2767 lines
278 KiB
XML
2767 lines
278 KiB
XML
<stix:STIX_Package
|
|
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
|
|
xmlns:cybox="http://cybox.mitre.org/cybox-2"
|
|
xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
|
|
xmlns:ASObj="http://cybox.mitre.org/objects#ASObject-1"
|
|
xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
|
|
xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1"
|
|
xmlns:EmailMessageObj="http://cybox.mitre.org/objects#EmailMessageObject-2"
|
|
xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"
|
|
xmlns:HTTPSessionObj="http://cybox.mitre.org/objects#HTTPSessionObject-2"
|
|
xmlns:HostnameObj="http://cybox.mitre.org/objects#HostnameObject-1"
|
|
xmlns:MutexObj="http://cybox.mitre.org/objects#MutexObject-2"
|
|
xmlns:PipeObj="http://cybox.mitre.org/objects#PipeObject-2"
|
|
xmlns:URIObj="http://cybox.mitre.org/objects#URIObject-2"
|
|
xmlns:WinRegistryKeyObj="http://cybox.mitre.org/objects#WinRegistryKeyObject-2"
|
|
xmlns:marking="http://data-marking.mitre.org/Marking-1"
|
|
xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"
|
|
xmlns:et="http://stix.mitre.org/ExploitTarget-1"
|
|
xmlns:incident="http://stix.mitre.org/Incident-1"
|
|
xmlns:indicator="http://stix.mitre.org/Indicator-2"
|
|
xmlns:ttp="http://stix.mitre.org/TTP-1"
|
|
xmlns:ta="http://stix.mitre.org/ThreatActor-1"
|
|
xmlns:stixCommon="http://stix.mitre.org/common-1"
|
|
xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
|
|
xmlns:stix-ciqidentity="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1"
|
|
xmlns:snortTM="http://stix.mitre.org/extensions/TestMechanism#Snort-1"
|
|
xmlns:stix="http://stix.mitre.org/stix-1"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xmlns:xal="urn:oasis:names:tc:ciq:xal:3"
|
|
xmlns:xnl="urn:oasis:names:tc:ciq:xnl:3"
|
|
xmlns:xpil="urn:oasis:names:tc:ciq:xpil:3"
|
|
xsi:schemaLocation="
|
|
http://cybox.mitre.org/common-2 http://cybox.mitre.org/XMLSchema/common/2.1/cybox_common.xsd
|
|
http://cybox.mitre.org/cybox-2 http://cybox.mitre.org/XMLSchema/core/2.1/cybox_core.xsd
|
|
http://cybox.mitre.org/default_vocabularies-2 http://cybox.mitre.org/XMLSchema/default_vocabularies/2.1/cybox_default_vocabularies.xsd
|
|
http://cybox.mitre.org/objects#ASObject-1 http://cybox.mitre.org/XMLSchema/objects/AS/1.0/AS_Object.xsd
|
|
http://cybox.mitre.org/objects#AddressObject-2 http://cybox.mitre.org/XMLSchema/objects/Address/2.1/Address_Object.xsd
|
|
http://cybox.mitre.org/objects#DomainNameObject-1 http://cybox.mitre.org/XMLSchema/objects/Domain_Name/1.0/Domain_Name_Object.xsd
|
|
http://cybox.mitre.org/objects#EmailMessageObject-2 http://cybox.mitre.org/XMLSchema/objects/Email_Message/2.1/Email_Message_Object.xsd
|
|
http://cybox.mitre.org/objects#FileObject-2 http://cybox.mitre.org/XMLSchema/objects/File/2.1/File_Object.xsd
|
|
http://cybox.mitre.org/objects#HTTPSessionObject-2 http://cybox.mitre.org/XMLSchema/objects/HTTP_Session/2.1/HTTP_Session_Object.xsd
|
|
http://cybox.mitre.org/objects#HostnameObject-1 http://cybox.mitre.org/XMLSchema/objects/Hostname/1.0/Hostname_Object.xsd
|
|
http://cybox.mitre.org/objects#MutexObject-2 http://cybox.mitre.org/XMLSchema/objects/Mutex/2.1/Mutex_Object.xsd
|
|
http://cybox.mitre.org/objects#PipeObject-2 http://cybox.mitre.org/XMLSchema/objects/Pipe/2.1/Pipe_Object.xsd
|
|
http://cybox.mitre.org/objects#URIObject-2 http://cybox.mitre.org/XMLSchema/objects/URI/2.1/URI_Object.xsd
|
|
http://cybox.mitre.org/objects#WinRegistryKeyObject-2 http://cybox.mitre.org/XMLSchema/objects/Win_Registry_Key/2.1/Win_Registry_Key_Object.xsd
|
|
http://data-marking.mitre.org/Marking-1 http://stix.mitre.org/XMLSchema/data_marking/1.1.1/data_marking.xsd
|
|
http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1 http://stix.mitre.org/XMLSchema/extensions/marking/tlp/1.1.1/tlp_marking.xsd
|
|
http://stix.mitre.org/ExploitTarget-1 http://stix.mitre.org/XMLSchema/exploit_target/1.1.1/exploit_target.xsd
|
|
http://stix.mitre.org/Incident-1 http://stix.mitre.org/XMLSchema/incident/1.1.1/incident.xsd
|
|
http://stix.mitre.org/Indicator-2 http://stix.mitre.org/XMLSchema/indicator/2.1.1/indicator.xsd
|
|
http://stix.mitre.org/TTP-1 http://stix.mitre.org/XMLSchema/ttp/1.1.1/ttp.xsd
|
|
http://stix.mitre.org/ThreatActor-1 http://stix.mitre.org/XMLSchema/threat_actor/1.1.1/threat_actor.xsd
|
|
http://stix.mitre.org/common-1 http://stix.mitre.org/XMLSchema/common/1.1.1/stix_common.xsd
|
|
http://stix.mitre.org/default_vocabularies-1 http://stix.mitre.org/XMLSchema/default_vocabularies/1.1.1/stix_default_vocabularies.xsd
|
|
http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1 http://stix.mitre.org/XMLSchema/extensions/identity/ciq_3.0/1.1.1/ciq_3.0_identity.xsd
|
|
http://stix.mitre.org/extensions/TestMechanism#Snort-1 http://stix.mitre.org/XMLSchema/extensions/test_mechanism/snort/1.1.1/snort_test_mechanism.xsd
|
|
http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.1.1/stix_core.xsd
|
|
urn:oasis:names:tc:ciq:xal:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xAL.xsd
|
|
urn:oasis:names:tc:ciq:xnl:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xNL.xsd
|
|
urn:oasis:names:tc:ciq:xpil:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xPIL.xsd" id=":Package-1107ab14-42a8-4bff-b35b-c8444bb86797" version="1.1.1" timestamp="2017-06-26T17:32:11.167418+00:00">
|
|
<stix:STIX_Header>
|
|
<stix:Title>Export from MISP</stix:Title>
|
|
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
|
|
</stix:STIX_Header>
|
|
<stix:Related_Packages>
|
|
<stix:Related_Package>
|
|
<stix:Package id=":STIXPackage-59513ebe-4144-4e2d-8670-06b38e96ca05" version="1.1.1" timestamp="2017-06-26T13:23:58+00:00">
|
|
<stix:STIX_Header>
|
|
<stix:Title>Reckless Exploit: Mexican Journalists, Lawyers, and a Child Targeted with NSO Spyware (MISP Event #104)</stix:Title>
|
|
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
|
|
</stix:STIX_Header>
|
|
<stix:Incidents>
|
|
<stix:Incident id=":incident-59513ebe-4144-4e2d-8670-06b38e96ca05" timestamp="2017-06-26T13:30:22+00:00" xsi:type='incident:IncidentType'>
|
|
<incident:Title>Reckless Exploit: Mexican Journalists, Lawyers, and a Child Targeted with NSO Spyware</incident:Title>
|
|
<incident:External_ID source="MISP Event">104</incident:External_ID>
|
|
<incident:Time>
|
|
<incident:Incident_Discovery precision="second">2017-06-26T00:00:00+00:00</incident:Incident_Discovery>
|
|
<incident:Incident_Reported precision="second">2017-06-26T13:30:22+00:00</incident:Incident_Reported>
|
|
</incident:Time>
|
|
<incident:Status xsi:type="stixVocabs:IncidentStatusVocab-1.0">Closed</incident:Status>
|
|
<incident:Related_Indicators>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>External analysis</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5951432e-a3f8-4510-b5ba-06b28e96ca05" timestamp="2017-06-26T13:23:58+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>External analysis: https://citizenlab.org/2017/06/reckless-exploit-mexico-nso/ (MISP Attribute #16322)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>External analysis: https://citizenlab.org/2017/06/reckless-exploit-mexico-nso/ (MISP Attribute #16322)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5951432e-a3f8-4510-b5ba-06b28e96ca05">
|
|
<cybox:Object id=":URI-5951432e-a3f8-4510-b5ba-06b28e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://citizenlab.org/2017/06/reckless-exploit-mexico-nso/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:23:58+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595140b9-a2cc-4642-be72-06b28e96ca05" timestamp="2017-06-26T13:13:29+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: ideas-telcel.com.mx (MISP Attribute #16155)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: ideas-telcel.com.mx (MISP Attribute #16155)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595140b9-a2cc-4642-be72-06b28e96ca05">
|
|
<cybox:Object id=":DomainName-595140b9-a2cc-4642-be72-06b28e96ca05">
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
|
<DomainNameObj:Value condition="Equals">ideas-telcel.com.mx</DomainNameObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:13:29+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595140b9-6d24-4529-b5cb-06b28e96ca05" timestamp="2017-06-26T13:13:29+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: iusacell-movil.com.mx (MISP Attribute #16156)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: iusacell-movil.com.mx (MISP Attribute #16156)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595140b9-6d24-4529-b5cb-06b28e96ca05">
|
|
<cybox:Object id=":DomainName-595140b9-6d24-4529-b5cb-06b28e96ca05">
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
|
<DomainNameObj:Value condition="Equals">iusacell-movil.com.mx</DomainNameObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:13:29+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595140b9-ea38-4167-af75-06b28e96ca05" timestamp="2017-06-26T13:13:29+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: mymensaje-sms.com (MISP Attribute #16157)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: mymensaje-sms.com (MISP Attribute #16157)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595140b9-ea38-4167-af75-06b28e96ca05">
|
|
<cybox:Object id=":DomainName-595140b9-ea38-4167-af75-06b28e96ca05">
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
|
<DomainNameObj:Value condition="Equals">mymensaje-sms.com</DomainNameObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:13:29+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595140b9-fee0-42c2-abc9-06b28e96ca05" timestamp="2017-06-26T13:13:29+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: network190.com (MISP Attribute #16158)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: network190.com (MISP Attribute #16158)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595140b9-fee0-42c2-abc9-06b28e96ca05">
|
|
<cybox:Object id=":DomainName-595140b9-fee0-42c2-abc9-06b28e96ca05">
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
|
<DomainNameObj:Value condition="Equals">network190.com</DomainNameObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:13:29+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595140b9-8bf0-466f-a633-06b28e96ca05" timestamp="2017-06-26T13:13:29+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: secure-access10.mx (MISP Attribute #16159)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: secure-access10.mx (MISP Attribute #16159)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595140b9-8bf0-466f-a633-06b28e96ca05">
|
|
<cybox:Object id=":DomainName-595140b9-8bf0-466f-a633-06b28e96ca05">
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
|
<DomainNameObj:Value condition="Equals">secure-access10.mx</DomainNameObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:13:29+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595140b9-7ac8-4ae1-84ac-06b28e96ca05" timestamp="2017-06-26T13:13:29+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: smscentro.com (MISP Attribute #16160)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: smscentro.com (MISP Attribute #16160)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595140b9-7ac8-4ae1-84ac-06b28e96ca05">
|
|
<cybox:Object id=":DomainName-595140b9-7ac8-4ae1-84ac-06b28e96ca05">
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
|
<DomainNameObj:Value condition="Equals">smscentro.com</DomainNameObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:13:29+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595140b9-bf04-4011-a222-06b28e96ca05" timestamp="2017-06-26T13:13:29+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: smsmensaje.mx (MISP Attribute #16161)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: smsmensaje.mx (MISP Attribute #16161)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595140b9-bf04-4011-a222-06b28e96ca05">
|
|
<cybox:Object id=":DomainName-595140b9-bf04-4011-a222-06b28e96ca05">
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
|
<DomainNameObj:Value condition="Equals">smsmensaje.mx</DomainNameObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:13:29+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595140b9-7ed4-48c2-ad5b-06b28e96ca05" timestamp="2017-06-26T13:13:29+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: twiitter.com.mx (MISP Attribute #16162)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: twiitter.com.mx (MISP Attribute #16162)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595140b9-7ed4-48c2-ad5b-06b28e96ca05">
|
|
<cybox:Object id=":DomainName-595140b9-7ed4-48c2-ad5b-06b28e96ca05">
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
|
<DomainNameObj:Value condition="Equals">twiitter.com.mx</DomainNameObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:13:29+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595140b9-d344-4943-8ee8-06b28e96ca05" timestamp="2017-06-26T13:13:29+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: unonoticias.net (MISP Attribute #16163)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: unonoticias.net (MISP Attribute #16163)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595140b9-d344-4943-8ee8-06b28e96ca05">
|
|
<cybox:Object id=":DomainName-595140b9-d344-4943-8ee8-06b28e96ca05">
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
|
<DomainNameObj:Value condition="Equals">unonoticias.net</DomainNameObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:13:29+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595140b9-fdf8-4877-ae89-06b28e96ca05" timestamp="2017-06-26T13:13:29+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: fb-accounts.com (MISP Attribute #16164)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: fb-accounts.com (MISP Attribute #16164)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595140b9-fdf8-4877-ae89-06b28e96ca05">
|
|
<cybox:Object id=":DomainName-595140b9-fdf8-4877-ae89-06b28e96ca05">
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
|
<DomainNameObj:Value condition="Equals">fb-accounts.com</DomainNameObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:13:29+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-1a9c-4657-9043-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1EQYOkG (MISP Attribute #16207)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1EQYOkG (MISP Attribute #16207)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-1a9c-4657-9043-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-1a9c-4657-9043-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1EQYOkG</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-2608-4458-8a3a-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1hMG15k (MISP Attribute #16208)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1hMG15k (MISP Attribute #16208)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-2608-4458-8a3a-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-2608-4458-8a3a-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1hMG15k</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-77b0-4fc8-9cb0-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1JDkjuX (MISP Attribute #16209)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1JDkjuX (MISP Attribute #16209)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-77b0-4fc8-9cb0-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-77b0-4fc8-9cb0-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1JDkjuX</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-10ec-4896-8197-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1JW0JFQ (MISP Attribute #16210)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1JW0JFQ (MISP Attribute #16210)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-10ec-4896-8197-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-10ec-4896-8197-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1JW0JFQ</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-d470-4103-b354-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1JzfmW1 (MISP Attribute #16211)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1JzfmW1 (MISP Attribute #16211)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-d470-4103-b354-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-d470-4103-b354-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1JzfmW1</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-fca8-4841-b6e5-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1KDekJ9 (MISP Attribute #16212)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1KDekJ9 (MISP Attribute #16212)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-fca8-4841-b6e5-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-fca8-4841-b6e5-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1KDekJ9</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-1ce8-4723-a8a7-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1KufGUy (MISP Attribute #16213)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1KufGUy (MISP Attribute #16213)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-1ce8-4723-a8a7-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-1ce8-4723-a8a7-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1KufGUy</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-5dac-47dc-81f3-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1LLY8oK (MISP Attribute #16214)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1LLY8oK (MISP Attribute #16214)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-5dac-47dc-81f3-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-5dac-47dc-81f3-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1LLY8oK</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-e484-4c67-bb23-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1LLYT15 (MISP Attribute #16215)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1LLYT15 (MISP Attribute #16215)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-e484-4c67-bb23-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-e484-4c67-bb23-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1LLYT15</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-0754-4b53-a851-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1MAAWrO (MISP Attribute #16216)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1MAAWrO (MISP Attribute #16216)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-0754-4b53-a851-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-0754-4b53-a851-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1MAAWrO</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-752c-4355-a7ca-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1MAzTZ7 (MISP Attribute #16217)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1MAzTZ7 (MISP Attribute #16217)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-752c-4355-a7ca-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-752c-4355-a7ca-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1MAzTZ7</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-7858-4579-a385-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1NlM0ME (MISP Attribute #16218)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1NlM0ME (MISP Attribute #16218)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-7858-4579-a385-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-7858-4579-a385-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1NlM0ME</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-2514-421a-86f7-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1Nr0Vpb (MISP Attribute #16219)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1Nr0Vpb (MISP Attribute #16219)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-2514-421a-86f7-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-2514-421a-86f7-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1Nr0Vpb</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-1198-4ef7-89ab-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1Nz2RZe (MISP Attribute #16220)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1Nz2RZe (MISP Attribute #16220)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-1198-4ef7-89ab-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-1198-4ef7-89ab-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1Nz2RZe</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-93c0-4169-828c-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1NzkyeZ (MISP Attribute #16221)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1NzkyeZ (MISP Attribute #16221)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-93c0-4169-828c-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-93c0-4169-828c-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1NzkyeZ</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-9750-4b3f-822b-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1O77vPb (MISP Attribute #16222)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1O77vPb (MISP Attribute #16222)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-9750-4b3f-822b-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-9750-4b3f-822b-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1O77vPb</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-48bc-4d2b-a43d-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1QbgONr (MISP Attribute #16223)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1QbgONr (MISP Attribute #16223)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-48bc-4d2b-a43d-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-48bc-4d2b-a43d-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1QbgONr</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-4c4c-484b-b316-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1QYVJU9 (MISP Attribute #16224)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1QYVJU9 (MISP Attribute #16224)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-4c4c-484b-b316-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-4c4c-484b-b316-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1QYVJU9</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-fe1c-4872-a3fd-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1s2eguc (MISP Attribute #16225)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1s2eguc (MISP Attribute #16225)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-fe1c-4872-a3fd-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-fe1c-4872-a3fd-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1s2eguc</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-e780-479f-af9e-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1SU5N7q (MISP Attribute #16226)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1SU5N7q (MISP Attribute #16226)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-e780-479f-af9e-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-e780-479f-af9e-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1SU5N7q</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-3fc4-49a7-a84a-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1TTjm6D (MISP Attribute #16227)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1TTjm6D (MISP Attribute #16227)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-3fc4-49a7-a84a-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-3fc4-49a7-a84a-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1TTjm6D</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-17e0-4953-ae3e-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1twXSDl (MISP Attribute #16228)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1twXSDl (MISP Attribute #16228)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-17e0-4953-ae3e-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-17e0-4953-ae3e-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1twXSDl</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-136c-40a3-bf90-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1U0yzVG (MISP Attribute #16229)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1U0yzVG (MISP Attribute #16229)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-136c-40a3-bf90-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-136c-40a3-bf90-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1U0yzVG</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-e0e8-4d3d-a2f5-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1Wzryvp (MISP Attribute #16230)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1Wzryvp (MISP Attribute #16230)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-e0e8-4d3d-a2f5-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-e0e8-4d3d-a2f5-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1Wzryvp</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-4d6c-4191-96dd-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1WzrZ8T (MISP Attribute #16231)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1WzrZ8T (MISP Attribute #16231)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-4d6c-4191-96dd-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-4d6c-4191-96dd-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1WzrZ8T</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ad-5060-4c84-b0e5-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1X9kJRJ (MISP Attribute #16232)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1X9kJRJ (MISP Attribute #16232)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ad-5060-4c84-b0e5-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ad-5060-4c84-b0e5-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1X9kJRJ</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-c9ec-4d6b-aeb1-06b38e96ca05" timestamp="2017-06-26T13:17:33+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1XFaS4F (MISP Attribute #16233)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1XFaS4F (MISP Attribute #16233)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-c9ec-4d6b-aeb1-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-c9ec-4d6b-aeb1-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1XFaS4F</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:33+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-8e00-41c6-825e-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1Xxf32k (MISP Attribute #16234)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1Xxf32k (MISP Attribute #16234)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-8e00-41c6-825e-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-8e00-41c6-825e-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1Xxf32k</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-8354-4c49-b7a1-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/1z2NQdh (MISP Attribute #16235)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/1z2NQdh (MISP Attribute #16235)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-8354-4c49-b7a1-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-8354-4c49-b7a1-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/1z2NQdh</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-c494-4b9b-9676-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/20Y9r10 (MISP Attribute #16236)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/20Y9r10 (MISP Attribute #16236)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-c494-4b9b-9676-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-c494-4b9b-9676-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/20Y9r10</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-215c-4101-bdc5-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/235giae (MISP Attribute #16237)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/235giae (MISP Attribute #16237)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-215c-4101-bdc5-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-215c-4101-bdc5-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/235giae</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-7874-44b6-8638-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/246dkRy (MISP Attribute #16238)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/246dkRy (MISP Attribute #16238)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-7874-44b6-8638-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-7874-44b6-8638-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/246dkRy</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-7660-4301-91cd-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/246doke (MISP Attribute #16239)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/246doke (MISP Attribute #16239)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-7660-4301-91cd-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-7660-4301-91cd-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/246doke</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-f278-41ad-9e79-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/25nmH1O (MISP Attribute #16240)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/25nmH1O (MISP Attribute #16240)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-f278-41ad-9e79-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-f278-41ad-9e79-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/25nmH1O</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-2e38-4e91-a008-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/292heXd (MISP Attribute #16241)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/292heXd (MISP Attribute #16241)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-2e38-4e91-a008-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-2e38-4e91-a008-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/292heXd</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-e8f4-4c6b-9571-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/295RmfH (MISP Attribute #16242)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/295RmfH (MISP Attribute #16242)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-e8f4-4c6b-9571-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-e8f4-4c6b-9571-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/295RmfH</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-f250-4615-b9cd-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/295RNq7 (MISP Attribute #16243)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/295RNq7 (MISP Attribute #16243)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-f250-4615-b9cd-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-f250-4615-b9cd-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/295RNq7</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-83d4-45e0-960e-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/29eWFqz (MISP Attribute #16244)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/29eWFqz (MISP Attribute #16244)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-83d4-45e0-960e-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-83d4-45e0-960e-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/29eWFqz</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-4be8-45c9-b2dc-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/29eWzzv (MISP Attribute #16245)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/29eWzzv (MISP Attribute #16245)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-4be8-45c9-b2dc-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-4be8-45c9-b2dc-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/29eWzzv</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-d118-4cfe-a0a4-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/29LfZfD (MISP Attribute #16246)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/29LfZfD (MISP Attribute #16246)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-d118-4cfe-a0a4-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-d118-4cfe-a0a4-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/29LfZfD</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-b058-4eb5-bb7b-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/29lQvyh (MISP Attribute #16247)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/29lQvyh (MISP Attribute #16247)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-b058-4eb5-bb7b-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-b058-4eb5-bb7b-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/29lQvyh</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-8ca4-46f9-8c33-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://bit.ly/2a0hZ2l (MISP Attribute #16248)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://bit.ly/2a0hZ2l (MISP Attribute #16248)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-8ca4-46f9-8c33-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-8ca4-46f9-8c33-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://bit.ly/2a0hZ2l</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-efbc-487e-ae1a-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://fb-accounts.com/1074139s/ (MISP Attribute #16249)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://fb-accounts.com/1074139s/ (MISP Attribute #16249)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-efbc-487e-ae1a-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-efbc-487e-ae1a-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://fb-accounts.com/1074139s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-a384-43c4-ae80-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://fb-accounts.com/2069487s/ (MISP Attribute #16250)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://fb-accounts.com/2069487s/ (MISP Attribute #16250)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-a384-43c4-ae80-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-a384-43c4-ae80-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://fb-accounts.com/2069487s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-b48c-4a93-9163-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://ideas-telcel.com.mx/1930327s (MISP Attribute #16251)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://ideas-telcel.com.mx/1930327s (MISP Attribute #16251)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-b48c-4a93-9163-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-b48c-4a93-9163-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://ideas-telcel.com.mx/1930327s</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-d21c-4e4e-94b8-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://ideas-telcel.com.mx/2110126s/ (MISP Attribute #16252)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://ideas-telcel.com.mx/2110126s/ (MISP Attribute #16252)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-d21c-4e4e-94b8-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-d21c-4e4e-94b8-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://ideas-telcel.com.mx/2110126s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-4944-4ad9-a7af-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://ideas-telcel.com.mx/7757294s (MISP Attribute #16253)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://ideas-telcel.com.mx/7757294s (MISP Attribute #16253)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-4944-4ad9-a7af-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-4944-4ad9-a7af-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://ideas-telcel.com.mx/7757294s</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-ea14-4684-adb1-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://iusacell-movil.com.mx/7918310s/ (MISP Attribute #16254)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://iusacell-movil.com.mx/7918310s/ (MISP Attribute #16254)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-ea14-4684-adb1-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-ea14-4684-adb1-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://iusacell-movil.com.mx/7918310s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-f220-4bee-9df4-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://iusacell-movil.com.mx/8595070s/ (MISP Attribute #16255)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://iusacell-movil.com.mx/8595070s/ (MISP Attribute #16255)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-f220-4bee-9df4-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-f220-4bee-9df4-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://iusacell-movil.com.mx/8595070s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-3e2c-443b-ad7b-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://mymensaje-sms.com/6649365s/ (MISP Attribute #16256)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://mymensaje-sms.com/6649365s/ (MISP Attribute #16256)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-3e2c-443b-ad7b-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-3e2c-443b-ad7b-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://mymensaje-sms.com/6649365s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-909c-4d8d-948a-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://fb-accounts.com/2408931s (MISP Attribute #16257)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://fb-accounts.com/2408931s (MISP Attribute #16257)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-909c-4d8d-948a-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-909c-4d8d-948a-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://fb-accounts.com/2408931s</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-fba4-4030-9c61-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://ideas-telcel.com.mx/3975827s (MISP Attribute #16258)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://ideas-telcel.com.mx/3975827s (MISP Attribute #16258)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-fba4-4030-9c61-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-fba4-4030-9c61-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://ideas-telcel.com.mx/3975827s</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-738c-4135-aa6c-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://ideas-telcel.com.mx/5706662s (MISP Attribute #16259)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://ideas-telcel.com.mx/5706662s (MISP Attribute #16259)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-738c-4135-aa6c-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-738c-4135-aa6c-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://ideas-telcel.com.mx/5706662s</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-b9e0-4327-aa26-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://smscentro.com/9480260s/ (MISP Attribute #16260)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://smscentro.com/9480260s/ (MISP Attribute #16260)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-b9e0-4327-aa26-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-b9e0-4327-aa26-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://smscentro.com/9480260s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-24ec-488e-b0e8-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://smsmensaje.mx/1239663s/ (MISP Attribute #16261)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://smsmensaje.mx/1239663s/ (MISP Attribute #16261)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-24ec-488e-b0e8-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-24ec-488e-b0e8-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://smsmensaje.mx/1239663s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-593c-49e2-b5e2-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://smsmensaje.mx/1331744s/ (MISP Attribute #16262)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://smsmensaje.mx/1331744s/ (MISP Attribute #16262)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-593c-49e2-b5e2-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-593c-49e2-b5e2-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://smsmensaje.mx/1331744s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-e034-48d6-83cf-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://smsmensaje.mx/1493024s/ (MISP Attribute #16263)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://smsmensaje.mx/1493024s/ (MISP Attribute #16263)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-e034-48d6-83cf-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-e034-48d6-83cf-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://smsmensaje.mx/1493024s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-0cb8-4da3-9788-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://smsmensaje.mx/1656017s/ (MISP Attribute #16264)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://smsmensaje.mx/1656017s/ (MISP Attribute #16264)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-0cb8-4da3-9788-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-0cb8-4da3-9788-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://smsmensaje.mx/1656017s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-e150-4ab5-93d5-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://smsmensaje.mx/1911343s/ (MISP Attribute #16265)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://smsmensaje.mx/1911343s/ (MISP Attribute #16265)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-e150-4ab5-93d5-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-e150-4ab5-93d5-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://smsmensaje.mx/1911343s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-4dc4-4d20-9726-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://smsmensaje.mx/3376811s/ (MISP Attribute #16266)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://smsmensaje.mx/3376811s/ (MISP Attribute #16266)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-4dc4-4d20-9726-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-4dc4-4d20-9726-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://smsmensaje.mx/3376811s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-b384-4fc8-9951-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://smsmensaje.mx/3990495s/ (MISP Attribute #16267)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://smsmensaje.mx/3990495s/ (MISP Attribute #16267)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-b384-4fc8-9951-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-b384-4fc8-9951-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://smsmensaje.mx/3990495s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-0dbc-485c-9516-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://smsmensaje.mx/5957475s/ (MISP Attribute #16268)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://smsmensaje.mx/5957475s/ (MISP Attribute #16268)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-0dbc-485c-9516-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-0dbc-485c-9516-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://smsmensaje.mx/5957475s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-f4f4-4f6d-9dbe-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://smsmensaje.mx/6056487s/ (MISP Attribute #16269)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://smsmensaje.mx/6056487s/ (MISP Attribute #16269)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-f4f4-4f6d-9dbe-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-f4f4-4f6d-9dbe-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://smsmensaje.mx/6056487s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-e008-472d-9d03-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://smsmensaje.mx/6445761s/ (MISP Attribute #16270)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://smsmensaje.mx/6445761s/ (MISP Attribute #16270)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-e008-472d-9d03-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-e008-472d-9d03-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://smsmensaje.mx/6445761s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-b69c-4aaf-a217-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://smsmensaje.mx/6881768s/ (MISP Attribute #16271)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://smsmensaje.mx/6881768s/ (MISP Attribute #16271)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-b69c-4aaf-a217-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-b69c-4aaf-a217-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://smsmensaje.mx/6881768s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-7040-450e-97c7-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://smsmensaje.mx/9093723s/ (MISP Attribute #16272)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://smsmensaje.mx/9093723s/ (MISP Attribute #16272)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-7040-450e-97c7-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-7040-450e-97c7-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://smsmensaje.mx/9093723s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-1af0-4d3a-be93-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://smsmensaje.mx/9371877s/ (MISP Attribute #16273)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://smsmensaje.mx/9371877s/ (MISP Attribute #16273)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-1af0-4d3a-be93-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-1af0-4d3a-be93-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://smsmensaje.mx/9371877s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-6aa4-4e7f-a9b3-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://smsmensaje.mx/9439115s/ (MISP Attribute #16274)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://smsmensaje.mx/9439115s/ (MISP Attribute #16274)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-6aa4-4e7f-a9b3-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-6aa4-4e7f-a9b3-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://smsmensaje.mx/9439115s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-929c-4c73-b5ae-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://smsmensaje.mx/9936510s/ (MISP Attribute #16275)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://smsmensaje.mx/9936510s/ (MISP Attribute #16275)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-929c-4c73-b5ae-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-929c-4c73-b5ae-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://smsmensaje.mx/9936510s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-4aa8-4962-986c-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://smsmensaje.mx/[unavailable] (MISP Attribute #16276)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://smsmensaje.mx/[unavailable] (MISP Attribute #16276)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-4aa8-4962-986c-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-4aa8-4962-986c-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://smsmensaje.mx/[unavailable]</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-74b0-4be5-be10-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://network190.com/2066781s/ (MISP Attribute #16277)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://network190.com/2066781s/ (MISP Attribute #16277)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-74b0-4be5-be10-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-74b0-4be5-be10-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://network190.com/2066781s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-82a0-4fed-acdc-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://network190.com/6214010s/ (MISP Attribute #16278)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://network190.com/6214010s/ (MISP Attribute #16278)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-82a0-4fed-acdc-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-82a0-4fed-acdc-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://network190.com/6214010s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-191c-4dad-a8df-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://network190.com/8361397s/ (MISP Attribute #16279)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://network190.com/8361397s/ (MISP Attribute #16279)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-191c-4dad-a8df-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-191c-4dad-a8df-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://network190.com/8361397s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-eba4-4d12-bc80-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://secure-access10.mx/2618844s/ (MISP Attribute #16280)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://secure-access10.mx/2618844s/ (MISP Attribute #16280)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-eba4-4d12-bc80-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-eba4-4d12-bc80-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://secure-access10.mx/2618844s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-cbe0-4757-a1a6-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://secure-access10.mx/4257391s/ (MISP Attribute #16281)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://secure-access10.mx/4257391s/ (MISP Attribute #16281)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-cbe0-4757-a1a6-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-cbe0-4757-a1a6-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://secure-access10.mx/4257391s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-b0cc-46ad-8fda-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://secure-access10.mx/7161504s/ (MISP Attribute #16282)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://secure-access10.mx/7161504s/ (MISP Attribute #16282)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-b0cc-46ad-8fda-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-b0cc-46ad-8fda-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://secure-access10.mx/7161504s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-21ac-41b9-956c-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://smsmensaje.mx/2683786s/ (MISP Attribute #16283)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://smsmensaje.mx/2683786s/ (MISP Attribute #16283)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-21ac-41b9-956c-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-21ac-41b9-956c-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://smsmensaje.mx/2683786s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-6b6c-4675-b743-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://smsmensaje.mx/4494681s/ (MISP Attribute #16284)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://smsmensaje.mx/4494681s/ (MISP Attribute #16284)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-6b6c-4675-b743-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-6b6c-4675-b743-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://smsmensaje.mx/4494681s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-2bf8-4f1d-8ed0-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://smsmensaje.mx/4667624s/ (MISP Attribute #16285)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://smsmensaje.mx/4667624s/ (MISP Attribute #16285)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-2bf8-4f1d-8ed0-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-2bf8-4f1d-8ed0-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://smsmensaje.mx/4667624s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-4054-47ba-b479-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://smsmensaje.mx/4878494s/ (MISP Attribute #16286)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://smsmensaje.mx/4878494s/ (MISP Attribute #16286)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-4054-47ba-b479-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-4054-47ba-b479-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://smsmensaje.mx/4878494s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-d08c-48ca-bd09-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://smsmensaje.mx/5478753s/ (MISP Attribute #16287)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://smsmensaje.mx/5478753s/ (MISP Attribute #16287)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-d08c-48ca-bd09-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-d08c-48ca-bd09-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://smsmensaje.mx/5478753s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-da5c-42a8-aea5-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://smsmensaje.mx/5732641s/ (MISP Attribute #16288)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://smsmensaje.mx/5732641s/ (MISP Attribute #16288)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-da5c-42a8-aea5-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-da5c-42a8-aea5-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://smsmensaje.mx/5732641s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-6cec-4bb8-b0ec-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://smsmensaje.mx/5840625s/ (MISP Attribute #16289)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://smsmensaje.mx/5840625s/ (MISP Attribute #16289)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-6cec-4bb8-b0ec-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-6cec-4bb8-b0ec-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://smsmensaje.mx/5840625s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-5650-454d-b04a-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://smsmensaje.mx/7831163s/ (MISP Attribute #16290)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://smsmensaje.mx/7831163s/ (MISP Attribute #16290)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-5650-454d-b04a-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-5650-454d-b04a-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://smsmensaje.mx/7831163s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-f498-4f27-bb20-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://smsmensaje.mx/7893029s/ (MISP Attribute #16291)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://smsmensaje.mx/7893029s/ (MISP Attribute #16291)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-f498-4f27-bb20-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-f498-4f27-bb20-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://smsmensaje.mx/7893029s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-fa1c-4757-8946-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://smsmensaje.mx/8435662s/ (MISP Attribute #16292)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://smsmensaje.mx/8435662s/ (MISP Attribute #16292)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-fa1c-4757-8946-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-fa1c-4757-8946-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://smsmensaje.mx/8435662s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-9418-41e9-aecc-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://smsmensaje.mx/8643330s/ (MISP Attribute #16293)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://smsmensaje.mx/8643330s/ (MISP Attribute #16293)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-9418-41e9-aecc-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-9418-41e9-aecc-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://smsmensaje.mx/8643330s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-a298-4139-a48b-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://unonoticias.net/1214510s/ (MISP Attribute #16294)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://unonoticias.net/1214510s/ (MISP Attribute #16294)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-a298-4139-a48b-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-a298-4139-a48b-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://unonoticias.net/1214510s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141ae-420c-4615-b723-06b38e96ca05" timestamp="2017-06-26T13:17:34+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://unonoticias.net/1419678s/ (MISP Attribute #16295)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://unonoticias.net/1419678s/ (MISP Attribute #16295)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141ae-420c-4615-b723-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141ae-420c-4615-b723-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://unonoticias.net/1419678s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:34+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-75cc-4c7e-8e0a-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://unonoticias.net/1867745s/ (MISP Attribute #16296)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://unonoticias.net/1867745s/ (MISP Attribute #16296)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-75cc-4c7e-8e0a-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-75cc-4c7e-8e0a-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://unonoticias.net/1867745s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-dbd4-4aff-9733-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://unonoticias.net/2046803s/ (MISP Attribute #16297)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://unonoticias.net/2046803s/ (MISP Attribute #16297)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-dbd4-4aff-9733-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-dbd4-4aff-9733-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://unonoticias.net/2046803s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-109c-49c0-a621-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://unonoticias.net/3651023s/ (MISP Attribute #16298)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://unonoticias.net/3651023s/ (MISP Attribute #16298)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-109c-49c0-a621-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-109c-49c0-a621-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://unonoticias.net/3651023s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-a2c8-4f54-af98-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://unonoticias.net/4392216s/ (MISP Attribute #16299)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://unonoticias.net/4392216s/ (MISP Attribute #16299)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-a2c8-4f54-af98-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-a2c8-4f54-af98-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://unonoticias.net/4392216s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-8e20-4a46-bf32-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://unonoticias.net/4709973s/ (MISP Attribute #16300)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://unonoticias.net/4709973s/ (MISP Attribute #16300)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-8e20-4a46-bf32-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-8e20-4a46-bf32-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://unonoticias.net/4709973s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-3c6c-4adf-b195-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://unonoticias.net/5027740s/ (MISP Attribute #16301)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://unonoticias.net/5027740s/ (MISP Attribute #16301)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-3c6c-4adf-b195-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-3c6c-4adf-b195-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://unonoticias.net/5027740s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-1c0c-40a8-9059-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://unonoticias.net/5723329s/ (MISP Attribute #16302)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://unonoticias.net/5723329s/ (MISP Attribute #16302)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-1c0c-40a8-9059-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-1c0c-40a8-9059-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://unonoticias.net/5723329s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-ae9c-46b6-bd19-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://unonoticias.net/5851721s/ (MISP Attribute #16303)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://unonoticias.net/5851721s/ (MISP Attribute #16303)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-ae9c-46b6-bd19-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-ae9c-46b6-bd19-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://unonoticias.net/5851721s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-e238-48f1-8fdf-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://unonoticias.net/6532946s/ (MISP Attribute #16304)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://unonoticias.net/6532946s/ (MISP Attribute #16304)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-e238-48f1-8fdf-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-e238-48f1-8fdf-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://unonoticias.net/6532946s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-545c-45eb-8055-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://unonoticias.net/6809853s/ (MISP Attribute #16305)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://unonoticias.net/6809853s/ (MISP Attribute #16305)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-545c-45eb-8055-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-545c-45eb-8055-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://unonoticias.net/6809853s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-4e28-43e0-abb7-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://unonoticias.net/6843502s/ (MISP Attribute #16306)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://unonoticias.net/6843502s/ (MISP Attribute #16306)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-4e28-43e0-abb7-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-4e28-43e0-abb7-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://unonoticias.net/6843502s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-af04-42cd-8891-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://unonoticias.net/7564969s/ (MISP Attribute #16307)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://unonoticias.net/7564969s/ (MISP Attribute #16307)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-af04-42cd-8891-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-af04-42cd-8891-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://unonoticias.net/7564969s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-b5e0-4b6e-a4ea-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://unonoticias.net/7972736s/ (MISP Attribute #16308)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://unonoticias.net/7972736s/ (MISP Attribute #16308)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-b5e0-4b6e-a4ea-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-b5e0-4b6e-a4ea-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://unonoticias.net/7972736s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-fc1c-407c-a526-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://unonoticias.net/8167459s/ (MISP Attribute #16309)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://unonoticias.net/8167459s/ (MISP Attribute #16309)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-fc1c-407c-a526-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-fc1c-407c-a526-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://unonoticias.net/8167459s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-64c8-4783-8cfc-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://unonoticias.net/8439927s/ (MISP Attribute #16310)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://unonoticias.net/8439927s/ (MISP Attribute #16310)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-64c8-4783-8cfc-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-64c8-4783-8cfc-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://unonoticias.net/8439927s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-2e50-4760-826b-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://unonoticias.net/8592764s/ (MISP Attribute #16311)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://unonoticias.net/8592764s/ (MISP Attribute #16311)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-2e50-4760-826b-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-2e50-4760-826b-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://unonoticias.net/8592764s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-d7c4-4ec4-b292-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: https://unonoticias.net/9436744s/ (MISP Attribute #16312)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: https://unonoticias.net/9436744s/ (MISP Attribute #16312)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-d7c4-4ec4-b292-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-d7c4-4ec4-b292-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://unonoticias.net/9436744s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-e3dc-4232-b605-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://tinyurl.com/j7luz86 (MISP Attribute #16313)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://tinyurl.com/j7luz86 (MISP Attribute #16313)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-e3dc-4232-b605-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-e3dc-4232-b605-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://tinyurl.com/j7luz86</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-f744-4f14-825e-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://tinyurl.com/o2tq8rl (MISP Attribute #16314)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://tinyurl.com/o2tq8rl (MISP Attribute #16314)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-f744-4f14-825e-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-f744-4f14-825e-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://tinyurl.com/o2tq8rl</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-73d4-45d1-aecd-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://twiitter.com.mx/2857663s/ (MISP Attribute #16315)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://twiitter.com.mx/2857663s/ (MISP Attribute #16315)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-73d4-45d1-aecd-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-73d4-45d1-aecd-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://twiitter.com.mx/2857663s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-8adc-48ba-b585-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://unonoticias.net/1214510s/ (MISP Attribute #16316)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://unonoticias.net/1214510s/ (MISP Attribute #16316)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-8adc-48ba-b585-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-8adc-48ba-b585-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://unonoticias.net/1214510s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-6b7c-430b-ac54-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://unonoticias.net/3423768s/ (MISP Attribute #16317)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://unonoticias.net/3423768s/ (MISP Attribute #16317)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-6b7c-430b-ac54-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-6b7c-430b-ac54-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://unonoticias.net/3423768s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-4ed0-493c-abb8-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://unonoticias.net/5819525s/ (MISP Attribute #16318)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://unonoticias.net/5819525s/ (MISP Attribute #16318)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-4ed0-493c-abb8-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-4ed0-493c-abb8-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://unonoticias.net/5819525s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-8d70-4703-8aab-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://unonoticias.net/6218095s/ (MISP Attribute #16319)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://unonoticias.net/6218095s/ (MISP Attribute #16319)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-8d70-4703-8aab-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-8d70-4703-8aab-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://unonoticias.net/6218095s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-1650-4b7a-a3f3-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://unonoticias.net/9250302s/ (MISP Attribute #16320)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://unonoticias.net/9250302s/ (MISP Attribute #16320)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-1650-4b7a-a3f3-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-1650-4b7a-a3f3-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://unonoticias.net/9250302s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-595141af-2dac-4f74-9717-06b38e96ca05" timestamp="2017-06-26T13:17:35+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: http://unonoticias.net/9804185s/ (MISP Attribute #16321)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: http://unonoticias.net/9804185s/ (MISP Attribute #16321)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-595141af-2dac-4f74-9717-06b38e96ca05">
|
|
<cybox:Object id=":URI-595141af-2dac-4f74-9717-06b38e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">http://unonoticias.net/9804185s/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-06-26T13:17:35+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
</incident:Related_Indicators>
|
|
<incident:History>
|
|
<incident:History_Item>
|
|
<incident:Journal_Entry time_precision="second">Event Threat Level: High</incident:Journal_Entry>
|
|
</incident:History_Item>
|
|
<incident:History_Item>
|
|
<incident:Journal_Entry time_precision="second">MISP Tag: TLP:GREEN</incident:Journal_Entry>
|
|
</incident:History_Item>
|
|
<incident:History_Item>
|
|
<incident:Journal_Entry time_precision="second">MISP Tag: SOURCE:CITIZENLAB</incident:Journal_Entry>
|
|
</incident:History_Item>
|
|
<incident:History_Item>
|
|
<incident:Journal_Entry time_precision="second">MISP Tag: DETECT</incident:Journal_Entry>
|
|
</incident:History_Item>
|
|
<incident:History_Item>
|
|
<incident:Journal_Entry time_precision="second">MISP Tag: PUBLISHED</incident:Journal_Entry>
|
|
</incident:History_Item>
|
|
<incident:History_Item>
|
|
<incident:Journal_Entry time_precision="second">MISP Tag: TARGET:MEXICO</incident:Journal_Entry>
|
|
</incident:History_Item>
|
|
</incident:History>
|
|
<incident:Information_Source>
|
|
<stixCommon:Identity>
|
|
<stixCommon:Name>citizenlab</stixCommon:Name>
|
|
</stixCommon:Identity>
|
|
</incident:Information_Source>
|
|
<incident:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
|
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="GREEN"/>
|
|
</marking:Marking>
|
|
</incident:Handling>
|
|
</stix:Incident>
|
|
</stix:Incidents>
|
|
</stix:Package>
|
|
</stix:Related_Package>
|
|
</stix:Related_Packages>
|
|
</stix:STIX_Package>
|