<stix:STIX_Package
	xmlns:ciqIdentity="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1"
	xmlns:xs="http://www.w3.org/2001/XMLSchema"
	xmlns:URIObj="http://cybox.mitre.org/objects#URIObject-2"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:xnl="urn:oasis:names:tc:ciq:xnl:3"
	xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
	xmlns:AccountObj="http://cybox.mitre.org/objects#AccountObject-2"
	xmlns:cybox="http://cybox.mitre.org/cybox-2"
	xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"
	xmlns:xlink="http://www.w3.org/1999/xlink"
	xmlns:EmailMessageObj="http://cybox.mitre.org/objects#EmailMessageObject-2"
	xmlns:WinExecutableFileObj="http://cybox.mitre.org/objects#WinExecutableFileObject-2"
	xmlns:ASObj="http://cybox.mitre.org/objects#ASObject-1"
	xmlns:PortObj="http://cybox.mitre.org/objects#PortObject-2"
	xmlns:SystemObj="http://cybox.mitre.org/objects#SystemObject-2"
	xmlns:HostnameObj="http://cybox.mitre.org/objects#HostnameObject-1"
	xmlns:et="http://stix.mitre.org/ExploitTarget-1"
	xmlns:snortTM="http://stix.mitre.org/extensions/TestMechanism#Snort-1"
	xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1"
	xmlns:PipeObj="http://cybox.mitre.org/objects#PipeObject-2"
	xmlns:WinServiceObj="http://cybox.mitre.org/objects#WinServiceObject-2"
	xmlns:WhoisObj="http://cybox.mitre.org/objects#WhoisObject-2"
	xmlns:WinRegistryKeyObj="http://cybox.mitre.org/objects#WinRegistryKeyObject-2"
	xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
	xmlns:incident="http://stix.mitre.org/Incident-1"
	xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"
	xmlns:ttp="http://stix.mitre.org/TTP-1"
	xmlns:SocketAddressObj="http://cybox.mitre.org/objects#SocketAddressObject-1"
	xmlns:xpil="urn:oasis:names:tc:ciq:xpil:3"
	xmlns:indicator="http://stix.mitre.org/Indicator-2"
	xmlns:marking="http://data-marking.mitre.org/Marking-1"
	xmlns:MutexObj="http://cybox.mitre.org/objects#MutexObject-2"
	xmlns:stixCommon="http://stix.mitre.org/common-1"
	xmlns:HTTPSessionObj="http://cybox.mitre.org/objects#HTTPSessionObject-2"
	xmlns:xal="urn:oasis:names:tc:ciq:xal:3"
	xmlns:ta="http://stix.mitre.org/ThreatActor-1"
	xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
	xmlns:X509CertificateObj="http://cybox.mitre.org/objects#X509CertificateObject-2"
	xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
	xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
	xmlns:ProcessObj="http://cybox.mitre.org/objects#ProcessObject-2"
	xmlns:stix="http://stix.mitre.org/stix-1"
	xmlns:NetworkConnectionObj="http://cybox.mitre.org/objects#NetworkConnectionObject-2"
	xmlns:NetworkSocketObj="http://cybox.mitre.org/objects#NetworkSocketObject-2"
	 id="ORGNAME:Package-7b229daa-536d-496a-ab24-4eaf42d9a226" version="1.1.1" timestamp="2019-05-10T11:48:29.630785">
    <stix:STIX_Header>
        <stix:Title>Export from ORGNAME MISP</stix:Title>
        <stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
    </stix:STIX_Header>
    <stix:Related_Packages>
        <stix:Related_Package>
            <stix:Package id="ORGNAME:STIXPackage-5cd56458-a1b0-4129-8649-64d90a14d415" version="1.1.1" timestamp="2019-05-10T11:46:42">
                <stix:STIX_Header>
                    <stix:Title>Export from ORGNAME MISP</stix:Title>
                    <stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
                </stix:STIX_Header>
                <stix:Incidents>
                    <stix:Incident id="ORGNAME:incident-5cd56458-a1b0-4129-8649-64d90a14d415" timestamp="2019-05-10T11:47:09" xsi:type='incident:IncidentType'>
                        <incident:Title>Burned After Reading: Endless Mayfly’s Ephemeral Disinformation Campaign</incident:Title>
                        <incident:External_ID source="MISP Event">138</incident:External_ID>
                        <incident:Time>
                            <incident:Incident_Discovery precision="second">2019-05-10T00:00:00</incident:Incident_Discovery>
                            <incident:Incident_Reported precision="second">2019-05-10T11:47:09</incident:Incident_Reported>
                        </incident:Time>
                        <incident:Reporter>
                            <stixCommon:Identity>
                                <stixCommon:Name>MAIN</stixCommon:Name>
                            </stixCommon:Identity>
                        </incident:Reporter>
                        <incident:Status xsi:type="stixVocabs:IncidentStatusVocab-1.0">Closed</incident:Status>
                        <incident:Related_Observables>
                            <incident:Related_Observable>
                                <stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
                                <stixCommon:Observable id="ORGNAME:File-5cd56487-0b50-4e81-b7eb-651f0a14d415">
                                    <cybox:Object id="ORGNAME:FileObject-5cd56487-0b50-4e81-b7eb-651f0a14d415">
                                        <cybox:Properties xsi:type="FileObj:FileObjectType">
                                            <FileObj:Hashes>
                                                <cyboxCommon:Hash>
                                                    <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
                                                    <cyboxCommon:Simple_Hash_Value condition="Equals">5b920c6cd1d8de54463f07965b8c43f3</cyboxCommon:Simple_Hash_Value>
                                                </cyboxCommon:Hash>
                                            </FileObj:Hashes>
                                        </cybox:Properties>
                                    </cybox:Object>
                                </stixCommon:Observable>
                            </incident:Related_Observable>
                            <incident:Related_Observable>
                                <stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
                                <stixCommon:Observable id="ORGNAME:File-5cd56487-b340-4b92-a378-651f0a14d415">
                                    <cybox:Object id="ORGNAME:FileObject-5cd56487-b340-4b92-a378-651f0a14d415">
                                        <cybox:Properties xsi:type="FileObj:FileObjectType">
                                            <FileObj:Hashes>
                                                <cyboxCommon:Hash>
                                                    <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
                                                    <cyboxCommon:Simple_Hash_Value condition="Equals">07d495245814c5c4996422b4b2f52473</cyboxCommon:Simple_Hash_Value>
                                                </cyboxCommon:Hash>
                                            </FileObj:Hashes>
                                        </cybox:Properties>
                                    </cybox:Object>
                                </stixCommon:Observable>
                            </incident:Related_Observable>
                            <incident:Related_Observable>
                                <stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
                                <stixCommon:Observable id="ORGNAME:File-5cd56487-4424-4859-99b3-651f0a14d415">
                                    <cybox:Object id="ORGNAME:FileObject-5cd56487-4424-4859-99b3-651f0a14d415">
                                        <cybox:Properties xsi:type="FileObj:FileObjectType">
                                            <FileObj:Hashes>
                                                <cyboxCommon:Hash>
                                                    <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
                                                    <cyboxCommon:Simple_Hash_Value condition="Equals">8522c77e48c846c2c026b6e16501a3b2</cyboxCommon:Simple_Hash_Value>
                                                </cyboxCommon:Hash>
                                            </FileObj:Hashes>
                                        </cybox:Properties>
                                    </cybox:Object>
                                </stixCommon:Observable>
                            </incident:Related_Observable>
                            <incident:Related_Observable>
                                <stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
                                <stixCommon:Observable id="ORGNAME:File-5cd56487-a880-4c60-a6f0-651f0a14d415">
                                    <cybox:Object id="ORGNAME:FileObject-5cd56487-a880-4c60-a6f0-651f0a14d415">
                                        <cybox:Properties xsi:type="FileObj:FileObjectType">
                                            <FileObj:Hashes>
                                                <cyboxCommon:Hash>
                                                    <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
                                                    <cyboxCommon:Simple_Hash_Value condition="Equals">bc31493e996db7fe45b7ed7aaa51fd54</cyboxCommon:Simple_Hash_Value>
                                                </cyboxCommon:Hash>
                                            </FileObj:Hashes>
                                        </cybox:Properties>
                                    </cybox:Object>
                                </stixCommon:Observable>
                            </incident:Related_Observable>
                            <incident:Related_Observable>
                                <stixCommon:Relationship>Network activity</stixCommon:Relationship>
                                <stixCommon:Observable id="ORGNAME:Address-5cd564a2-e098-43bc-8cd6-65920a14d415">
                                    <cybox:Object id="ORGNAME:AddressObject-5cd564a2-e098-43bc-8cd6-65920a14d415">
                                        <cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false" is_destination="true">
                                            <AddressObj:Address_Value condition="Equals">217.182.54.223</AddressObj:Address_Value>
                                        </cybox:Properties>
                                    </cybox:Object>
                                </stixCommon:Observable>
                            </incident:Related_Observable>
                            <incident:Related_Observable>
                                <stixCommon:Relationship>Network activity</stixCommon:Relationship>
                                <stixCommon:Observable id="ORGNAME:Address-5cd564a2-7c6c-46b2-acb4-65920a14d415">
                                    <cybox:Object id="ORGNAME:AddressObject-5cd564a2-7c6c-46b2-acb4-65920a14d415">
                                        <cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false" is_destination="true">
                                            <AddressObj:Address_Value condition="Equals">51.255.101.144</AddressObj:Address_Value>
                                        </cybox:Properties>
                                    </cybox:Object>
                                </stixCommon:Observable>
                            </incident:Related_Observable>
                        </incident:Related_Observables>
                        <incident:History>
                            <incident:History_Item>
                                <incident:Journal_Entry time_precision="second">Event Threat Level: Medium</incident:Journal_Entry>
                            </incident:History_Item>
                            <incident:History_Item>
                                <incident:Journal_Entry time_precision="second">MISP Tag: misp:tool="misp2stix"</incident:Journal_Entry>
                            </incident:History_Item>
                        </incident:History>
                        <incident:Information_Source>
                            <stixCommon:Identity>
                                <stixCommon:Name>MAIN</stixCommon:Name>
                            </stixCommon:Identity>
                        </incident:Information_Source>
                    </stix:Incident>
                </stix:Incidents>
            </stix:Package>
        </stix:Related_Package>
    </stix:Related_Packages>
</stix:STIX_Package>