Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs
This commit is contained in:
SsSnake
@@ -0,0 +1,3 @@
|
||||
# Burned After Reading: Endless Mayfly’s Ephemeral Disinformation Campaign
|
||||
|
||||
Indicators for the campaign "[Burned After Reading: Endless Mayfly’s Ephemeral Disinformation Campaign](https://citizenlab.ca/2019/05/burned-after-reading-endless-mayflys-ephemeral-disinformation-campaign/)" published by the Citizen Lab
|
||||
@@ -0,0 +1,8 @@
|
||||
uuid,event_id,category,type,value,comment,to_ids,date,object_relation,attribute_tag,object_uuid,object_name,object_meta_category
|
||||
"5cd56487-0b50-4e81-b7eb-651f0a14d415",138,"Payload delivery","md5","5b920c6cd1d8de54463f07965b8c43f3","",0,1557488775,"","","","",""
|
||||
"5cd56487-b340-4b92-a378-651f0a14d415",138,"Payload delivery","md5","07d495245814c5c4996422b4b2f52473","",0,1557488775,"","","","",""
|
||||
"5cd56487-4424-4859-99b3-651f0a14d415",138,"Payload delivery","md5","8522c77e48c846c2c026b6e16501a3b2","",0,1557488775,"","","","",""
|
||||
"5cd56487-a880-4c60-a6f0-651f0a14d415",138,"Payload delivery","md5","bc31493e996db7fe45b7ed7aaa51fd54","",0,1557488775,"","","","",""
|
||||
"5cd564a2-e098-43bc-8cd6-65920a14d415",138,"Network activity","ip-dst","217.182.54.223","",0,1557488802,"","","","",""
|
||||
"5cd564a2-7c6c-46b2-acb4-65920a14d415",138,"Network activity","ip-dst","51.255.101.144","",0,1557488802,"","","","",""
|
||||
|
||||
|
37
data/ioc/spyware/citizen_lab/201905_EndlessMayfly/iocs.ioc
Normal file
37
data/ioc/spyware/citizen_lab/201905_EndlessMayfly/iocs.ioc
Normal file
@@ -0,0 +1,37 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="5cd56458-a1b0-4129-8649-64d90a14d415" last-modified="2019-05-10T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
|
||||
<short_description>Event #138</short_description>
|
||||
<description>Burned After Reading: Endless Mayfly’s Ephemeral Disinformation Campaign (5cd56458-a1b0-4129-8649-64d90a14d415)</description>
|
||||
<keywords />
|
||||
<authored_by>MAIN</authored_by>
|
||||
<authored_date>2019-05-10T00:00:00</authored_date>
|
||||
<links />
|
||||
<definition>
|
||||
<Indicator operator="OR" id="5cd5657b-86f0-43c7-88a5-64db0a14d415">
|
||||
<IndicatorItem id="5cd56487-0b50-4e81-b7eb-651f0a14d415" condition="is">
|
||||
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
||||
<Content type="md5">5b920c6cd1d8de54463f07965b8c43f3</Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="5cd56487-b340-4b92-a378-651f0a14d415" condition="is">
|
||||
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
||||
<Content type="md5">07d495245814c5c4996422b4b2f52473</Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="5cd56487-4424-4859-99b3-651f0a14d415" condition="is">
|
||||
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
||||
<Content type="md5">8522c77e48c846c2c026b6e16501a3b2</Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="5cd56487-a880-4c60-a6f0-651f0a14d415" condition="is">
|
||||
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
||||
<Content type="md5">bc31493e996db7fe45b7ed7aaa51fd54</Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="5cd564a2-e098-43bc-8cd6-65920a14d415" condition="is">
|
||||
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
||||
<Content type="IP">217.182.54.223</Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="5cd564a2-7c6c-46b2-acb4-65920a14d415" condition="is">
|
||||
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
||||
<Content type="IP">51.255.101.144</Content>
|
||||
</IndicatorItem>
|
||||
</Indicator>
|
||||
</definition>
|
||||
</ioc>
|
||||
@@ -0,0 +1 @@
|
||||
{"response": [{"Event":{"id":"138","orgc_id":"1","org_id":"1","date":"2019-05-10","threat_level_id":"2","info":"Burned After Reading: Endless Mayfly\u2019s Ephemeral Disinformation Campaign","published":true,"uuid":"5cd56458-a1b0-4129-8649-64d90a14d415","attribute_count":"6","analysis":"2","timestamp":"1557488802","distribution":"1","proposal_email_lock":false,"locked":false,"publish_timestamp":"1557488829","sharing_group_id":"0","disable_correlation":false,"extends_uuid":"","event_creator_email":"tek@randhome.io","Org":{"id":"1","name":"MAIN","uuid":"5bd8e936-9bd4-4da2-8837-04067fcbd4ab"},"Orgc":{"id":"1","name":"MAIN","uuid":"5bd8e936-9bd4-4da2-8837-04067fcbd4ab"},"Attribute":[{"id":"16779","type":"md5","category":"Payload delivery","to_ids":false,"uuid":"5cd56487-0b50-4e81-b7eb-651f0a14d415","event_id":"138","distribution":"5","timestamp":"1557488775","comment":"","sharing_group_id":"0","deleted":false,"disable_correlation":false,"object_id":"0","object_relation":null,"value":"5b920c6cd1d8de54463f07965b8c43f3","Galaxy":[],"ShadowAttribute":[]},{"id":"16780","type":"md5","category":"Payload delivery","to_ids":false,"uuid":"5cd56487-b340-4b92-a378-651f0a14d415","event_id":"138","distribution":"5","timestamp":"1557488775","comment":"","sharing_group_id":"0","deleted":false,"disable_correlation":false,"object_id":"0","object_relation":null,"value":"07d495245814c5c4996422b4b2f52473","Galaxy":[],"ShadowAttribute":[]},{"id":"16781","type":"md5","category":"Payload delivery","to_ids":false,"uuid":"5cd56487-4424-4859-99b3-651f0a14d415","event_id":"138","distribution":"5","timestamp":"1557488775","comment":"","sharing_group_id":"0","deleted":false,"disable_correlation":false,"object_id":"0","object_relation":null,"value":"8522c77e48c846c2c026b6e16501a3b2","Galaxy":[],"ShadowAttribute":[]},{"id":"16782","type":"md5","category":"Payload delivery","to_ids":false,"uuid":"5cd56487-a880-4c60-a6f0-651f0a14d415","event_id":"138","distribution":"5","timestamp":"1557488775","comment":"","sharing_group_id":"0","deleted":false,"disable_correlation":false,"object_id":"0","object_relation":null,"value":"bc31493e996db7fe45b7ed7aaa51fd54","Galaxy":[],"ShadowAttribute":[]},{"id":"16783","type":"ip-dst","category":"Network activity","to_ids":false,"uuid":"5cd564a2-e098-43bc-8cd6-65920a14d415","event_id":"138","distribution":"5","timestamp":"1557488802","comment":"","sharing_group_id":"0","deleted":false,"disable_correlation":false,"object_id":"0","object_relation":null,"value":"217.182.54.223","Galaxy":[],"ShadowAttribute":[]},{"id":"16784","type":"ip-dst","category":"Network activity","to_ids":false,"uuid":"5cd564a2-7c6c-46b2-acb4-65920a14d415","event_id":"138","distribution":"5","timestamp":"1557488802","comment":"","sharing_group_id":"0","deleted":false,"disable_correlation":false,"object_id":"0","object_relation":null,"value":"51.255.101.144","Galaxy":[],"ShadowAttribute":[]}],"ShadowAttribute":[],"RelatedEvent":[],"Galaxy":[],"Object":[]}}]}
|
||||
172
data/ioc/spyware/citizen_lab/201905_EndlessMayfly/stix.xml
Normal file
172
data/ioc/spyware/citizen_lab/201905_EndlessMayfly/stix.xml
Normal file
@@ -0,0 +1,172 @@
|
||||
<stix:STIX_Package
|
||||
xmlns:ciqIdentity="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1"
|
||||
xmlns:xs="http://www.w3.org/2001/XMLSchema"
|
||||
xmlns:URIObj="http://cybox.mitre.org/objects#URIObject-2"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xmlns:xnl="urn:oasis:names:tc:ciq:xnl:3"
|
||||
xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
|
||||
xmlns:AccountObj="http://cybox.mitre.org/objects#AccountObject-2"
|
||||
xmlns:cybox="http://cybox.mitre.org/cybox-2"
|
||||
xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"
|
||||
xmlns:xlink="http://www.w3.org/1999/xlink"
|
||||
xmlns:EmailMessageObj="http://cybox.mitre.org/objects#EmailMessageObject-2"
|
||||
xmlns:WinExecutableFileObj="http://cybox.mitre.org/objects#WinExecutableFileObject-2"
|
||||
xmlns:ASObj="http://cybox.mitre.org/objects#ASObject-1"
|
||||
xmlns:PortObj="http://cybox.mitre.org/objects#PortObject-2"
|
||||
xmlns:SystemObj="http://cybox.mitre.org/objects#SystemObject-2"
|
||||
xmlns:HostnameObj="http://cybox.mitre.org/objects#HostnameObject-1"
|
||||
xmlns:et="http://stix.mitre.org/ExploitTarget-1"
|
||||
xmlns:snortTM="http://stix.mitre.org/extensions/TestMechanism#Snort-1"
|
||||
xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1"
|
||||
xmlns:PipeObj="http://cybox.mitre.org/objects#PipeObject-2"
|
||||
xmlns:WinServiceObj="http://cybox.mitre.org/objects#WinServiceObject-2"
|
||||
xmlns:WhoisObj="http://cybox.mitre.org/objects#WhoisObject-2"
|
||||
xmlns:WinRegistryKeyObj="http://cybox.mitre.org/objects#WinRegistryKeyObject-2"
|
||||
xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
|
||||
xmlns:incident="http://stix.mitre.org/Incident-1"
|
||||
xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"
|
||||
xmlns:ttp="http://stix.mitre.org/TTP-1"
|
||||
xmlns:SocketAddressObj="http://cybox.mitre.org/objects#SocketAddressObject-1"
|
||||
xmlns:xpil="urn:oasis:names:tc:ciq:xpil:3"
|
||||
xmlns:indicator="http://stix.mitre.org/Indicator-2"
|
||||
xmlns:marking="http://data-marking.mitre.org/Marking-1"
|
||||
xmlns:MutexObj="http://cybox.mitre.org/objects#MutexObject-2"
|
||||
xmlns:stixCommon="http://stix.mitre.org/common-1"
|
||||
xmlns:HTTPSessionObj="http://cybox.mitre.org/objects#HTTPSessionObject-2"
|
||||
xmlns:xal="urn:oasis:names:tc:ciq:xal:3"
|
||||
xmlns:ta="http://stix.mitre.org/ThreatActor-1"
|
||||
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
|
||||
xmlns:X509CertificateObj="http://cybox.mitre.org/objects#X509CertificateObject-2"
|
||||
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
|
||||
xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
|
||||
xmlns:ProcessObj="http://cybox.mitre.org/objects#ProcessObject-2"
|
||||
xmlns:stix="http://stix.mitre.org/stix-1"
|
||||
xmlns:NetworkConnectionObj="http://cybox.mitre.org/objects#NetworkConnectionObject-2"
|
||||
xmlns:NetworkSocketObj="http://cybox.mitre.org/objects#NetworkSocketObject-2"
|
||||
id="ORGNAME:Package-7b229daa-536d-496a-ab24-4eaf42d9a226" version="1.1.1" timestamp="2019-05-10T11:48:29.630785">
|
||||
<stix:STIX_Header>
|
||||
<stix:Title>Export from ORGNAME MISP</stix:Title>
|
||||
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
|
||||
</stix:STIX_Header>
|
||||
<stix:Related_Packages>
|
||||
<stix:Related_Package>
|
||||
<stix:Package id="ORGNAME:STIXPackage-5cd56458-a1b0-4129-8649-64d90a14d415" version="1.1.1" timestamp="2019-05-10T11:46:42">
|
||||
<stix:STIX_Header>
|
||||
<stix:Title>Export from ORGNAME MISP</stix:Title>
|
||||
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
|
||||
</stix:STIX_Header>
|
||||
<stix:Incidents>
|
||||
<stix:Incident id="ORGNAME:incident-5cd56458-a1b0-4129-8649-64d90a14d415" timestamp="2019-05-10T11:47:09" xsi:type='incident:IncidentType'>
|
||||
<incident:Title>Burned After Reading: Endless Mayfly’s Ephemeral Disinformation Campaign</incident:Title>
|
||||
<incident:External_ID source="MISP Event">138</incident:External_ID>
|
||||
<incident:Time>
|
||||
<incident:Incident_Discovery precision="second">2019-05-10T00:00:00</incident:Incident_Discovery>
|
||||
<incident:Incident_Reported precision="second">2019-05-10T11:47:09</incident:Incident_Reported>
|
||||
</incident:Time>
|
||||
<incident:Reporter>
|
||||
<stixCommon:Identity>
|
||||
<stixCommon:Name>MAIN</stixCommon:Name>
|
||||
</stixCommon:Identity>
|
||||
</incident:Reporter>
|
||||
<incident:Status xsi:type="stixVocabs:IncidentStatusVocab-1.0">Closed</incident:Status>
|
||||
<incident:Related_Observables>
|
||||
<incident:Related_Observable>
|
||||
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||||
<stixCommon:Observable id="ORGNAME:File-5cd56487-0b50-4e81-b7eb-651f0a14d415">
|
||||
<cybox:Object id="ORGNAME:FileObject-5cd56487-0b50-4e81-b7eb-651f0a14d415">
|
||||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||||
<FileObj:Hashes>
|
||||
<cyboxCommon:Hash>
|
||||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||||
<cyboxCommon:Simple_Hash_Value condition="Equals">5b920c6cd1d8de54463f07965b8c43f3</cyboxCommon:Simple_Hash_Value>
|
||||
</cyboxCommon:Hash>
|
||||
</FileObj:Hashes>
|
||||
</cybox:Properties>
|
||||
</cybox:Object>
|
||||
</stixCommon:Observable>
|
||||
</incident:Related_Observable>
|
||||
<incident:Related_Observable>
|
||||
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||||
<stixCommon:Observable id="ORGNAME:File-5cd56487-b340-4b92-a378-651f0a14d415">
|
||||
<cybox:Object id="ORGNAME:FileObject-5cd56487-b340-4b92-a378-651f0a14d415">
|
||||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||||
<FileObj:Hashes>
|
||||
<cyboxCommon:Hash>
|
||||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||||
<cyboxCommon:Simple_Hash_Value condition="Equals">07d495245814c5c4996422b4b2f52473</cyboxCommon:Simple_Hash_Value>
|
||||
</cyboxCommon:Hash>
|
||||
</FileObj:Hashes>
|
||||
</cybox:Properties>
|
||||
</cybox:Object>
|
||||
</stixCommon:Observable>
|
||||
</incident:Related_Observable>
|
||||
<incident:Related_Observable>
|
||||
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||||
<stixCommon:Observable id="ORGNAME:File-5cd56487-4424-4859-99b3-651f0a14d415">
|
||||
<cybox:Object id="ORGNAME:FileObject-5cd56487-4424-4859-99b3-651f0a14d415">
|
||||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||||
<FileObj:Hashes>
|
||||
<cyboxCommon:Hash>
|
||||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||||
<cyboxCommon:Simple_Hash_Value condition="Equals">8522c77e48c846c2c026b6e16501a3b2</cyboxCommon:Simple_Hash_Value>
|
||||
</cyboxCommon:Hash>
|
||||
</FileObj:Hashes>
|
||||
</cybox:Properties>
|
||||
</cybox:Object>
|
||||
</stixCommon:Observable>
|
||||
</incident:Related_Observable>
|
||||
<incident:Related_Observable>
|
||||
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||||
<stixCommon:Observable id="ORGNAME:File-5cd56487-a880-4c60-a6f0-651f0a14d415">
|
||||
<cybox:Object id="ORGNAME:FileObject-5cd56487-a880-4c60-a6f0-651f0a14d415">
|
||||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||||
<FileObj:Hashes>
|
||||
<cyboxCommon:Hash>
|
||||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||||
<cyboxCommon:Simple_Hash_Value condition="Equals">bc31493e996db7fe45b7ed7aaa51fd54</cyboxCommon:Simple_Hash_Value>
|
||||
</cyboxCommon:Hash>
|
||||
</FileObj:Hashes>
|
||||
</cybox:Properties>
|
||||
</cybox:Object>
|
||||
</stixCommon:Observable>
|
||||
</incident:Related_Observable>
|
||||
<incident:Related_Observable>
|
||||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||||
<stixCommon:Observable id="ORGNAME:Address-5cd564a2-e098-43bc-8cd6-65920a14d415">
|
||||
<cybox:Object id="ORGNAME:AddressObject-5cd564a2-e098-43bc-8cd6-65920a14d415">
|
||||
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false" is_destination="true">
|
||||
<AddressObj:Address_Value condition="Equals">217.182.54.223</AddressObj:Address_Value>
|
||||
</cybox:Properties>
|
||||
</cybox:Object>
|
||||
</stixCommon:Observable>
|
||||
</incident:Related_Observable>
|
||||
<incident:Related_Observable>
|
||||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||||
<stixCommon:Observable id="ORGNAME:Address-5cd564a2-7c6c-46b2-acb4-65920a14d415">
|
||||
<cybox:Object id="ORGNAME:AddressObject-5cd564a2-7c6c-46b2-acb4-65920a14d415">
|
||||
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false" is_destination="true">
|
||||
<AddressObj:Address_Value condition="Equals">51.255.101.144</AddressObj:Address_Value>
|
||||
</cybox:Properties>
|
||||
</cybox:Object>
|
||||
</stixCommon:Observable>
|
||||
</incident:Related_Observable>
|
||||
</incident:Related_Observables>
|
||||
<incident:History>
|
||||
<incident:History_Item>
|
||||
<incident:Journal_Entry time_precision="second">Event Threat Level: Medium</incident:Journal_Entry>
|
||||
</incident:History_Item>
|
||||
<incident:History_Item>
|
||||
<incident:Journal_Entry time_precision="second">MISP Tag: misp:tool="misp2stix"</incident:Journal_Entry>
|
||||
</incident:History_Item>
|
||||
</incident:History>
|
||||
<incident:Information_Source>
|
||||
<stixCommon:Identity>
|
||||
<stixCommon:Name>MAIN</stixCommon:Name>
|
||||
</stixCommon:Identity>
|
||||
</incident:Information_Source>
|
||||
</stix:Incident>
|
||||
</stix:Incidents>
|
||||
</stix:Package>
|
||||
</stix:Related_Package>
|
||||
</stix:Related_Packages>
|
||||
</stix:STIX_Package>
|
||||
Reference in New Issue
Block a user