Skip to content

Commit 1ab371f

Browse files
Delta-SierraDelta-Sierra
committed
2 parents 51e131d + 3ac5099 commit 1ab371f

14 files changed

Lines changed: 531 additions & 9 deletions

File tree

‎README.md‎

Lines changed: 30 additions & 3 deletions
Large diffs are not rendered by default.

‎objects/artifact/definition.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
},
2525
"payload_bin": {
2626
"description": "Specifies the binary data contained in the artifact as a base64-encoded string.",
27-
"misp-attribute": "text",
27+
"misp-attribute": "attachment",
2828
"ui-priority": 0
2929
},
3030
"sha1": {

‎objects/attack-step/definition.json‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,13 @@
2626
"description": "IP destination of the attack step, if any.",
2727
"disable_correlation": true,
2828
"misp-attribute": "ip-dst",
29+
"multiple": true,
2930
"ui-priority": 1
3031
},
3132
"dst-misc": {
32-
"description": "Other type of source of the attack step, if any. This can be e.g. localhost.",
33+
"description": "Other type of destination of the attack step, if any. This can be e.g. localhost.",
3334
"misp-attribute": "text",
35+
"multiple": true,
3436
"ui-priority": 1
3537
},
3638
"expected-response": {
@@ -50,16 +52,19 @@
5052
"source-domain": {
5153
"description": "Domain source of the attack step, if any.",
5254
"misp-attribute": "domain",
55+
"multiple": true,
5356
"ui-priority": 1
5457
},
5558
"source-ip": {
5659
"description": "IP source of the attack step, if any.",
5760
"misp-attribute": "ip-src",
61+
"multiple": true,
5862
"ui-priority": 1
5963
},
6064
"source-misc": {
6165
"description": "Other type of source of the attack step, if any. This can be e.g. rotating ip from cloud providers such as AWS, or localhost.",
6266
"misp-attribute": "text",
67+
"multiple": true,
6368
"ui-priority": 1
6469
},
6570
"succesful": {

‎objects/c2-list/definition.json‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"attributes": {
3+
"c2-ip": {
4+
"categories": [
5+
"Network activity"
6+
],
7+
"description": "IP of C2 server with unknown port",
8+
"misp-attribute": "ip-src",
9+
"multiple": true,
10+
"ui-priority": 1
11+
},
12+
"c2-ipport": {
13+
"categories": [
14+
"Network activity"
15+
],
16+
"description": "IP:Port of C2 server",
17+
"misp-attribute": "ip-src|port",
18+
"multiple": true,
19+
"ui-priority": 1
20+
},
21+
"report-url": {
22+
"description": "URL of source of information, e.g. blog post, ransomware analysis",
23+
"disable_correlation": true,
24+
"misp-attribute": "link",
25+
"multiple": true,
26+
"ui-priority": 1
27+
},
28+
"threat": {
29+
"categories": [
30+
"Attribution",
31+
"Payload type"
32+
],
33+
"description": "threat actor or malware",
34+
"misp-attribute": "text",
35+
"ui-priority": 1
36+
}
37+
},
38+
"description": "List of C2-servers with common ground, e.g. extracted from a blog post or ransomware analysis",
39+
"meta-category": "network",
40+
"name": "c2-list",
41+
"required": [
42+
"threat"
43+
],
44+
"requiredOneOf": [
45+
"c2-ipport",
46+
"c2-ip"
47+
],
48+
"uuid": "12456351-ceb7-4d43-9a7e-d2275d8b5785",
49+
"version": 20230919
50+
}

‎objects/crowdstrike-report/definition.json‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{
2+
"attributes": {
3+
"command": {
4+
"description": "Commandline triggering the detection",
5+
"disable_correlation": true,
6+
"misp-attribute": "text",
7+
"multiple": true,
8+
"ui-priority": 1
9+
},
10+
"file-hash": {
11+
"description": "Unique file hash",
12+
"misp-attribute": "sha256",
13+
"ui-priority": 1
14+
},
15+
"filename": {
16+
"description": "Filename on disk",
17+
"disable_correlation": true,
18+
"misp-attribute": "filename",
19+
"multiple": true,
20+
"ui-priority": 1
21+
},
22+
"fullpath": {
23+
"description": "Complete path of the filename including the filename",
24+
"disable_correlation": true,
25+
"misp-attribute": "text",
26+
"multiple": true,
27+
"ui-priority": 0
28+
},
29+
"ip": {
30+
"description": "Source IP address",
31+
"misp-attribute": "ip-src",
32+
"ui-priority": 1
33+
},
34+
"parent-command": {
35+
"description": "Commandline of the parent process",
36+
"disable_correlation": true,
37+
"misp-attribute": "text",
38+
"multiple": true,
39+
"ui-priority": 1
40+
},
41+
"process-name": {
42+
"description": "Name of the process trigerring the detection",
43+
"misp-attribute": "text",
44+
"multiple": true,
45+
"ui-priority": 1
46+
}
47+
},
48+
"description": "An Object Template to encode an Crowdstrike detection report",
49+
"meta-category": "misc",
50+
"name": "crowdstrike-report",
51+
"uuid": "805b327c-8f1b-4d76-a3ba-c8bc4964e740",
52+
"version": 1
53+
}

‎objects/cs-beacon-config/definition.json‎

Lines changed: 44 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
{
22
"attributes": {
3+
"asn": {
4+
"description": "Originating ASN for the CS Beacon Config",
5+
"disable_correlation": true,
6+
"misp-attribute": "AS",
7+
"ui-priority": 0
8+
},
39
"c2": {
410
"categories": [
511
"Network activity"
@@ -9,6 +15,24 @@
915
"multiple": true,
1016
"ui-priority": 1
1117
},
18+
"city": {
19+
"description": "City location of the CS Beacon Config in question",
20+
"disable_correlation": true,
21+
"misp-attribute": "text",
22+
"ui-priority": 0
23+
},
24+
"geo": {
25+
"description": "Country location of the CS Beacon Config",
26+
"disable_correlation": true,
27+
"misp-attribute": "text",
28+
"ui-priority": 0
29+
},
30+
"ip": {
31+
"description": "IP of the C2",
32+
"misp-attribute": "ip-dst",
33+
"multiple": true,
34+
"ui-priority": 1
35+
},
1236
"jar-md5": {
1337
"categories": [
1438
"External analysis"
@@ -17,6 +41,11 @@
1741
"misp-attribute": "md5",
1842
"ui-priority": 0
1943
},
44+
"license-id": {
45+
"description": "License ID of the Colbalt Strike",
46+
"misp-attribute": "text",
47+
"ui-priority": 1
48+
},
2049
"md5": {
2150
"categories": [
2251
"Payload delivery"
@@ -25,6 +54,20 @@
2554
"misp-attribute": "md5",
2655
"ui-priority": 1
2756
},
57+
"naics": {
58+
"description": "North American Industry Classification System Code",
59+
"disable_correlation": true,
60+
"misp-attribute": "text",
61+
"multiple": true,
62+
"ui-priority": 0
63+
},
64+
"sector": {
65+
"description": "Sector of for the CS Beacon Config in question",
66+
"disable_correlation": true,
67+
"misp-attribute": "text",
68+
"multiple": true,
69+
"ui-priority": 0
70+
},
2871
"sha1": {
2972
"categories": [
3073
"Payload delivery"
@@ -69,5 +112,5 @@
69112
"watermark"
70113
],
71114
"uuid": "d17355ef-ca1f-4b5a-86cd-65d877991f54",
72-
"version": 1
115+
"version": 3
73116
}

‎objects/flowintel-cm-case/definition.json‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
{
2+
"attributes": {
3+
"case-owner-org-name": {
4+
"description": "Name of the organisation that created the case.",
5+
"disable_correlation": true,
6+
"misp-attribute": "text",
7+
"ui-priority": 0
8+
},
9+
"case-owner-org-uuid": {
10+
"description": "UUID of the organisation that created the case.",
11+
"disable_correlation": true,
12+
"misp-attribute": "text",
13+
"ui-priority": 0
14+
},
15+
"case-uuid": {
16+
"description": "UUID of the case",
17+
"disable_correlation": true,
18+
"misp-attribute": "text",
19+
"ui-priority": 1
20+
},
21+
"creation-date": {
22+
"description": "Creation date of the case",
23+
"disable_correlation": true,
24+
"misp-attribute": "datetime",
25+
"ui-priority": 0
26+
},
27+
"deadline": {
28+
"description": "Deadline of the case",
29+
"disable_correlation": true,
30+
"misp-attribute": "datetime",
31+
"ui-priority": 0
32+
},
33+
"description": {
34+
"description": "A description of the case",
35+
"disable_correlation": true,
36+
"misp-attribute": "text",
37+
"ui-priority": 0
38+
},
39+
"finish-date": {
40+
"description": "Finish date of the case",
41+
"disable_correlation": true,
42+
"misp-attribute": "datetime",
43+
"ui-priority": 0
44+
},
45+
"origin-url": {
46+
"description": "Origin of the case",
47+
"disable_correlation": true,
48+
"misp-attribute": "url",
49+
"to_ids": false,
50+
"ui-priority": 1
51+
},
52+
"recurring-type": {
53+
"description": "Recurring type",
54+
"disable_correlation": true,
55+
"misp-attribute": "text",
56+
"sane_default": [
57+
"once",
58+
"weekly",
59+
"daily",
60+
"monthly"
61+
],
62+
"ui-priority": 0
63+
},
64+
"status": {
65+
"description": "Status of the case",
66+
"disable_correlation": true,
67+
"misp-attribute": "text",
68+
"sane_default": [
69+
"created",
70+
"ongoing",
71+
"recurring",
72+
"unavailable",
73+
"rejected",
74+
"finished"
75+
],
76+
"ui-priority": 0
77+
},
78+
"title": {
79+
"description": "Title of the case",
80+
"disable_correlation": true,
81+
"misp-attribute": "text",
82+
"ui-priority": 1
83+
}
84+
},
85+
"description": "A case as defined by flowintel-cm.",
86+
"meta-category": "misc",
87+
"name": "flowintel-cm-case",
88+
"uuid": "19df57c7-b315-4fd2-84e5-d81ab221425e",
89+
"version": 2
90+
}

0 commit comments

Comments
 (0)