sssnake/autarch
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

Browse Source
This commit is contained in:
SsSnake
2026-07-13 15:45:47 -07:00
parent 925216290f
commit e48d577bd5
387 changed files with 211976 additions and 921 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
data/ioc/spyware/citizen_lab/201810_TheKingdomCameToCanada/iocs.csv Normal file
View File

@@ -0,0 +1,21 @@
uuid,event_id,category,type,value,comment,to_ids,date
5bb2777f-11e4-4591-b2d2-700d8064ab0b,138,Payload delivery,domain,"kingdom-news.com","",1,20181001
5bb2777f-17dc-4422-b198-700d8064ab0b,138,Payload delivery,domain,"all-sales.info","",1,20181001
5bb2777f-1d34-42cc-b869-700d8064ab0b,138,Payload delivery,domain,"nouvelles247.com","",1,20181001
5bb2777f-2ef0-4e54-b5dd-700d8064ab0b,138,Payload delivery,domain,"findmyplants.com","",1,20181001
5bb2777f-36c4-4621-abf9-700d8064ab0b,138,Payload delivery,domain,"arabnews365.com","",1,20181001
5bb2777f-4fb0-4727-9c47-700d8064ab0b,138,Payload delivery,domain,"kingdom-deals.com","",1,20181001
5bb2777f-5a18-4c67-9a35-700d8064ab0b,138,Payload delivery,domain,"akhbar-arabia.com","",1,20181001
5bb2777f-6e5c-496e-975b-700d8064ab0b,138,Payload delivery,domain,"muslim-world.info","",1,20181001
5bb2777f-9834-4835-9cd0-700d8064ab0b,138,Payload delivery,domain,"news-gazette.info","",1,20181001
5bb2777f-a8fc-4c13-8aed-700d8064ab0b,138,Payload delivery,domain,"arabworld.biz","",1,20181001
5bb2777f-a91c-45dc-99ae-700d8064ab0b,138,Payload delivery,domain,"dinneraroundyou.com","",1,20181001
5bb2777f-ad24-4ab7-bb07-700d8064ab0b,138,Payload delivery,domain,"promosdereve.com","",1,20181001
5bb2777f-cc98-4611-8d13-700d8064ab0b,138,Payload delivery,domain,"housesfurniture.com","",1,20181001
5bb2777f-ebd0-4410-b335-700d8064ab0b,138,Payload delivery,domain,"daily-sport.news","",1,20181001
5bb2777f-f954-4227-9e89-700d8064ab0b,138,Payload delivery,domain,"mideast-today.com","",1,20181001
5bb27780-ba04-4fa1-9198-700d8064ab0b,138,Payload delivery,domain,"wonderfulinsights.com","",1,20181001
5bb27780-e238-499c-a677-700d8064ab0b,138,Payload delivery,domain,"social-life.info","",1,20181001
5bb27780-fe30-4662-9264-700d8064ab0b,138,Payload delivery,domain,"sunday-deals.com","",1,20181001
5bb277a3-277c-4cc9-a7d0-4c668064ab0b,138,Network activity,domain,"beststores4u.com","",1,20181001
5bb277a3-ac80-403b-a3a7-4c668064ab0b,138,Network activity,domain,"cheapapartmentsaroundme.com","",1,20181001
1 uuid event_id category type value comment to_ids date
2 5bb2777f-11e4-4591-b2d2-700d8064ab0b 138 Payload delivery domain kingdom-news.com 1 20181001
3 5bb2777f-17dc-4422-b198-700d8064ab0b 138 Payload delivery domain all-sales.info 1 20181001
4 5bb2777f-1d34-42cc-b869-700d8064ab0b 138 Payload delivery domain nouvelles247.com 1 20181001
5 5bb2777f-2ef0-4e54-b5dd-700d8064ab0b 138 Payload delivery domain findmyplants.com 1 20181001
6 5bb2777f-36c4-4621-abf9-700d8064ab0b 138 Payload delivery domain arabnews365.com 1 20181001
7 5bb2777f-4fb0-4727-9c47-700d8064ab0b 138 Payload delivery domain kingdom-deals.com 1 20181001
8 5bb2777f-5a18-4c67-9a35-700d8064ab0b 138 Payload delivery domain akhbar-arabia.com 1 20181001
9 5bb2777f-6e5c-496e-975b-700d8064ab0b 138 Payload delivery domain muslim-world.info 1 20181001
10 5bb2777f-9834-4835-9cd0-700d8064ab0b 138 Payload delivery domain news-gazette.info 1 20181001
11 5bb2777f-a8fc-4c13-8aed-700d8064ab0b 138 Payload delivery domain arabworld.biz 1 20181001
12 5bb2777f-a91c-45dc-99ae-700d8064ab0b 138 Payload delivery domain dinneraroundyou.com 1 20181001
13 5bb2777f-ad24-4ab7-bb07-700d8064ab0b 138 Payload delivery domain promosdereve.com 1 20181001
14 5bb2777f-cc98-4611-8d13-700d8064ab0b 138 Payload delivery domain housesfurniture.com 1 20181001
15 5bb2777f-ebd0-4410-b335-700d8064ab0b 138 Payload delivery domain daily-sport.news 1 20181001
16 5bb2777f-f954-4227-9e89-700d8064ab0b 138 Payload delivery domain mideast-today.com 1 20181001
17 5bb27780-ba04-4fa1-9198-700d8064ab0b 138 Payload delivery domain wonderfulinsights.com 1 20181001
18 5bb27780-e238-499c-a677-700d8064ab0b 138 Payload delivery domain social-life.info 1 20181001
19 5bb27780-fe30-4662-9264-700d8064ab0b 138 Payload delivery domain sunday-deals.com 1 20181001
20 5bb277a3-277c-4cc9-a7d0-4c668064ab0b 138 Network activity domain beststores4u.com 1 20181001
21 5bb277a3-ac80-403b-a3a7-4c668064ab0b 138 Network activity domain cheapapartmentsaroundme.com 1 20181001

377
data/ioc/spyware/citizen_lab/201810_TheKingdomCameToCanada/misp.json Normal file
View File

@@ -0,0 +1,377 @@
{"response":[{
"Event": {
"id": "138",
"orgc_id": "2",
"org_id": "2",
"date": "2018-10-01",
"threat_level_id": "1",
"info": "The Kingdom Came To Canada",
"published": true,
"uuid": "5bb27709-12a0-4240-b90e-6f848064ab0b",
"attribute_count": "20",
"analysis": "2",
"timestamp": "1538422691",
"distribution": "1",
"proposal_email_lock": false,
"locked": false,
"publish_timestamp": "1538423091",
"sharing_group_id": "0",
"Org": {
"id": "2",
"name": "citizenlab",
"uuid": "581b5fea-818c-441a-bd1d-49798e96ca05"
},
"Orgc": {
"id": "2",
"name": "citizenlab",
"uuid": "581b5fea-818c-441a-bd1d-49798e96ca05"
},
"Attribute": [
{
"id": "18379",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5bb277a3-277c-4cc9-a7d0-4c668064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422691",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "beststores4u.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18380",
"type": "domain",
"category": "Network activity",
"to_ids": true,
"uuid": "5bb277a3-ac80-403b-a3a7-4c668064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422691",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "cheapapartmentsaroundme.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18361",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-5a18-4c67-9a35-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "akhbar-arabia.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18362",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-17dc-4422-b198-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "all-sales.info",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18363",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-36c4-4621-abf9-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "arabnews365.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18364",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-a8fc-4c13-8aed-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "arabworld.biz",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18365",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-ebd0-4410-b335-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "daily-sport.news",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18366",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-a91c-45dc-99ae-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "dinneraroundyou.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18367",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-2ef0-4e54-b5dd-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "findmyplants.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18368",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-cc98-4611-8d13-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "housesfurniture.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18369",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-4fb0-4727-9c47-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "kingdom-deals.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18370",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-11e4-4591-b2d2-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "kingdom-news.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18371",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-f954-4227-9e89-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "mideast-today.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18372",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-6e5c-496e-975b-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "muslim-world.info",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18373",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-9834-4835-9cd0-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "news-gazette.info",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18374",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-1d34-42cc-b869-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "nouvelles247.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18375",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb2777f-ad24-4ab7-bb07-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422655",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "promosdereve.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18376",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb27780-e238-499c-a677-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422656",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "social-life.info",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18377",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb27780-fe30-4662-9264-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422656",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "sunday-deals.com",
"SharingGroup": [],
"ShadowAttribute": []
},
{
"id": "18378",
"type": "domain",
"category": "Payload delivery",
"to_ids": true,
"uuid": "5bb27780-ba04-4fa1-9198-700d8064ab0b",
"event_id": "138",
"distribution": "5",
"timestamp": "1538422656",
"comment": "",
"sharing_group_id": "0",
"deleted": false,
"value": "wonderfulinsights.com",
"SharingGroup": [],
"ShadowAttribute": []
}
],
"ShadowAttribute": [],
"RelatedEvent": [],
"Tag": [
{
"id": "5",
"name": "SOURCE:CITIZENLAB",
"colour": "#ffad0d",
"exportable": true,
"org_id": false
},
{
"id": "7",
"name": "DETECT",
"colour": "#cccccc",
"exportable": true,
"org_id": false
},
{
"id": "8",
"name": "PUBLISHED",
"colour": "#91caff",
"exportable": true,
"org_id": false
}
]
}
}]}

93
data/ioc/spyware/citizen_lab/201810_TheKingdomCameToCanada/openioc.ioc Normal file
View File

@@ -0,0 +1,93 @@
<?xml version="1.0" encoding="utf-8"?>
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="5bb27709-12a0-4240-b90e-6f848064ab0b" last-modified="2018-10-01T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
<short_description>Event #138</short_description>
<description>The Kingdom Came To Canada</description>
<keywords />
<authored_by>citizenlab</authored_by>
<authored_date>2018-10-01T00:00:00</authored_date>
<links />
<definition>
<Indicator operator="OR" id="5bb27709-12a0-4240-b90e-6f848064ab0b">
<IndicatorItem id="beststores4u.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="cheapapartmentsaroundme.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="akhbar-arabia.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="all-sales.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="arabnews365.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="arabworld.biz" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="daily-sport.news" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="dinneraroundyou.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="findmyplants.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="housesfurniture.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="kingdom-deals.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="kingdom-news.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="mideast-today.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="muslim-world.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="news-gazette.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="nouvelles247.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="promosdereve.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="social-life.info" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="sunday-deals.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="wonderfulinsights.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
</Indicator>
</definition>
</ioc>

537
data/ioc/spyware/citizen_lab/201810_TheKingdomCameToCanada/stix.xml Normal file
View File

@@ -0,0 +1,537 @@
<stix:STIX_Package
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
xmlns:cybox="http://cybox.mitre.org/cybox-2"
xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
xmlns:ASObj="http://cybox.mitre.org/objects#ASObject-1"
xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1"
xmlns:EmailMessageObj="http://cybox.mitre.org/objects#EmailMessageObject-2"
xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"
xmlns:HTTPSessionObj="http://cybox.mitre.org/objects#HTTPSessionObject-2"
xmlns:HostnameObj="http://cybox.mitre.org/objects#HostnameObject-1"
xmlns:MutexObj="http://cybox.mitre.org/objects#MutexObject-2"
xmlns:PipeObj="http://cybox.mitre.org/objects#PipeObject-2"
xmlns:URIObj="http://cybox.mitre.org/objects#URIObject-2"
xmlns:WinRegistryKeyObj="http://cybox.mitre.org/objects#WinRegistryKeyObject-2"
xmlns:marking="http://data-marking.mitre.org/Marking-1"
xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"
xmlns:et="http://stix.mitre.org/ExploitTarget-1"
xmlns:incident="http://stix.mitre.org/Incident-1"
xmlns:indicator="http://stix.mitre.org/Indicator-2"
xmlns:ttp="http://stix.mitre.org/TTP-1"
xmlns:ta="http://stix.mitre.org/ThreatActor-1"
xmlns:stixCommon="http://stix.mitre.org/common-1"
xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
xmlns:stix-ciqidentity="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1"
xmlns:snortTM="http://stix.mitre.org/extensions/TestMechanism#Snort-1"
xmlns:stix="http://stix.mitre.org/stix-1"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xal="urn:oasis:names:tc:ciq:xal:3"
xmlns:xnl="urn:oasis:names:tc:ciq:xnl:3"
xmlns:xpil="urn:oasis:names:tc:ciq:xpil:3"
xsi:schemaLocation="
http://cybox.mitre.org/common-2 http://cybox.mitre.org/XMLSchema/common/2.1/cybox_common.xsd
http://cybox.mitre.org/cybox-2 http://cybox.mitre.org/XMLSchema/core/2.1/cybox_core.xsd
http://cybox.mitre.org/default_vocabularies-2 http://cybox.mitre.org/XMLSchema/default_vocabularies/2.1/cybox_default_vocabularies.xsd
http://cybox.mitre.org/objects#ASObject-1 http://cybox.mitre.org/XMLSchema/objects/AS/1.0/AS_Object.xsd
http://cybox.mitre.org/objects#AddressObject-2 http://cybox.mitre.org/XMLSchema/objects/Address/2.1/Address_Object.xsd
http://cybox.mitre.org/objects#DomainNameObject-1 http://cybox.mitre.org/XMLSchema/objects/Domain_Name/1.0/Domain_Name_Object.xsd
http://cybox.mitre.org/objects#EmailMessageObject-2 http://cybox.mitre.org/XMLSchema/objects/Email_Message/2.1/Email_Message_Object.xsd
http://cybox.mitre.org/objects#FileObject-2 http://cybox.mitre.org/XMLSchema/objects/File/2.1/File_Object.xsd
http://cybox.mitre.org/objects#HTTPSessionObject-2 http://cybox.mitre.org/XMLSchema/objects/HTTP_Session/2.1/HTTP_Session_Object.xsd
http://cybox.mitre.org/objects#HostnameObject-1 http://cybox.mitre.org/XMLSchema/objects/Hostname/1.0/Hostname_Object.xsd
http://cybox.mitre.org/objects#MutexObject-2 http://cybox.mitre.org/XMLSchema/objects/Mutex/2.1/Mutex_Object.xsd
http://cybox.mitre.org/objects#PipeObject-2 http://cybox.mitre.org/XMLSchema/objects/Pipe/2.1/Pipe_Object.xsd
http://cybox.mitre.org/objects#URIObject-2 http://cybox.mitre.org/XMLSchema/objects/URI/2.1/URI_Object.xsd
http://cybox.mitre.org/objects#WinRegistryKeyObject-2 http://cybox.mitre.org/XMLSchema/objects/Win_Registry_Key/2.1/Win_Registry_Key_Object.xsd
http://data-marking.mitre.org/Marking-1 http://stix.mitre.org/XMLSchema/data_marking/1.1.1/data_marking.xsd
http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1 http://stix.mitre.org/XMLSchema/extensions/marking/tlp/1.1.1/tlp_marking.xsd
http://stix.mitre.org/ExploitTarget-1 http://stix.mitre.org/XMLSchema/exploit_target/1.1.1/exploit_target.xsd
http://stix.mitre.org/Incident-1 http://stix.mitre.org/XMLSchema/incident/1.1.1/incident.xsd
http://stix.mitre.org/Indicator-2 http://stix.mitre.org/XMLSchema/indicator/2.1.1/indicator.xsd
http://stix.mitre.org/TTP-1 http://stix.mitre.org/XMLSchema/ttp/1.1.1/ttp.xsd
http://stix.mitre.org/ThreatActor-1 http://stix.mitre.org/XMLSchema/threat_actor/1.1.1/threat_actor.xsd
http://stix.mitre.org/common-1 http://stix.mitre.org/XMLSchema/common/1.1.1/stix_common.xsd
http://stix.mitre.org/default_vocabularies-1 http://stix.mitre.org/XMLSchema/default_vocabularies/1.1.1/stix_default_vocabularies.xsd
http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1 http://stix.mitre.org/XMLSchema/extensions/identity/ciq_3.0/1.1.1/ciq_3.0_identity.xsd
http://stix.mitre.org/extensions/TestMechanism#Snort-1 http://stix.mitre.org/XMLSchema/extensions/test_mechanism/snort/1.1.1/snort_test_mechanism.xsd
http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.1.1/stix_core.xsd
urn:oasis:names:tc:ciq:xal:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xAL.xsd
urn:oasis:names:tc:ciq:xnl:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xNL.xsd
urn:oasis:names:tc:ciq:xpil:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xPIL.xsd" id=":Package-7dcd1bb3-5361-4e47-b0ef-3acaeee6a84b" version="1.1.1" timestamp="2018-10-01T19:46:38.446941+00:00">
<stix:STIX_Header>
<stix:Title>Export from MISP</stix:Title>
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
</stix:STIX_Header>
<stix:Related_Packages>
<stix:Related_Package>
<stix:Package id=":STIXPackage-5bb27709-12a0-4240-b90e-6f848064ab0b" version="1.1.1" timestamp="2018-10-01T15:38:11+00:00">
<stix:STIX_Header>
<stix:Title>The Kingdom Came To Canada (MISP Event #138)</stix:Title>
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
</stix:STIX_Header>
<stix:Incidents>
<stix:Incident id=":incident-5bb27709-12a0-4240-b90e-6f848064ab0b" timestamp="2018-10-01T15:44:51+00:00" xsi:type='incident:IncidentType'>
<incident:Title>The Kingdom Came To Canada</incident:Title>
<incident:External_ID source="MISP Event">138</incident:External_ID>
<incident:Time>
<incident:Incident_Discovery precision="second">2018-10-01T00:00:00+00:00</incident:Incident_Discovery>
<incident:Incident_Reported precision="second">2018-10-01T15:44:51+00:00</incident:Incident_Reported>
</incident:Time>
<incident:Status xsi:type="stixVocabs:IncidentStatusVocab-1.0">Closed</incident:Status>
<incident:Related_Indicators>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb277a3-277c-4cc9-a7d0-4c668064ab0b" timestamp="2018-10-01T15:38:11+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: beststores4u.com (MISP Attribute #18379)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: beststores4u.com (MISP Attribute #18379)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb277a3-277c-4cc9-a7d0-4c668064ab0b">
<cybox:Object id=":DomainName-5bb277a3-277c-4cc9-a7d0-4c668064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">beststores4u.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:38:11+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb277a3-ac80-403b-a3a7-4c668064ab0b" timestamp="2018-10-01T15:38:11+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Network activity: cheapapartmentsaroundme.com (MISP Attribute #18380)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Network activity: cheapapartmentsaroundme.com (MISP Attribute #18380)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb277a3-ac80-403b-a3a7-4c668064ab0b">
<cybox:Object id=":DomainName-5bb277a3-ac80-403b-a3a7-4c668064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">cheapapartmentsaroundme.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:38:11+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-5a18-4c67-9a35-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: akhbar-arabia.com (MISP Attribute #18361)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: akhbar-arabia.com (MISP Attribute #18361)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-5a18-4c67-9a35-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-5a18-4c67-9a35-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">akhbar-arabia.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-17dc-4422-b198-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: all-sales.info (MISP Attribute #18362)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: all-sales.info (MISP Attribute #18362)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-17dc-4422-b198-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-17dc-4422-b198-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">all-sales.info</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-36c4-4621-abf9-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: arabnews365.com (MISP Attribute #18363)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: arabnews365.com (MISP Attribute #18363)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-36c4-4621-abf9-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-36c4-4621-abf9-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">arabnews365.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-a8fc-4c13-8aed-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: arabworld.biz (MISP Attribute #18364)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: arabworld.biz (MISP Attribute #18364)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-a8fc-4c13-8aed-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-a8fc-4c13-8aed-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">arabworld.biz</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-ebd0-4410-b335-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: daily-sport.news (MISP Attribute #18365)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: daily-sport.news (MISP Attribute #18365)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-ebd0-4410-b335-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-ebd0-4410-b335-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">daily-sport.news</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-a91c-45dc-99ae-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: dinneraroundyou.com (MISP Attribute #18366)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: dinneraroundyou.com (MISP Attribute #18366)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-a91c-45dc-99ae-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-a91c-45dc-99ae-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">dinneraroundyou.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-2ef0-4e54-b5dd-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: findmyplants.com (MISP Attribute #18367)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: findmyplants.com (MISP Attribute #18367)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-2ef0-4e54-b5dd-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-2ef0-4e54-b5dd-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">findmyplants.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-cc98-4611-8d13-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: housesfurniture.com (MISP Attribute #18368)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: housesfurniture.com (MISP Attribute #18368)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-cc98-4611-8d13-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-cc98-4611-8d13-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">housesfurniture.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-4fb0-4727-9c47-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: kingdom-deals.com (MISP Attribute #18369)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: kingdom-deals.com (MISP Attribute #18369)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-4fb0-4727-9c47-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-4fb0-4727-9c47-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">kingdom-deals.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-11e4-4591-b2d2-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: kingdom-news.com (MISP Attribute #18370)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: kingdom-news.com (MISP Attribute #18370)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-11e4-4591-b2d2-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-11e4-4591-b2d2-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">kingdom-news.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-f954-4227-9e89-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: mideast-today.com (MISP Attribute #18371)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: mideast-today.com (MISP Attribute #18371)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-f954-4227-9e89-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-f954-4227-9e89-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">mideast-today.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-6e5c-496e-975b-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: muslim-world.info (MISP Attribute #18372)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: muslim-world.info (MISP Attribute #18372)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-6e5c-496e-975b-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-6e5c-496e-975b-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">muslim-world.info</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-9834-4835-9cd0-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: news-gazette.info (MISP Attribute #18373)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: news-gazette.info (MISP Attribute #18373)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-9834-4835-9cd0-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-9834-4835-9cd0-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">news-gazette.info</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-1d34-42cc-b869-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: nouvelles247.com (MISP Attribute #18374)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: nouvelles247.com (MISP Attribute #18374)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-1d34-42cc-b869-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-1d34-42cc-b869-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">nouvelles247.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb2777f-ad24-4ab7-bb07-700d8064ab0b" timestamp="2018-10-01T15:37:35+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: promosdereve.com (MISP Attribute #18375)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: promosdereve.com (MISP Attribute #18375)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb2777f-ad24-4ab7-bb07-700d8064ab0b">
<cybox:Object id=":DomainName-5bb2777f-ad24-4ab7-bb07-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">promosdereve.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:35+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb27780-e238-499c-a677-700d8064ab0b" timestamp="2018-10-01T15:37:36+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: social-life.info (MISP Attribute #18376)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: social-life.info (MISP Attribute #18376)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb27780-e238-499c-a677-700d8064ab0b">
<cybox:Object id=":DomainName-5bb27780-e238-499c-a677-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">social-life.info</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:36+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb27780-fe30-4662-9264-700d8064ab0b" timestamp="2018-10-01T15:37:36+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: sunday-deals.com (MISP Attribute #18377)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: sunday-deals.com (MISP Attribute #18377)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb27780-fe30-4662-9264-700d8064ab0b">
<cybox:Object id=":DomainName-5bb27780-fe30-4662-9264-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">sunday-deals.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:36+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
<incident:Related_Indicator>
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
<stixCommon:Indicator id=":indicator-5bb27780-ba04-4fa1-9198-700d8064ab0b" timestamp="2018-10-01T15:37:36+00:00" xsi:type='indicator:IndicatorType'>
<indicator:Title>Payload delivery: wonderfulinsights.com (MISP Attribute #18378)</indicator:Title>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
<indicator:Description>Payload delivery: wonderfulinsights.com (MISP Attribute #18378)</indicator:Description>
<indicator:Valid_Time_Position/>
<indicator:Observable id=":observable-5bb27780-ba04-4fa1-9198-700d8064ab0b">
<cybox:Object id=":DomainName-5bb27780-ba04-4fa1-9198-700d8064ab0b">
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
<DomainNameObj:Value condition="Equals">wonderfulinsights.com</DomainNameObj:Value>
</cybox:Properties>
</cybox:Object>
</indicator:Observable>
<indicator:Confidence timestamp="2018-10-01T15:37:36+00:00">
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
</indicator:Confidence>
</stixCommon:Indicator>
</incident:Related_Indicator>
</incident:Related_Indicators>
<incident:History>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">Event Threat Level: High</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: SOURCE:CITIZENLAB</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: DETECT</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: PUBLISHED</incident:Journal_Entry>
</incident:History_Item>
<incident:History_Item>
<incident:Journal_Entry time_precision="second">MISP Tag: TLP:WHITE</incident:Journal_Entry>
</incident:History_Item>
</incident:History>
<incident:Information_Source>
<stixCommon:Identity>
<stixCommon:Name>citizenlab</stixCommon:Name>
</stixCommon:Identity>
</incident:Information_Source>
<incident:Handling>
<marking:Marking>
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="GREEN"/>
</marking:Marking>
</incident:Handling>
</stix:Incident>
</stix:Incidents>
</stix:Package>
</stix:Related_Package>
</stix:Related_Packages>
</stix:STIX_Package>