Cybersixgill Darkfeed TAXII 集成

{
    "@timestamp": "2021-12-07T13:58:01.596Z",
    "agent": {
        "ephemeral_id": "9c2e1e11-18ae-413f-9523-290c561a4b61",
        "id": "8299ae35-ee0e-4107-9acb-1b6acfdda1fb",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "cybersixgill": {
        "actor": "vaedzy",
        "deleted_at": "2021-12-17T13:58:01.596Z",
        "expiration_duration": "10d",
        "feedname": "dark_web_hashes",
        "mitre": {
            "description": "Mitre attack tactics and technique reference"
        },
        "title": "[病毒样本] #Trickbot (2021-12-07)",
        "virustotal": {
            "pr": "medium",
            "url": "https://virustotal.com/#/file/7bdf8b8594ec269da864ee662334f4da53d4820a3f0f8aa665a0fa096ca8f22d"
        }
    },
    "data_stream": {
        "dataset": "ti_cybersixgill.threat",
        "namespace": "78677",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "8299ae35-ee0e-4107-9acb-1b6acfdda1fb",
        "snapshot": false,
        "version": "8.13.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "threat"
        ],
        "created": "2024-08-02T04:14:26.522Z",
        "dataset": "ti_cybersixgill.threat",
        "ingested": "2024-08-02T04:14:27Z",
        "kind": "enrichment",
        "original": "{\"confidence\":70,\"created\":\"2021-12-07T13:58:01.596Z\",\"description\":\"Hash attributed to malware that was discovered in the dark and deep web\",\"extensions\":{\"extension-definition--3de9ff00-174d-4d41-87c9-05a27a7e117c\":{\"extension_type\":\"toplevel-property-extension\"}},\"external_references\":[{\"positive_rate\":\"medium\",\"source_name\":\"VirusTotal\",\"url\":\"https://virustotal.com/#/file/7bdf8b8594ec269da864ee662334f4da53d4820a3f0f8aa665a0fa096ca8f22d\"},{\"description\":\"Mitre attack tactics and technique reference\",\"mitre_attack_tactic\":\"Build Capabilities\",\"mitre_attack_tactic_id\":\"TA0024\",\"mitre_attack_tactic_url\":\"https://attack.mitre.org/tactics/TA0024/\",\"source_name\":\"mitre-attack\"}],\"id\":\"indicator--302dab0f-64dc-42f5-b99e-702b28c1aaa9\",\"indicator_types\":[\"malicious-activity\"],\"lang\":\"en\",\"modified\":\"2021-12-07T13:58:01.596Z\",\"name\":\"4d0f21919d623bd1631ee15ca7429f28;5ce39ef0700b64bd0c71b55caf64ae45d8400965;7bdf8b8594ec269da864ee662334f4da53d4820a3f0f8aa665a0fa096ca8f22d\",\"pattern\":\"[file:hashes.MD5 = '4d0f21919d623bd1631ee15ca7429f28' OR file:hashes.'SHA-1' = '5ce39ef0700b64bd0c71b55caf64ae45d8400965' OR file:hashes.'SHA-256' = '7bdf8b8594ec269da864ee662334f4da53d4820a3f0f8aa665a0fa096ca8f22d']\",\"pattern_type\":\"stix\",\"sixgill_actor\":\"vaedzy\",\"sixgill_confidence\":70,\"sixgill_feedid\":\"darkfeed_012\",\"sixgill_feedname\":\"dark_web_hashes\",\"sixgill_post_virustotallink\":\"https://virustotal.com/#/file/7bdf8b8594ec269da864ee662334f4da53d4820a3f0f8aa665a0fa096ca8f22d\",\"sixgill_postid\":\"c0c9a0085fb5281cfb40a0ddb62e1d2c6a53eb7a\",\"sixgill_posttitle\":\"[病毒样本] #Trickbot (2021-12-07)\",\"sixgill_severity\":70,\"sixgill_source\":\"forum_kafan\",\"spec_version\":\"2.1\",\"type\":\"indicator\",\"valid_from\":\"2021-12-07T02:55:17Z\"}",
        "severity": 70,
        "type": [
            "indicator"
        ]
    },
    "input": {
        "type": "httpjson"
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "ti_cybersixgill"
    ],
    "threat": {
        "indicator": {
            "confidence": "High",
            "description": "Hash attributed to malware that was discovered in the dark and deep web",
            "file": {
                "hash": {
                    "md5": "4d0f21919d623bd1631ee15ca7429f28",
                    "sha1": "5ce39ef0700b64bd0c71b55caf64ae45d8400965",
                    "sha256": "7bdf8b8594ec269da864ee662334f4da53d4820a3f0f8aa665a0fa096ca8f22d"
                }
            },
            "first_seen": "2021-12-07T02:55:17.000Z",
            "last_seen": "2021-12-07T13:58:01.596Z",
            "name": "7bdf8b8594ec269da864ee662334f4da53d4820a3f0f8aa665a0fa096ca8f22d",
            "provider": "forum_kafan",
            "reference": "https://portal.cybersixgill.com/#/search?q=_id:c0c9a0085fb5281cfb40a0ddb62e1d2c6a53eb7a",
            "type": "file"
        },
        "tactic": {
            "id": [
                "TA0024"
            ],
            "name": [
                "Build Capabilities"
            ],
            "reference": [
                "https://attack.mitre.org/tactics/TA0024/"
            ]
        }
    }
}