forked from demisto/content
-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
c0703a0
commit c2fb359
Showing
6 changed files
with
47 additions
and
96 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,5 @@ | ||
| { | ||
| "id": "account-facebook.com", | ||
| "id": "<domain>", | ||
| "type": "domain", | ||
| "attributes": { | ||
| "last_modification_date": 1726690020, | ||
|
|
@@ -9,7 +9,7 @@ | |
| "mandiant_ic_score": 84, | ||
| "registrar": "Amazon Registrar, Inc.", | ||
| "last_dns_records_date": 1726675835, | ||
| "whois": "Admin City: Clearwater\nAdmin Country: US\nAdmin Email: [email protected]\nAdmin Organization: Knowbe4\nAdmin Postal Code: 33755\nAdmin State/Province: FL\nCreation Date: 2020-12-07T20:18:23Z\nDNSSEC: unsigned\nDomain Name: ACCOUNT-FACEBOOK.COM\nDomain Name: account-facebook.com\nDomain Status: ok https://icann.org/epp#ok\nName Server: NS-1381.AWSDNS-44.ORG\nName Server: NS-1693.AWSDNS-19.CO.UK\nName Server: NS-330.AWSDNS-41.COM\nName Server: NS-537.AWSDNS-03.NET\nRegistrant City: 9f17c16e0cbd11e5\nRegistrant Country: US\nRegistrant Email: [email protected]\nRegistrant Fax Ext: 3432650ec337c945\nRegistrant Fax: 3432650ec337c945\nRegistrant Name: 24277ff58446df8f\nRegistrant Organization: c25274193b9137ef\nRegistrant Phone Ext: 3432650ec337c945\nRegistrant Phone: 6099a769d1923d4a\nRegistrant Postal Code: f28adb1ee249d449\nRegistrant State/Province: 6eb233f5a5adbed8\nRegistrant Street: 7d57c43d3cfd7338\nRegistrar Abuse Contact Email: [email protected]\nRegistrar Abuse Contact Phone: +1.2024422253\nRegistrar IANA ID: 468\nRegistrar Registration Expiration Date: 2024-12-07T20:18:23Z\nRegistrar URL: http://registrar.amazon.com\nRegistrar URL: https://registrar.amazon.com\nRegistrar WHOIS Server: whois.registrar.amazon\nRegistrar WHOIS Server: whois.registrar.amazon.com\nRegistrar: Amazon Registrar, Inc.\nRegistry Admin ID: Not Available From Registry\nRegistry Domain ID: 2577160164_DOMAIN_COM-VRSN\nRegistry Expiry Date: 2024-12-07T20:18:23Z\nRegistry Registrant ID: Not Available From Registry\nRegistry Tech ID: Not Available From Registry\nTech City: Clearwater\nTech Country: US\nTech Email: [email protected]\nTech Organization: Knowbe4\nTech Postal Code: 33755\nTech State/Province: FL\nUpdated Date: 2023-11-03T22:57:14Z", | ||
| "whois": "Admin City: Clearwater\nAdmin Country: US\nAdmin Email: <admin_email>@google.com\nAdmin Organization: <Admin Org>\nAdmin Postal Code: 33755\nAdmin State/Province: FL\nCreation Date: 2020-12-07T20:18:23Z\nDNSSEC: unsigned\nDomain Name: <Domain Name>\nDomain Status: OK\nName Server: <Name Server>\nRegistrant City: 9f17c16e0cbd11e5\nRegistrant Country: US\nRegistrant Email: <registrant_email>@google.com\nRegistrant Fax Ext: 3432650ec337c945\nRegistrant Fax: 3432650ec337c945\nRegistrant Name: 24277ff58446df8f\nRegistrant Organization: c25274193b9137ef\nRegistrant Phone Ext: 3432650ec337c945\nRegistrant Phone: 6099a769d1923d4a\nRegistrant Postal Code: f28adb1ee249d449\nRegistrant State/Province: 6eb233f5a5adbed8\nRegistrant Street: 7d57c43d3cfd7338\nRegistrar Abuse Contact Email: <abuse>@google.com\nRegistrar Abuse Contact Phone: +34 600 000 000\nRegistrar IANA ID: <IANA ID>\nRegistrar Registration Expiration Date: 2024-12-07T20:18:23Z\nRegistrar URL: <Registrar URL>\nRegistrar URL: <Registrar URL>\nRegistrar WHOIS Server: <Registrar WHOIS Server>\nRegistrar: <Registrar>\nRegistry Admin ID: Not Available From Registry\nRegistry Domain ID: <Registry Domain ID>\nRegistry Expiry Date: 2024-12-07T20:18:23Z\nRegistry Registrant ID: Not Available From Registry\nRegistry Tech ID: Not Available From Registry\nTech City: Clearwater\nTech Country: US\nTech Email: <tech_email>@google.com\nTech Organization: <Tech Org>\nTech Postal Code: 33755\nTech State/Province: FL\nUpdated Date: 2023-11-03T22:57:14Z", | ||
| "last_https_certificate_date": 1593568953, | ||
| "threat_verdict": "VERDICT_UNDETECTED", | ||
| "whois_date": 1724217310, | ||
|
|
@@ -28,13 +28,13 @@ | |
| "attribution": { | ||
| "detailed_threat_actors": [ | ||
| { | ||
| "name": "UNC2710", | ||
| "name": "<TA_name>", | ||
| "source": "Mandiant", | ||
| "id": "threat-actor--31613362-0ea7-596b-8941-8ede904e98ac" | ||
| "id": "<TA_id>" | ||
| } | ||
| ], | ||
| "threat_actors": [ | ||
| "UNC2710" | ||
| "<TA_name>" | ||
| ] | ||
| }, | ||
| "total_votes": { | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,5 @@ | ||
| { | ||
| "id": "8.8.8.8", | ||
| "id": "X.X.X.X", | ||
| "type": "ip_address", | ||
| "attributes": { | ||
| "last_modification_date": 1726781178, | ||
|
|
@@ -18,9 +18,9 @@ | |
| "first_seen_itw_date": 1409607591, | ||
| "reputation": 535, | ||
| "tags": [], | ||
| "whois": "NetRange: 8.8.8.0 - 8.8.8.255\nCIDR: 8.8.8.0/24\nNetName: GOGL\nNetHandle: NET-8-8-8-0-2\nParent: NET8 (NET-8-0-0-0-0)\nNetType: Direct Allocation\nOriginAS: \nOrganization: Google LLC (GOGL)\nRegDate: 2023-12-28\nUpdated: 2023-12-28\nRef: https://rdap.arin.net/registry/ip/8.8.8.0\nOrgName: Google LLC\nOrgId: GOGL\nAddress: 1600 Amphitheatre Parkway\nCity: Mountain View\nStateProv: CA\nPostalCode: 94043\nCountry: US\nRegDate: 2000-03-30\nUpdated: 2019-10-31\nComment: Please note that the recommended way to file abuse complaints are located in the following links. \nComment: \nComment: To report abuse and illegal activity: https://www.google.com/contact/\nComment: \nComment: For legal requests: http://support.google.com/legal \nComment: \nComment: Regards, \nComment: The Google Team\nRef: https://rdap.arin.net/registry/entity/GOGL\nOrgAbuseHandle: ABUSE5250-ARIN\nOrgAbuseName: Abuse\nOrgAbusePhone: +1-650-253-0000 \nOrgAbuseEmail: [email protected]\nOrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE5250-ARIN\nOrgTechHandle: ZG39-ARIN\nOrgTechName: Google LLC\nOrgTechPhone: +1-650-253-0000 \nOrgTechEmail: [email protected]\nOrgTechRef: https://rdap.arin.net/registry/entity/ZG39-ARIN\n", | ||
| "whois": "NetRange: X.X.X.0 - X.X.X.255\nCIDR: X.X.X.0/24\n", | ||
| "continent": "NA", | ||
| "network": "8.8.8.0/24", | ||
| "network": "X.X.X.0/24", | ||
| "threat_verdict": "VERDICT_UNDETECTED", | ||
| "country": "US", | ||
| "regional_internet_registry": "ARIN", | ||
|
|
@@ -32,51 +32,35 @@ | |
| "attribution": { | ||
| "detailed_threat_actors": [ | ||
| { | ||
| "source": "MISPGalaxy", | ||
| "name": "ToddyCat", | ||
| "id": "threat-actor--091a0b69-74de-44b6-bb12-16b7a8fd078b" | ||
| "source": "<TA_source_1>", | ||
| "name": "<TA_name_1>", | ||
| "id": "<TA_id_1>" | ||
| }, | ||
| { | ||
| "source": "MISPGalaxy", | ||
| "name": "SWEED", | ||
| "id": "threat-actor--64ac8827-89d9-4738-9df3-cd955c628bee" | ||
| "source": "<TA_source_2>", | ||
| "name": "<TA_name_2>", | ||
| "id": "<TA_id_2>" | ||
| } | ||
| ], | ||
| "malware_families": [ | ||
| { | ||
| "source": "mandiant_backscatter", | ||
| "family": "asyncrat" | ||
| "source": "<MF_source_1>", | ||
| "family": "<MF_family_1>" | ||
| }, | ||
| { | ||
| "source": "mandiant_backscatter_memdump_cape", | ||
| "family": "metasploit" | ||
| }, | ||
| { | ||
| "source": "mandiant_backscatter_memdump_zenbox", | ||
| "family": "metasploit" | ||
| }, | ||
| { | ||
| "source": "mandiant_backscatter", | ||
| "family": "metasploit" | ||
| }, | ||
| { | ||
| "source": "mandiant_backscatter", | ||
| "family": "meterpreter" | ||
| }, | ||
| { | ||
| "source": "mandiant_backscatter", | ||
| "family": "quasarrat" | ||
| "source": "<MF_source_2>", | ||
| "family": "<MF_family_2>" | ||
| } | ||
| ], | ||
| "threat_actors": [ | ||
| "ToddyCat", | ||
| "SWEED" | ||
| "<TA_name_1>", | ||
| "<TA_name_2>" | ||
| ], | ||
| "family": "asyncrat", | ||
| "family": "<MF_family_1>", | ||
| "family_pivot": "collection:None" | ||
| }, | ||
| "last_seen_itw_date": 1726766855, | ||
| "jarm": "29d3fd00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae", | ||
| "jarm": "<jarm>", | ||
| "gti_assessment": { | ||
| "contributing_factors": { | ||
| "normalised_categories": [ | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,12 +1,14 @@ | ||
|
|
||
| #### Indicator Fields | ||
|
|
||
| - New: **GTI Verdict** | ||
| - New: **GTI Severity** | ||
|
|
||
| - New: **GTI Threat Score** | ||
|
|
||
| - New: **GTI Verdict** | ||
|
|
||
| #### Integrations | ||
|
|
||
| ##### New: Google Threat Intelligence IoC Stream Feed | ||
|
|
||
| - New: Use this feed integration to fetch Google Threat Intelligence IoC Stream notifications as indicators. (Available from Cortex XSOAR 5.5.0). | ||
| - New: Use this feed integration to fetch Google Threat Intelligence IoC Stream notifications as indicators. |