5243 lines
508 KiB
XML
5243 lines
508 KiB
XML
<stix:STIX_Package
|
||
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
|
||
xmlns:cybox="http://cybox.mitre.org/cybox-2"
|
||
xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
|
||
xmlns:ASObj="http://cybox.mitre.org/objects#ASObject-1"
|
||
xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
|
||
xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1"
|
||
xmlns:EmailMessageObj="http://cybox.mitre.org/objects#EmailMessageObject-2"
|
||
xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"
|
||
xmlns:HTTPSessionObj="http://cybox.mitre.org/objects#HTTPSessionObject-2"
|
||
xmlns:HostnameObj="http://cybox.mitre.org/objects#HostnameObject-1"
|
||
xmlns:MutexObj="http://cybox.mitre.org/objects#MutexObject-2"
|
||
xmlns:PipeObj="http://cybox.mitre.org/objects#PipeObject-2"
|
||
xmlns:URIObj="http://cybox.mitre.org/objects#URIObject-2"
|
||
xmlns:WinRegistryKeyObj="http://cybox.mitre.org/objects#WinRegistryKeyObject-2"
|
||
xmlns:marking="http://data-marking.mitre.org/Marking-1"
|
||
xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"
|
||
xmlns:et="http://stix.mitre.org/ExploitTarget-1"
|
||
xmlns:incident="http://stix.mitre.org/Incident-1"
|
||
xmlns:indicator="http://stix.mitre.org/Indicator-2"
|
||
xmlns:ttp="http://stix.mitre.org/TTP-1"
|
||
xmlns:ta="http://stix.mitre.org/ThreatActor-1"
|
||
xmlns:stixCommon="http://stix.mitre.org/common-1"
|
||
xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
|
||
xmlns:stix-ciqidentity="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1"
|
||
xmlns:snortTM="http://stix.mitre.org/extensions/TestMechanism#Snort-1"
|
||
xmlns:stix="http://stix.mitre.org/stix-1"
|
||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||
xmlns:="https://rufus.citlab.utoronto.ca"
|
||
xmlns:xal="urn:oasis:names:tc:ciq:xal:3"
|
||
xmlns:xnl="urn:oasis:names:tc:ciq:xnl:3"
|
||
xmlns:xpil="urn:oasis:names:tc:ciq:xpil:3"
|
||
xsi:schemaLocation="
|
||
http://cybox.mitre.org/common-2 http://cybox.mitre.org/XMLSchema/common/2.1/cybox_common.xsd
|
||
http://cybox.mitre.org/cybox-2 http://cybox.mitre.org/XMLSchema/core/2.1/cybox_core.xsd
|
||
http://cybox.mitre.org/default_vocabularies-2 http://cybox.mitre.org/XMLSchema/default_vocabularies/2.1/cybox_default_vocabularies.xsd
|
||
http://cybox.mitre.org/objects#ASObject-1 http://cybox.mitre.org/XMLSchema/objects/AS/1.0/AS_Object.xsd
|
||
http://cybox.mitre.org/objects#AddressObject-2 http://cybox.mitre.org/XMLSchema/objects/Address/2.1/Address_Object.xsd
|
||
http://cybox.mitre.org/objects#DomainNameObject-1 http://cybox.mitre.org/XMLSchema/objects/Domain_Name/1.0/Domain_Name_Object.xsd
|
||
http://cybox.mitre.org/objects#EmailMessageObject-2 http://cybox.mitre.org/XMLSchema/objects/Email_Message/2.1/Email_Message_Object.xsd
|
||
http://cybox.mitre.org/objects#FileObject-2 http://cybox.mitre.org/XMLSchema/objects/File/2.1/File_Object.xsd
|
||
http://cybox.mitre.org/objects#HTTPSessionObject-2 http://cybox.mitre.org/XMLSchema/objects/HTTP_Session/2.1/HTTP_Session_Object.xsd
|
||
http://cybox.mitre.org/objects#HostnameObject-1 http://cybox.mitre.org/XMLSchema/objects/Hostname/1.0/Hostname_Object.xsd
|
||
http://cybox.mitre.org/objects#MutexObject-2 http://cybox.mitre.org/XMLSchema/objects/Mutex/2.1/Mutex_Object.xsd
|
||
http://cybox.mitre.org/objects#PipeObject-2 http://cybox.mitre.org/XMLSchema/objects/Pipe/2.1/Pipe_Object.xsd
|
||
http://cybox.mitre.org/objects#URIObject-2 http://cybox.mitre.org/XMLSchema/objects/URI/2.1/URI_Object.xsd
|
||
http://cybox.mitre.org/objects#WinRegistryKeyObject-2 http://cybox.mitre.org/XMLSchema/objects/Win_Registry_Key/2.1/Win_Registry_Key_Object.xsd
|
||
http://data-marking.mitre.org/Marking-1 http://stix.mitre.org/XMLSchema/data_marking/1.1.1/data_marking.xsd
|
||
http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1 http://stix.mitre.org/XMLSchema/extensions/marking/tlp/1.1.1/tlp_marking.xsd
|
||
http://stix.mitre.org/ExploitTarget-1 http://stix.mitre.org/XMLSchema/exploit_target/1.1.1/exploit_target.xsd
|
||
http://stix.mitre.org/Incident-1 http://stix.mitre.org/XMLSchema/incident/1.1.1/incident.xsd
|
||
http://stix.mitre.org/Indicator-2 http://stix.mitre.org/XMLSchema/indicator/2.1.1/indicator.xsd
|
||
http://stix.mitre.org/TTP-1 http://stix.mitre.org/XMLSchema/ttp/1.1.1/ttp.xsd
|
||
http://stix.mitre.org/ThreatActor-1 http://stix.mitre.org/XMLSchema/threat_actor/1.1.1/threat_actor.xsd
|
||
http://stix.mitre.org/common-1 http://stix.mitre.org/XMLSchema/common/1.1.1/stix_common.xsd
|
||
http://stix.mitre.org/default_vocabularies-1 http://stix.mitre.org/XMLSchema/default_vocabularies/1.1.1/stix_default_vocabularies.xsd
|
||
http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1 http://stix.mitre.org/XMLSchema/extensions/identity/ciq_3.0/1.1.1/ciq_3.0_identity.xsd
|
||
http://stix.mitre.org/extensions/TestMechanism#Snort-1 http://stix.mitre.org/XMLSchema/extensions/test_mechanism/snort/1.1.1/snort_test_mechanism.xsd
|
||
http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.1.1/stix_core.xsd
|
||
urn:oasis:names:tc:ciq:xal:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xAL.xsd
|
||
urn:oasis:names:tc:ciq:xnl:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xNL.xsd
|
||
urn:oasis:names:tc:ciq:xpil:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xPIL.xsd" id=":Package-2de45e5f-6ccd-445d-affb-16a2a2f22214" version="1.1.1" timestamp="2016-11-08T21:38:30.512967+00:00">
|
||
<stix:STIX_Header>
|
||
<stix:Title>Export from MISP</stix:Title>
|
||
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
|
||
</stix:STIX_Header>
|
||
<stix:Related_Packages>
|
||
<stix:Related_Package>
|
||
<stix:Package id=":STIXPackage-581c11ef-a8c4-4c26-a4ea-49798e96ca05" version="1.1.1" timestamp="2016-11-08T16:36:35+00:00">
|
||
<stix:STIX_Header>
|
||
<stix:Title>Packrat: Seven Years of a South American Threat Actor (MISP Event #12)</stix:Title>
|
||
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
|
||
</stix:STIX_Header>
|
||
<stix:TTPs>
|
||
<stix:TTP id=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'>
|
||
<ttp:Title>Payload type: CyberGate (MISP Attribute #1350)</ttp:Title>
|
||
<ttp:Behavior>
|
||
<ttp:Malware>
|
||
<ttp:Malware_Instance>
|
||
<ttp:Name>CyberGate</ttp:Name>
|
||
</ttp:Malware_Instance>
|
||
</ttp:Malware>
|
||
</ttp:Behavior>
|
||
</stix:TTP>
|
||
<stix:TTP id=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'>
|
||
<ttp:Title>Payload type: Xtreme RAT (MISP Attribute #1351)</ttp:Title>
|
||
<ttp:Behavior>
|
||
<ttp:Malware>
|
||
<ttp:Malware_Instance>
|
||
<ttp:Name>Xtreme RAT</ttp:Name>
|
||
</ttp:Malware_Instance>
|
||
</ttp:Malware>
|
||
</ttp:Behavior>
|
||
</stix:TTP>
|
||
<stix:TTP id=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'>
|
||
<ttp:Title>Payload type: AlienSpy (MISP Attribute #1352)</ttp:Title>
|
||
<ttp:Behavior>
|
||
<ttp:Malware>
|
||
<ttp:Malware_Instance>
|
||
<ttp:Name>AlienSpy</ttp:Name>
|
||
</ttp:Malware_Instance>
|
||
</ttp:Malware>
|
||
</ttp:Behavior>
|
||
</stix:TTP>
|
||
<stix:TTP id=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'>
|
||
<ttp:Title>Payload type: Adzok (MISP Attribute #1353)</ttp:Title>
|
||
<ttp:Behavior>
|
||
<ttp:Malware>
|
||
<ttp:Malware_Instance>
|
||
<ttp:Name>Adzok</ttp:Name>
|
||
</ttp:Malware_Instance>
|
||
</ttp:Malware>
|
||
</ttp:Behavior>
|
||
</stix:TTP>
|
||
</stix:TTPs>
|
||
<stix:Incidents>
|
||
<stix:Incident id=":incident-581c11ef-a8c4-4c26-a4ea-49798e96ca05" timestamp="2016-11-08T16:38:11+00:00" xsi:type='incident:IncidentType'>
|
||
<incident:Title>Packrat: Seven Years of a South American Threat Actor</incident:Title>
|
||
<incident:External_ID source="MISP Event">12</incident:External_ID>
|
||
<incident:Time>
|
||
<incident:Incident_Discovery precision="second">2015-12-08T00:00:00+00:00</incident:Incident_Discovery>
|
||
<incident:Incident_Reported precision="second">2016-11-08T16:38:11+00:00</incident:Incident_Reported>
|
||
</incident:Time>
|
||
<incident:Status xsi:type="stixVocabs:IncidentStatusVocab-1.0">Closed</incident:Status>
|
||
<incident:Related_Indicators>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-b0bd3917-ba04-4d95-a5d3-928993f331a9" timestamp="2016-11-08T16:34:12+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: a988235ad7d47acbeca5ccb4ea5a1ed5 (MISP Attribute #539)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: a988235ad7d47acbeca5ccb4ea5a1ed5 (MISP Attribute #539)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-b0bd3917-ba04-4d95-a5d3-928993f331a9">
|
||
<cybox:Object id=":File-b0bd3917-ba04-4d95-a5d3-928993f331a9">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">a988235ad7d47acbeca5ccb4ea5a1ed5</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:34:12+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-2034aaac-cd1a-4f24-9c9e-a622763cc35a" timestamp="2016-11-08T16:34:21+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: 15ebe16cd9500de534d5bfd5eeceaf73 (MISP Attribute #540)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: 15ebe16cd9500de534d5bfd5eeceaf73 (MISP Attribute #540)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-2034aaac-cd1a-4f24-9c9e-a622763cc35a">
|
||
<cybox:Object id=":File-2034aaac-cd1a-4f24-9c9e-a622763cc35a">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">15ebe16cd9500de534d5bfd5eeceaf73</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:34:21+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-2cd0f135-c88d-4a89-8cd4-bbc6cd3efa0f" timestamp="2016-11-08T16:34:30+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: 01dec1b1d0760d5a1a562edcfeb478d1 (MISP Attribute #541)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: 01dec1b1d0760d5a1a562edcfeb478d1 (MISP Attribute #541)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-2cd0f135-c88d-4a89-8cd4-bbc6cd3efa0f">
|
||
<cybox:Object id=":File-2cd0f135-c88d-4a89-8cd4-bbc6cd3efa0f">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">01dec1b1d0760d5a1a562edcfeb478d1</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:34:30+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-378b1659-18cc-484d-aa90-df1a36849693" timestamp="2016-11-08T16:34:41+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: 1e6d0b59d4fb7650453c207688385f3a (MISP Attribute #542)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: 1e6d0b59d4fb7650453c207688385f3a (MISP Attribute #542)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-378b1659-18cc-484d-aa90-df1a36849693">
|
||
<cybox:Object id=":File-378b1659-18cc-484d-aa90-df1a36849693">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">1e6d0b59d4fb7650453c207688385f3a</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:34:41+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-440b7b2b-7d18-4a95-a95c-f4d80412535c" timestamp="2016-11-08T16:34:51+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: e03be1849ad7cecba1e20923074cd22f (MISP Attribute #543)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: e03be1849ad7cecba1e20923074cd22f (MISP Attribute #543)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-440b7b2b-7d18-4a95-a95c-f4d80412535c">
|
||
<cybox:Object id=":File-440b7b2b-7d18-4a95-a95c-f4d80412535c">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">e03be1849ad7cecba1e20923074cd22f</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:34:51+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-8d8d0ac6-1cbe-4d9c-9b3c-8b7dbd1a1ce4" timestamp="2016-11-08T16:35:02+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: 779a79c11f581b84e7c81f321fd8d743 (MISP Attribute #544)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: 779a79c11f581b84e7c81f321fd8d743 (MISP Attribute #544)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-8d8d0ac6-1cbe-4d9c-9b3c-8b7dbd1a1ce4">
|
||
<cybox:Object id=":File-8d8d0ac6-1cbe-4d9c-9b3c-8b7dbd1a1ce4">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">779a79c11f581b84e7c81f321fd8d743</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:35:02+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-9fbc655c-1010-4057-8af4-d29425574e3e" timestamp="2016-11-08T16:35:13+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: 13d939b2412c6adbab3cc1b539166671 (MISP Attribute #545)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: 13d939b2412c6adbab3cc1b539166671 (MISP Attribute #545)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-9fbc655c-1010-4057-8af4-d29425574e3e">
|
||
<cybox:Object id=":File-9fbc655c-1010-4057-8af4-d29425574e3e">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">13d939b2412c6adbab3cc1b539166671</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:35:13+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-3cd6d0dd-13e7-40b1-adaf-957bedfc212b" timestamp="2016-11-08T16:35:28+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: 7b2cb5249d704cb1df8d4210e7c3d553 (MISP Attribute #546)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: 7b2cb5249d704cb1df8d4210e7c3d553 (MISP Attribute #546)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-3cd6d0dd-13e7-40b1-adaf-957bedfc212b">
|
||
<cybox:Object id=":File-3cd6d0dd-13e7-40b1-adaf-957bedfc212b">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">7b2cb5249d704cb1df8d4210e7c3d553</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:35:28+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-665a391e-0346-477b-8062-0e093fba3333" timestamp="2016-11-08T16:35:38+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: a09f100ddc7cf29f8a93a3d7a79c58b9 (MISP Attribute #547)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: a09f100ddc7cf29f8a93a3d7a79c58b9 (MISP Attribute #547)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-665a391e-0346-477b-8062-0e093fba3333">
|
||
<cybox:Object id=":File-665a391e-0346-477b-8062-0e093fba3333">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">a09f100ddc7cf29f8a93a3d7a79c58b9</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:35:38+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-11c2de46-6ded-4948-914e-a8acff9ff027" timestamp="2016-11-08T16:36:04+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: ce6065346a918a813eeb58bbb0814a23 (MISP Attribute #548)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: ce6065346a918a813eeb58bbb0814a23 (MISP Attribute #548)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-11c2de46-6ded-4948-914e-a8acff9ff027">
|
||
<cybox:Object id=":File-11c2de46-6ded-4948-914e-a8acff9ff027">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">ce6065346a918a813eeb58bbb0814a23</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:36:04+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-ac5dde92-e97e-4b57-9305-5e439f9bbb40" timestamp="2016-11-08T16:36:13+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: ea50bf8abcf9c0c40c4490dc15fb0a2a (MISP Attribute #549)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: ea50bf8abcf9c0c40c4490dc15fb0a2a (MISP Attribute #549)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-ac5dde92-e97e-4b57-9305-5e439f9bbb40">
|
||
<cybox:Object id=":File-ac5dde92-e97e-4b57-9305-5e439f9bbb40">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">ea50bf8abcf9c0c40c4490dc15fb0a2a</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:36:13+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-85d91d34-8222-4b2e-b154-0b394ec75fe3" timestamp="2016-11-08T16:36:25+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: 3a61d64986ee6529cee271ab6754faa5 (MISP Attribute #550)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: 3a61d64986ee6529cee271ab6754faa5 (MISP Attribute #550)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-85d91d34-8222-4b2e-b154-0b394ec75fe3">
|
||
<cybox:Object id=":File-85d91d34-8222-4b2e-b154-0b394ec75fe3">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">3a61d64986ee6529cee271ab6754faa5</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:36:25+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-04da6270-0f60-44e0-a68c-bb6d0eb89d84" timestamp="2016-11-08T16:36:35+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: 695db7dd3b1daf89f2c56d59faecc088 (MISP Attribute #551)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: 695db7dd3b1daf89f2c56d59faecc088 (MISP Attribute #551)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-04da6270-0f60-44e0-a68c-bb6d0eb89d84">
|
||
<cybox:Object id=":File-04da6270-0f60-44e0-a68c-bb6d0eb89d84">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">695db7dd3b1daf89f2c56d59faecc088</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:36:35+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-da13fa70-4007-4c44-b611-a890dd8b1f31" timestamp="2016-11-08T16:31:42+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: ea7bcf58a4ccdecb0c64e56b9998a4ac (MISP Attribute #552)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: ea7bcf58a4ccdecb0c64e56b9998a4ac (MISP Attribute #552)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-da13fa70-4007-4c44-b611-a890dd8b1f31">
|
||
<cybox:Object id=":File-da13fa70-4007-4c44-b611-a890dd8b1f31">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">ea7bcf58a4ccdecb0c64e56b9998a4ac</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:31:42+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-1242c1d0-3d53-48f2-a30f-f6566a46b262" timestamp="2016-11-08T16:31:08+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: efc0009d76a2057f86c5f00030378c72 (MISP Attribute #553)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: efc0009d76a2057f86c5f00030378c72 (MISP Attribute #553)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-1242c1d0-3d53-48f2-a30f-f6566a46b262">
|
||
<cybox:Object id=":File-1242c1d0-3d53-48f2-a30f-f6566a46b262">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">efc0009d76a2057f86c5f00030378c72</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:31:08+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-a179e1f8-66e4-4055-a762-ed5d9166afa2" timestamp="2016-11-08T16:31:22+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: 74613eae84347183b4ca61b912a4573f (MISP Attribute #554)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: 74613eae84347183b4ca61b912a4573f (MISP Attribute #554)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-a179e1f8-66e4-4055-a762-ed5d9166afa2">
|
||
<cybox:Object id=":File-a179e1f8-66e4-4055-a762-ed5d9166afa2">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">74613eae84347183b4ca61b912a4573f</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:31:22+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-dad67427-90fd-429f-94cc-15aab9efefc7" timestamp="2016-11-08T16:30:31+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: bc97437fec7e7e8634c2eabae3cc4832 (MISP Attribute #555)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: bc97437fec7e7e8634c2eabae3cc4832 (MISP Attribute #555)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-dad67427-90fd-429f-94cc-15aab9efefc7">
|
||
<cybox:Object id=":File-dad67427-90fd-429f-94cc-15aab9efefc7">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">bc97437fec7e7e8634c2eabae3cc4832</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:30:31+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-a8d6eb71-318f-4516-b319-5e50d6996770" timestamp="2016-11-08T16:27:54+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: dd1101adc86fd282f5f183942cc2f3b7 (MISP Attribute #556)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: dd1101adc86fd282f5f183942cc2f3b7 (MISP Attribute #556)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-a8d6eb71-318f-4516-b319-5e50d6996770">
|
||
<cybox:Object id=":File-a8d6eb71-318f-4516-b319-5e50d6996770">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">dd1101adc86fd282f5f183942cc2f3b7</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:27:54+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-694b6503-2ef8-4da9-8adf-1eaf5b0393c8" timestamp="2016-11-08T16:28:09+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: 2d722592a4e3c8030410dccccb221ce4 (MISP Attribute #557)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: 2d722592a4e3c8030410dccccb221ce4 (MISP Attribute #557)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-694b6503-2ef8-4da9-8adf-1eaf5b0393c8">
|
||
<cybox:Object id=":File-694b6503-2ef8-4da9-8adf-1eaf5b0393c8">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">2d722592a4e3c8030410dccccb221ce4</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:28:09+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-475c2ee5-d819-4a55-bb4d-1d909905c039" timestamp="2016-11-08T16:28:44+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: d2adecc6287dd4d559fe6ce2ce7a7e31 (MISP Attribute #558)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: d2adecc6287dd4d559fe6ce2ce7a7e31 (MISP Attribute #558)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-475c2ee5-d819-4a55-bb4d-1d909905c039">
|
||
<cybox:Object id=":File-475c2ee5-d819-4a55-bb4d-1d909905c039">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">d2adecc6287dd4d559fe6ce2ce7a7e31</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:28:44+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-075b1d0f-b7b2-4571-bd0c-9a2ad1c98663" timestamp="2016-11-08T16:28:56+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: 93b630891db21a4a2350280a360c713d (MISP Attribute #559)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: 93b630891db21a4a2350280a360c713d (MISP Attribute #559)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-075b1d0f-b7b2-4571-bd0c-9a2ad1c98663">
|
||
<cybox:Object id=":File-075b1d0f-b7b2-4571-bd0c-9a2ad1c98663">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">93b630891db21a4a2350280a360c713d</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:28:56+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-17548c65-6dd6-473f-b79c-9ad3095fb9b2" timestamp="2016-11-08T16:29:09+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: a73351623577f44a2b578fed1e78e37e (MISP Attribute #560)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: a73351623577f44a2b578fed1e78e37e (MISP Attribute #560)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-17548c65-6dd6-473f-b79c-9ad3095fb9b2">
|
||
<cybox:Object id=":File-17548c65-6dd6-473f-b79c-9ad3095fb9b2">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">a73351623577f44a2b578fed1e78e37e</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:29:09+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-09e60b2e-a849-4dc3-9910-59cd78bc3f82" timestamp="2016-11-08T16:29:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: 5a8975873f52436377d8fb0b5ab0d87a (MISP Attribute #561)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: 5a8975873f52436377d8fb0b5ab0d87a (MISP Attribute #561)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-09e60b2e-a849-4dc3-9910-59cd78bc3f82">
|
||
<cybox:Object id=":File-09e60b2e-a849-4dc3-9910-59cd78bc3f82">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">5a8975873f52436377d8fb0b5ab0d87a</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:29:46+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-d036cf1a-59fb-4c11-9da9-cbf99f5733a7" timestamp="2016-11-08T16:29:55+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: ed8d7ed45b64890b8901b735018318f3 (MISP Attribute #562)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: ed8d7ed45b64890b8901b735018318f3 (MISP Attribute #562)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-d036cf1a-59fb-4c11-9da9-cbf99f5733a7">
|
||
<cybox:Object id=":File-d036cf1a-59fb-4c11-9da9-cbf99f5733a7">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">ed8d7ed45b64890b8901b735018318f3</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:29:55+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-3a638a7b-6cc4-4cfe-940c-921fb417e79c" timestamp="2016-11-08T16:30:08+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: c2237e9d415f542ce6e73adb260af123 (MISP Attribute #563)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: c2237e9d415f542ce6e73adb260af123 (MISP Attribute #563)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-3a638a7b-6cc4-4cfe-940c-921fb417e79c">
|
||
<cybox:Object id=":File-3a638a7b-6cc4-4cfe-940c-921fb417e79c">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">c2237e9d415f542ce6e73adb260af123</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:30:08+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-69d8d573-3f23-493b-97f4-8fa6b4cf9f1b" timestamp="2016-11-08T16:30:20+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: 2827450763b55c5e71fda3caaf8e75f9 (MISP Attribute #564)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: 2827450763b55c5e71fda3caaf8e75f9 (MISP Attribute #564)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-69d8d573-3f23-493b-97f4-8fa6b4cf9f1b">
|
||
<cybox:Object id=":File-69d8d573-3f23-493b-97f4-8fa6b4cf9f1b">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">2827450763b55c5e71fda3caaf8e75f9</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:30:20+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-8ae2e6c9-806a-4a57-aa17-aed767339990" timestamp="2016-11-08T16:30:43+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: d7f34168b1a7dd7cbd8e62a5ab1ebc0e (MISP Attribute #565)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: d7f34168b1a7dd7cbd8e62a5ab1ebc0e (MISP Attribute #565)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-8ae2e6c9-806a-4a57-aa17-aed767339990">
|
||
<cybox:Object id=":File-8ae2e6c9-806a-4a57-aa17-aed767339990">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">d7f34168b1a7dd7cbd8e62a5ab1ebc0e</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:30:43+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-f7dbcb2a-96c1-48d9-8bda-785348f8d91b" timestamp="2016-11-08T16:30:53+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: 6c34d4296126679d9c6a0bc2660dc453 (MISP Attribute #566)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: 6c34d4296126679d9c6a0bc2660dc453 (MISP Attribute #566)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-f7dbcb2a-96c1-48d9-8bda-785348f8d91b">
|
||
<cybox:Object id=":File-f7dbcb2a-96c1-48d9-8bda-785348f8d91b">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">6c34d4296126679d9c6a0bc2660dc453</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:30:53+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-8f38d4c7-dff5-484f-be90-3aaa3fba6753" timestamp="2016-11-08T16:31:33+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: d2f151312f7dee2483ddcab9766b56db (MISP Attribute #567)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: d2f151312f7dee2483ddcab9766b56db (MISP Attribute #567)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-8f38d4c7-dff5-484f-be90-3aaa3fba6753">
|
||
<cybox:Object id=":File-8f38d4c7-dff5-484f-be90-3aaa3fba6753">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">d2f151312f7dee2483ddcab9766b56db</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:31:33+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-55ab0c50-6ba9-44f0-bbf5-e30f13396fba" timestamp="2016-11-08T16:31:54+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: 1e4265a0c37773c2372b97bb6630ae57 (MISP Attribute #568)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: 1e4265a0c37773c2372b97bb6630ae57 (MISP Attribute #568)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-55ab0c50-6ba9-44f0-bbf5-e30f13396fba">
|
||
<cybox:Object id=":File-55ab0c50-6ba9-44f0-bbf5-e30f13396fba">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">1e4265a0c37773c2372b97bb6630ae57</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:31:54+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-c103e0dc-7fb4-4e6d-a3d1-d6dfadc90045" timestamp="2016-11-08T16:32:53+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: 08a3bb5b220eb1e0dc2ecccbbc6859f5 (MISP Attribute #569)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: 08a3bb5b220eb1e0dc2ecccbbc6859f5 (MISP Attribute #569)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-c103e0dc-7fb4-4e6d-a3d1-d6dfadc90045">
|
||
<cybox:Object id=":File-c103e0dc-7fb4-4e6d-a3d1-d6dfadc90045">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">08a3bb5b220eb1e0dc2ecccbbc6859f5</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:32:53+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-53d09cce-3d68-4a76-bddb-118176b5eda6" timestamp="2016-11-08T16:33:11+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: 2de51e74fd571319bbf763ec62781096 (MISP Attribute #570)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: 2de51e74fd571319bbf763ec62781096 (MISP Attribute #570)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-53d09cce-3d68-4a76-bddb-118176b5eda6">
|
||
<cybox:Object id=":File-53d09cce-3d68-4a76-bddb-118176b5eda6">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">2de51e74fd571319bbf763ec62781096</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:33:11+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-6cb4f4a0-1cf6-4cf4-98c2-5b9b93ff9867" timestamp="2016-11-08T16:33:21+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: 8fb96dfab7e4c0acb1eb9f4e950ba4b9 (MISP Attribute #571)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: 8fb96dfab7e4c0acb1eb9f4e950ba4b9 (MISP Attribute #571)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-6cb4f4a0-1cf6-4cf4-98c2-5b9b93ff9867">
|
||
<cybox:Object id=":File-6cb4f4a0-1cf6-4cf4-98c2-5b9b93ff9867">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">8fb96dfab7e4c0acb1eb9f4e950ba4b9</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:33:21+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-078ea337-c004-430a-87d7-982e517f81c4" timestamp="2016-11-08T16:33:31+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: 4a23a1d6779d199aaa582cf0a5868ad1 (MISP Attribute #572)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: 4a23a1d6779d199aaa582cf0a5868ad1 (MISP Attribute #572)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-078ea337-c004-430a-87d7-982e517f81c4">
|
||
<cybox:Object id=":File-078ea337-c004-430a-87d7-982e517f81c4">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">4a23a1d6779d199aaa582cf0a5868ad1</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:33:31+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-bd9e3887-abea-465a-9f42-4ca38ea31d17" timestamp="2016-11-08T16:33:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: 0ae0038ffe8cf5c3170734a71ff2213d (MISP Attribute #573)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: 0ae0038ffe8cf5c3170734a71ff2213d (MISP Attribute #573)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-bd9e3887-abea-465a-9f42-4ca38ea31d17">
|
||
<cybox:Object id=":File-bd9e3887-abea-465a-9f42-4ca38ea31d17">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">0ae0038ffe8cf5c3170734a71ff2213d</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:33:40+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-9096fec9-6b26-4c94-a9a1-8bfe16caf1b5" timestamp="2016-11-08T16:33:49+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: 8e0f021dcbbfa586a1c6780e77ac0fb6 (MISP Attribute #574)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: 8e0f021dcbbfa586a1c6780e77ac0fb6 (MISP Attribute #574)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-9096fec9-6b26-4c94-a9a1-8bfe16caf1b5">
|
||
<cybox:Object id=":File-9096fec9-6b26-4c94-a9a1-8bfe16caf1b5">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">8e0f021dcbbfa586a1c6780e77ac0fb6</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:33:49+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-341b2a91-d835-4766-8a27-d0a04cf9af90" timestamp="2016-11-08T16:34:00+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: a74ef893b1bf21c9df6d8e31285db981 (MISP Attribute #575)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: a74ef893b1bf21c9df6d8e31285db981 (MISP Attribute #575)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-341b2a91-d835-4766-8a27-d0a04cf9af90">
|
||
<cybox:Object id=":File-341b2a91-d835-4766-8a27-d0a04cf9af90">
|
||
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
||
<FileObj:Hashes>
|
||
<cyboxCommon:Hash>
|
||
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
||
<cyboxCommon:Simple_Hash_Value condition="Equals">a74ef893b1bf21c9df6d8e31285db981</cyboxCommon:Simple_Hash_Value>
|
||
</cyboxCommon:Hash>
|
||
</FileObj:Hashes>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:34:00+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-c7d3ba98-9951-45a1-864f-ad1c6c000aad" timestamp="2016-11-04T00:43:53+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: HKLM\SOFTWARE\Microsoft\Active (MISP Attribute #576)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Host Characteristics</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: HKLM\SOFTWARE\Microsoft\Active (MISP Attribute #576)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-c7d3ba98-9951-45a1-864f-ad1c6c000aad">
|
||
<cybox:Object id=":WinRegistryKey-c7d3ba98-9951-45a1-864f-ad1c6c000aad">
|
||
<cybox:Properties xsi:type="WinRegistryKeyObj:WindowsRegistryKeyObjectType">
|
||
<WinRegistryKeyObj:Key condition="Equals">SOFTWARE\Microsoft\Active</WinRegistryKeyObj:Key>
|
||
<WinRegistryKeyObj:Hive condition="Equals">HKEY_LOCAL_MACHINE</WinRegistryKeyObj:Hive>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:43:53+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-a723650f-2306-48f3-a588-e57822f92448" timestamp="2016-11-04T00:43:54+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\Policies (MISP Attribute #577)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Host Characteristics</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\Policies (MISP Attribute #577)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-a723650f-2306-48f3-a588-e57822f92448">
|
||
<cybox:Object id=":WinRegistryKey-a723650f-2306-48f3-a588-e57822f92448">
|
||
<cybox:Properties xsi:type="WinRegistryKeyObj:WindowsRegistryKeyObjectType">
|
||
<WinRegistryKeyObj:Key condition="Equals">SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\Policies</WinRegistryKeyObj:Key>
|
||
<WinRegistryKeyObj:Hive condition="Equals">HKEY_LOCAL_MACHINE</WinRegistryKeyObj:Hive>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:43:54+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-2738530c-979b-43ef-a7a3-6e509d38d073" timestamp="2016-11-04T00:43:54+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Artifacts dropped: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msconfig (MISP Attribute #578)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Host Characteristics</indicator:Type>
|
||
<indicator:Description>Artifacts dropped: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msconfig (MISP Attribute #578)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-2738530c-979b-43ef-a7a3-6e509d38d073">
|
||
<cybox:Object id=":WinRegistryKey-2738530c-979b-43ef-a7a3-6e509d38d073">
|
||
<cybox:Properties xsi:type="WinRegistryKeyObj:WindowsRegistryKeyObjectType">
|
||
<WinRegistryKeyObj:Key condition="Equals">SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msconfig</WinRegistryKeyObj:Key>
|
||
<WinRegistryKeyObj:Hive condition="Equals">HKEY_LOCAL_MACHINE</WinRegistryKeyObj:Hive>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:43:54+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-64c9eefd-aabd-47be-8a66-56a3f777fca0" timestamp="2016-11-04T00:43:55+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: taskmgr.redirectme.net (MISP Attribute #580)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: taskmgr.redirectme.net (MISP Attribute #580)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-64c9eefd-aabd-47be-8a66-56a3f777fca0">
|
||
<cybox:Object id=":DomainName-64c9eefd-aabd-47be-8a66-56a3f777fca0">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">taskmgr.redirectme.net</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:43:55+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-83aa404a-cb12-407c-993c-1ff9b7fa1947" timestamp="2016-11-04T00:43:55+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: ftp.server.com (MISP Attribute #581)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: ftp.server.com (MISP Attribute #581)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-83aa404a-cb12-407c-993c-1ff9b7fa1947">
|
||
<cybox:Object id=":DomainName-83aa404a-cb12-407c-993c-1ff9b7fa1947">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">ftp.server.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:43:55+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-19da57bf-1c40-4472-a9e1-696a56ff0d12" timestamp="2016-11-04T00:43:55+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: update-outlook.info (MISP Attribute #582)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: update-outlook.info (MISP Attribute #582)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-19da57bf-1c40-4472-a9e1-696a56ff0d12">
|
||
<cybox:Object id=":DomainName-19da57bf-1c40-4472-a9e1-696a56ff0d12">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">update-outlook.info</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:43:55+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-7b018a95-eb5d-4226-a5ca-9e32f4b288e4" timestamp="2016-11-04T00:43:56+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: deyrep.com (MISP Attribute #583)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: deyrep.com (MISP Attribute #583)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-7b018a95-eb5d-4226-a5ca-9e32f4b288e4">
|
||
<cybox:Object id=":DomainName-7b018a95-eb5d-4226-a5ca-9e32f4b288e4">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">deyrep.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:43:56+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-cfd9e067-855e-4c38-af7b-b1ec7b9c5e0f" timestamp="2016-11-04T00:43:56+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: support-whatsapp.com (MISP Attribute #584)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: support-whatsapp.com (MISP Attribute #584)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-cfd9e067-855e-4c38-af7b-b1ec7b9c5e0f">
|
||
<cybox:Object id=":DomainName-cfd9e067-855e-4c38-af7b-b1ec7b9c5e0f">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">support-whatsapp.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:43:56+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-668f1383-b9db-44fb-ab01-49537c77ad1e" timestamp="2016-11-04T00:43:56+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: blackboxmusic.co (MISP Attribute #585)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: blackboxmusic.co (MISP Attribute #585)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-668f1383-b9db-44fb-ab01-49537c77ad1e">
|
||
<cybox:Object id=":DomainName-668f1383-b9db-44fb-ab01-49537c77ad1e">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">blackboxmusic.co</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:43:56+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-035cef0c-ab5b-4870-8a2d-3fffb2002a86" timestamp="2016-11-04T00:43:57+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: www.blackboxmusic.co (MISP Attribute #586)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: www.blackboxmusic.co (MISP Attribute #586)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-035cef0c-ab5b-4870-8a2d-3fffb2002a86">
|
||
<cybox:Object id=":DomainName-035cef0c-ab5b-4870-8a2d-3fffb2002a86">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">www.blackboxmusic.co</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:43:57+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-102812f0-1515-475b-85c9-fe3b9f298322" timestamp="2016-11-04T00:43:57+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: mail-account-update.com (MISP Attribute #587)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: mail-account-update.com (MISP Attribute #587)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-102812f0-1515-475b-85c9-fe3b9f298322">
|
||
<cybox:Object id=":DomainName-102812f0-1515-475b-85c9-fe3b9f298322">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">mail-account-update.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:43:57+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-abb6b95e-2364-4aad-b826-7c925b587d0a" timestamp="2016-11-04T00:43:58+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: lavozmericana.info (MISP Attribute #588)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: lavozmericana.info (MISP Attribute #588)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-abb6b95e-2364-4aad-b826-7c925b587d0a">
|
||
<cybox:Object id=":DomainName-abb6b95e-2364-4aad-b826-7c925b587d0a">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">lavozmericana.info</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:43:58+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-1d17b791-20fd-4a0b-b074-36282e6fe9b9" timestamp="2016-11-04T00:43:58+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: support-java.com (MISP Attribute #589)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: support-java.com (MISP Attribute #589)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-1d17b791-20fd-4a0b-b074-36282e6fe9b9">
|
||
<cybox:Object id=":DomainName-1d17b791-20fd-4a0b-b074-36282e6fe9b9">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">support-java.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:43:58+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-ab318121-5622-4ea7-aca3-59e972601644" timestamp="2016-11-04T00:43:58+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: n3.pancaliente.info (MISP Attribute #590)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: n3.pancaliente.info (MISP Attribute #590)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-ab318121-5622-4ea7-aca3-59e972601644">
|
||
<cybox:Object id=":DomainName-ab318121-5622-4ea7-aca3-59e972601644">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">n3.pancaliente.info</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:43:58+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-613fc81a-9472-402a-864f-ba796bd820f9" timestamp="2016-11-04T00:43:59+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: n4.pancaliente.info (MISP Attribute #591)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: n4.pancaliente.info (MISP Attribute #591)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-613fc81a-9472-402a-864f-ba796bd820f9">
|
||
<cybox:Object id=":DomainName-613fc81a-9472-402a-864f-ba796bd820f9">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">n4.pancaliente.info</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:43:59+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-576bf524-78bd-47b8-9ae0-54ecea1bb4af" timestamp="2016-11-04T00:43:59+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: ns1.deyrep.com (MISP Attribute #592)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: ns1.deyrep.com (MISP Attribute #592)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-576bf524-78bd-47b8-9ae0-54ecea1bb4af">
|
||
<cybox:Object id=":DomainName-576bf524-78bd-47b8-9ae0-54ecea1bb4af">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">ns1.deyrep.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:43:59+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-7ca51a3d-b093-497f-accf-00bca0964287" timestamp="2016-11-04T00:44:00+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: ns2.deyrep.com (MISP Attribute #593)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: ns2.deyrep.com (MISP Attribute #593)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-7ca51a3d-b093-497f-accf-00bca0964287">
|
||
<cybox:Object id=":DomainName-7ca51a3d-b093-497f-accf-00bca0964287">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">ns2.deyrep.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:00+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-32c1f9d8-b15a-4f28-a91d-1d781b28aaa0" timestamp="2016-11-04T00:44:00+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: n1.login-office365.com (MISP Attribute #594)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: n1.login-office365.com (MISP Attribute #594)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-32c1f9d8-b15a-4f28-a91d-1d781b28aaa0">
|
||
<cybox:Object id=":DomainName-32c1f9d8-b15a-4f28-a91d-1d781b28aaa0">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">n1.login-office365.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:00+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-7908fe7c-4346-4810-9f79-3ad2a8b93fd6" timestamp="2016-11-04T00:44:01+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: n2.login-office365.com (MISP Attribute #595)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: n2.login-office365.com (MISP Attribute #595)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-7908fe7c-4346-4810-9f79-3ad2a8b93fd6">
|
||
<cybox:Object id=":DomainName-7908fe7c-4346-4810-9f79-3ad2a8b93fd6">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">n2.login-office365.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:01+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-b0df1407-9653-4f07-8f2e-5cd7f1c1a212" timestamp="2016-11-04T00:44:01+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: n1.update-outlook.info (MISP Attribute #596)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: n1.update-outlook.info (MISP Attribute #596)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-b0df1407-9653-4f07-8f2e-5cd7f1c1a212">
|
||
<cybox:Object id=":DomainName-b0df1407-9653-4f07-8f2e-5cd7f1c1a212">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">n1.update-outlook.info</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:01+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-fd6b3ff2-e441-4bc1-ba2d-d3d9dd50ab24" timestamp="2016-11-04T00:44:01+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: ns.update-outlook.info (MISP Attribute #597)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: ns.update-outlook.info (MISP Attribute #597)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-fd6b3ff2-e441-4bc1-ba2d-d3d9dd50ab24">
|
||
<cybox:Object id=":DomainName-fd6b3ff2-e441-4bc1-ba2d-d3d9dd50ab24">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">ns.update-outlook.info</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:01+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-65be605b-ce44-483a-9398-c9b6c1d2584f" timestamp="2016-11-04T00:44:02+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: s1.mgoogle.us (MISP Attribute #598)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: s1.mgoogle.us (MISP Attribute #598)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-65be605b-ce44-483a-9398-c9b6c1d2584f">
|
||
<cybox:Object id=":DomainName-65be605b-ce44-483a-9398-c9b6c1d2584f">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">s1.mgoogle.us</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:02+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-bc40a9ee-df43-4ba3-ad9d-529dc845d04b" timestamp="2016-11-04T00:44:02+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: s2.mgoogle.us (MISP Attribute #599)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: s2.mgoogle.us (MISP Attribute #599)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-bc40a9ee-df43-4ba3-ad9d-529dc845d04b">
|
||
<cybox:Object id=":DomainName-bc40a9ee-df43-4ba3-ad9d-529dc845d04b">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">s2.mgoogle.us</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:02+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-f7508074-3443-4ceb-a1b6-08e87bc65b44" timestamp="2016-11-04T00:44:03+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: support-login-validate-outlook.tk (MISP Attribute #600)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: support-login-validate-outlook.tk (MISP Attribute #600)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-f7508074-3443-4ceb-a1b6-08e87bc65b44">
|
||
<cybox:Object id=":DomainName-f7508074-3443-4ceb-a1b6-08e87bc65b44">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">support-login-validate-outlook.tk</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:03+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-1b9f7074-c66c-472d-8917-0592bd07202e" timestamp="2016-11-04T00:44:03+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: verify-gmail-support-secure.tk (MISP Attribute #601)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: verify-gmail-support-secure.tk (MISP Attribute #601)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-1b9f7074-c66c-472d-8917-0592bd07202e">
|
||
<cybox:Object id=":DomainName-1b9f7074-c66c-472d-8917-0592bd07202e">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">verify-gmail-support-secure.tk</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:03+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-b373771f-54f4-4559-8297-52779ee94c28" timestamp="2016-11-04T00:44:04+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: soporte-login-account-gmail.tk (MISP Attribute #602)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: soporte-login-account-gmail.tk (MISP Attribute #602)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-b373771f-54f4-4559-8297-52779ee94c28">
|
||
<cybox:Object id=":DomainName-b373771f-54f4-4559-8297-52779ee94c28">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">soporte-login-account-gmail.tk</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:04+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-5f6ed532-7034-4529-8f1f-eca4f3ead06a" timestamp="2016-11-04T00:44:04+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: soporte-login-account-yahoo.tk (MISP Attribute #603)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: soporte-login-account-yahoo.tk (MISP Attribute #603)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-5f6ed532-7034-4529-8f1f-eca4f3ead06a">
|
||
<cybox:Object id=":DomainName-5f6ed532-7034-4529-8f1f-eca4f3ead06a">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">soporte-login-account-yahoo.tk</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:04+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-887aba05-4662-4967-8d93-09cb8b3d7685" timestamp="2016-11-04T00:44:04+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: n1.support-java.com (MISP Attribute #604)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: n1.support-java.com (MISP Attribute #604)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-887aba05-4662-4967-8d93-09cb8b3d7685">
|
||
<cybox:Object id=":DomainName-887aba05-4662-4967-8d93-09cb8b3d7685">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">n1.support-java.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:04+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-aea5a3f5-d174-47c1-81a0-c97a5a478e00" timestamp="2016-11-04T00:44:05+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: n1.lavozamericana.info (MISP Attribute #605)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: n1.lavozamericana.info (MISP Attribute #605)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-aea5a3f5-d174-47c1-81a0-c97a5a478e00">
|
||
<cybox:Object id=":DomainName-aea5a3f5-d174-47c1-81a0-c97a5a478e00">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">n1.lavozamericana.info</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:05+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-d605e928-93ec-4aec-897e-0de476fe3f0e" timestamp="2016-11-04T00:44:05+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: s1.support (MISP Attribute #606)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: s1.support (MISP Attribute #606)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-d605e928-93ec-4aec-897e-0de476fe3f0e">
|
||
<cybox:Object id=":DomainName-d605e928-93ec-4aec-897e-0de476fe3f0e">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">s1.support</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:05+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-2bcfdd38-8a5d-4512-b575-9b06096bed81" timestamp="2016-11-04T00:44:06+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: ns1.ukraine.com.ua (MISP Attribute #607)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: ns1.ukraine.com.ua (MISP Attribute #607)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-2bcfdd38-8a5d-4512-b575-9b06096bed81">
|
||
<cybox:Object id=":DomainName-2bcfdd38-8a5d-4512-b575-9b06096bed81">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">ns1.ukraine.com.ua</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:06+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-a0787877-1f51-45a2-a268-99585abd3753" timestamp="2016-11-04T00:44:07+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: android-flash.com (MISP Attribute #608)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: android-flash.com (MISP Attribute #608)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-a0787877-1f51-45a2-a268-99585abd3753">
|
||
<cybox:Object id=":DomainName-a0787877-1f51-45a2-a268-99585abd3753">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">android-flash.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:07+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-2b8e7578-2b1b-4ee4-b690-812825551490" timestamp="2016-11-08T16:24:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: deyrep24.ddns.net (MISP Attribute #609)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: deyrep24.ddns.net (MISP Attribute #609)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-2b8e7578-2b1b-4ee4-b690-812825551490">
|
||
<cybox:Object id=":DomainName-2b8e7578-2b1b-4ee4-b690-812825551490">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">deyrep24.ddns.net</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:24:48+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-c6f40987-2e22-495f-9fcf-ce681c67e901" timestamp="2016-11-08T16:26:30+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: daynews.sytes.net (MISP Attribute #610)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: daynews.sytes.net (MISP Attribute #610)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-c6f40987-2e22-495f-9fcf-ce681c67e901">
|
||
<cybox:Object id=":DomainName-c6f40987-2e22-495f-9fcf-ce681c67e901">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">daynews.sytes.net</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:26:30+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-1f129d35-b9b2-42b4-81f6-8903c25c7080" timestamp="2016-11-08T16:26:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: taskmgr.serveftp.com (MISP Attribute #611)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: taskmgr.serveftp.com (MISP Attribute #611)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-1f129d35-b9b2-42b4-81f6-8903c25c7080">
|
||
<cybox:Object id=":DomainName-1f129d35-b9b2-42b4-81f6-8903c25c7080">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">taskmgr.serveftp.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:26:48+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-d79f9f17-548f-4712-afdf-a8dc5dc43be1" timestamp="2016-11-04T00:44:09+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: taskmgr.servehttp.com (MISP Attribute #612)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: taskmgr.servehttp.com (MISP Attribute #612)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-d79f9f17-548f-4712-afdf-a8dc5dc43be1">
|
||
<cybox:Object id=":DomainName-d79f9f17-548f-4712-afdf-a8dc5dc43be1">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">taskmgr.servehttp.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:09+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-4e37e013-f1ce-4df9-ae83-f04eb6b18ba9" timestamp="2016-11-04T00:44:09+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: taskmgr.redirectme.com (MISP Attribute #613)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: taskmgr.redirectme.com (MISP Attribute #613)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-4e37e013-f1ce-4df9-ae83-f04eb6b18ba9">
|
||
<cybox:Object id=":DomainName-4e37e013-f1ce-4df9-ae83-f04eb6b18ba9">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">taskmgr.redirectme.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:09+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-b812855c-8fdc-41f2-8857-8966aa84ea89" timestamp="2016-11-04T00:44:10+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: ruley.no-ip.org (MISP Attribute #614)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: ruley.no-ip.org (MISP Attribute #614)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-b812855c-8fdc-41f2-8857-8966aa84ea89">
|
||
<cybox:Object id=":DomainName-b812855c-8fdc-41f2-8857-8966aa84ea89">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">ruley.no-ip.org</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:10+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-83bc4a8a-fe39-48d7-b26c-f4e4bfe08cde" timestamp="2016-11-04T00:44:10+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: lolinha.no-ip.org (MISP Attribute #615)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: lolinha.no-ip.org (MISP Attribute #615)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-83bc4a8a-fe39-48d7-b26c-f4e4bfe08cde">
|
||
<cybox:Object id=":DomainName-83bc4a8a-fe39-48d7-b26c-f4e4bfe08cde">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">lolinha.no-ip.org</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:10+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-cbdf99c3-ac02-49e1-bd44-aa95c5e2acac" timestamp="2016-11-04T00:44:11+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: wjwj.no-ip.org (MISP Attribute #616)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: wjwj.no-ip.org (MISP Attribute #616)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-cbdf99c3-ac02-49e1-bd44-aa95c5e2acac">
|
||
<cybox:Object id=":DomainName-cbdf99c3-ac02-49e1-bd44-aa95c5e2acac">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">wjwj.no-ip.org</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:11+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-1013af0f-98ea-44cf-8c57-d5dfcc2a9398" timestamp="2016-11-04T00:44:11+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: conhost.servehttp.com (MISP Attribute #617)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: conhost.servehttp.com (MISP Attribute #617)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-1013af0f-98ea-44cf-8c57-d5dfcc2a9398">
|
||
<cybox:Object id=":DomainName-1013af0f-98ea-44cf-8c57-d5dfcc2a9398">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">conhost.servehttp.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:11+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-29d3b93f-a8c7-46f0-8aaa-d5b1d3a7efa6" timestamp="2016-11-04T00:44:12+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: dllhost.servehttp.com (MISP Attribute #618)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: dllhost.servehttp.com (MISP Attribute #618)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-29d3b93f-a8c7-46f0-8aaa-d5b1d3a7efa6">
|
||
<cybox:Object id=":DomainName-29d3b93f-a8c7-46f0-8aaa-d5b1d3a7efa6">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">dllhost.servehttp.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:12+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-c67572b2-b7f4-4f32-9e4d-a8892079fec4" timestamp="2016-11-04T00:44:12+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: wjwjwj.no-ip.org (MISP Attribute #619)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: wjwjwj.no-ip.org (MISP Attribute #619)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-c67572b2-b7f4-4f32-9e4d-a8892079fec4">
|
||
<cybox:Object id=":DomainName-c67572b2-b7f4-4f32-9e4d-a8892079fec4">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">wjwjwj.no-ip.org</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:12+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-a38d5330-38f4-4016-a6a5-82fefed9aacd" timestamp="2016-11-04T00:44:13+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: wjwjwjwj.no-ip.org (MISP Attribute #620)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: wjwjwjwj.no-ip.org (MISP Attribute #620)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-a38d5330-38f4-4016-a6a5-82fefed9aacd">
|
||
<cybox:Object id=":DomainName-a38d5330-38f4-4016-a6a5-82fefed9aacd">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">wjwjwjwj.no-ip.org</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:13+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-b66ec73a-4faf-4873-bdd8-8fdde6207ca4" timestamp="2016-11-04T00:44:13+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: ecuadorenvivo.co (MISP Attribute #621)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: ecuadorenvivo.co (MISP Attribute #621)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-b66ec73a-4faf-4873-bdd8-8fdde6207ca4">
|
||
<cybox:Object id=":DomainName-b66ec73a-4faf-4873-bdd8-8fdde6207ca4">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">ecuadorenvivo.co</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:13+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-568339a3-cddf-4539-8e40-f2d726a5341b" timestamp="2016-11-04T00:44:14+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: ecuadorenvivo.com (MISP Attribute #622)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: ecuadorenvivo.com (MISP Attribute #622)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-568339a3-cddf-4539-8e40-f2d726a5341b">
|
||
<cybox:Object id=":DomainName-568339a3-cddf-4539-8e40-f2d726a5341b">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">ecuadorenvivo.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:14+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-93541388-7cc4-436a-bf73-1e1584776a59" timestamp="2016-11-04T00:44:15+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: www.movimientoanticorreista.com (MISP Attribute #623)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: www.movimientoanticorreista.com (MISP Attribute #623)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-93541388-7cc4-436a-bf73-1e1584776a59">
|
||
<cybox:Object id=":DomainName-93541388-7cc4-436a-bf73-1e1584776a59">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">www.movimientoanticorreista.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:15+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-33a05e11-fe8c-47e0-b8a2-55b568df6adf" timestamp="2016-11-04T00:44:15+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: focusecuador.tk (MISP Attribute #624)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: focusecuador.tk (MISP Attribute #624)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-33a05e11-fe8c-47e0-b8a2-55b568df6adf">
|
||
<cybox:Object id=":DomainName-33a05e11-fe8c-47e0-b8a2-55b568df6adf">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">focusecuador.tk</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:15+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-22c32e7b-f0a5-4e57-8821-a080cb880cdb" timestamp="2016-11-04T00:44:16+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: mesvr.com (MISP Attribute #625)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: mesvr.com (MISP Attribute #625)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-22c32e7b-f0a5-4e57-8821-a080cb880cdb">
|
||
<cybox:Object id=":DomainName-22c32e7b-f0a5-4e57-8821-a080cb880cdb">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">mesvr.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:16+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-a391d94a-2311-4420-a315-067f450915c2" timestamp="2016-11-04T00:44:16+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: ftp.ftpserver.com (MISP Attribute #626)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: ftp.ftpserver.com (MISP Attribute #626)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-a391d94a-2311-4420-a315-067f450915c2">
|
||
<cybox:Object id=":DomainName-a391d94a-2311-4420-a315-067f450915c2">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">ftp.ftpserver.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:16+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-f5818138-37c1-412a-8cf7-2d7bcb538367" timestamp="2016-11-04T00:44:17+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: lavozamericana.info (MISP Attribute #627)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: lavozamericana.info (MISP Attribute #627)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-f5818138-37c1-412a-8cf7-2d7bcb538367">
|
||
<cybox:Object id=":DomainName-f5818138-37c1-412a-8cf7-2d7bcb538367">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">lavozamericana.info</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:17+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-8eecda70-e625-413f-b7fc-8451d76f4765" timestamp="2016-11-04T00:44:18+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: ec.cu9.co (MISP Attribute #628)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: ec.cu9.co (MISP Attribute #628)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-8eecda70-e625-413f-b7fc-8451d76f4765">
|
||
<cybox:Object id=":DomainName-8eecda70-e625-413f-b7fc-8451d76f4765">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">ec.cu9.co</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:18+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-395f1ba8-c107-4622-a845-f2a2e2660b64" timestamp="2016-11-04T00:44:18+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: movimientoanticorreista.com (MISP Attribute #629)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: movimientoanticorreista.com (MISP Attribute #629)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-395f1ba8-c107-4622-a845-f2a2e2660b64">
|
||
<cybox:Object id=":DomainName-395f1ba8-c107-4622-a845-f2a2e2660b64">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">movimientoanticorreista.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:18+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-74bc6c34-77bb-4328-9edc-75059585e539" timestamp="2016-11-04T00:44:19+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: mgoogle.us (MISP Attribute #630)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: mgoogle.us (MISP Attribute #630)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-74bc6c34-77bb-4328-9edc-75059585e539">
|
||
<cybox:Object id=":DomainName-74bc6c34-77bb-4328-9edc-75059585e539">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">mgoogle.us</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:19+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-b5b19817-6112-4eeb-b3d1-666f92b33ee7" timestamp="2016-11-04T00:44:20+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: no.response.delivery.es (MISP Attribute #631)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: no.response.delivery.es (MISP Attribute #631)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-b5b19817-6112-4eeb-b3d1-666f92b33ee7">
|
||
<cybox:Object id=":DomainName-b5b19817-6112-4eeb-b3d1-666f92b33ee7">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">no.response.delivery.es</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:20+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-50dd1978-ed90-48a0-8fae-f841d7d26c0e" timestamp="2016-11-04T00:44:20+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: cu9.co (MISP Attribute #632)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: cu9.co (MISP Attribute #632)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-50dd1978-ed90-48a0-8fae-f841d7d26c0e">
|
||
<cybox:Object id=":DomainName-50dd1978-ed90-48a0-8fae-f841d7d26c0e">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">cu9.co</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:20+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-491292ff-d9e0-481e-aed8-575ac817cff9" timestamp="2016-11-04T00:44:21+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: asambleanacional-gob-ec.cu9.co (MISP Attribute #634)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: asambleanacional-gob-ec.cu9.co (MISP Attribute #634)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-491292ff-d9e0-481e-aed8-575ac817cff9">
|
||
<cybox:Object id=":DomainName-491292ff-d9e0-481e-aed8-575ac817cff9">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">asambleanacional-gob-ec.cu9.co</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:21+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-cf896608-add9-45a1-8a66-8a04096b70f1" timestamp="2016-11-04T00:44:22+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: mail.asambleanacional.gob.ec (MISP Attribute #635)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: mail.asambleanacional.gob.ec (MISP Attribute #635)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-cf896608-add9-45a1-8a66-8a04096b70f1">
|
||
<cybox:Object id=":DomainName-cf896608-add9-45a1-8a66-8a04096b70f1">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">mail.asambleanacional.gob.ec</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:22+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-53063744-8009-4309-823f-44ac089a9f4d" timestamp="2016-11-04T00:44:23+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: formmail.com (MISP Attribute #636)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: formmail.com (MISP Attribute #636)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-53063744-8009-4309-823f-44ac089a9f4d">
|
||
<cybox:Object id=":DomainName-53063744-8009-4309-823f-44ac089a9f4d">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">formmail.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:23+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-c00a3cd4-3530-4a3d-a0b2-4231aad495ad" timestamp="2016-11-04T00:44:23+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: login-office365.com (MISP Attribute #637)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: login-office365.com (MISP Attribute #637)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-c00a3cd4-3530-4a3d-a0b2-4231aad495ad">
|
||
<cybox:Object id=":DomainName-c00a3cd4-3530-4a3d-a0b2-4231aad495ad">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">login-office365.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:23+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-abc292cf-5485-4189-8c0a-b18d830cc7f2" timestamp="2016-11-04T00:44:24+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: pancaliente.info (MISP Attribute #638)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: pancaliente.info (MISP Attribute #638)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-abc292cf-5485-4189-8c0a-b18d830cc7f2">
|
||
<cybox:Object id=":DomainName-abc292cf-5485-4189-8c0a-b18d830cc7f2">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">pancaliente.info</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:24+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-77cc5d54-a422-4f1b-ab2f-167cdfde8bef" timestamp="2016-11-04T00:44:24+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: focusecuador.net (MISP Attribute #639)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: focusecuador.net (MISP Attribute #639)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-77cc5d54-a422-4f1b-ab2f-167cdfde8bef">
|
||
<cybox:Object id=":DomainName-77cc5d54-a422-4f1b-ab2f-167cdfde8bef">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">focusecuador.net</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:24+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-ec9d62d6-4906-45a7-a781-a4b3939e77bc" timestamp="2016-11-04T00:44:26+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: gmail.com.msg07.xyz (MISP Attribute #641)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: gmail.com.msg07.xyz (MISP Attribute #641)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-ec9d62d6-4906-45a7-a781-a4b3939e77bc">
|
||
<cybox:Object id=":DomainName-ec9d62d6-4906-45a7-a781-a4b3939e77bc">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">gmail.com.msg07.xyz</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:26+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-0fabddd8-3837-4d33-bb62-efc4edfe67a5" timestamp="2016-11-04T00:44:26+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: supportgmai1.com (MISP Attribute #642)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: supportgmai1.com (MISP Attribute #642)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-0fabddd8-3837-4d33-bb62-efc4edfe67a5">
|
||
<cybox:Object id=":DomainName-0fabddd8-3837-4d33-bb62-efc4edfe67a5">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">supportgmai1.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:26+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-1fcd075d-0b8f-42d9-852d-31813ae49879" timestamp="2016-11-04T00:44:27+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: chavistas24.com (MISP Attribute #643)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: chavistas24.com (MISP Attribute #643)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-1fcd075d-0b8f-42d9-852d-31813ae49879">
|
||
<cybox:Object id=":DomainName-1fcd075d-0b8f-42d9-852d-31813ae49879">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">chavistas24.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:27+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-7a7a2e9e-8e1e-45c7-ba5d-c6d6ce59465a" timestamp="2016-11-04T00:44:28+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: ns1.hostinger.ru (MISP Attribute #644)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: ns1.hostinger.ru (MISP Attribute #644)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-7a7a2e9e-8e1e-45c7-ba5d-c6d6ce59465a">
|
||
<cybox:Object id=":DomainName-7a7a2e9e-8e1e-45c7-ba5d-c6d6ce59465a">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">ns1.hostinger.ru</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:28+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-0c0abe15-22aa-433f-9a15-0b8196c3a99a" timestamp="2016-11-04T00:44:28+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: venezuela365.com (MISP Attribute #645)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: venezuela365.com (MISP Attribute #645)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-0c0abe15-22aa-433f-9a15-0b8196c3a99a">
|
||
<cybox:Object id=":DomainName-0c0abe15-22aa-433f-9a15-0b8196c3a99a">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">venezuela365.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:28+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-4e2e0b4c-8e54-40bc-9432-152d34b9980b" timestamp="2016-11-04T00:44:29+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: 24.com (MISP Attribute #646)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: 24.com (MISP Attribute #646)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-4e2e0b4c-8e54-40bc-9432-152d34b9980b">
|
||
<cybox:Object id=":DomainName-4e2e0b4c-8e54-40bc-9432-152d34b9980b">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">24.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:29+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-823b71a4-5bcc-4c16-bd79-816b1b6e70d9" timestamp="2016-11-04T00:44:30+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: justicia-desvinculados.com (MISP Attribute #647)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: justicia-desvinculados.com (MISP Attribute #647)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-823b71a4-5bcc-4c16-bd79-816b1b6e70d9">
|
||
<cybox:Object id=":DomainName-823b71a4-5bcc-4c16-bd79-816b1b6e70d9">
|
||
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
||
<DomainNameObj:Value condition="Equals">justicia-desvinculados.com</DomainNameObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:30+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-c891c678-1cf0-4842-bcec-fe93b9479a28" timestamp="2016-11-08T16:25:43+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: 50.62.133.49 (MISP Attribute #648)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: 50.62.133.49 (MISP Attribute #648)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-c891c678-1cf0-4842-bcec-fe93b9479a28">
|
||
<cybox:Object id=":Address-c891c678-1cf0-4842-bcec-fe93b9479a28">
|
||
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
|
||
<AddressObj:Address_Value condition="Equals">50.62.133.49</AddressObj:Address_Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:25:43+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-89db0f38-a183-45b8-9503-69828bf29412" timestamp="2016-11-08T16:26:04+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: 192.169.243.65 (MISP Attribute #649)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: 192.169.243.65 (MISP Attribute #649)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-89db0f38-a183-45b8-9503-69828bf29412">
|
||
<cybox:Object id=":Address-89db0f38-a183-45b8-9503-69828bf29412">
|
||
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
|
||
<AddressObj:Address_Value condition="Equals">192.169.243.65</AddressObj:Address_Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:26:04+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-9e0ea90e-1dae-4fd3-9fe2-a95bf8ff29c7" timestamp="2016-11-04T00:44:32+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: 190.210.180.181 (MISP Attribute #650)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: 190.210.180.181 (MISP Attribute #650)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-9e0ea90e-1dae-4fd3-9fe2-a95bf8ff29c7">
|
||
<cybox:Object id=":Address-9e0ea90e-1dae-4fd3-9fe2-a95bf8ff29c7">
|
||
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
|
||
<AddressObj:Address_Value condition="Equals">190.210.180.181</AddressObj:Address_Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:32+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-080d5bfb-0924-48a0-8b75-37104a301e1c" timestamp="2016-11-04T00:44:33+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: 201.52.24.126 (MISP Attribute #651)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: 201.52.24.126 (MISP Attribute #651)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-080d5bfb-0924-48a0-8b75-37104a301e1c">
|
||
<cybox:Object id=":Address-080d5bfb-0924-48a0-8b75-37104a301e1c">
|
||
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
|
||
<AddressObj:Address_Value condition="Equals">201.52.24.126</AddressObj:Address_Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:33+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-7a948702-dd5c-46da-93e6-37d7bc088693" timestamp="2016-11-04T00:44:33+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: 190.20.180.181 (MISP Attribute #652)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: 190.20.180.181 (MISP Attribute #652)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-7a948702-dd5c-46da-93e6-37d7bc088693">
|
||
<cybox:Object id=":Address-7a948702-dd5c-46da-93e6-37d7bc088693">
|
||
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
|
||
<AddressObj:Address_Value condition="Equals">190.20.180.181</AddressObj:Address_Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:33+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-d736d788-19c3-47d3-85ba-6f1b8a3f0897" timestamp="2016-11-04T00:44:34+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: 186.220.1.84 (MISP Attribute #653)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: 186.220.1.84 (MISP Attribute #653)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-d736d788-19c3-47d3-85ba-6f1b8a3f0897">
|
||
<cybox:Object id=":Address-d736d788-19c3-47d3-85ba-6f1b8a3f0897">
|
||
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
|
||
<AddressObj:Address_Value condition="Equals">186.220.1.84</AddressObj:Address_Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:34+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-f4ce5713-8486-4eff-be64-f04899ad0e63" timestamp="2016-11-04T00:44:35+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: 186.220.11.67 (MISP Attribute #654)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: 186.220.11.67 (MISP Attribute #654)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-f4ce5713-8486-4eff-be64-f04899ad0e63">
|
||
<cybox:Object id=":Address-f4ce5713-8486-4eff-be64-f04899ad0e63">
|
||
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
|
||
<AddressObj:Address_Value condition="Equals">186.220.11.67</AddressObj:Address_Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:35+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-0a4ead27-a700-45f4-bcd0-b469d002b231" timestamp="2016-11-04T00:44:36+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: 189.100.148.188 (MISP Attribute #655)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: 189.100.148.188 (MISP Attribute #655)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-0a4ead27-a700-45f4-bcd0-b469d002b231">
|
||
<cybox:Object id=":Address-0a4ead27-a700-45f4-bcd0-b469d002b231">
|
||
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
|
||
<AddressObj:Address_Value condition="Equals">189.100.148.188</AddressObj:Address_Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:36+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-56e407af-b034-469f-833e-4261d12f4e3f" timestamp="2016-11-04T00:44:36+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: 179.208.187.216 (MISP Attribute #656)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: 179.208.187.216 (MISP Attribute #656)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-56e407af-b034-469f-833e-4261d12f4e3f">
|
||
<cybox:Object id=":Address-56e407af-b034-469f-833e-4261d12f4e3f">
|
||
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
|
||
<AddressObj:Address_Value condition="Equals">179.208.187.216</AddressObj:Address_Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:36+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-2de6d004-f85c-4967-9aaf-f6a2bd9f4349" timestamp="2016-11-04T00:44:37+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: 46.246.89.246 (MISP Attribute #657)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: 46.246.89.246 (MISP Attribute #657)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-2de6d004-f85c-4967-9aaf-f6a2bd9f4349">
|
||
<cybox:Object id=":Address-2de6d004-f85c-4967-9aaf-f6a2bd9f4349">
|
||
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
|
||
<AddressObj:Address_Value condition="Equals">46.246.89.246</AddressObj:Address_Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:37+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-1c9844bb-53a7-4c6d-859a-864d802fb755" timestamp="2016-11-04T00:44:38+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: 198.12.150.249 (MISP Attribute #658)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: 198.12.150.249 (MISP Attribute #658)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-1c9844bb-53a7-4c6d-859a-864d802fb755">
|
||
<cybox:Object id=":Address-1c9844bb-53a7-4c6d-859a-864d802fb755">
|
||
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
|
||
<AddressObj:Address_Value condition="Equals">198.12.150.249</AddressObj:Address_Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:38+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-63f47613-ca7a-4a85-859b-55acf0440a1a" timestamp="2016-11-04T00:44:38+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: 50.63.202.57 (MISP Attribute #659)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: 50.63.202.57 (MISP Attribute #659)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-63f47613-ca7a-4a85-859b-55acf0440a1a">
|
||
<cybox:Object id=":Address-63f47613-ca7a-4a85-859b-55acf0440a1a">
|
||
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
|
||
<AddressObj:Address_Value condition="Equals">50.63.202.57</AddressObj:Address_Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:38+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-8149df18-d5b8-4b8f-9ebf-48676f586058" timestamp="2016-11-04T00:44:39+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: 193.105.134.27 (MISP Attribute #660)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: 193.105.134.27 (MISP Attribute #660)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-8149df18-d5b8-4b8f-9ebf-48676f586058">
|
||
<cybox:Object id=":Address-8149df18-d5b8-4b8f-9ebf-48676f586058">
|
||
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
|
||
<AddressObj:Address_Value condition="Equals">193.105.134.27</AddressObj:Address_Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:39+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-3b6d91fc-6693-453e-b8d0-9a0955b12a9c" timestamp="2016-11-04T00:44:40+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: http://ecuadorenvivo.com/videos/el-meme-que-volvio-loco-a-correa.html (MISP Attribute #661)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: http://ecuadorenvivo.com/videos/el-meme-que-volvio-loco-a-correa.html (MISP Attribute #661)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-3b6d91fc-6693-453e-b8d0-9a0955b12a9c">
|
||
<cybox:Object id=":URI-3b6d91fc-6693-453e-b8d0-9a0955b12a9c">
|
||
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
||
<URIObj:Value condition="Equals">http://ecuadorenvivo.com/videos/el-meme-que-volvio-loco-a-correa.html</URIObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:40+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-0e4cc2f6-8b32-489a-8f86-6279b96ff313" timestamp="2016-11-04T00:44:41+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: http://ecuadorenvivo.co/videos/el-meme-que-volvio-loco-a-correa.html (MISP Attribute #662)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: http://ecuadorenvivo.co/videos/el-meme-que-volvio-loco-a-correa.html (MISP Attribute #662)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-0e4cc2f6-8b32-489a-8f86-6279b96ff313">
|
||
<cybox:Object id=":URI-0e4cc2f6-8b32-489a-8f86-6279b96ff313">
|
||
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
||
<URIObj:Value condition="Equals">http://ecuadorenvivo.co/videos/el-meme-que-volvio-loco-a-correa.html</URIObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:41+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-809f7cd8-5a6f-4e4e-baca-d148180828b7" timestamp="2016-11-04T00:44:41+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: http://mail.asambleanacional.gob.ec (MISP Attribute #663)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: http://mail.asambleanacional.gob.ec (MISP Attribute #663)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-809f7cd8-5a6f-4e4e-baca-d148180828b7">
|
||
<cybox:Object id=":URI-809f7cd8-5a6f-4e4e-baca-d148180828b7">
|
||
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
||
<URIObj:Value condition="Equals">http://mail.asambleanacional.gob.ec</URIObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:41+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-521771b2-16c0-44e8-b1c6-0dedfe52a93f" timestamp="2016-11-04T00:44:42+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: http://pancaliente.info/los-negocios-secretos-de-leocenis-garcia-y-gonzalo-tirado (MISP Attribute #664)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: http://pancaliente.info/los-negocios-secretos-de-leocenis-garcia-y-gonzalo-tirado (MISP Attribute #664)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-521771b2-16c0-44e8-b1c6-0dedfe52a93f">
|
||
<cybox:Object id=":URI-521771b2-16c0-44e8-b1c6-0dedfe52a93f">
|
||
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
||
<URIObj:Value condition="Equals">http://pancaliente.info/los-negocios-secretos-de-leocenis-garcia-y-gonzalo-tirado</URIObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:42+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-8ea723f1-5e6d-4984-80a1-c844988006d9" timestamp="2016-11-04T00:44:43+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Network activity: http://venezuela365.com/wp-content/uploads/2014/10/tirado-g-300×169.jpg (MISP Attribute #665)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
||
<indicator:Description>Network activity: http://venezuela365.com/wp-content/uploads/2014/10/tirado-g-300×169.jpg (MISP Attribute #665)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-8ea723f1-5e6d-4984-80a1-c844988006d9">
|
||
<cybox:Object id=":URI-8ea723f1-5e6d-4984-80a1-c844988006d9">
|
||
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
||
<URIObj:Value condition="Equals">http://venezuela365.com/wp-content/uploads/2014/10/tirado-g-300×169.jpg</URIObj:Value>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:43+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-9f3c0a52-cf4e-434c-852b-a93df8a857e1" timestamp="2016-11-08T16:24:09+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Payload delivery: claudiobonadio88@gmail.com (MISP Attribute #666)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
<indicator:Description>Payload delivery: claudiobonadio88@gmail.com (MISP Attribute #666)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-9f3c0a52-cf4e-434c-852b-a93df8a857e1">
|
||
<cybox:Object id=":EmailMessage-9f3c0a52-cf4e-434c-852b-a93df8a857e1">
|
||
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
<EmailMessageObj:Header>
|
||
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
<AddressObj:Address_Value condition="Equals">claudiobonadio88@gmail.com</AddressObj:Address_Value>
|
||
</EmailMessageObj:From>
|
||
</EmailMessageObj:Header>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:24:09+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-ced4acdc-8a7e-4766-b6c6-431b37b0e332" timestamp="2016-11-08T16:25:19+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Payload delivery: cfed.bonadio@gmail.com (MISP Attribute #667)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
<indicator:Description>Payload delivery: cfed.bonadio@gmail.com (MISP Attribute #667)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-ced4acdc-8a7e-4766-b6c6-431b37b0e332">
|
||
<cybox:Object id=":EmailMessage-ced4acdc-8a7e-4766-b6c6-431b37b0e332">
|
||
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
<EmailMessageObj:Header>
|
||
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
<AddressObj:Address_Value condition="Equals">cfed.bonadio@gmail.com</AddressObj:Address_Value>
|
||
</EmailMessageObj:From>
|
||
</EmailMessageObj:Header>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Confidence timestamp="2016-11-08T16:25:19+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-88a1c5b7-d445-49fc-aa75-7ee28b069510" timestamp="2016-11-04T00:44:45+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Payload delivery: focusedtior1@gmail.com (MISP Attribute #668)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
<indicator:Description>Payload delivery: focusedtior1@gmail.com (MISP Attribute #668)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-88a1c5b7-d445-49fc-aa75-7ee28b069510">
|
||
<cybox:Object id=":EmailMessage-88a1c5b7-d445-49fc-aa75-7ee28b069510">
|
||
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
<EmailMessageObj:Header>
|
||
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
<AddressObj:Address_Value condition="Equals">focusedtior1@gmail.com</AddressObj:Address_Value>
|
||
</EmailMessageObj:From>
|
||
</EmailMessageObj:Header>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:45+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-e4567864-ed20-4a52-8ebc-280bb84bc259" timestamp="2016-11-04T00:44:46+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Payload delivery: no.response.delivery.es@gmail.com (MISP Attribute #669)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
<indicator:Description>Payload delivery: no.response.delivery.es@gmail.com (MISP Attribute #669)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-e4567864-ed20-4a52-8ebc-280bb84bc259">
|
||
<cybox:Object id=":EmailMessage-e4567864-ed20-4a52-8ebc-280bb84bc259">
|
||
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
<EmailMessageObj:Header>
|
||
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
<AddressObj:Address_Value condition="Equals">no.response.delivery.es@gmail.com</AddressObj:Address_Value>
|
||
</EmailMessageObj:From>
|
||
</EmailMessageObj:Header>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:46+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-438fd35d-28ff-4669-a2c6-d3606ad95501" timestamp="2016-11-04T00:44:47+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Payload delivery: enripintos123@outlook.es (MISP Attribute #670)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
<indicator:Description>Payload delivery: enripintos123@outlook.es (MISP Attribute #670)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-438fd35d-28ff-4669-a2c6-d3606ad95501">
|
||
<cybox:Object id=":EmailMessage-438fd35d-28ff-4669-a2c6-d3606ad95501">
|
||
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
<EmailMessageObj:Header>
|
||
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
<AddressObj:Address_Value condition="Equals">enripintos123@outlook.es</AddressObj:Address_Value>
|
||
</EmailMessageObj:From>
|
||
</EmailMessageObj:Header>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:47+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-55bc7d1d-b8c1-404a-ba53-0e81f893bf4f" timestamp="2016-11-04T00:44:48+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Payload delivery: movimiento.anti.correista@gmail.com (MISP Attribute #671)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
<indicator:Description>Payload delivery: movimiento.anti.correista@gmail.com (MISP Attribute #671)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-55bc7d1d-b8c1-404a-ba53-0e81f893bf4f">
|
||
<cybox:Object id=":EmailMessage-55bc7d1d-b8c1-404a-ba53-0e81f893bf4f">
|
||
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
<EmailMessageObj:Header>
|
||
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
<AddressObj:Address_Value condition="Equals">movimiento.anti.correista@gmail.com</AddressObj:Address_Value>
|
||
</EmailMessageObj:From>
|
||
</EmailMessageObj:Header>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:48+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
<incident:Related_Indicator>
|
||
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
||
<stixCommon:Indicator id=":indicator-4982d975-2425-4c0e-8709-8ea8c3743372" timestamp="2016-11-04T00:44:49+00:00" xsi:type='indicator:IndicatorType'>
|
||
<indicator:Title>Payload delivery: no-responder@supportgmai1.com (MISP Attribute #672)</indicator:Title>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
||
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malicious E-mail</indicator:Type>
|
||
<indicator:Description>Payload delivery: no-responder@supportgmai1.com (MISP Attribute #672)</indicator:Description>
|
||
<indicator:Valid_Time_Position/>
|
||
<indicator:Observable id=":observable-4982d975-2425-4c0e-8709-8ea8c3743372">
|
||
<cybox:Object id=":EmailMessage-4982d975-2425-4c0e-8709-8ea8c3743372">
|
||
<cybox:Properties xsi:type="EmailMessageObj:EmailMessageObjectType">
|
||
<EmailMessageObj:Header>
|
||
<EmailMessageObj:From xsi:type="AddressObj:AddressObjectType" category="e-mail">
|
||
<AddressObj:Address_Value condition="Equals">no-responder@supportgmai1.com</AddressObj:Address_Value>
|
||
</EmailMessageObj:From>
|
||
</EmailMessageObj:Header>
|
||
</cybox:Properties>
|
||
</cybox:Object>
|
||
</indicator:Observable>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Indicated_TTP>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</indicator:Indicated_TTP>
|
||
<indicator:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="AMBER"/>
|
||
</marking:Marking>
|
||
</indicator:Handling>
|
||
<indicator:Confidence timestamp="2016-11-04T00:44:49+00:00">
|
||
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
||
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
||
</indicator:Confidence>
|
||
</stixCommon:Indicator>
|
||
</incident:Related_Indicator>
|
||
</incident:Related_Indicators>
|
||
<incident:Leveraged_TTPs>
|
||
<incident:Leveraged_TTP>
|
||
<stixCommon:Relationship>Payload type</stixCommon:Relationship>
|
||
<stixCommon:TTP idref=":ttp-582243bb-0f34-4775-9d56-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</incident:Leveraged_TTP>
|
||
<incident:Leveraged_TTP>
|
||
<stixCommon:Relationship>Payload type</stixCommon:Relationship>
|
||
<stixCommon:TTP idref=":ttp-582243bb-c8d8-4986-a6f6-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</incident:Leveraged_TTP>
|
||
<incident:Leveraged_TTP>
|
||
<stixCommon:Relationship>Payload type</stixCommon:Relationship>
|
||
<stixCommon:TTP idref=":ttp-582243bb-f194-4e73-8e86-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</incident:Leveraged_TTP>
|
||
<incident:Leveraged_TTP>
|
||
<stixCommon:Relationship>Payload type</stixCommon:Relationship>
|
||
<stixCommon:TTP idref=":ttp-582243bb-28a4-4ba0-bb04-49798e96ca05" timestamp="2016-11-08T16:29:31+00:00" xsi:type='ttp:TTPType'/>
|
||
</incident:Leveraged_TTP>
|
||
</incident:Leveraged_TTPs>
|
||
<incident:History>
|
||
<incident:History_Item>
|
||
<incident:Journal_Entry time_precision="second">Event Threat Level: Medium</incident:Journal_Entry>
|
||
</incident:History_Item>
|
||
<incident:History_Item>
|
||
<incident:Journal_Entry time_precision="second">MISP Tag: TLP:GREEN</incident:Journal_Entry>
|
||
</incident:History_Item>
|
||
<incident:History_Item>
|
||
<incident:Journal_Entry time_precision="second">MISP Tag: SOURCE:CITIZENLAB</incident:Journal_Entry>
|
||
</incident:History_Item>
|
||
<incident:History_Item>
|
||
<incident:Journal_Entry time_precision="second">MISP Tag: DETECT</incident:Journal_Entry>
|
||
</incident:History_Item>
|
||
<incident:History_Item>
|
||
<incident:Journal_Entry time_precision="second">MISP Tag: PUBLISHED</incident:Journal_Entry>
|
||
</incident:History_Item>
|
||
</incident:History>
|
||
<incident:Information_Source>
|
||
<stixCommon:Identity>
|
||
<stixCommon:Name>citizenlab</stixCommon:Name>
|
||
</stixCommon:Identity>
|
||
<stixCommon:References>
|
||
<stixCommon:Reference>https://citizenlab.org/2015/12/packrat-report/</stixCommon:Reference>
|
||
</stixCommon:References>
|
||
</incident:Information_Source>
|
||
<incident:Handling>
|
||
<marking:Marking>
|
||
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
||
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="GREEN"/>
|
||
</marking:Marking>
|
||
</incident:Handling>
|
||
</stix:Incident>
|
||
</stix:Incidents>
|
||
</stix:Package>
|
||
</stix:Related_Package>
|
||
</stix:Related_Packages>
|
||
</stix:STIX_Package>
|