1634 lines
162 KiB
XML
1634 lines
162 KiB
XML
|
<stix:STIX_Package
|
||
|
|
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
|
||
|
|
xmlns:cybox="http://cybox.mitre.org/cybox-2"
|
||
|
|
xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
|
||
|
|
xmlns:ASObj="http://cybox.mitre.org/objects#ASObject-1"
|
||
|
|
xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
|
||
|
|
xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1"
|
||
|
|
xmlns:EmailMessageObj="http://cybox.mitre.org/objects#EmailMessageObject-2"
|
||
|
|
xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"
|
||
|
|
xmlns:HTTPSessionObj="http://cybox.mitre.org/objects#HTTPSessionObject-2"
|
||
|
|
xmlns:HostnameObj="http://cybox.mitre.org/objects#HostnameObject-1"
|
||
|
|
xmlns:MutexObj="http://cybox.mitre.org/objects#MutexObject-2"
|
||
|
|
xmlns:PipeObj="http://cybox.mitre.org/objects#PipeObject-2"
|
||
|
|
xmlns:URIObj="http://cybox.mitre.org/objects#URIObject-2"
|
||
|
|
xmlns:WinRegistryKeyObj="http://cybox.mitre.org/objects#WinRegistryKeyObject-2"
|
||
|
|
xmlns:marking="http://data-marking.mitre.org/Marking-1"
|
||
|
|
xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"
|
||
|
|
xmlns:et="http://stix.mitre.org/ExploitTarget-1"
|
||
|
|
xmlns:incident="http://stix.mitre.org/Incident-1"
|
||
|
|
xmlns:indicator="http://stix.mitre.org/Indicator-2"
|
||
|
|
xmlns:ttp="http://stix.mitre.org/TTP-1"
|
||
|
|
xmlns:ta="http://stix.mitre.org/ThreatActor-1"
|
||
|
|
xmlns:stixCommon="http://stix.mitre.org/common-1"
|
||
|
|
xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
|
||
|
|
xmlns:stix-ciqidentity="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1"
|
||
|
|
xmlns:snortTM="http://stix.mitre.org/extensions/TestMechanism#Snort-1"
|
||
|
|
xmlns:stix="http://stix.mitre.org/stix-1"
|
||
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||
|
|
xmlns:xal="urn:oasis:names:tc:ciq:xal:3"
|
||
|
|
xmlns:xnl="urn:oasis:names:tc:ciq:xnl:3"
|
||
|
|
xmlns:xpil="urn:oasis:names:tc:ciq:xpil:3"
|
||
|
|
xsi:schemaLocation="
|
||
|
|
http://cybox.mitre.org/common-2 http://cybox.mitre.org/XMLSchema/common/2.1/cybox_common.xsd
|
||
|
|
http://cybox.mitre.org/cybox-2 http://cybox.mitre.org/XMLSchema/core/2.1/cybox_core.xsd
|
||
|
|
http://cybox.mitre.org/default_vocabularies-2 http://cybox.mitre.org/XMLSchema/default_vocabularies/2.1/cybox_default_vocabularies.xsd
|
||
|
|
http://cybox.mitre.org/objects#ASObject-1 http://cybox.mitre.org/XMLSchema/objects/AS/1.0/AS_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#AddressObject-2 http://cybox.mitre.org/XMLSchema/objects/Address/2.1/Address_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#DomainNameObject-1 http://cybox.mitre.org/XMLSchema/objects/Domain_Name/1.0/Domain_Name_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#EmailMessageObject-2 http://cybox.mitre.org/XMLSchema/objects/Email_Message/2.1/Email_Message_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#FileObject-2 http://cybox.mitre.org/XMLSchema/objects/File/2.1/File_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#HTTPSessionObject-2 http://cybox.mitre.org/XMLSchema/objects/HTTP_Session/2.1/HTTP_Session_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#HostnameObject-1 http://cybox.mitre.org/XMLSchema/objects/Hostname/1.0/Hostname_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#MutexObject-2 http://cybox.mitre.org/XMLSchema/objects/Mutex/2.1/Mutex_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#PipeObject-2 http://cybox.mitre.org/XMLSchema/objects/Pipe/2.1/Pipe_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#URIObject-2 http://cybox.mitre.org/XMLSchema/objects/URI/2.1/URI_Object.xsd
|
||
|
|
http://cybox.mitre.org/objects#WinRegistryKeyObject-2 http://cybox.mitre.org/XMLSchema/objects/Win_Registry_Key/2.1/Win_Registry_Key_Object.xsd
|
||
|
|
http://data-marking.mitre.org/Marking-1 http://stix.mitre.org/XMLSchema/data_marking/1.1.1/data_marking.xsd
|
||
|
|
http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1 http://stix.mitre.org/XMLSchema/extensions/marking/tlp/1.1.1/tlp_marking.xsd
|
||
|
|
http://stix.mitre.org/ExploitTarget-1 http://stix.mitre.org/XMLSchema/exploit_target/1.1.1/exploit_target.xsd
|
||
|
|
http://stix.mitre.org/Incident-1 http://stix.mitre.org/XMLSchema/incident/1.1.1/incident.xsd
|
||
|
|
http://stix.mitre.org/Indicator-2 http://stix.mitre.org/XMLSchema/indicator/2.1.1/indicator.xsd
|
||
|
|
http://stix.mitre.org/TTP-1 http://stix.mitre.org/XMLSchema/ttp/1.1.1/ttp.xsd
|
||
|
|
http://stix.mitre.org/ThreatActor-1 http://stix.mitre.org/XMLSchema/threat_actor/1.1.1/threat_actor.xsd
|
||
|
|
http://stix.mitre.org/common-1 http://stix.mitre.org/XMLSchema/common/1.1.1/stix_common.xsd
|
||
|
|
http://stix.mitre.org/default_vocabularies-1 http://stix.mitre.org/XMLSchema/default_vocabularies/1.1.1/stix_default_vocabularies.xsd
|
||
|
|
http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1 http://stix.mitre.org/XMLSchema/extensions/identity/ciq_3.0/1.1.1/ciq_3.0_identity.xsd
|
||
|
|
http://stix.mitre.org/extensions/TestMechanism#Snort-1 http://stix.mitre.org/XMLSchema/extensions/test_mechanism/snort/1.1.1/snort_test_mechanism.xsd
|
||
|
|
http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.1.1/stix_core.xsd
|
||
|
|
urn:oasis:names:tc:ciq:xal:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xAL.xsd
|
||
|
|
urn:oasis:names:tc:ciq:xnl:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xNL.xsd
|
||
|
|
urn:oasis:names:tc:ciq:xpil:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xPIL.xsd" id=":Package-ca68db1c-662a-4001-9285-522950e31bc1" version="1.1.1" timestamp="2018-03-07T19:23:42.090147+00:00">
|
||
|
|
<stix:STIX_Header>
|
||
|
|
<stix:Title>Export from MISP</stix:Title>
|
||
|
|
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
|
||
|
|
</stix:STIX_Header>
|
||
|
|
<stix:Related_Packages>
|
||
|
|
<stix:Related_Package>
|
||
|
|
<stix:Package id=":STIXPackage-5a84a4bc-1498-4808-9cf1-6ce78e96ca05" version="1.1.1" timestamp="2018-03-07T14:22:42+00:00">
|
||
|
|
<stix:STIX_Header>
|
||
|
|
<stix:Title>Bad Traffic (MISP Event #134)</stix:Title>
|
||
|
|
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
|
||
|
|
</stix:STIX_Header>
|
||
|
|
<stix:Incidents>
|
||
|
|
<stix:Incident id=":incident-5a84a4bc-1498-4808-9cf1-6ce78e96ca05" timestamp="2018-03-07T14:23:18+00:00" xsi:type='incident:IncidentType'>
|
||
|
|
<incident:Title>Bad Traffic</incident:Title>
|
||
|
|
<incident:External_ID source="MISP Event">134</incident:External_ID>
|
||
|
|
<incident:Time>
|
||
|
|
<incident:Incident_Discovery precision="second">2018-02-14T00:00:00+00:00</incident:Incident_Discovery>
|
||
|
|
<incident:Incident_Reported precision="second">2018-03-07T14:23:18+00:00</incident:Incident_Reported>
|
||
|
|
</incident:Time>
|
||
|
|
<incident:Status xsi:type="stixVocabs:IncidentStatusVocab-1.0">New</incident:Status>
|
||
|
|
<incident:Related_Indicators>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-1c94-40ca-b487-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: a070fd2cce434a6f0b0d0fa6d3278d22 (MISP Attribute #18176)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: a070fd2cce434a6f0b0d0fa6d3278d22 (MISP Attribute #18176)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-1c94-40ca-b487-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-1c94-40ca-b487-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">a070fd2cce434a6f0b0d0fa6d3278d22</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-bb2c-495d-a460-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: be6f2a03dfddbaf1166854730961d13c (MISP Attribute #18177)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: be6f2a03dfddbaf1166854730961d13c (MISP Attribute #18177)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-bb2c-495d-a460-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-bb2c-495d-a460-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">be6f2a03dfddbaf1166854730961d13c</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-af4c-40fc-8e98-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: d7ec065cc3f563928504f80692578d2f (MISP Attribute #18178)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: d7ec065cc3f563928504f80692578d2f (MISP Attribute #18178)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-af4c-40fc-8e98-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-af4c-40fc-8e98-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">d7ec065cc3f563928504f80692578d2f</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-c054-4a65-8ff3-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: f344da38958dbc730ddebc10660cd451 (MISP Attribute #18179)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: f344da38958dbc730ddebc10660cd451 (MISP Attribute #18179)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-c054-4a65-8ff3-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-c054-4a65-8ff3-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">f344da38958dbc730ddebc10660cd451</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-e354-4d5d-bafb-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: fa90508007b94a4dbfeb8b48d5443ec8 (MISP Attribute #18180)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: fa90508007b94a4dbfeb8b48d5443ec8 (MISP Attribute #18180)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-e354-4d5d-bafb-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-e354-4d5d-bafb-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">fa90508007b94a4dbfeb8b48d5443ec8</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-c1f8-45f5-abd0-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 001316808aa7108b467e8ecc06139c2e (MISP Attribute #18181)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 001316808aa7108b467e8ecc06139c2e (MISP Attribute #18181)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-c1f8-45f5-abd0-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-c1f8-45f5-abd0-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">001316808aa7108b467e8ecc06139c2e</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-9dd4-42eb-aef1-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 5c3f0dcf4aaa699b50154aa245923c86 (MISP Attribute #18182)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 5c3f0dcf4aaa699b50154aa245923c86 (MISP Attribute #18182)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-9dd4-42eb-aef1-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-9dd4-42eb-aef1-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">5c3f0dcf4aaa699b50154aa245923c86</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-5d38-493a-a73c-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 7fd98d6bb1e9d6bcf2e1984e812c1e46 (MISP Attribute #18183)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 7fd98d6bb1e9d6bcf2e1984e812c1e46 (MISP Attribute #18183)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-5d38-493a-a73c-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-5d38-493a-a73c-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">7fd98d6bb1e9d6bcf2e1984e812c1e46</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-f83c-46dd-9ceb-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 89180820b47bb11ccf0c8505371e98d1 (MISP Attribute #18184)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 89180820b47bb11ccf0c8505371e98d1 (MISP Attribute #18184)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-f83c-46dd-9ceb-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-f83c-46dd-9ceb-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">89180820b47bb11ccf0c8505371e98d1</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-bbec-446d-a785-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 8bb2ba6f1cfa3bd99146688cd1e76bb0 (MISP Attribute #18185)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 8bb2ba6f1cfa3bd99146688cd1e76bb0 (MISP Attribute #18185)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-bbec-446d-a785-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-bbec-446d-a785-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">8bb2ba6f1cfa3bd99146688cd1e76bb0</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-1de8-45fc-8681-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 8c8eb5cfc5642a773c5f2b5f59148aa3 (MISP Attribute #18186)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 8c8eb5cfc5642a773c5f2b5f59148aa3 (MISP Attribute #18186)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-1de8-45fc-8681-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-1de8-45fc-8681-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">8c8eb5cfc5642a773c5f2b5f59148aa3</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-887c-4c49-baa1-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 8fea3de31a58415c3fec2e6dd4095575 (MISP Attribute #18187)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 8fea3de31a58415c3fec2e6dd4095575 (MISP Attribute #18187)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-887c-4c49-baa1-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-887c-4c49-baa1-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">8fea3de31a58415c3fec2e6dd4095575</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-2ee4-46ad-9e1f-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 9b0de56f7f862db73e223f41099fc74c (MISP Attribute #18188)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 9b0de56f7f862db73e223f41099fc74c (MISP Attribute #18188)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-2ee4-46ad-9e1f-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-2ee4-46ad-9e1f-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">9b0de56f7f862db73e223f41099fc74c</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-e6dc-44c8-a030-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: be8a344487bcfea66de8e0f0f14d869e (MISP Attribute #18189)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: be8a344487bcfea66de8e0f0f14d869e (MISP Attribute #18189)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-e6dc-44c8-a030-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-e6dc-44c8-a030-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">be8a344487bcfea66de8e0f0f14d869e</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-56e8-4a86-b564-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: df0045bd4168893922480f7ccb29860a (MISP Attribute #18190)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: df0045bd4168893922480f7ccb29860a (MISP Attribute #18190)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-56e8-4a86-b564-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-56e8-4a86-b564-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">df0045bd4168893922480f7ccb29860a</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-87ac-4368-b185-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: e436e849d9496ef3f651c1904786c78f (MISP Attribute #18191)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: e436e849d9496ef3f651c1904786c78f (MISP Attribute #18191)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-87ac-4368-b185-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-87ac-4368-b185-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">e436e849d9496ef3f651c1904786c78f</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-d490-4f27-be9b-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: e80d8a0c35133f7485d8e87ade903919 (MISP Attribute #18192)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: e80d8a0c35133f7485d8e87ade903919 (MISP Attribute #18192)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-d490-4f27-be9b-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-d490-4f27-be9b-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">e80d8a0c35133f7485d8e87ade903919</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-f230-436a-b587-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: f36e67109ae368c9db109d0a41b5817c (MISP Attribute #18193)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: f36e67109ae368c9db109d0a41b5817c (MISP Attribute #18193)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-f230-436a-b587-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-f230-436a-b587-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">f36e67109ae368c9db109d0a41b5817c</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-1034-4a7d-8335-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 08b8b4787f3ce90c6c1483cc127b1cdc (MISP Attribute #18194)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 08b8b4787f3ce90c6c1483cc127b1cdc (MISP Attribute #18194)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-1034-4a7d-8335-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-1034-4a7d-8335-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">08b8b4787f3ce90c6c1483cc127b1cdc</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-4b84-43af-a448-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 205a5502ff0da4a471c4dad0e06c6c57 (MISP Attribute #18195)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 205a5502ff0da4a471c4dad0e06c6c57 (MISP Attribute #18195)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-4b84-43af-a448-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-4b84-43af-a448-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">205a5502ff0da4a471c4dad0e06c6c57</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-0d40-42e6-8472-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 32bc51088953377d601c6b27ca7484a9 (MISP Attribute #18196)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 32bc51088953377d601c6b27ca7484a9 (MISP Attribute #18196)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-0d40-42e6-8472-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-0d40-42e6-8472-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">32bc51088953377d601c6b27ca7484a9</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-4d40-4614-a23e-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 3729531c71163cddcded7e70c02a3004 (MISP Attribute #18197)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 3729531c71163cddcded7e70c02a3004 (MISP Attribute #18197)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-4d40-4614-a23e-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-4d40-4614-a23e-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">3729531c71163cddcded7e70c02a3004</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-0d08-4751-b2a6-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 43b39fd4ddc386092372da19f6278c25 (MISP Attribute #18198)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 43b39fd4ddc386092372da19f6278c25 (MISP Attribute #18198)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-0d08-4751-b2a6-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-0d08-4751-b2a6-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">43b39fd4ddc386092372da19f6278c25</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-29e0-421c-9135-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 4fe4094302c26e7ea2c58f5ca9f7f993 (MISP Attribute #18199)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 4fe4094302c26e7ea2c58f5ca9f7f993 (MISP Attribute #18199)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-29e0-421c-9135-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-29e0-421c-9135-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">4fe4094302c26e7ea2c58f5ca9f7f993</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-ba64-42f1-9505-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 58239ea5747d3375278ce7c04db22c1b (MISP Attribute #18200)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 58239ea5747d3375278ce7c04db22c1b (MISP Attribute #18200)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-ba64-42f1-9505-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-ba64-42f1-9505-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">58239ea5747d3375278ce7c04db22c1b</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-ff78-4858-a1e3-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 6491df10c766be9c487fb9495d04df6e (MISP Attribute #18201)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 6491df10c766be9c487fb9495d04df6e (MISP Attribute #18201)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-ff78-4858-a1e3-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-ff78-4858-a1e3-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">6491df10c766be9c487fb9495d04df6e</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-a0c8-4282-8b2b-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 6a442a610c047a7a306a12f423978bfb (MISP Attribute #18202)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 6a442a610c047a7a306a12f423978bfb (MISP Attribute #18202)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-a0c8-4282-8b2b-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-a0c8-4282-8b2b-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">6a442a610c047a7a306a12f423978bfb</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-0668-4191-b597-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 6ce947913231bd968c86a2737bae7bba (MISP Attribute #18203)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 6ce947913231bd968c86a2737bae7bba (MISP Attribute #18203)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-0668-4191-b597-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-0668-4191-b597-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">6ce947913231bd968c86a2737bae7bba</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-359c-4b66-afb6-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 7ad8ad340c084f8185e2bb18cbfde891 (MISP Attribute #18204)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 7ad8ad340c084f8185e2bb18cbfde891 (MISP Attribute #18204)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-359c-4b66-afb6-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-359c-4b66-afb6-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">7ad8ad340c084f8185e2bb18cbfde891</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-55f8-4be5-8e12-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 90373539c60529153d0d6b0cc857e845 (MISP Attribute #18205)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 90373539c60529153d0d6b0cc857e845 (MISP Attribute #18205)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-55f8-4be5-8e12-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-55f8-4be5-8e12-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">90373539c60529153d0d6b0cc857e845</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-9cb8-477d-a13f-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: a5ae6e0d74052d4f889f2538fdd7cb9b (MISP Attribute #18206)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: a5ae6e0d74052d4f889f2538fdd7cb9b (MISP Attribute #18206)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-9cb8-477d-a13f-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-9cb8-477d-a13f-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">a5ae6e0d74052d4f889f2538fdd7cb9b</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-43dc-4fd9-b2b3-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 08d971f5f4707ae6ea56ed2f243c38b7 (MISP Attribute #18169)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 08d971f5f4707ae6ea56ed2f243c38b7 (MISP Attribute #18169)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-43dc-4fd9-b2b3-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-43dc-4fd9-b2b3-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">08d971f5f4707ae6ea56ed2f243c38b7</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-bb18-4c5d-879d-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 20755b98d7c094747b75b157413e3422 (MISP Attribute #18170)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 20755b98d7c094747b75b157413e3422 (MISP Attribute #18170)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-bb18-4c5d-879d-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-bb18-4c5d-879d-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">20755b98d7c094747b75b157413e3422</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-50e4-4d9e-85c8-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 3632fb080545d3518d57320466f96cb3 (MISP Attribute #18171)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 3632fb080545d3518d57320466f96cb3 (MISP Attribute #18171)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-50e4-4d9e-85c8-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-50e4-4d9e-85c8-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">3632fb080545d3518d57320466f96cb3</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-0ba0-4c9f-91f1-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 40383bee9846ecbd78581402e3379051 (MISP Attribute #18172)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 40383bee9846ecbd78581402e3379051 (MISP Attribute #18172)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-0ba0-4c9f-91f1-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-0ba0-4c9f-91f1-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">40383bee9846ecbd78581402e3379051</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-5038-4cff-8b98-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 449ba12127133ecd0440a558b083468c (MISP Attribute #18173)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 449ba12127133ecd0440a558b083468c (MISP Attribute #18173)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-5038-4cff-8b98-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-5038-4cff-8b98-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">449ba12127133ecd0440a558b083468c</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-4cf0-4b40-9d1f-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 461446151be0033a668782c2d7ba58cb (MISP Attribute #18174)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 461446151be0033a668782c2d7ba58cb (MISP Attribute #18174)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-4cf0-4b40-9d1f-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-4cf0-4b40-9d1f-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">461446151be0033a668782c2d7ba58cb</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebaec-1fdc-4320-a7d2-65188064ab0b" timestamp="2018-03-06T10:59:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Artifacts dropped: 56bc314bc0d4a0a230a4de2bf978b5ae (MISP Attribute #18175)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Artifacts dropped: 56bc314bc0d4a0a230a4de2bf978b5ae (MISP Attribute #18175)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebaec-1fdc-4320-a7d2-65188064ab0b">
|
||
|
|
<cybox:Object id=":File-5a9ebaec-1fdc-4320-a7d2-65188064ab0b">
|
||
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
|
|
<FileObj:Hashes>
|
||
|
|
<cyboxCommon:Hash>
|
||
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">56bc314bc0d4a0a230a4de2bf978b5ae</cyboxCommon:Simple_Hash_Value>
|
||
|
|
</cyboxCommon:Hash>
|
||
|
|
</FileObj:Hashes>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:59:40+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5aa03a55-d3dc-4b53-a6e4-67a48064ab0b" timestamp="2018-03-07T14:15:33+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: document.downloadingsystem.com (MISP Attribute #18208)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: document.downloadingsystem.com (MISP Attribute #18208)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5aa03a55-d3dc-4b53-a6e4-67a48064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5aa03a55-d3dc-4b53-a6e4-67a48064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">document.downloadingsystem.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-07T14:15:33+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5aa03a55-6920-413a-a285-67a48064ab0b" timestamp="2018-03-07T14:15:33+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: epoch.englishdownloaders.today (MISP Attribute #18209)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: epoch.englishdownloaders.today (MISP Attribute #18209)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5aa03a55-6920-413a-a285-67a48064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5aa03a55-6920-413a-a285-67a48064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">epoch.englishdownloaders.today</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-07T14:15:33+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5aa03a55-0118-4f2a-9ab5-67a48064ab0b" timestamp="2018-03-07T14:15:33+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: internet.downloadingdocuments.com (MISP Attribute #18210)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: internet.downloadingdocuments.com (MISP Attribute #18210)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5aa03a55-0118-4f2a-9ab5-67a48064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5aa03a55-0118-4f2a-9ab5-67a48064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">internet.downloadingdocuments.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-07T14:15:33+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5aa03a55-e36c-4dc5-934d-67a48064ab0b" timestamp="2018-03-07T14:15:33+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: system.filedownloaders.com (MISP Attribute #18211)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: system.filedownloaders.com (MISP Attribute #18211)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5aa03a55-e36c-4dc5-934d-67a48064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5aa03a55-e36c-4dc5-934d-67a48064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">system.filedownloaders.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-07T14:15:33+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5aa03a55-7f20-4130-9def-67a48064ab0b" timestamp="2018-03-07T14:15:33+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: upd-ms3-app-state.com (MISP Attribute #18212)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: upd-ms3-app-state.com (MISP Attribute #18212)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5aa03a55-7f20-4130-9def-67a48064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5aa03a55-7f20-4130-9def-67a48064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">upd-ms3-app-state.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-07T14:15:33+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5aa03c02-8520-4c2c-8ae7-67a28064ab0b" timestamp="2018-03-07T14:22:42+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: bombinate.winload.info (MISP Attribute #18213)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: bombinate.winload.info (MISP Attribute #18213)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5aa03c02-8520-4c2c-8ae7-67a28064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5aa03c02-8520-4c2c-8ae7-67a28064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">bombinate.winload.info</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-07T14:22:42+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5aa03c02-e238-4288-9217-67a28064ab0b" timestamp="2018-03-07T14:22:42+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: epoch.uploaders.online (MISP Attribute #18214)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: epoch.uploaders.online (MISP Attribute #18214)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5aa03c02-e238-4288-9217-67a28064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5aa03c02-e238-4288-9217-67a28064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">epoch.uploaders.online</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-07T14:22:42+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5aa03c02-0bd0-42ee-ade7-67a28064ab0b" timestamp="2018-03-07T14:22:42+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: solitude.filedownloads.online (MISP Attribute #18215)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: solitude.filedownloads.online (MISP Attribute #18215)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5aa03c02-0bd0-42ee-ade7-67a28064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5aa03c02-0bd0-42ee-ade7-67a28064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">solitude.filedownloads.online</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-07T14:22:42+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebab6-5b58-489e-90e2-630f8064ab0b" timestamp="2018-03-06T10:58:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: download.downloading.shop (MISP Attribute #18152)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: download.downloading.shop (MISP Attribute #18152)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebab6-5b58-489e-90e2-630f8064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5a9ebab6-5b58-489e-90e2-630f8064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">download.downloading.shop</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:58:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebab6-1cf8-44f7-9995-630f8064ab0b" timestamp="2018-03-06T10:58:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: downloading.syriantelecom.co (MISP Attribute #18153)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: downloading.syriantelecom.co (MISP Attribute #18153)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebab6-1cf8-44f7-9995-630f8064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5a9ebab6-1cf8-44f7-9995-630f8064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">downloading.syriantelecom.co</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:58:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebab6-e0ac-49ac-b6fa-630f8064ab0b" timestamp="2018-03-06T10:58:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: download.syriantelecommunications.co (MISP Attribute #18154)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: download.syriantelecommunications.co (MISP Attribute #18154)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebab6-e0ac-49ac-b6fa-630f8064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5a9ebab6-e0ac-49ac-b6fa-630f8064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">download.syriantelecommunications.co</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:58:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebab6-49a8-4bb1-81d7-630f8064ab0b" timestamp="2018-03-06T10:58:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: redirection.bid (MISP Attribute #18155)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: redirection.bid (MISP Attribute #18155)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebab6-49a8-4bb1-81d7-630f8064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5a9ebab6-49a8-4bb1-81d7-630f8064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">redirection.bid</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:58:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebab6-def0-4a56-9745-630f8064ab0b" timestamp="2018-03-06T10:58:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: downloading.internetdownloading.co (MISP Attribute #18156)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: downloading.internetdownloading.co (MISP Attribute #18156)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebab6-def0-4a56-9745-630f8064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5a9ebab6-def0-4a56-9745-630f8064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">downloading.internetdownloading.co</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:58:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebab6-f734-4a44-a766-630f8064ab0b" timestamp="2018-03-06T10:58:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: download.downloadering.co (MISP Attribute #18157)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: download.downloadering.co (MISP Attribute #18157)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebab6-f734-4a44-a766-630f8064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5a9ebab6-f734-4a44-a766-630f8064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">download.downloadering.co</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:58:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebab6-193c-4062-8a28-630f8064ab0b" timestamp="2018-03-06T10:58:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: updserv-east-cdn3.com (MISP Attribute #18158)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: updserv-east-cdn3.com (MISP Attribute #18158)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebab6-193c-4062-8a28-630f8064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5a9ebab6-193c-4062-8a28-630f8064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">updserv-east-cdn3.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:58:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebab6-1dc4-4139-92f9-630f8064ab0b" timestamp="2018-03-06T10:58:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: computing.downloaders.today (MISP Attribute #18159)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: computing.downloaders.today (MISP Attribute #18159)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebab6-1dc4-4139-92f9-630f8064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5a9ebab6-1dc4-4139-92f9-630f8064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">computing.downloaders.today</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:58:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebab6-dd2c-446e-94a1-630f8064ab0b" timestamp="2018-03-06T10:58:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: storage.computingdownloads.life (MISP Attribute #18160)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: storage.computingdownloads.life (MISP Attribute #18160)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebab6-dd2c-446e-94a1-630f8064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5a9ebab6-dd2c-446e-94a1-630f8064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">storage.computingdownloads.life</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:58:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebab6-479c-4201-b823-630f8064ab0b" timestamp="2018-03-06T10:58:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: window.processingdownloads.today (MISP Attribute #18161)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: window.processingdownloads.today (MISP Attribute #18161)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebab6-479c-4201-b823-630f8064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5a9ebab6-479c-4201-b823-630f8064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">window.processingdownloads.today</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:58:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebab6-389c-4de0-be65-630f8064ab0b" timestamp="2018-03-06T10:58:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: ms-cdn-88.com (MISP Attribute #18162)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: ms-cdn-88.com (MISP Attribute #18162)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebab6-389c-4de0-be65-630f8064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5a9ebab6-389c-4de0-be65-630f8064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">ms-cdn-88.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:58:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebab6-41d4-4b46-8c16-630f8064ab0b" timestamp="2018-03-06T10:58:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: solitude.file-download.today (MISP Attribute #18163)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: solitude.file-download.today (MISP Attribute #18163)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebab6-41d4-4b46-8c16-630f8064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5a9ebab6-41d4-4b46-8c16-630f8064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">solitude.file-download.today</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:58:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebab6-c2ac-45da-902c-630f8064ab0b" timestamp="2018-03-06T10:58:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: system.documentations.live (MISP Attribute #18164)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: system.documentations.live (MISP Attribute #18164)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebab6-c2ac-45da-902c-630f8064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5a9ebab6-c2ac-45da-902c-630f8064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">system.documentations.live</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:58:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebab6-adc4-48ac-8d5d-630f8064ab0b" timestamp="2018-03-06T10:58:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: epiphany.download-document.world (MISP Attribute #18165)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: epiphany.download-document.world (MISP Attribute #18165)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebab6-adc4-48ac-8d5d-630f8064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5a9ebab6-adc4-48ac-8d5d-630f8064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">epiphany.download-document.world</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:58:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebab6-b9b8-412b-9929-630f8064ab0b" timestamp="2018-03-06T10:58:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: epoch.wind-files.today (MISP Attribute #18166)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: epoch.wind-files.today (MISP Attribute #18166)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebab6-b9b8-412b-9929-630f8064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5a9ebab6-b9b8-412b-9929-630f8064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">epoch.wind-files.today</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:58:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebab6-caf4-41b4-8e69-630f8064ab0b" timestamp="2018-03-06T10:58:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: internet.document-management.today (MISP Attribute #18167)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: internet.document-management.today (MISP Attribute #18167)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebab6-caf4-41b4-8e69-630f8064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5a9ebab6-caf4-41b4-8e69-630f8064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">internet.document-management.today</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:58:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
<incident:Related_Indicator>
|
||
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
|
|
<stixCommon:Indicator id=":indicator-5a9ebab6-b230-4313-9195-630f8064ab0b" timestamp="2018-03-06T10:58:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
|
|
<indicator:Title>Network activity: cdn-upd-ms6.com (MISP Attribute #18168)</indicator:Title>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
|
|
<indicator:Description>Network activity: cdn-upd-ms6.com (MISP Attribute #18168)</indicator:Description>
|
||
|
|
<indicator:Valid_Time_Position/>
|
||
|
|
<indicator:Observable id=":observable-5a9ebab6-b230-4313-9195-630f8064ab0b">
|
||
|
|
<cybox:Object id=":DomainName-5a9ebab6-b230-4313-9195-630f8064ab0b">
|
||
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
|
|
<DomainNameObj:Value condition="Equals">cdn-upd-ms6.com</DomainNameObj:Value>
|
||
|
|
</cybox:Properties>
|
||
|
|
</cybox:Object>
|
||
|
|
</indicator:Observable>
|
||
|
|
<indicator:Confidence timestamp="2018-03-06T10:58:46+00:00">
|
||
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
|
|
</indicator:Confidence>
|
||
|
|
</stixCommon:Indicator>
|
||
|
|
</incident:Related_Indicator>
|
||
|
|
</incident:Related_Indicators>
|
||
|
|
<incident:History>
|
||
|
|
<incident:History_Item>
|
||
|
|
<incident:Journal_Entry time_precision="second">Event Threat Level: High</incident:Journal_Entry>
|
||
|
|
</incident:History_Item>
|
||
|
|
<incident:History_Item>
|
||
|
|
<incident:Journal_Entry time_precision="second">MISP Tag: SOURCE:CITIZENLAB</incident:Journal_Entry>
|
||
|
|
</incident:History_Item>
|
||
|
|
<incident:History_Item>
|
||
|
|
<incident:Journal_Entry time_precision="second">MISP Tag: DETECT</incident:Journal_Entry>
|
||
|
|
</incident:History_Item>
|
||
|
|
<incident:History_Item>
|
||
|
|
<incident:Journal_Entry time_precision="second">MISP Tag: TARGET:SYRIA</incident:Journal_Entry>
|
||
|
|
</incident:History_Item>
|
||
|
|
<incident:History_Item>
|
||
|
|
<incident:Journal_Entry time_precision="second">MISP Tag: TARGET:EGYPT</incident:Journal_Entry>
|
||
|
|
</incident:History_Item>
|
||
|
|
<incident:History_Item>
|
||
|
|
<incident:Journal_Entry time_precision="second">MISP Tag: TARGET:TURKEY</incident:Journal_Entry>
|
||
|
|
</incident:History_Item>
|
||
|
|
</incident:History>
|
||
|
|
<incident:Information_Source>
|
||
|
|
<stixCommon:Identity>
|
||
|
|
<stixCommon:Name>citizenlab</stixCommon:Name>
|
||
|
|
</stixCommon:Identity>
|
||
|
|
</incident:Information_Source>
|
||
|
|
<incident:Handling>
|
||
|
|
<marking:Marking>
|
||
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
|
|
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="GREEN"/>
|
||
|
|
</marking:Marking>
|
||
|
|
</incident:Handling>
|
||
|
|
</stix:Incident>
|
||
|
|
</stix:Incidents>
|
||
|
|
</stix:Package>
|
||
|
|
</stix:Related_Package>
|
||
|
|
</stix:Related_Packages>
|
||
|
|
</stix:STIX_Package>
|