribute #18597)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: maildeliveryagent.com (MISP Attribute #18597)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-63d0-44ec-8fa7-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-63d0-44ec-8fa7-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">maildeliveryagent.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-34c0-47a6-9887-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: buzzoffsg.com (MISP Attribute #18853)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: buzzoffsg.com (MISP Attribute #18853)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-34c0-47a6-9887-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-34c0-47a6-9887-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">buzzoffsg.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-9798-4cb1-ade2-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hbh-europe-ripoff-report.com (MISP Attribute #18598)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hbh-europe-ripoff-report.com (MISP Attribute #18598)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-9798-4cb1-ade2-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-9798-4cb1-ade2-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hbh-europe-ripoff-report.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-5454-4b4d-aa33-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hostbasichk.com (MISP Attribute #18854)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hostbasichk.com (MISP Attribute #18854)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-5454-4b4d-aa33-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-5454-4b4d-aa33-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hostbasichk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-8fb8-4691-9e50-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: shortformurl.com (MISP Attribute #18599)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: shortformurl.com (MISP Attribute #18599)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-8fb8-4691-9e50-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-8fb8-4691-9e50-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">shortformurl.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-3fd0-4d16-94f7-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hostbasicholl.com (MISP Attribute #18855)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hostbasicholl.com (MISP Attribute #18855)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-3fd0-4d16-94f7-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-3fd0-4d16-94f7-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hostbasicholl.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-b100-401e-bc99-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: shortformurl.xyz (MISP Attribute #18600)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: shortformurl.xyz (MISP Attribute #18600)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-b100-401e-bc99-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-b100-401e-bc99-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">shortformurl.xyz</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-aeb0-4b09-9650-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hostbasicmy.com (MISP Attribute #18856)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hostbasicmy.com (MISP Attribute #18856)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-aeb0-4b09-9650-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-aeb0-4b09-9650-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hostbasicmy.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-a4f8-4564-83d2-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: webredirect39.com (MISP Attribute #18601)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: webredirect39.com (MISP Attribute #18601)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-a4f8-4564-83d2-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-a4f8-4564-83d2-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">webredirect39.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-2a10-40d2-ad2d-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hostbasicru.com (MISP Attribute #18857)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hostbasicru.com (MISP Attribute #18857)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-2a10-40d2-ad2d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-2a10-40d2-ad2d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hostbasicru.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-ba64-44ff-aa99-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: logserver39.com (MISP Attribute #18602)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: logserver39.com (MISP Attribute #18602)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-ba64-44ff-aa99-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-ba64-44ff-aa99-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">logserver39.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-0394-493e-92cc-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hostbasicsg.com (MISP Attribute #18858)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hostbasicsg.com (MISP Attribute #18858)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-0394-493e-92cc-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-0394-493e-92cc-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hostbasicsg.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-1770-4e23-b405-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: webmasterserver39.com (MISP Attribute #18603)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: webmasterserver39.com (MISP Attribute #18603)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-1770-4e23-b405-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-1770-4e23-b405-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">webmasterserver39.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-076c-40b4-acd9-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: demoprojectsuk.com (MISP Attribute #18859)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: demoprojectsuk.com (MISP Attribute #18859)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-076c-40b4-acd9-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-076c-40b4-acd9-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">demoprojectsuk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-124c-417d-a74e-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: webnetonlineservice.com (MISP Attribute #18604)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: webnetonlineservice.com (MISP Attribute #18604)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-124c-417d-a74e-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-124c-417d-a74e-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">webnetonlineservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-0180-4724-9fc2-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: shortnerserviceonline.com (MISP Attribute #18860)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: shortnerserviceonline.com (MISP Attribute #18860)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-0180-4724-9fc2-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-0180-4724-9fc2-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">shortnerserviceonline.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-155c-49d2-b611-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: redirectonline.xyz (MISP Attribute #18605)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: redirectonline.xyz (MISP Attribute #18605)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-155c-49d2-b611-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-155c-49d2-b611-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">redirectonline.xyz</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-ae7c-4519-9607-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hklinbas.com (MISP Attribute #18861)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hklinbas.com (MISP Attribute #18861)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-ae7c-4519-9607-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-ae7c-4519-9607-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hklinbas.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-c3e8-4f50-863c-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: homeserver87.com (MISP Attribute #18606)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: homeserver87.com (MISP Attribute #18606)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-c3e8-4f50-863c-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-c3e8-4f50-863c-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">homeserver87.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-4aac-4dc1-874c-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: luxlinbas.com (MISP Attribute #18862)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: luxlinbas.com (MISP Attribute #18862)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-4aac-4dc1-874c-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-4aac-4dc1-874c-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">luxlinbas.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-2198-4e07-b618-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: netcomserviceonline.com (MISP Attribute #18607)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: netcomserviceonline.com (MISP Attribute #18607)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-2198-4e07-b618-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-2198-4e07-b618-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">netcomserviceonline.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-1518-4800-9a25-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mylinbas.com (MISP Attribute #18863)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mylinbas.com (MISP Attribute #18863)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-1518-4800-9a25-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-1518-4800-9a25-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mylinbas.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-525c-4396-ba4d-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: servermappingserviceonline.com (MISP Attribute #18608)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: servermappingserviceonline.com (MISP Attribute #18608)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-525c-4396-ba4d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-525c-4396-ba4d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">servermappingserviceonline.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-4578-4f21-b8e0-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: ruslinbas.com (MISP Attribute #18864)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: ruslinbas.com (MISP Attribute #18864)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-4578-4f21-b8e0-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-4578-4f21-b8e0-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">ruslinbas.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-9900-4bde-bd24-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: onlinenetworkinghelp.com (MISP Attribute #18609)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: onlinenetworkinghelp.com (MISP Attribute #18609)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-9900-4bde-bd24-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-9900-4bde-bd24-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">onlinenetworkinghelp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-90cc-4198-b987-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: sglinbas.com (MISP Attribute #18865)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: sglinbas.com (MISP Attribute #18865)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-90cc-4198-b987-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-90cc-4198-b987-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">sglinbas.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-b18c-4072-87f0-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: loginauths-service.com (MISP Attribute #18610)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: loginauths-service.com (MISP Attribute #18610)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-b18c-4072-87f0-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-b18c-4072-87f0-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">loginauths-service.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-5ebc-4cef-b91d-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: serverfortechies.com (MISP Attribute #18866)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: serverfortechies.com (MISP Attribute #18866)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-5ebc-4cef-b91d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-5ebc-4cef-b91d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">serverfortechies.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-7680-41d3-bc19-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: softnetworksolutions.com (MISP Attribute #18611)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: softnetworksolutions.com (MISP Attribute #18611)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-7680-41d3-bc19-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-7680-41d3-bc19-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">softnetworksolutions.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-748c-44c9-aef9-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: basicservicehk.com (MISP Attribute #18867)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: basicservicehk.com (MISP Attribute #18867)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-748c-44c9-aef9-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-748c-44c9-aef9-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">basicservicehk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-c1d4-4fb9-9ac9-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: ultronnetworksolution.com (MISP Attribute #18612)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: ultronnetworksolution.com (MISP Attribute #18612)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-c1d4-4fb9-9ac9-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-c1d4-4fb9-9ac9-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">ultronnetworksolution.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-82f0-4cf1-aa52-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: basicservicelux.com (MISP Attribute #18868)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: basicservicelux.com (MISP Attribute #18868)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-82f0-4cf1-aa52-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-82f0-4cf1-aa52-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">basicservicelux.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-b778-4722-af3a-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: softredirect.info (MISP Attribute #18613)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: softredirect.info (MISP Attribute #18613)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-b778-4722-af3a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-b778-4722-af3a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">softredirect.info</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-61ac-49a6-8ce9-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: basicservicemy.com (MISP Attribute #18869)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: basicservicemy.com (MISP Attribute #18869)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-61ac-49a6-8ce9-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-61ac-49a6-8ce9-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">basicservicemy.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-28b0-4f26-b8ed-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: extranetserviceonline.com (MISP Attribute #18614)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: extranetserviceonline.com (MISP Attribute #18614)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-28b0-4f26-b8ed-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-28b0-4f26-b8ed-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">extranetserviceonline.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-87e4-4558-a61a-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: basicservicerus.com (MISP Attribute #18870)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: basicservicerus.com (MISP Attribute #18870)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-87e4-4558-a61a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-87e4-4558-a61a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">basicservicerus.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-1eb8-428d-b36b-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: short-ner.com (MISP Attribute #18615)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: short-ner.com (MISP Attribute #18615)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-1eb8-428d-b36b-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-1eb8-428d-b36b-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">short-ner.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-ffc0-44b9-8d8e-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: basicservicesg.com (MISP Attribute #18871)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: basicservicesg.com (MISP Attribute #18871)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-ffc0-44b9-8d8e-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-ffc0-44b9-8d8e-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">basicservicesg.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-2038-46e4-9331-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailserveruk.com (MISP Attribute #18616)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailserveruk.com (MISP Attribute #18616)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-2038-46e4-9331-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-2038-46e4-9331-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailserveruk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-cf40-41d9-90fb-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: serverforhelphk.com (MISP Attribute #18872)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: serverforhelphk.com (MISP Attribute #18872)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-cf40-41d9-90fb-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-cf40-41d9-90fb-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">serverforhelphk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-e8f0-402b-8d49-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mywebredirect.info (MISP Attribute #18617)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mywebredirect.info (MISP Attribute #18617)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-e8f0-402b-8d49-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-e8f0-402b-8d49-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mywebredirect.info</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-85c0-4aa0-9d28-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: serverforhelpru.com (MISP Attribute #18873)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: serverforhelpru.com (MISP Attribute #18873)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-85c0-4aa0-9d28-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-85c0-4aa0-9d28-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">serverforhelpru.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-0118-48e1-8d89-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: srtnr.co (MISP Attribute #18618)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: srtnr.co (MISP Attribute #18618)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-0118-48e1-8d89-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-0118-48e1-8d89-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">srtnr.co</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-f8ac-4b06-b3e2-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: serverforhelpsg.com (MISP Attribute #18874)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: serverforhelpsg.com (MISP Attribute #18874)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-f8ac-4b06-b3e2-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-f8ac-4b06-b3e2-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">serverforhelpsg.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-74cc-423f-a7af-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: cyberanalyticals.com (MISP Attribute #18619)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: cyberanalyticals.com (MISP Attribute #18619)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-74cc-423f-a7af-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-74cc-423f-a7af-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">cyberanalyticals.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-af2c-4075-b385-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: domainforhostuk.com (MISP Attribute #18875)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: domainforhostuk.com (MISP Attribute #18875)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-af2c-4075-b385-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-af2c-4075-b385-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">domainforhostuk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-c230-41f6-9a49-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mail-logger.com (MISP Attribute #18620)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mail-logger.com (MISP Attribute #18620)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-c230-41f6-9a49-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-c230-41f6-9a49-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mail-logger.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-6098-4415-bf1e-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: transferdomainhk.com (MISP Attribute #18876)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: transferdomainhk.com (MISP Attribute #18876)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-6098-4415-bf1e-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-6098-4415-bf1e-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">transferdomainhk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-dabc-4879-9bd0-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailer-domain.com (MISP Attribute #18621)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailer-domain.com (MISP Attribute #18621)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-dabc-4879-9bd0-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-dabc-4879-9bd0-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailer-domain.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-7154-4e65-8649-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: transferdomainlu.com (MISP Attribute #18877)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: transferdomainlu.com (MISP Attribute #18877)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-7154-4e65-8649-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-7154-4e65-8649-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">transferdomainlu.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-4744-4707-8722-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: servermailing34.com (MISP Attribute #18622)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: servermailing34.com (MISP Attribute #18622)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-4744-4707-8722-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-4744-4707-8722-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">servermailing34.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-fc78-4632-bc67-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: transferdomainmy.com (MISP Attribute #18878)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: transferdomainmy.com (MISP Attribute #18878)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-fc78-4632-bc67-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-fc78-4632-bc67-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">transferdomainmy.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-3f64-4f6e-849d-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: nodeserver50.com (MISP Attribute #18623)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: nodeserver50.com (MISP Attribute #18623)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-3f64-4f6e-849d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-3f64-4f6e-849d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">nodeserver50.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-abfc-4f30-a75e-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: shoponlinefreesg.com (MISP Attribute #18879)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: shoponlinefreesg.com (MISP Attribute #18879)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-abfc-4f30-a75e-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-abfc-4f30-a75e-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">shoponlinefreesg.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-f87c-402a-9b1a-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: rackserver39.com (MISP Attribute #18624)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: rackserver39.com (MISP Attribute #18624)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-f87c-402a-9b1a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-f87c-402a-9b1a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">rackserver39.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-56c4-4a2a-8774-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: shoponlinefreeuk.com (MISP Attribute #18880)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: shoponlinefreeuk.com (MISP Attribute #18880)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-56c4-4a2a-8774-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-56c4-4a2a-8774-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">shoponlinefreeuk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-6b68-4e98-ac7d-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailerdomain56.com (MISP Attribute #18625)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailerdomain56.com (MISP Attribute #18625)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-6b68-4e98-ac7d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-6b68-4e98-ac7d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailerdomain56.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-5cf4-43bc-9d02-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: shrinkandshareurl.com (MISP Attribute #18881)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: shrinkandshareurl.com (MISP Attribute #18881)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-5cf4-43bc-9d02-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-5cf4-43bc-9d02-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">shrinkandshareurl.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-c258-4537-9381-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: loginserviceunified.com (MISP Attribute #18626)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: loginserviceunified.com (MISP Attribute #18626)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-c258-4537-9381-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-c258-4537-9381-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">loginserviceunified.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-4c7c-4ff7-84df-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: strngbltru.com (MISP Attribute #18882)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: strngbltru.com (MISP Attribute #18882)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-4c7c-4ff7-84df-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-4c7c-4ff7-84df-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">strngbltru.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-1f64-4635-a8e9-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: comservicelogin.com (MISP Attribute #18627)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: comservicelogin.com (MISP Attribute #18627)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-1f64-4635-a8e9-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-1f64-4635-a8e9-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">comservicelogin.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-863c-4ea3-bc83-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: optionalblogginges.com (MISP Attribute #18883)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: optionalblogginges.com (MISP Attribute #18883)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-863c-4ea3-bc83-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-863c-4ea3-bc83-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">optionalblogginges.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-ec28-413e-ac2c-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: 4mblk.com (MISP Attribute #18628)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: 4mblk.com (MISP Attribute #18628)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-ec28-413e-ac2c-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-ec28-413e-ac2c-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">4mblk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-dc1c-4a27-9d22-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: optionalbloggingeu.com (MISP Attribute #18884)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: optionalbloggingeu.com (MISP Attribute #18884)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-dc1c-4a27-9d22-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-dc1c-4a27-9d22-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">optionalbloggingeu.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-0644-4281-87ba-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: corn-en-us.com (MISP Attribute #18629)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: corn-en-us.com (MISP Attribute #18629)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-0644-4281-87ba-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-0644-4281-87ba-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">corn-en-us.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-5f4c-49d8-b403-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: optionalblogginguk.com (MISP Attribute #18885)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: optionalblogginguk.com (MISP Attribute #18885)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-5f4c-49d8-b403-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-5f4c-49d8-b403-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">optionalblogginguk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-5f68-40d7-83ee-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: corn-en-gb.com (MISP Attribute #18630)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: corn-en-gb.com (MISP Attribute #18630)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-5f68-40d7-83ee-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-5f68-40d7-83ee-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">corn-en-gb.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-40c4-4a93-96e4-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: shrinkthisurl.com (MISP Attribute #18886)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: shrinkthisurl.com (MISP Attribute #18886)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-40c4-4a93-96e4-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-40c4-4a93-96e4-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">shrinkthisurl.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-1fac-46a2-9be7-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: corn-lang-eng.com (MISP Attribute #18631)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: corn-lang-eng.com (MISP Attribute #18631)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-1fac-46a2-9be7-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-1fac-46a2-9be7-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">corn-lang-eng.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-4690-4211-b94f-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: updatenameserver45.com (MISP Attribute #18887)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: updatenameserver45.com (MISP Attribute #18887)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-4690-4211-b94f-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-4690-4211-b94f-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">updatenameserver45.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-0ac4-408b-b5e4-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: corn-loginservicesverified.com (MISP Attribute #18632)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: corn-loginservicesverified.com (MISP Attribute #18632)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-0ac4-408b-b5e4-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-0ac4-408b-b5e4-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">corn-loginservicesverified.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-b444-4749-83d7-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: rulinuxbasic.com (MISP Attribute #18888)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: rulinuxbasic.com (MISP Attribute #18888)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-b444-4749-83d7-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-b444-4749-83d7-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">rulinuxbasic.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-563c-4c15-ba60-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: corn-msrvrgr.com (MISP Attribute #18633)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: corn-msrvrgr.com (MISP Attribute #18633)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-563c-4c15-ba60-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-563c-4c15-ba60-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">corn-msrvrgr.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-8810-46a1-b086-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: russialinuxbasic.com (MISP Attribute #18889)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: russialinuxbasic.com (MISP Attribute #18889)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-8810-46a1-b086-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-8810-46a1-b086-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">russialinuxbasic.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-4eb0-4f7b-acd7-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: corn-servicelogin.com (MISP Attribute #18634)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: corn-servicelogin.com (MISP Attribute #18634)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-4eb0-4f7b-acd7-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-4eb0-4f7b-acd7-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">corn-servicelogin.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-5fa0-4bc1-82c4-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: domainsforfreehosting.com (MISP Attribute #18890)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: domainsforfreehosting.com (MISP Attribute #18890)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-5fa0-4bc1-82c4-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-5fa0-4bc1-82c4-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">domainsforfreehosting.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-8ed4-4367-9b88-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: corn-ukr.com (MISP Attribute #18635)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: corn-ukr.com (MISP Attribute #18635)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-8ed4-4367-9b88-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-8ed4-4367-9b88-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">corn-ukr.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-3794-4593-8994-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: domainsforsupport.com (MISP Attribute #18891)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: domainsforsupport.com (MISP Attribute #18891)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-3794-4593-8994-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-3794-4593-8994-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">domainsforsupport.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-8ec4-4b0a-9792-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: corn-fr-fr.com (MISP Attribute #18636)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: corn-fr-fr.com (MISP Attribute #18636)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-8ec4-4b0a-9792-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-8ec4-4b0a-9792-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">corn-fr-fr.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-ddec-496d-90fa-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: domainsfortechhelp.com (MISP Attribute #18892)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: domainsfortechhelp.com (MISP Attribute #18892)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-ddec-496d-90fa-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-ddec-496d-90fa-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">domainsfortechhelp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-0e30-4512-be41-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailserver89.org (MISP Attribute #18637)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailserver89.org (MISP Attribute #18637)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-0e30-4512-be41-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-0e30-4512-be41-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailserver89.org</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-e2cc-4736-9799-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: linuxbasichk.com (MISP Attribute #18893)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: linuxbasichk.com (MISP Attribute #18893)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-e2cc-4736-9799-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-e2cc-4736-9799-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">linuxbasichk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-b704-4f9a-bac6-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailserver89.net (MISP Attribute #18638)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailserver89.net (MISP Attribute #18638)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-b704-4f9a-bac6-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-b704-4f9a-bac6-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailserver89.net</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-d5b4-4852-907d-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: linuxbasichk1.com (MISP Attribute #18894)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: linuxbasichk1.com (MISP Attribute #18894)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-d5b4-4852-907d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-d5b4-4852-907d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">linuxbasichk1.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-15c4-4f56-9c76-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: srtnr.com (MISP Attribute #18639)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: srtnr.com (MISP Attribute #18639)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-15c4-4f56-9c76-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-15c4-4f56-9c76-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">srtnr.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-e070-47f5-9941-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: linuxbasicmy.com (MISP Attribute #18895)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: linuxbasicmy.com (MISP Attribute #18895)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-e070-47f5-9941-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-e070-47f5-9941-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">linuxbasicmy.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-40d0-4407-8e21-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailserver89.com (MISP Attribute #18640)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailserver89.com (MISP Attribute #18640)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-40d0-4407-8e21-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-40d0-4407-8e21-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailserver89.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-3690-4c15-99b4-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: linuxbasicru.com (MISP Attribute #18896)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: linuxbasicru.com (MISP Attribute #18896)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-3690-4c15-99b4-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-3690-4c15-99b4-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">linuxbasicru.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-50e0-4cc7-8527-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailserveruk89.org (MISP Attribute #18641)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailserveruk89.org (MISP Attribute #18641)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-50e0-4cc7-8527-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-50e0-4cc7-8527-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailserveruk89.org</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-fe1c-4b88-a1f1-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: linuxbasicru1.com (MISP Attribute #18897)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: linuxbasicru1.com (MISP Attribute #18897)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-fe1c-4b88-a1f1-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-fe1c-4b88-a1f1-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">linuxbasicru1.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-d2a4-4362-80d4-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailserveruk89.net (MISP Attribute #18642)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailserveruk89.net (MISP Attribute #18642)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-d2a4-4362-80d4-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-d2a4-4362-80d4-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailserveruk89.net</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-efd8-4e35-b441-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: linuxbasicsg.com (MISP Attribute #18898)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: linuxbasicsg.com (MISP Attribute #18898)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-efd8-4e35-b441-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-efd8-4e35-b441-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">linuxbasicsg.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-0968-4995-8b4b-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: 2mblk.com (MISP Attribute #18643)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: 2mblk.com (MISP Attribute #18643)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-0968-4995-8b4b-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-0968-4995-8b4b-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">2mblk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-226c-4b68-9093-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: linuxbasicsg1.com (MISP Attribute #18899)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: linuxbasicsg1.com (MISP Attribute #18899)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-226c-4b68-9093-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-226c-4b68-9093-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">linuxbasicsg1.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-ddd8-474a-bf5e-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailserveruk89.com (MISP Attribute #18644)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailserveruk89.com (MISP Attribute #18644)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-ddd8-474a-bf5e-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-ddd8-474a-bf5e-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailserveruk89.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-ce3c-4b3d-a1cf-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hostingserviceclean.com (MISP Attribute #18900)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hostingserviceclean.com (MISP Attribute #18900)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-ce3c-4b3d-a1cf-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-ce3c-4b3d-a1cf-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hostingserviceclean.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-7b58-47aa-9a92-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mblk1.com (MISP Attribute #18645)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mblk1.com (MISP Attribute #18645)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-7b58-47aa-9a92-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-7b58-47aa-9a92-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mblk1.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-d230-4215-839c-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hostingserviceforall.com (MISP Attribute #18901)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hostingserviceforall.com (MISP Attribute #18901)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-d230-4215-839c-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-d230-4215-839c-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hostingserviceforall.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-f934-4a99-9c8f-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: un-told.net (MISP Attribute #18646)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: un-told.net (MISP Attribute #18646)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-f934-4a99-9c8f-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-f934-4a99-9c8f-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">un-told.net</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-bd48-4ac8-8a01-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hostingservicesloyal.com (MISP Attribute #18902)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hostingservicesloyal.com (MISP Attribute #18902)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-bd48-4ac8-8a01-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-bd48-4ac8-8a01-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hostingservicesloyal.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-d980-4714-a8f9-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: com-website33.net (MISP Attribute #18647)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: com-website33.net (MISP Attribute #18647)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-d980-4714-a8f9-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-d980-4714-a8f9-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">com-website33.net</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-b0f8-471a-a175-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hostingservicesukit.com (MISP Attribute #18903)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hostingservicesukit.com (MISP Attribute #18903)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-b0f8-471a-a175-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-b0f8-471a-a175-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hostingservicesukit.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-8e70-479d-9aab-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: com-website33.biz (MISP Attribute #18648)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: com-website33.biz (MISP Attribute #18648)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-8e70-479d-9aab-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-8e70-479d-9aab-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">com-website33.biz</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-a7c8-492e-b0cc-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: xpertmaildomain.com (MISP Attribute #18904)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: xpertmaildomain.com (MISP Attribute #18904)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-a7c8-492e-b0cc-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-a7c8-492e-b0cc-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">xpertmaildomain.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-3bf4-44f6-b012-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: com-website33.com (MISP Attribute #18649)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: com-website33.com (MISP Attribute #18649)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-3bf4-44f6-b012-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-3bf4-44f6-b012-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">com-website33.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-3584-4b12-925f-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: standardofficeholland.com (MISP Attribute #18905)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: standardofficeholland.com (MISP Attribute #18905)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-3584-4b12-925f-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-3584-4b12-925f-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">standardofficeholland.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-b64c-41fd-8fed-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: com-website33.info (MISP Attribute #18650)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: com-website33.info (MISP Attribute #18650)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-b64c-41fd-8fed-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-b64c-41fd-8fed-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">com-website33.info</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-91e4-441f-8e18-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: standardofficeil.com (MISP Attribute #18906)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: standardofficeil.com (MISP Attribute #18906)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-91e4-441f-8e18-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-91e4-441f-8e18-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">standardofficeil.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-00d8-4bb1-a02e-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: com-website33.org (MISP Attribute #18651)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: com-website33.org (MISP Attribute #18651)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-00d8-4bb1-a02e-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-00d8-4bb1-a02e-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">com-website33.org</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-56b4-4798-85da-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: standardofficeuk.com (MISP Attribute #18907)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: standardofficeuk.com (MISP Attribute #18907)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-56b4-4798-85da-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-56b4-4798-85da-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">standardofficeuk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-dae4-45a9-9694-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: browserextensions.info (MISP Attribute #18652)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: browserextensions.info (MISP Attribute #18652)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-dae4-45a9-9694-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-dae4-45a9-9694-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">browserextensions.info</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-1fd0-4c51-aaa5-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: postserverem.com (MISP Attribute #18908)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: postserverem.com (MISP Attribute #18908)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-1fd0-4c51-aaa5-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-1fd0-4c51-aaa5-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">postserverem.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-31a0-49cb-b011-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: allaboutiot.website (MISP Attribute #18653)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: allaboutiot.website (MISP Attribute #18653)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-31a0-49cb-b011-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-31a0-49cb-b011-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">allaboutiot.website</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-c498-4a47-ac99-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: serverformailings.com (MISP Attribute #18909)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: serverformailings.com (MISP Attribute #18909)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-c498-4a47-ac99-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-c498-4a47-ac99-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">serverformailings.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-2b90-4d94-aa1a-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: domainserver322.com (MISP Attribute #18654)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: domainserver322.com (MISP Attribute #18654)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-2b90-4d94-aa1a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-2b90-4d94-aa1a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">domainserver322.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-acf4-4960-87bf-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: serverfornetworks.com (MISP Attribute #18910)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: serverfornetworks.com (MISP Attribute #18910)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-acf4-4960-87bf-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-acf4-4960-87bf-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">serverfornetworks.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-fb80-49d4-912d-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: searchsimple.info (MISP Attribute #18655)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: searchsimple.info (MISP Attribute #18655)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-fb80-49d4-912d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-fb80-49d4-912d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">searchsimple.info</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-c358-49be-aa68-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: serverforzapper.com (MISP Attribute #18911)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: serverforzapper.com (MISP Attribute #18911)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-c358-49be-aa68-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-c358-49be-aa68-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">serverforzapper.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-014c-453e-b000-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: ecom-servicelogin.com (MISP Attribute #18656)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: ecom-servicelogin.com (MISP Attribute #18656)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-014c-453e-b000-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-014c-453e-b000-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">ecom-servicelogin.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-d710-4c41-89a9-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: serviceforneworder.com (MISP Attribute #18912)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: serviceforneworder.com (MISP Attribute #18912)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-d710-4c41-89a9-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-d710-4c41-89a9-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">serviceforneworder.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-affc-4a69-ba79-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: searchsimple.net (MISP Attribute #18657)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: searchsimple.net (MISP Attribute #18657)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-affc-4a69-ba79-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-affc-4a69-ba79-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">searchsimple.net</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-5cec-4d36-9d48-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: loginservicehelp.com (MISP Attribute #18913)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: loginservicehelp.com (MISP Attribute #18913)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-5cec-4d36-9d48-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-5cec-4d36-9d48-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">loginservicehelp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-72fc-4068-b954-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: sapserverhipe.com (MISP Attribute #18658)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: sapserverhipe.com (MISP Attribute #18658)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-72fc-4068-b954-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-72fc-4068-b954-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">sapserverhipe.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-829c-454d-bd75-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: shortenurlservices.com (MISP Attribute #18914)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: shortenurlservices.com (MISP Attribute #18914)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-829c-454d-bd75-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-829c-454d-bd75-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">shortenurlservices.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-1bd0-42d0-bdd1-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: webserver91.website (MISP Attribute #18659)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: webserver91.website (MISP Attribute #18659)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-1bd0-42d0-bdd1-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-1bd0-42d0-bdd1-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">webserver91.website</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-5f40-4848-a111-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hostusewithtech.com (MISP Attribute #18915)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hostusewithtech.com (MISP Attribute #18915)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-5f40-4848-a111-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-5f40-4848-a111-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hostusewithtech.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-e18c-467e-a40b-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: phpwebserver34.site (MISP Attribute #18660)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: phpwebserver34.site (MISP Attribute #18660)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-e18c-467e-a40b-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-e18c-467e-a40b-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">phpwebserver34.site</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-fdb8-4975-9ea4-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: linuxhostingplatformuk.com (MISP Attribute #18916)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: linuxhostingplatformuk.com (MISP Attribute #18916)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-fdb8-4975-9ea4-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-fdb8-4975-9ea4-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">linuxhostingplatformuk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-1e90-4e26-9a90-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: phpwebserver34.tech (MISP Attribute #18661)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: phpwebserver34.tech (MISP Attribute #18661)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-1e90-4e26-9a90-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-1e90-4e26-9a90-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">phpwebserver34.tech</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-5cf0-4e14-9200-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: youranotherserver.com (MISP Attribute #18917)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: youranotherserver.com (MISP Attribute #18917)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-5cf0-4e14-9200-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-5cf0-4e14-9200-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">youranotherserver.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-7cc8-4a6d-ac95-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: phpwebserver34.xyz (MISP Attribute #18662)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: phpwebserver34.xyz (MISP Attribute #18662)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-7cc8-4a6d-ac95-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-7cc8-4a6d-ac95-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">phpwebserver34.xyz</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-b544-44bd-a17a-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: serverforhiretech.com (MISP Attribute #18918)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: serverforhiretech.com (MISP Attribute #18918)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-b544-44bd-a17a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-b544-44bd-a17a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">serverforhiretech.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-d034-4204-95bd-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: phpwebserver34.best (MISP Attribute #18663)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: phpwebserver34.best (MISP Attribute #18663)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-d034-4204-95bd-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-d034-4204-95bd-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">phpwebserver34.best</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-b574-4200-beaa-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: serverfortechhelp.com (MISP Attribute #18919)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: serverfortechhelp.com (MISP Attribute #18919)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-b574-4200-beaa-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-b574-4200-beaa-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">serverfortechhelp.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-eccc-432c-9ad7-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: myfacetik.cf (MISP Attribute #18664)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: myfacetik.cf (MISP Attribute #18664)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-eccc-432c-9ad7-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-eccc-432c-9ad7-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">myfacetik.cf</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-90ec-4a51-9cb1-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: blogforpranks.com (MISP Attribute #18920)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: blogforpranks.com (MISP Attribute #18920)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-90ec-4a51-9cb1-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-90ec-4a51-9cb1-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">blogforpranks.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-dcdc-4da8-a2f7-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: goomail.ml (MISP Attribute #18665)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: goomail.ml (MISP Attribute #18665)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-dcdc-4da8-a2f7-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-dcdc-4da8-a2f7-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">goomail.ml</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-4078-4c94-97f9-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: planyourexoticvacation.com (MISP Attribute #18921)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: planyourexoticvacation.com (MISP Attribute #18921)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-4078-4c94-97f9-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-4078-4c94-97f9-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">planyourexoticvacation.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-af7c-4f6b-9404-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: websociofiles.com (MISP Attribute #18666)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: websociofiles.com (MISP Attribute #18666)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-af7c-4f6b-9404-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-af7c-4f6b-9404-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">websociofiles.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-3108-4ce1-b76a-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: usewithcareathome.com (MISP Attribute #18922)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: usewithcareathome.com (MISP Attribute #18922)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-3108-4ce1-b76a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-3108-4ce1-b76a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">usewithcareathome.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-0c88-45e2-8ab3-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: domainmanager33.website (MISP Attribute #18667)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: domainmanager33.website (MISP Attribute #18667)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-0c88-45e2-8ab3-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-0c88-45e2-8ab3-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">domainmanager33.website</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-51d4-4035-8752-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: serverforhome.com (MISP Attribute #18923)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: serverforhome.com (MISP Attribute #18923)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-51d4-4035-8752-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-51d4-4035-8752-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">serverforhome.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-515c-4ed2-b281-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: domainmanager33.com (MISP Attribute #18668)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: domainmanager33.com (MISP Attribute #18668)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-515c-4ed2-b281-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-515c-4ed2-b281-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">domainmanager33.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-f100-4344-9990-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: optionsothego.com (MISP Attribute #18924)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: optionsothego.com (MISP Attribute #18924)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-f100-4344-9990-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-f100-4344-9990-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">optionsothego.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-6b38-4858-9427-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: domainmanager33.site (MISP Attribute #18669)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: domainmanager33.site (MISP Attribute #18669)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-6b38-4858-9427-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-6b38-4858-9427-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">domainmanager33.site</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-1584-4172-9242-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: anitmationworldnews.com (MISP Attribute #18925)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: anitmationworldnews.com (MISP Attribute #18925)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-1584-4172-9242-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-1584-4172-9242-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">anitmationworldnews.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-0a08-4a29-a4a3-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailtickr.com (MISP Attribute #18670)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailtickr.com (MISP Attribute #18670)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-0a08-4a29-a4a3-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-0a08-4a29-a4a3-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailtickr.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-8c64-4036-b55a-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: servicegoingfar.com (MISP Attribute #18926)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: servicegoingfar.com (MISP Attribute #18926)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-8c64-4036-b55a-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-8c64-4036-b55a-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">servicegoingfar.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-376c-4b9f-92c5-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: servergateway56.com (MISP Attribute #18671)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: servergateway56.com (MISP Attribute #18671)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-376c-4b9f-92c5-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-376c-4b9f-92c5-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">servergateway56.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-8b3c-4a51-bc70-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: trusteventservices.com (MISP Attribute #18927)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: trusteventservices.com (MISP Attribute #18927)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-8b3c-4a51-bc70-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-8b3c-4a51-bc70-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">trusteventservices.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-dac8-48f3-b108-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: servergateway33.com (MISP Attribute #18672)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: servergateway33.com (MISP Attribute #18672)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-dac8-48f3-b108-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-dac8-48f3-b108-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">servergateway33.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-ac3c-4cd0-852e-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: belowmargins.com (MISP Attribute #18928)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: belowmargins.com (MISP Attribute #18928)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-ac3c-4cd0-852e-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-ac3c-4cd0-852e-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">belowmargins.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-d2e0-4497-ba46-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: msrfrgr.com (MISP Attribute #18673)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: msrfrgr.com (MISP Attribute #18673)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-d2e0-4497-ba46-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-d2e0-4497-ba46-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">msrfrgr.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-3b88-4b23-9f2f-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: hostserverrus.com (MISP Attribute #18929)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: hostserverrus.com (MISP Attribute #18929)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-3b88-4b23-9f2f-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-3b88-4b23-9f2f-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">hostserverrus.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-6918-4c89-bc38-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: pageserverru.com (MISP Attribute #18674)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: pageserverru.com (MISP Attribute #18674)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-6918-4c89-bc38-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-6918-4c89-bc38-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">pageserverru.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-1390-41f2-9eef-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: registrationonlineeurope.com (MISP Attribute #18930)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: registrationonlineeurope.com (MISP Attribute #18930)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-1390-41f2-9eef-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-1390-41f2-9eef-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">registrationonlineeurope.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-a360-40c5-bf27-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: serverhello54.com (MISP Attribute #18675)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: serverhello54.com (MISP Attribute #18675)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-a360-40c5-bf27-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-a360-40c5-bf27-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">serverhello54.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-7d38-4846-9698-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: tineeurl.com (MISP Attribute #18931)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: tineeurl.com (MISP Attribute #18931)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-7d38-4846-9698-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-7d38-4846-9698-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">tineeurl.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-a4a0-4395-876d-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: smtpserver466.com (MISP Attribute #18676)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: smtpserver466.com (MISP Attribute #18676)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-a4a0-4395-876d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-a4a0-4395-876d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">smtpserver466.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-3010-4cee-95ae-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: secureserverasia.com (MISP Attribute #18932)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: secureserverasia.com (MISP Attribute #18932)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-3010-4cee-95ae-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-3010-4cee-95ae-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">secureserverasia.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-d330-4e5c-a1e1-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: webserver39.com (MISP Attribute #18677)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: webserver39.com (MISP Attribute #18677)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-d330-4e5c-a1e1-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-d330-4e5c-a1e1-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">webserver39.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-eaf8-406b-ac11-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: secureservereurope.com (MISP Attribute #18933)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: secureservereurope.com (MISP Attribute #18933)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-eaf8-406b-ac11-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-eaf8-406b-ac11-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">secureservereurope.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-91e4-4488-bb36-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: linksrtnr.com (MISP Attribute #18678)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: linksrtnr.com (MISP Attribute #18678)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-91e4-4488-bb36-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-91e4-4488-bb36-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">linksrtnr.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-806c-42c6-b2f9-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: serverasiasap.com (MISP Attribute #18934)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: serverasiasap.com (MISP Attribute #18934)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-806c-42c6-b2f9-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-806c-42c6-b2f9-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">serverasiasap.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-e7e8-4cc0-ba44-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: netmapservice.com (MISP Attribute #18679)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: netmapservice.com (MISP Attribute #18679)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-e7e8-4cc0-ba44-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-e7e8-4cc0-ba44-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">netmapservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-ae2c-4309-a967-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: mailservereurope.com (MISP Attribute #18935)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: mailservereurope.com (MISP Attribute #18935)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-ae2c-4309-a967-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-ae2c-4309-a967-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">mailservereurope.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-7358-473b-9cfd-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: imapserverholland.com (MISP Attribute #18680)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: imapserverholland.com (MISP Attribute #18680)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-7358-473b-9cfd-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-7358-473b-9cfd-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">imapserverholland.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-1900-4c7a-9a95-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: serverloadbalance.com (MISP Attribute #18936)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: serverloadbalance.com (MISP Attribute #18936)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-1900-4c7a-9a95-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-1900-4c7a-9a95-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">serverloadbalance.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-b358-4799-b811-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: webserveronline9.com (MISP Attribute #18681)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: webserveronline9.com (MISP Attribute #18681)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-b358-4799-b811-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-b358-4799-b811-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">webserveronline9.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-3c58-49a5-91d9-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: frwrdrwr.com (MISP Attribute #18937)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: frwrdrwr.com (MISP Attribute #18937)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-3c58-49a5-91d9-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-3c58-49a5-91d9-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">frwrdrwr.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-63fc-491f-b39b-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: getemailopens.com (MISP Attribute #18682)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: getemailopens.com (MISP Attribute #18682)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-63fc-491f-b39b-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-63fc-491f-b39b-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">getemailopens.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-6b04-446d-83a0-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: localserversa.com (MISP Attribute #18938)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: localserversa.com (MISP Attribute #18938)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-6b04-446d-83a0-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-6b04-446d-83a0-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">localserversa.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-3a84-4dc8-9919-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: msrvrgeh.com (MISP Attribute #18683)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: msrvrgeh.com (MISP Attribute #18683)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-3a84-4dc8-9919-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-3a84-4dc8-9919-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">msrvrgeh.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-d060-40eb-9e73-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: serverdemoservice.com (MISP Attribute #18939)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: serverdemoservice.com (MISP Attribute #18939)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-d060-40eb-9e73-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-d060-40eb-9e73-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">serverdemoservice.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-0d88-4db6-8d5d-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: msrvrgh.com (MISP Attribute #18684)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: msrvrgh.com (MISP Attribute #18684)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-0d88-4db6-8d5d-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-0d88-4db6-8d5d-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">msrvrgh.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-dab8-4408-8afd-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: fastserverasia.com (MISP Attribute #18940)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: fastserverasia.com (MISP Attribute #18940)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-dab8-4408-8afd-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-dab8-4408-8afd-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">fastserverasia.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-caac-4790-9459-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: emailserverholland.com (MISP Attribute #18685)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: emailserverholland.com (MISP Attribute #18685)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-caac-4790-9459-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-caac-4790-9459-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">emailserverholland.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-844c-45a5-8ab8-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: fastservereurope.com (MISP Attribute #18941)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: fastservereurope.com (MISP Attribute #18941)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-844c-45a5-8ab8-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-844c-45a5-8ab8-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">fastservereurope.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-f210-4037-8741-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: emailserverhk48.com (MISP Attribute #18686)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: emailserverhk48.com (MISP Attribute #18686)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-f210-4037-8741-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-f210-4037-8741-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">emailserverhk48.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-d620-4c77-b6c0-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: fastserveruk.com (MISP Attribute #18942)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: fastserveruk.com (MISP Attribute #18942)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-d620-4c77-b6c0-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-d620-4c77-b6c0-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">fastserveruk.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974a-8504-4659-bfd7-7a498064ab0b" timestamp="2020-06-08T15:53:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: webserverredirect99.com (MISP Attribute #18687)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: webserverredirect99.com (MISP Attribute #18687)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974a-8504-4659-bfd7-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974a-8504-4659-bfd7-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">webserverredirect99.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede974b-3028-4600-82af-7a498064ab0b" timestamp="2020-06-08T15:53:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: fastserverusa.com (MISP Attribute #18943)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: fastserverusa.com (MISP Attribute #18943)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede974b-3028-4600-82af-7a498064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5ede974b-3028-4600-82af-7a498064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">fastserverusa.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:53:47+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede97f5-4efc-4e42-afa5-7e298064ab0b" timestamp="2020-06-08T15:56:37+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: n0replyupdatesnotificationskj9@gmail.com (MISP Attribute #19039)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: n0replyupdatesnotificationskj9@gmail.com (MISP Attribute #19039)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede97f5-4efc-4e42-afa5-7e298064ab0b">
|
||
|
|
<cybox:Object id=":EmailMessage-5ede97f5-4efc-4e42-afa5-7e298064ab0b">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">n0replyupdatesnotificationskj9@gmail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:56:37+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede97f5-6950-4509-9af0-7e298064ab0b" timestamp="2020-06-08T15:56:37+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: n0replyn0tificati0nupdatemail@gmail.com (MISP Attribute #19040)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: n0replyn0tificati0nupdatemail@gmail.com (MISP Attribute #19040)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede97f5-6950-4509-9af0-7e298064ab0b">
|
||
|
|
<cybox:Object id=":EmailMessage-5ede97f5-6950-4509-9af0-7e298064ab0b">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">n0replyn0tificati0nupdatemail@gmail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:56:37+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede97f5-89ec-4587-a2d4-7e298064ab0b" timestamp="2020-06-08T15:56:37+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: n0reply.notificationexsasuve@gmail.com (MISP Attribute #19041)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: n0reply.notificationexsasuve@gmail.com (MISP Attribute #19041)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede97f5-89ec-4587-a2d4-7e298064ab0b">
|
||
|
|
<cybox:Object id=":EmailMessage-5ede97f5-89ec-4587-a2d4-7e298064ab0b">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">n0reply.notificationexsasuve@gmail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:56:37+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede97f5-e864-4084-a3bb-7e298064ab0b" timestamp="2020-06-08T15:56:37+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: noreply.535466586you6585tubadh@gmail.com (MISP Attribute #19042)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: noreply.535466586you6585tubadh@gmail.com (MISP Attribute #19042)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede97f5-e864-4084-a3bb-7e298064ab0b">
|
||
|
|
<cybox:Object id=":EmailMessage-5ede97f5-e864-4084-a3bb-7e298064ab0b">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">noreply.535466586you6585tubadh@gmail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:56:37+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede97f5-409c-44b3-8207-7e298064ab0b" timestamp="2020-06-08T15:56:37+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: no.reply.n0tification.alsdkch@gmail.com (MISP Attribute #19043)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: no.reply.n0tification.alsdkch@gmail.com (MISP Attribute #19043)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede97f5-409c-44b3-8207-7e298064ab0b">
|
||
|
|
<cybox:Object id=":EmailMessage-5ede97f5-409c-44b3-8207-7e298064ab0b">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">no.reply.n0tification.alsdkch@gmail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:56:37+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede97f5-2e0c-42e1-9cdb-7e298064ab0b" timestamp="2020-06-08T15:56:37+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: noreply.notifications.gkejkdgj@gmail.com (MISP Attribute #19044)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: noreply.notifications.gkejkdgj@gmail.com (MISP Attribute #19044)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede97f5-2e0c-42e1-9cdb-7e298064ab0b">
|
||
|
|
<cybox:Object id=":EmailMessage-5ede97f5-2e0c-42e1-9cdb-7e298064ab0b">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">noreply.notifications.gkejkdgj@gmail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:56:37+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede97f5-81f8-4221-8637-7e298064ab0b" timestamp="2020-06-08T15:56:37+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: noreplynotification.updates@gmail.com (MISP Attribute #19045)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: noreplynotification.updates@gmail.com (MISP Attribute #19045)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede97f5-81f8-4221-8637-7e298064ab0b">
|
||
|
|
<cybox:Object id=":EmailMessage-5ede97f5-81f8-4221-8637-7e298064ab0b">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">noreplynotification.updates@gmail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:56:37+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede97f5-9808-43ba-8d46-7e298064ab0b" timestamp="2020-06-08T15:56:37+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: no.reply.updates.asdfaffgh78jg@gmail.com (MISP Attribute #19046)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: no.reply.updates.asdfaffgh78jg@gmail.com (MISP Attribute #19046)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede97f5-9808-43ba-8d46-7e298064ab0b">
|
||
|
|
<cybox:Object id=":EmailMessage-5ede97f5-9808-43ba-8d46-7e298064ab0b">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">no.reply.updates.asdfaffgh78jg@gmail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:56:37+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede97f5-3820-4868-ad30-7e298064ab0b" timestamp="2020-06-08T15:56:37+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: scorpiobond4@gmail.com (MISP Attribute #19047)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: scorpiobond4@gmail.com (MISP Attribute #19047)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede97f5-3820-4868-ad30-7e298064ab0b">
|
||
|
|
<cybox:Object id=":EmailMessage-5ede97f5-3820-4868-ad30-7e298064ab0b">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">scorpiobond4@gmail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:56:37+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede97f5-681c-4f01-9706-7e298064ab0b" timestamp="2020-06-08T15:56:37+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: sophia.1johnson@mail.com (MISP Attribute #19048)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: sophia.1johnson@mail.com (MISP Attribute #19048)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede97f5-681c-4f01-9706-7e298064ab0b">
|
||
|
|
<cybox:Object id=":EmailMessage-5ede97f5-681c-4f01-9706-7e298064ab0b">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">sophia.1johnson@mail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:56:37+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5ede97f5-1448-4d36-a35e-7e298064ab0b" timestamp="2020-06-08T15:56:37+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Payload delivery: noreply.mailingservice.3kdj9e9@gmail.com (MISP Attribute #19049)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
|
|
<indicator:Description>Payload delivery: noreply.mailingservice.3kdj9e9@gmail.com (MISP Attribute #19049)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5ede97f5-1448-4d36-a35e-7e298064ab0b">
|
||
|
|
<cybox:Object id=":EmailMessage-5ede97f5-1448-4d36-a35e-7e298064ab0b">
|
||
|
|
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
|
|
<EmailMessageObj:Header>
|
||
|
|
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
|
|
<AddressObj:Address_Value condition="Equals">noreply.mailingservice.3kdj9e9@gmail.com</AddressObj:Address_Value>
|
||
|
|
</EmailMessageObj:From>
|
||
|
|
</EmailMessageObj:Header>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2020-06-08T15:56:37+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
</incident:Related_Indicators>
|
||
|
|
<incident:History>
|
||
|
|
<incident:History_Item>
|
||
|
|
<incident:Journal_Entry time_precision="second">Event Threat Level: High</incident:Journal_Entry>
|
||
|
|
</incident:History_Item>
|
||
|
|
<incident:History_Item>
|
||
|
|
<incident:Journal_Entry time_precision="second">MISP Tag: SOURCE:CITIZENLAB</incident:Journal_Entry>
|
||
|
|
</incident:History_Item>
|
||
|
|
<incident:History_Item>
|
||
|
|
<incident:Journal_Entry time_precision="second">MISP Tag: DETECT</incident:Journal_Entry>
|
||
|
|
</incident:History_Item>
|
||
|
|
</incident:History>
|
||
|
|
<incident:Information_Source>
|
||
|
|
<stixCommon:Identity>
|
||
|
|
<stixCommon:Name>citizenlab</stixCommon:Name>
|
||
|
|
</stixCommon:Identity>
|
||
|
|
</incident:Information_Source>
|
||
|
|
<incident:Handling>
|
||
|
|
<marking:Marking>
|
||
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
|
|
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="GREEN"/>
|
||
|
|
</marking:Marking>
|
||
|
|
</incident:Handling>
|
||
|
|
</stix:Incident>
|
||
|
|
</stix:Incidents>
|
||
|
|
</stix:Package>
|
||
|
|
</stix:Related_Package>
|
||
|
|
</stix:Related_Packages>
|
||
|
|
</stix:STIX_Package>
|