Mandiant Advantage Threat Intelligence
Enrich Indicators of Compromise, and fetch information about Actors, Malware Families, and Campaigns from Mandiant Advantage.
Data Enrichment & Threat Intelligence · Mandiant Advantage Threat Intelligence · Feed
Details
| ID | Mandiant Advantage Threat Intelligence |
|---|---|
| Provider | |
| Category | Data Enrichment & Threat Intelligence |
| From Version | 6.6.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Supported Modules | Agentix XSIAM |
README
Enrich Indicators of Compromise, and fetch information about Actors, Malware Families, and Campaigns from Mandiant Advantage.
This integration was integrated and tested with version 4 of the Mandiant Advantage Threat Intelligence API
Configure Mandiant Advantage Threat Intelligence on Cortex XSOAR
- Navigate to Settings > Integrations > Servers & Services.
- Search for Mandiant Advantage Threat Intelligence.
-
Click Add instance to create and configure a new integration instance.
Parameter Description Required API Base URL Leave as ‘api.intelligence.mandiant.com’ if unsure False API Key Your API Key from Mandiant Advantage Threat Intelligence True Secret Key Your Secret Key from Mandiant Advantage Threat Intelligence True Fetch indicators False Indicator Reputation Indicators from this integration instance will be marked with this reputation. False Source Reliability Reliability of the source providing the intelligence data. True Traffic Light Protocol Color The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed. False Feed Expiration Policy False Feed Expiration Interval False Feed Fetch Interval False Feed Minimum Confidence Score The minimum MScore value to import as part of the feed True Feed Exclude Open Source Intelligence Whether to exclude Open Source Intelligence as part of the feed True Mandiant indicator type The type of indicators to fetch. Indicator type might include the following: Domains, IPs, Files and URLs. False First fetch time The maximum value allowed is 90 days. False Maximum number of indicators per fetch Maximum value of 1000. Any values higher will be capped to 1000 False Tags Supports CSV values. False Timeout API calls timeout. False Bypass exclusion list When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system. False Retrieve indicator metadata Retrieve additional information for each indicator. Note that this requires additional API calls. False Create relationships Note that this requires additional API calls. False Trust any certificate (not secure) False Use system proxy settings False - Click Test to validate the URLs, token, and connection.
Commands
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
mati-get-indicator
Get information about a single Indicator of Compromise from Mandiant
Base Command
mati-get-indicator
Input
| Argument Name | Description | Required |
|---|---|---|
| indicator_value | Value of the indicator to look up. Can be URL, domain name, IP address, or file hash. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| MANDIANTTI.IP.score | Number | The Severity Score of the IP indicator |
| MANDIANTTI.IP.fields.ip | String | The IP address of the IP indicator |
| MANDIANTTI.FILE.score | Number | The Severity Score of the File indicator |
| MANDIANTTI.FILE.fields.md5 | String | The MD5 Hash associated with the File indicator |
| MANDIANTTI.FILE.fields.sha256 | String | The SHA256 Hash associated with the File indicator |
| MANDIANTTI.FILE.fields.sha1 | String | The SHA1 Hash associated with the File indicator |
| MANDIANTTI.DOMAIN.score | Number | The Severity Score of the Domain indicator |
| MANDIANTTI.DOMAIN.fields.dns | String | The DNS record value for the Domain indicator |
| MANDIANTTI.DOMAIN.fields.domain | String | The domain name for the Domain indicator |
| MANDIANTTI.URL.score | Number | The Severity Score of the URL indicator |
| MANDIANTTI.URL.fields.url | String | The URL value for the Domain indicator |
Command example
!mati-get-indicator indicator_value=124.248.207.50
Context Example
{
"MANDIANTTI": {
"IP": {
"fields": {
"DBotScore": {
"Indicator": "124.248.207.50",
"Reliability": "A - Completely reliable",
"Score": 2,
"Type": "ip",
"Vendor": "Mandiant"
},
"firstseenbysource": "2016-06-09T16:28:01.000Z",
"ip": "124.248.207.50",
"lastseenbysource": "2018-04-19T17:23:59.000Z",
"stixid": "ipv4--3a4d8f76-6fde-5b25-9672-a45a0ac16bc8",
"trafficlightprotocol": "AMBER"
},
"rawJSON": {
"attributed_associations": [
{
"id": "threat-actor--3790b99d-7067-536c-821d-19953727bf7b",
"name": "Turla Team",
"type": "threat-actor"
}
],
"campaigns": [],
"first_seen": "2016-06-09T16:28:01.000Z",
"id": "ipv4--3a4d8f76-6fde-5b25-9672-a45a0ac16bc8",
"is_exclusive": false,
"is_publishable": true,
"last_seen": "2018-04-19T17:23:59.000Z",
"last_updated": "2022-05-14T10:15:13.771Z",
"mscore": 52,
"publications": [],
"sources": [
{
"category": [],
"first_seen": "2018-01-08T21:29:53.000+0000",
"last_seen": "2018-04-19T17:23:59.000+0000",
"osint": false,
"source_name": "Mandiant"
},
{
"category": [],
"first_seen": "2016-06-09T16:28:01.000+0000",
"last_seen": "2016-06-09T16:28:01.000+0000",
"osint": false,
"source_name": "Mandiant"
}
],
"type": "ipv4",
"value": "124.248.207.50"
},
"relationships": [],
"score": 2,
"type": "IP",
"value": {
"124.248.207.50": "[124.248.207.50](#/indicator/34576)"
}
}
}
}
Human Readable Output
Results
fields rawJSON relationships score type value firstseenbysource: 2016-06-09T16:28:01.000Z
lastseenbysource: 2018-04-19T17:23:59.000Z
stixid: ipv4–3a4d8f76-6fde-5b25-9672-a45a0ac16bc8
trafficlightprotocol: AMBER
DBotScore: {“Indicator”: “124.248.207.50”, “Type”: “ip”, “Vendor”: “Mandiant”, “Score”: 2, “Reliability”: “A - Completely reliable”}
ip: 124.248.207.50id: ipv4–3a4d8f76-6fde-5b25-9672-a45a0ac16bc8
mscore: 52
type: ipv4
value: 124.248.207.50
is_exclusive: false
is_publishable: true
sources: {‘first_seen’: ‘2018-01-08T21:29:53.000+0000’, ‘last_seen’: ‘2018-04-19T17:23:59.000+0000’, ‘osint’: False, ‘category’: [], ‘source_name’: ‘Mandiant’},
{‘first_seen’: ‘2016-06-09T16:28:01.000+0000’, ‘last_seen’: ‘2016-06-09T16:28:01.000+0000’, ‘osint’: False, ‘category’: [], ‘source_name’: ‘Mandiant’}
attributed_associations: {‘id’: ‘threat-actor–3790b99d-7067-536c-821d-19953727bf7b’, ‘name’: ‘Turla Team’, ‘type’: ‘threat-actor’}
last_updated: 2022-05-14T10:15:13.771Z
first_seen: 2016-06-09T16:28:01.000Z
last_seen: 2018-04-19T17:23:59.000Z
campaigns:
publications:2 IP 124.248.207.50: 124.248.207.50
mati-get-actor
Get information about a Threat Actor from Mandiant
Base Command
mati-get-actor
Input
| Argument Name | Description | Required |
|---|---|---|
| actor_name | Name of the actor to look up. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| MANDIANTTI.ThreatActor.value | String | The name of the ThreatActor |
| MANDIANTTI.ThreatActor.fields.primarymotivation | String | The primary motivation of the ThreatActor |
| MANDIANTTI.ThreatActor.fields.tags | String | The tags and target industries of the ThreatActor |
| MANDIANTTI.ThreatActor.fields.aliases | String | The known aliases of the ThreatActor |
| MANDIANTTI.ThreatActor.fields.targets | String | The known targets of the ThreatActor |
| MANDIANTTI.ThreatActor.fields.description | String | The description of the ThreatActor |
| MANDIANTTI.ThreatActor.fields.publications.title | String | The title of a report associated with the ThreatActor |
| MANDIANTTI.ThreatActor.fields.publications.link | String | The link to the report in Mandiant Advantage |
Command example
!mati-get-actor actor_name=APT1
Context Example
{
"MANDIANTTI": {
"ThreatActor": {
"fields": {
"DBot Score": {
"Indicator": null,
"Reliability": "A - Completely reliable",
"Score": 0,
"Type": "Actor",
"Vendor": "Mandiant"
},
"aliases": [
"Apt1 (Recorded Future)",
"Bronzesunset (Dell SecureWorks)",
"Comment Crew (Internet)",
"Comment Crew (ThreatConnect)",
"Comment Panda (CrowdStrike)",
"Commentcrew (Symantec)",
"Dev0046 (Microsoft)",
"Famoussparrow (ESET)",
"Fluorine (Microsoft)",
"Foxypanda (CrowdStrike)",
"Ghostemperor (Kaspersky)",
"Kumming Group (Dell SecureWorks)",
"Shanghaigroup (Dell SecureWorks)",
"Tg8223 (Dell SecureWorks)"
],
"description": "APT1 refers to a distinct grouping of global cyber espionage activity with a nexus to China. Based on available data, we assess that this is a nation-state-sponsored group located in China. Specifically, we believe that APT1 is the 2nd Bureau of the People's Liberation Army (PLA) General Staff Department's 3rd Department, or Unit 61398. The activity is distinguished by the use of common infrastructure and tools and a clear intent to collect intelligence on a number of issues that may be of interest to the People's Republic of China (PRC).",
"firstseenbysource": [
"2003-06-20T12:00:00.000Z",
"2019-05-22T00:00:00.000Z"
],
"lastseenbysource": [
"2015-10-20T00:00:00.000Z",
"2022-12-22T00:00:00.000Z"
],
"name": "APT1",
"primarymotivation": "Espionage",
"publications": [
{
"link": "https://advantage.mandiant.com/reports/23-00002244",
"source": "Mandiant",
"timestamp": 1675443298,
"title": "MITRE ATT&CK for ICS Tactics: Impact"
},
{
"link": "https://advantage.mandiant.com/reports/22-00023922",
"source": "Mandiant",
"timestamp": 1666102868,
"title": "Weekly Malware Update for Oct. 10\u201317, 2022"
}
],
"stixid": "threat-actor--0ac5c1db-8ad6-54b8-b4b9-c32fc738c54a",
"tags": [
"Aerospace & Defense",
"Chemicals & Materials",
"Civil Society & Non-Profits",
"Construction & Engineering",
"Education",
"Energy & Utilities",
"Financial Services",
"Governments",
"Healthcare",
"Hospitality",
"Legal & Professional Services",
"Manufacturing",
"Media & Entertainment",
"Oil & Gas",
"Retail",
"Technology",
"Telecommunications",
"Transportation"
],
"targets": [
"Belgium",
"Canada",
"Denmark",
"France",
"Hong Kong",
"India",
"Israel",
"Japan",
"Luxembourg",
"Norway",
"Singapore",
"South Africa",
"Switzerland",
"Taiwan",
"United Arab Emirates",
"United Kingdom",
"United States of America"
],
"trafficlightprotocol": "AMBER",
"updateddate": "2023-02-23T14:17:35.000Z"
},
"rawJSON": {
"aliases": [
{
"attribution_scope": "confirmed",
"name": "Apt1 (Recorded Future)"
},
{
"attribution_scope": "confirmed",
"name": "Bronzesunset (Dell SecureWorks)"
}
],
"associated_uncs": [
{
"attribution_scope": "possible",
"id": "threat-actor--aa6c510a-ddb7-5ea7-9921-bee8408ed3be",
"name": "UNC2286"
}
],
"audience": [
{
"license": "INTEL_RBI_FUS",
"name": "intel_fusion"
},
{
"license": "INTEL_CYB_ESP",
"name": "intel_ce"
}
],
"counts": {
"aliases": 14,
"associated_uncs": 1,
"attack_patterns": 133,
"cve": 2,
"industries": 18,
"malware": 104,
"reports": 9
},
"cve": [
{
"attribution_scope": "possible",
"cve_id": "CVE-2020-0688",
"id": "vulnerability--5335a68a-b519-51c3-b05f-bc1749604b7c"
},
{
"attribution_scope": "confirmed",
"cve_id": "CVE-2009-3129",
"id": "vulnerability--8cb90843-f69a-5aa6-95dc-3bdebcc8fa78"
}
],
"description": "APT1 refers to a distinct grouping of global cyber espionage activity with a nexus to China. Based on available data, we assess that this is a nation-state-sponsored group located in China. Specifically, we believe that APT1 is the 2nd Bureau of the People's Liberation Army (PLA) General Staff Department's 3rd Department, or Unit 61398. The activity is distinguished by the use of common infrastructure and tools and a clear intent to collect intelligence on a number of issues that may be of interest to the People's Republic of China (PRC).",
"id": "threat-actor--0ac5c1db-8ad6-54b8-b4b9-c32fc738c54a",
"industries": [
{
"attribution_scope": "confirmed",
"first_seen": "2009-07-29T04:35:35.000Z",
"id": "identity--cc593632-0c42-500c-8d0b-d38e97b90f1d",
"last_seen": "2014-10-24T03:07:40.000Z",
"name": "Aerospace & Defense"
},
{
"attribution_scope": "confirmed",
"first_seen": "2008-08-10T16:25:00.000Z",
"id": "identity--a93f63bc-bbfc-52ab-88c0-794c74f5bec0",
"last_seen": "2014-09-05T00:00:00.000Z",
"name": "Chemicals & Materials"
}
],
"intel_free": true,
"is_publishable": true,
"last_activity_time": "2015-10-20T00:00:00.000Z",
"last_updated": "2023-02-23T14:17:35.000Z",
"locations": {
"source": [
{
"country": {
"attribution_scope": "confirmed",
"id": "location--740e7e5f-f2a0-55e0-98a3-88872c55b581",
"iso2": "CN",
"name": "China"
},
"region": {
"attribution_scope": "confirmed",
"id": "location--8fc231f3-4e62-57e7-b734-eaee0a734612",
"name": "Asia"
},
"sub_region": {
"attribution_scope": "confirmed",
"id": "location--7b33370b-da4b-5c48-9741-b69f69febb77",
"name": "East Asia"
}
}
],
"target": [
{
"attribution_scope": "confirmed",
"id": "location--a509dfc8-789b-595b-a201-29c7af1dc0bb",
"iso2": "BE",
"name": "Belgium",
"region": "Europe",
"sub-region": "West Europe"
},
{
"attribution_scope": "confirmed",
"id": "location--fde14246-c07b-5f3f-9ac8-8d4d50910f15",
"iso2": "CA",
"name": "Canada",
"region": "Americas",
"sub-region": "North America"
}
],
"target_region": [
{
"attribution_scope": "confirmed",
"id": "location--9488166d-6469-5e54-ba5f-9abf2a385824",
"key": "africa",
"name": "Africa"
},
{
"attribution_scope": "confirmed",
"id": "location--6d65522f-0166-5e7e-973c-35cf7973e4e3",
"key": "americas",
"name": "Americas"
}
],
"target_sub_region": [
{
"attribution_scope": "confirmed",
"id": "location--7b33370b-da4b-5c48-9741-b69f69febb77",
"key": "eastasia",
"name": "East Asia",
"region": "Asia"
},
{
"attribution_scope": "confirmed",
"id": "location--0daadcfb-ad23-5f16-b53b-6c5b09bf20de",
"key": "northamerica",
"name": "North America",
"region": "Americas"
}
]
},
"malware": [
{
"attribution_scope": "confirmed",
"id": "malware--09673ebc-9fbf-5ab0-9130-7874c84cd3e4",
"name": "AGEDMOAT"
},
{
"attribution_scope": "confirmed",
"id": "malware--7c00490d-dc79-5623-bf50-fb4b169d1b4f",
"name": "AGEDSHOE"
}
],
"motivations": [
{
"attribution_scope": "confirmed",
"id": "motivation--1b8ca82a-7cff-5622-bedd-965c11d38a9e",
"name": "Espionage"
}
],
"name": "APT1",
"observed": [
{
"attribution_scope": "confirmed",
"earliest": "2003-06-20T12:00:00.000Z",
"recent": "2015-10-20T00:00:00.000Z"
},
{
"attribution_scope": "possible",
"earliest": "2019-05-22T00:00:00.000Z",
"recent": "2022-12-22T00:00:00.000Z"
}
],
"tools": [
{
"attribution_scope": "possible",
"id": "malware--e224f74a-ca0e-540b-884f-03753787316f",
"name": "NLTEST"
},
{
"attribution_scope": "possible",
"id": "malware--76ccff98-5f46-5b7e-8eae-f7b439d0e64a",
"name": "TCPTRAN"
}
],
"type": "threat-actor"
},
"relationships": [
{
"entityA": "APT1",
"entityAFamily": "Indicator",
"entityAType": "Threat Actor",
"entityB": "AGEDMOAT",
"entityBFamily": "Indicator",
"entityBType": "Malware",
"fields": {},
"name": "related-to",
"reverseName": "related-to",
"type": "IndicatorToIndicator"
},
{
"entityA": "APT1",
"entityAFamily": "Indicator",
"entityAType": "Threat Actor",
"entityB": "AGEDSHOE",
"entityBFamily": "Indicator",
"entityBType": "Malware",
"fields": {},
"name": "related-to",
"reverseName": "related-to",
"type": "IndicatorToIndicator"
}
],
"score": 0,
"type": "Threat Actor",
"value": "APT1"
}
}
}
Human Readable Output
Results
fields rawJSON relationships score type value primarymotivation: Espionage
tags: Aerospace & Defense,
Chemicals & Materials,
Civil Society & Non-Profits,
Construction & Engineering,
Education,
Energy & Utilities,
Financial Services,
Governments,
Healthcare,
Hospitality,
Legal & Professional Services,
Manufacturing,
Media & Entertainment,
Oil & Gas,
Retail,
Technology,
Telecommunications,
Transportation
aliases: Apt1 (Recorded Future),
Bronzesunset (Dell SecureWorks),
Comment Crew (Internet),
Comment Crew (ThreatConnect),
Comment Panda (CrowdStrike),
Commentcrew (Symantec),
Dev0046 (Microsoft),
Famoussparrow (ESET),
Fluorine (Microsoft),
Foxypanda (CrowdStrike),
Ghostemperor (Kaspersky),
Kumming Group (Dell SecureWorks),
Shanghaigroup (Dell SecureWorks),
Tg8223 (Dell SecureWorks)
firstseenbysource: 2003-06-20T12:00:00.000Z,
2019-05-22T00:00:00.000Z
lastseenbysource: 2015-10-20T00:00:00.000Z,
2022-12-22T00:00:00.000Z
targets: Belgium,
Canada,
Denmark,
France,
Hong Kong,
India,
Israel,
Japan,
Luxembourg,
Norway,
Singapore,
South Africa,
Switzerland,
Taiwan,
United Arab Emirates,
United Kingdom,
United States of America
stixid: threat-actor–0ac5c1db-8ad6-54b8-b4b9-c32fc738c54a
name: APT1
description: APT1 refers to a distinct grouping of global cyber espionage activity with a nexus to China. Based on available data, we assess that this is a nation-state-sponsored group located in China. Specifically, we believe that APT1 is the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s 3rd Department, or Unit 61398. The activity is distinguished by the use of common infrastructure and tools and a clear intent to collect intelligence on a number of issues that may be of interest to the People’s Republic of China (PRC).
updateddate: 2023-02-23T14:17:35.000Z
trafficlightprotocol: AMBER
DBot Score: {“Indicator”: null, “Type”: “Actor”, “Vendor”: “Mandiant”, “Score”: 0, “Reliability”: “A - Completely reliable”}
publications: {‘source’: ‘Mandiant’, ‘title’: ‘MITRE ATT&CK for ICS Tactics: Impact’, ‘link’: ‘https://advantage.mandiant.com/reports/23-00002244’, ‘timestamp’: 1675443298.0},
{‘source’: ‘Mandiant’, ‘title’: ‘Weekly Malware Update for Oct. 10–17, 2022’, ‘link’: ‘https://advantage.mandiant.com/reports/22-00023922’, ‘timestamp’: 1666102868.0}industries: {‘id’: ‘identity–cc593632-0c42-500c-8d0b-d38e97b90f1d’, ‘name’: ‘Aerospace & Defense’, ‘attribution_scope’: ‘confirmed’, ‘first_seen’: ‘2009-07-29T04:35:35.000Z’, ‘last_seen’: ‘2014-10-24T03:07:40.000Z’},
{‘id’: ‘identity–a93f63bc-bbfc-52ab-88c0-794c74f5bec0’, ‘name’: ‘Chemicals & Materials’, ‘attribution_scope’: ‘confirmed’, ‘first_seen’: ‘2008-08-10T16:25:00.000Z’, ‘last_seen’: ‘2014-09-05T00:00:00.000Z’}
locations: {“source”: [{“region”: {“id”: “location–8fc231f3-4e62-57e7-b734-eaee0a734612”, “name”: “Asia”, “attribution_scope”: “confirmed”}, “country”: {“id”: “location–740e7e5f-f2a0-55e0-98a3-88872c55b581”, “name”: “China”, “iso2”: “CN”, “attribution_scope”: “confirmed”}, “sub_region”: {“attribution_scope”: “confirmed”, “id”: “location–7b33370b-da4b-5c48-9741-b69f69febb77”, “name”: “East Asia”}}], “target”: [{“id”: “location–a509dfc8-789b-595b-a201-29c7af1dc0bb”, “name”: “Belgium”, “iso2”: “BE”, “region”: “Europe”, “sub-region”: “West Europe”, “attribution_scope”: “confirmed”}, {“id”: “location–fde14246-c07b-5f3f-9ac8-8d4d50910f15”, “name”: “Canada”, “iso2”: “CA”, “region”: “Americas”, “sub-region”: “North America”, “attribution_scope”: “confirmed”}]}
id: threat-actor–0ac5c1db-8ad6-54b8-b4b9-c32fc738c54a
name: APT1
description: APT1 refers to a distinct grouping of global cyber espionage activity with a nexus to China. Based on available data, we assess that this is a nation-state-sponsored group located in China. Specifically, we believe that APT1 is the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s 3rd Department, or Unit 61398. The activity is distinguished by the use of common infrastructure and tools and a clear intent to collect intelligence on a number of issues that may be of interest to the People’s Republic of China (PRC).
type: threat-actor
last_activity_time: 2015-10-20T00:00:00.000Z
audience: {‘name’: ‘intel_fusion’, ‘license’: ‘INTEL_RBI_FUS’},
{‘name’: ‘intel_ce’, ‘license’: ‘INTEL_CYB_ESP’}
is_publishable: true
intel_free: true
counts: {“reports”: 9, “malware”: 104, “cve”: 2, “associated_uncs”: 1, “aliases”: 14, “industries”: 18, “attack_patterns”: 133}
last_updated: 2023-02-23T14:17:35.000Z
aliases: {‘name’: ‘Apt1 (Recorded Future)’, ‘attribution_scope’: ‘confirmed’},
{‘name’: ‘Bronzesunset (Dell SecureWorks)’, ‘attribution_scope’: ‘confirmed’}
malware: {‘id’: ‘malware–09673ebc-9fbf-5ab0-9130-7874c84cd3e4’, ‘name’: ‘AGEDMOAT’, ‘attribution_scope’: ‘confirmed’},
{‘id’: ‘malware–7c00490d-dc79-5623-bf50-fb4b169d1b4f’, ‘name’: ‘AGEDSHOE’, ‘attribution_scope’: ‘confirmed’}
motivations: {‘id’: ‘motivation–1b8ca82a-7cff-5622-bedd-965c11d38a9e’, ‘name’: ‘Espionage’, ‘attribution_scope’: ‘confirmed’}
associated_uncs: {‘attribution_scope’: ‘possible’, ‘id’: ‘threat-actor–aa6c510a-ddb7-5ea7-9921-bee8408ed3be’, ‘name’: ‘UNC2286’}
cve: {‘attribution_scope’: ‘possible’, ‘cve_id’: ‘CVE-2020-0688’, ‘id’: ‘vulnerability–5335a68a-b519-51c3-b05f-bc1749604b7c’},
{‘attribution_scope’: ‘confirmed’, ‘cve_id’: ‘CVE-2009-3129’, ‘id’: ‘vulnerability–8cb90843-f69a-5aa6-95dc-3bdebcc8fa78’}
observed: {‘earliest’: ‘2003-06-20T12:00:00.000Z’, ‘recent’: ‘2015-10-20T00:00:00.000Z’, ‘attribution_scope’: ‘confirmed’},
{‘earliest’: ‘2019-05-22T00:00:00.000Z’, ‘recent’: ‘2022-12-22T00:00:00.000Z’, ‘attribution_scope’: ‘possible’}
tools: {‘id’: ‘malware–e224f74a-ca0e-540b-884f-03753787316f’, ‘name’: ‘NLTEST’, ‘attribution_scope’: ‘possible’},
{‘id’: ‘malware–76ccff98-5f46-5b7e-8eae-f7b439d0e64a’, ‘name’: ‘TCPTRAN’, ‘attribution_scope’: ‘possible’},
{‘id’: ‘malware–126826c5-cfdc-5970-a734-a4ce7d6d92f4’, ‘name’: ‘RAR’, ‘attribution_scope’: ‘possible’},
{‘id’: ‘malware–934dcadf-f9a8-52c1-9c90-353a1c3144d5’, ‘name’: ‘PSEXEC’, ‘attribution_scope’: ‘possible’},
{‘id’: ‘malware–0f315a7c-9bf4-58dc-8ea9-033355617485’, ‘name’: ‘PSINFO’, ‘attribution_scope’: ‘confirmed’},
{‘id’: ‘malware–d84951d6-8f8a-5f7f-92cb-4fee4ef18664’, ‘name’: ‘LDIFDE’, ‘attribution_scope’: ‘confirmed’},
{‘id’: ‘malware–4fb0b16d-53d6-56e5-975f-10458225f317’, ‘name’: ‘COBALTSTRIKE’, ‘attribution_scope’: ‘possible’},
{‘id’: ‘malware–22055c71-bf62-5456-a5af-b7f298f47627’, ‘name’: ‘CMDEXE’, ‘attribution_scope’: ‘confirmed’},
{‘id’: ‘malware–70e3757d-09ea-5267-9aa3-01be476b3dd9’, ‘name’: ‘XCMD’, ‘attribution_scope’: ‘confirmed’},
{‘id’: ‘malware–82f2aa10-d254-5e1e-a1db-a0c822d4cef6’, ‘name’: ‘POWERSHELL’, ‘attribution_scope’: ‘possible’},
{‘id’: ‘malware–f872b3e0-c277-5716-baae-885a9c410398’, ‘name’: ‘WHOAMI’, ‘attribution_scope’: ‘possible’},
{‘id’: ‘malware–0bfd6f0b-4cdc-525c-b3e9-cf56d747f189’, ‘name’: ‘FGDUMP’, ‘attribution_scope’: ‘confirmed’},
{‘id’: ‘malware–a73560d8-e4d4-5a38-8efc-bfe7b8e5aef6’, ‘name’: ‘PSFTP’, ‘attribution_scope’: ‘possible’},
{‘id’: ‘malware–33e3fd12-4c4a-5824-a4e5-5ac35b308345’, ‘name’: ‘PWDUMP’, ‘attribution_scope’: ‘confirmed’},
{‘id’: ‘malware–0c7945de-0968-55e3-ad4e-1600ddfc6b36’, ‘name’: ‘PROCDUMP’, ‘attribution_scope’: ‘possible’},
{‘id’: ‘malware–57e5ea29-1c08-5f80-b28e-dd7ca373e4b7’, ‘name’: ‘ANGRYIP’, ‘attribution_scope’: ‘confirmed’},
{‘id’: ‘malware–125d583e-0617-5192-bc27-9f3377bb98c3’, ‘name’: ‘WINRAR’, ‘attribution_scope’: ‘possible’},
{‘id’: ‘malware–bf2fc1e5-7850-5ecd-87a7-263e6da5708d’, ‘name’: ‘MIMIKATZ’, ‘attribution_scope’: ‘confirmed’},
{‘id’: ‘malware–ed8a8e26-0773-5fcf-b3f3-e17aac203fa3’, ‘name’: ‘SFXZIP’, ‘attribution_scope’: ‘confirmed’},
{‘id’: ‘malware–0953f997-41ce-5fe2-804a-08fd8d567c29’, ‘name’: ‘PUTTY’, ‘attribution_scope’: ‘possible’},
{‘id’: ‘malware–2db234c8-596a-58f9-a50f-ce24b58965cd’, ‘name’: ‘IMPACKET.SMBEXEC’, ‘attribution_scope’: ‘possible’},
{‘id’: ‘malware–b2bb2d97-675e-5023-9cdd-a4274893b4a7’, ‘name’: ‘SFXRAR’, ‘attribution_scope’: ‘confirmed’}{‘name’: ‘related-to’, ‘reverseName’: ‘related-to’, ‘type’: ‘IndicatorToIndicator’, ‘entityA’: ‘APT1’, ‘entityAFamily’: ‘Indicator’, ‘entityAType’: ‘Threat Actor’, ‘entityB’: ‘AGEDMOAT’, ‘entityBFamily’: ‘Indicator’, ‘entityBType’: ‘Malware’, ‘fields’: {}},
{‘name’: ‘related-to’, ‘reverseName’: ‘related-to’, ‘type’: ‘IndicatorToIndicator’, ‘entityA’: ‘APT1’, ‘entityAFamily’: ‘Indicator’, ‘entityAType’: ‘Threat Actor’, ‘entityB’: ‘AGEDSHOE’, ‘entityBFamily’: ‘Indicator’, ‘entityBType’: ‘Malware’, ‘fields’: {}}0 Threat Actor APT1
mati-get-malware
Get information about a Malware Family from Mandiant
Base Command
mati-get-malware
Input
| Argument Name | Description | Required |
|---|---|---|
| malware_name | Name of the malware family to look up. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| MANDIANTTI.Malware.value | String | The name of the Malware |
| MANDIANTTI.Malware.fields.operatingsystemrefs | String | The Operating Systems impacted by the malware |
| MANDIANTTI.Malware.fields.roles | String | The known roles of the Malware |
| MANDIANTTI.Malware.fields.description | String | The description of the Malware |
| MANDIANTTI.Malware.fields.Is Malware Family | String | Whether the Indicator is a Malware Family or a Tool |
| MANDIANTTI.Malware.fields.publications.title | String | The name of the Malware |
| MANDIANTTI.Malware.fields.publications.title | String | The title of a report associated with the Malware |
| MANDIANTTI.Malware.fields.publications.link | String | The link to the report in Mandiant Advantage |
Command example
!mati-get-malware malware_name=PoisonIvy
Context Example
{
"MANDIANTTI": {
"Malware": {
"fields": {
"DBot Score": {
"Indicator": null,
"Reliability": "A - Completely reliable",
"Score": 0,
"Type": "Malware",
"Vendor": "Mandiant"
},
"Is Malware Family": true,
"aliases": [
"Pivnoxy (Fortinet)",
"PIVY (LAC)",
"Pivy (Palo Alto Networks)",
"Pivydwnldr",
"Poison Ivy",
"Poison Ivy (JPCERT)",
"Poison Ivy (Proofpoint)",
"Poison Ivy (Symantec)",
"PoisonIvy",
"Poisonivy (Check Point)",
"Poisonivy (Recorded Future)",
"Royal Road (Anomali)",
"Royal Road (Internet)",
"Spivy (Palo Alto Networks)"
],
"capabilities": [
{
"description": "Capable of performing raw access to physical disks.",
"name": "Access raw disk"
},
{
"description": "Capable of allocating memory. ",
"name": "Allocates memory"
}
],
"description": "POISONIVY is a backdoor that exists as shellcode and communicates via a custom binary protocol over TCP. Additional shellcode plugins are downloaded, mapped directly into memory, and executed. Observed plugin functionality includes reverse shell, keylogging, video capture, audio capture, and registry manipulation. POISONIVY is configured, built, and controlled using a publicly available management interface. The interface produces the shellcode that must be included in, or executed by, a separate application.",
"lastseenbysource": "2023-03-06T02:29:14.000Z",
"mandiantdetections": [
"APT.Backdoor.Win.POISONIVY",
"POISON IVY (VARIANT)",
"FE_PoisonIVY_Stealer_Toolkit",
"FE_APT_Backdoor_Win32_POISONIVY_1",
"ET INFO SUSPICIOUS Dotted Quad Host MZ Response (ET OPEN)",
"ET POLICY PE EXE or DLL Windows file download HTTP (ET OPEN)",
"Backdoor.Win32.Poison.FEC2 (Trellix)",
"Trojan.APT.PoisonIvy",
"Win.Dropper.Zusy-9801038-0 (ClamAV)",
"Backdoor.APT.PoisonIvy",
"Win.Malware.Loader-9834612-0 (ClamAV)",
"Backdoor.Poison",
"Backdoor.Win.PI.FEC2 (Trellix)",
"Trojan.Poison",
"Trojan.PoisonIvy.DNS",
"Win.Trojan.PoisonIvy-9755171-0 (ClamAV)"
],
"name": {
"POISONIVY": "[POISONIVY](#/indicator/5559)"
},
"operatingsystemrefs": [
"Windows"
],
"publications": [
{
"link": "https://advantage.mandiant.com/reports/22-00022357",
"source": "Mandiant",
"timestamp": 1668046325,
"title": "Country Profile: India (2022)"
},
{
"link": "https://advantage.mandiant.com/reports/21-00010407",
"source": "Mandiant",
"timestamp": 1648063696,
"title": "Supply Chain Compromise Trends, 2019\u20132020"
}
],
"roles": [
"Backdoor"
],
"stixid": "malware--c14087e2-91dc-5a4c-a820-5eaa86ba4c99",
"tags": [
"Aerospace & Defense",
"Agriculture",
"Automotive",
"Chemicals & Materials",
"Civil Society & Non-Profits",
"Construction & Engineering",
"Energy & Utilities",
"Financial Services",
"Governments",
"Healthcare",
"Hospitality",
"Legal & Professional Services",
"Manufacturing",
"Media & Entertainment",
"Oil & Gas",
"Pharmaceuticals",
"Retail",
"Technology",
"Telecommunications",
"Transportation"
],
"trafficlightprotocol": "AMBER",
"updateddate": "2023-03-06T02:29:14.000Z",
"yara": [
[
"FE_PoisonIVY_Stealer_Toolkit",
"signature--84b13cca-37e8-5c95-9471-b63dcaeb6df0"
],
[
"FE_APT_Backdoor_Win32_POISONIVY_1",
"signature--22f52a69-ccc0-5763-bae7-c488ea856dae"
]
]
},
"rawJSON": {
"actors": [
{
"country_name": "China",
"id": "threat-actor--0ac5c1db-8ad6-54b8-b4b9-c32fc738c54a",
"iso2": "CN",
"last_updated": "2023-02-23T14:17:35Z",
"name": "APT1"
},
{
"country_name": "China",
"id": "threat-actor--bf9da649-f617-5464-9442-93e69cb80aa9",
"iso2": "CN",
"last_updated": "2023-01-28T06:02:22Z",
"name": "APT10"
}
],
"aliases": [
{
"name": "Pivnoxy (Fortinet)"
},
{
"name": "PIVY (LAC)"
}
],
"audience": [
{
"license": "INTEL_RBI_FUS",
"name": "intel_fusion"
},
{
"license": "INTEL_RBI_OPS",
"name": "intel_oper"
},
{
"license": "amber",
"name": "tlp_marking"
}
],
"capabilities": [
{
"description": "Capable of performing raw access to physical disks.",
"name": "Access raw disk"
},
{
"description": "Capable of allocating memory. ",
"name": "Allocates memory"
}
],
"counts": {
"actors": 27,
"aliases": 14,
"attack_patterns": 68,
"capabilities": 42,
"cve": 11,
"detections": 16,
"industries": 20,
"malware": 21,
"reports": 25
},
"cve": [
{
"cve_id": "CVE-2012-0158",
"id": "vulnerability--e0b130b7-1772-5c4d-891c-9c48eb1a5a23"
},
{
"cve_id": "CVE-2015-2545",
"id": "vulnerability--74c54fd3-dbc9-5273-88c6-b47975fca9b6"
}
],
"description": "POISONIVY is a backdoor that exists as shellcode and communicates via a custom binary protocol over TCP. Additional shellcode plugins are downloaded, mapped directly into memory, and executed. Observed plugin functionality includes reverse shell, keylogging, video capture, audio capture, and registry manipulation. POISONIVY is configured, built, and controlled using a publicly available management interface. The interface produces the shellcode that must be included in, or executed by, a separate application.",
"detections": [
"APT.Backdoor.Win.POISONIVY",
"POISON IVY (VARIANT)",
"FE_PoisonIVY_Stealer_Toolkit",
"FE_APT_Backdoor_Win32_POISONIVY_1",
"ET INFO SUSPICIOUS Dotted Quad Host MZ Response (ET OPEN)",
"ET POLICY PE EXE or DLL Windows file download HTTP (ET OPEN)",
"Backdoor.Win32.Poison.FEC2 (Trellix)",
"Trojan.APT.PoisonIvy",
"Win.Dropper.Zusy-9801038-0 (ClamAV)",
"Backdoor.APT.PoisonIvy",
"Win.Malware.Loader-9834612-0 (ClamAV)",
"Backdoor.Poison",
"Backdoor.Win.PI.FEC2 (Trellix)",
"Trojan.Poison",
"Trojan.PoisonIvy.DNS",
"Win.Trojan.PoisonIvy-9755171-0 (ClamAV)"
],
"id": "malware--c14087e2-91dc-5a4c-a820-5eaa86ba4c99",
"industries": [
{
"id": "identity--cc593632-0c42-500c-8d0b-d38e97b90f1d",
"name": "Aerospace & Defense"
},
{
"id": "identity--cd044760-0aef-557e-94c4-bc672ea177c2",
"name": "Agriculture"
}
],
"inherently_malicious": 1,
"is_publishable": true,
"last_activity_time": "2023-03-06T02:29:14.000Z",
"last_updated": "2023-03-06T02:29:14.000Z",
"malware": [
{
"id": "malware--709f2440-b4fa-5017-991e-b4a5b22b5fd9",
"name": "CRABREST"
},
{
"id": "malware--6e812e51-feb9-54fb-8372-8e38aaead41d",
"name": "EASYCHAIR"
}
],
"name": "POISONIVY",
"operating_systems": [
"Windows"
],
"roles": [
"Backdoor"
],
"type": "malware",
"yara": [
{
"id": "signature--84b13cca-37e8-5c95-9471-b63dcaeb6df0",
"name": "FE_PoisonIVY_Stealer_Toolkit"
},
{
"id": "signature--22f52a69-ccc0-5763-bae7-c488ea856dae",
"name": "FE_APT_Backdoor_Win32_POISONIVY_1"
}
]
},
"relationships": [
{
"entityA": "POISONIVY",
"entityAFamily": "Indicator",
"entityAType": "Malware",
"entityB": "APT1",
"entityBFamily": "Indicator",
"entityBType": "Threat Actor",
"fields": {},
"name": "related-to",
"reverseName": "related-to",
"type": "IndicatorToIndicator"
},
{
"entityA": "POISONIVY",
"entityAFamily": "Indicator",
"entityAType": "Malware",
"entityB": "APT10",
"entityBFamily": "Indicator",
"entityBType": "Threat Actor",
"fields": {},
"name": "related-to",
"reverseName": "related-to",
"type": "IndicatorToIndicator"
}
],
"score": 0,
"type": "Malware",
"value": "POISONIVY"
}
}
}
Human Readable Output
Results
fields rawJSON relationships score type value operatingsystemrefs: Windows
aliases: Pivnoxy (Fortinet),
PIVY (LAC),
Pivy (Palo Alto Networks),
Pivydwnldr,
Poison Ivy,
Poison Ivy (JPCERT),
Poison Ivy (Proofpoint),
Poison Ivy (Symantec),
PoisonIvy,
Poisonivy (Check Point),
Poisonivy (Recorded Future),
Royal Road (Anomali),
Royal Road (Internet),
Spivy (Palo Alto Networks)
capabilities: {‘name’: ‘Access raw disk’, ‘description’: ‘Capable of performing raw access to physical disks.’},
{‘name’: ‘Allocates memory’, ‘description’: ‘Capable of allocating memory. ‘},
{‘name’: ‘Capture operating system information’, ‘description’: ‘Can capture information about the system OS configuration.’}
tags: Aerospace & Defense,
Agriculture,
Automotive,
Chemicals & Materials,
Civil Society & Non-Profits,
Construction & Engineering,
Energy & Utilities,
Financial Services,
Governments,
Healthcare,
Hospitality,
Legal & Professional Services,
Manufacturing,
Media & Entertainment,
Oil & Gas,
Pharmaceuticals,
Retail,
Technology,
Telecommunications,
Transportation
mandiantdetections: APT.Backdoor.Win.POISONIVY,
POISON IVY (VARIANT),
FE_PoisonIVY_Stealer_Toolkit,
FE_APT_Backdoor_Win32_POISONIVY_1,
ET INFO SUSPICIOUS Dotted Quad Host MZ Response (ET OPEN),
ET POLICY PE EXE or DLL Windows file download HTTP (ET OPEN),
Backdoor.Win32.Poison.FEC2 (Trellix),
Trojan.APT.PoisonIvy,
Win.Dropper.Zusy-9801038-0 (ClamAV),
Backdoor.APT.PoisonIvy,
Win.Malware.Loader-9834612-0 (ClamAV),
Backdoor.Poison,
Backdoor.Win.PI.FEC2 (Trellix),
Trojan.Poison,
Trojan.PoisonIvy.DNS,
Win.Trojan.PoisonIvy-9755171-0 (ClamAV)
yara: (‘FE_PoisonIVY_Stealer_Toolkit’, ‘signature–84b13cca-37e8-5c95-9471-b63dcaeb6df0’),
(‘FE_APT_Backdoor_Win32_POISONIVY_1’, ‘signature–22f52a69-ccc0-5763-bae7-c488ea856dae’)
roles: Backdoor
stixid: malware–c14087e2-91dc-5a4c-a820-5eaa86ba4c99
name: {“POISONIVY”: “POISONIVY”}
description: POISONIVY is a backdoor that exists as shellcode and communicates via a custom binary protocol over TCP. Additional shellcode plugins are downloaded, mapped directly into memory, and executed. Observed plugin functionality includes reverse shell, keylogging, video capture, audio capture, and registry manipulation. POISONIVY is configured, built, and controlled using a publicly available management interface. The interface produces the shellcode that must be included in, or executed by, a separate application.
updateddate: 2023-03-06T02:29:14.000Z
lastseenbysource: 2023-03-06T02:29:14.000Z
trafficlightprotocol: AMBER
Is Malware Family: true
DBot Score: {“Indicator”: null, “Type”: “Malware”, “Vendor”: “Mandiant”, “Score”: 0, “Reliability”: “A - Completely reliable”}
publications: {‘source’: ‘Mandiant’, ‘title’: ‘Country Profile: India (2022)’, ‘link’: ‘https://advantage.mandiant.com/reports/22-00022357’, ‘timestamp’: 1668046325.0},
{‘source’: ‘Mandiant’, ‘title’: ‘Supply Chain Compromise Trends, 2019–2020’, ‘link’: ‘https://advantage.mandiant.com/reports/21-00010407’, ‘timestamp’: 1648063696.0}actors: {‘id’: ‘threat-actor–0ac5c1db-8ad6-54b8-b4b9-c32fc738c54a’, ‘name’: ‘APT1’, ‘country_name’: ‘China’, ‘iso2’: ‘CN’, ‘last_updated’: ‘2023-02-23T14:17:35Z’},
{‘id’: ‘threat-actor–bf9da649-f617-5464-9442-93e69cb80aa9’, ‘name’: ‘APT10’, ‘country_name’: ‘China’, ‘iso2’: ‘CN’, ‘last_updated’: ‘2023-01-28T06:02:22Z’}
audience: {‘name’: ‘intel_fusion’, ‘license’: ‘INTEL_RBI_FUS’},
{‘name’: ‘intel_oper’, ‘license’: ‘INTEL_RBI_OPS’},
{‘name’: ‘tlp_marking’, ‘license’: ‘amber’}
description: POISONIVY is a backdoor that exists as shellcode and communicates via a custom binary protocol over TCP. Additional shellcode plugins are downloaded, mapped directly into memory, and executed. Observed plugin functionality includes reverse shell, keylogging, video capture, audio capture, and registry manipulation. POISONIVY is configured, built, and controlled using a publicly available management interface. The interface produces the shellcode that must be included in, or executed by, a separate application.
detections: APT.Backdoor.Win.POISONIVY,
POISON IVY (VARIANT),
FE_PoisonIVY_Stealer_Toolkit,
FE_APT_Backdoor_Win32_POISONIVY_1,
ET INFO SUSPICIOUS Dotted Quad Host MZ Response (ET OPEN),
ET POLICY PE EXE or DLL Windows file download HTTP (ET OPEN),
Backdoor.Win32.Poison.FEC2 (Trellix),
Trojan.APT.PoisonIvy,
Win.Dropper.Zusy-9801038-0 (ClamAV),
Backdoor.APT.PoisonIvy,
Win.Malware.Loader-9834612-0 (ClamAV),
Backdoor.Poison,
Backdoor.Win.PI.FEC2 (Trellix),
Trojan.Poison,
Trojan.PoisonIvy.DNS,
Win.Trojan.PoisonIvy-9755171-0 (ClamAV)
id: malware–c14087e2-91dc-5a4c-a820-5eaa86ba4c99
industries: {‘id’: ‘identity–cc593632-0c42-500c-8d0b-d38e97b90f1d’, ‘name’: ‘Aerospace & Defense’},
{‘id’: ‘identity–cd044760-0aef-557e-94c4-bc672ea177c2’, ‘name’: ‘Agriculture’}
inherently_malicious: 1
last_activity_time: 2023-03-06T02:29:14.000Z
last_updated: 2023-03-06T02:29:14.000Z
malware: {‘id’: ‘malware–709f2440-b4fa-5017-991e-b4a5b22b5fd9’, ‘name’: ‘CRABREST’},
{‘id’: ‘malware–6e812e51-feb9-54fb-8372-8e38aaead41d’, ‘name’: ‘EASYCHAIR’}
name: POISONIVY
operating_systems: Windows
type: malware
yara: {‘id’: ‘signature–84b13cca-37e8-5c95-9471-b63dcaeb6df0’, ‘name’: ‘FE_PoisonIVY_Stealer_Toolkit’},
{‘id’: ‘signature–22f52a69-ccc0-5763-bae7-c488ea856dae’, ‘name’: ‘FE_APT_Backdoor_Win32_POISONIVY_1’}
is_publishable: true
counts: {“reports”: 25, “capabilities”: 42, “malware”: 21, “actors”: 27, “detections”: 16, “cve”: 11, “aliases”: 14, “industries”: 20, “attack_patterns”: 68}
aliases: {‘name’: ‘Pivnoxy (Fortinet)’},
{‘name’: ‘PIVY (LAC)’}
capabilities: {‘name’: ‘Access raw disk’, ‘description’: ‘Capable of performing raw access to physical disks.’},
{‘name’: ‘Allocates memory’, ‘description’: ‘Capable of allocating memory. ‘}
cve: {‘id’: ‘vulnerability–e0b130b7-1772-5c4d-891c-9c48eb1a5a23’, ‘cve_id’: ‘CVE-2012-0158’},
{‘id’: ‘vulnerability–74c54fd3-dbc9-5273-88c6-b47975fca9b6’, ‘cve_id’: ‘CVE-2015-2545’},
{‘id’: ‘vulnerability–005f9d5c-0298-52ea-b7d4-003fb7729586’, ‘cve_id’: ‘CVE-2018-0798’}
roles: Backdoor{‘name’: ‘related-to’, ‘reverseName’: ‘related-to’, ‘type’: ‘IndicatorToIndicator’, ‘entityA’: ‘POISONIVY’, ‘entityAFamily’: ‘Indicator’, ‘entityAType’: ‘Malware’, ‘entityB’: ‘APT1’, ‘entityBFamily’: ‘Indicator’, ‘entityBType’: ‘Threat Actor’, ‘fields’: {}},
{‘name’: ‘related-to’, ‘reverseName’: ‘related-to’, ‘type’: ‘IndicatorToIndicator’, ‘entityA’: ‘POISONIVY’, ‘entityAFamily’: ‘Indicator’, ‘entityAType’: ‘Malware’, ‘entityB’: ‘APT10’, ‘entityBFamily’: ‘Indicator’, ‘entityBType’: ‘Threat Actor’, ‘fields’: {}}0 Malware POISONIVY
file
Retrieve information about a File Hash from Mandiant
Base Command
file
Input
| Argument Name | Description | Required |
|---|---|---|
| file | List of files. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| MANDIANTTI.FILE.score | Number | The Severity Score of the File indicator |
| MANDIANTTI.FILE.fields.md5 | String | The MD5 Hash associated with the File indicator |
| MANDIANTTI.FILE.fields.sha256 | String | The SHA256 Hash associated with the File indicator |
| MANDIANTTI.FILE.fields.sha1 | String | The SHA1 Hash associated with the File indicator |
| File.MD5 | String | MD5 hash of the file submitted for analysis. |
| File.SHA1 | String | SHA1 hash of the file submitted for analysis. |
| File.SHA256 | String | SHA256 hash of the file submitted for analysis. |
| DBotScore.Score | number | The actual score. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Indicator | String | The indicator that was tested. |
Command example
!file file=9c944bd7a0af0ebd8a52f16d2e09f4ae
Context Example
{
"MANDIANTTI": {
"FILE": [
{
"fields": {
"DBotScore": {
"Indicator": "9c944bd7a0af0ebd8a52f16d2e09f4ae",
"Reliability": "A - Completely reliable",
"Score": 3,
"Type": "file",
"Vendor": "Mandiant"
},
"firstseenbysource": "2016-06-09T16:27:25.000Z",
"lastseenbysource": "2016-06-09T16:27:25.000Z",
"md5": "9c944bd7a0af0ebd8a52f16d2e09f4ae",
"sha1": "03b89c5e964113cb25bf6581d35ca3db97692ae2",
"sha256": "74bb66638683a1a3b6b64d4b90b7979f60e9269418fc07b17eacfd3324688a5e",
"stixid": "md5--381c455d-58ba-51e0-89fa-74534671c9fc",
"trafficlightprotocol": "AMBER"
},
"rawJSON": {
"associated_hashes": [
{
"id": "md5--381c455d-58ba-51e0-89fa-74534671c9fc",
"type": "md5",
"value": "9c944bd7a0af0ebd8a52f16d2e09f4ae"
},
{
"id": "sha1--2d3d8372-ecef-50bb-947b-8c004c6489dc",
"type": "sha1",
"value": "03b89c5e964113cb25bf6581d35ca3db97692ae2"
},
{
"id": "sha256--55212b49-045d-5f74-a9c7-37907e016e6a",
"type": "sha256",
"value": "74bb66638683a1a3b6b64d4b90b7979f60e9269418fc07b17eacfd3324688a5e"
}
],
"campaigns": [],
"first_seen": "2016-06-09T16:27:25.000Z",
"id": "md5--381c455d-58ba-51e0-89fa-74534671c9fc",
"is_publishable": true,
"last_seen": "2016-06-09T16:27:25.000Z",
"last_updated": "2022-02-21T02:46:13.698Z",
"mscore": 100,
"publications": [],
"sources": [
{
"category": [],
"first_seen": "2016-06-09T16:27:25.000+0000",
"last_seen": "2016-06-09T16:27:25.000+0000",
"osint": false,
"source_name": "Mandiant"
},
{
"category": [],
"first_seen": "2016-06-09T16:27:25.000+0000",
"last_seen": "2016-06-09T16:27:25.000+0000",
"osint": false,
"source_name": "Mandiant"
}
],
"type": "md5",
"value": "9c944bd7a0af0ebd8a52f16d2e09f4ae"
},
"relationships": [],
"score": 3,
"type": "File",
"value": "9c944bd7a0af0ebd8a52f16d2e09f4ae"
}
]
}
}
Human Readable Output
Results
fields rawJSON relationships score type value firstseenbysource: 2016-06-09T16:27:25.000Z
lastseenbysource: 2016-06-09T16:27:25.000Z
stixid: md5–381c455d-58ba-51e0-89fa-74534671c9fc
trafficlightprotocol: AMBER
DBotScore: {“Indicator”: “9c944bd7a0af0ebd8a52f16d2e09f4ae”, “Type”: “file”, “Vendor”: “Mandiant”, “Score”: 3, “Reliability”: “A - Completely reliable”}
md5: 9c944bd7a0af0ebd8a52f16d2e09f4ae
sha256: 74bb66638683a1a3b6b64d4b90b7979f60e9269418fc07b17eacfd3324688a5e
sha1: 03b89c5e964113cb25bf6581d35ca3db97692ae2id: md5–381c455d-58ba-51e0-89fa-74534671c9fc
mscore: 100
type: md5
value: 9c944bd7a0af0ebd8a52f16d2e09f4ae
is_publishable: true
sources: {‘first_seen’: ‘2016-06-09T16:27:25.000+0000’, ‘last_seen’: ‘2016-06-09T16:27:25.000+0000’, ‘osint’: False, ‘category’: [], ‘source_name’: ‘Mandiant’},
{‘first_seen’: ‘2016-06-09T16:27:25.000+0000’, ‘last_seen’: ‘2016-06-09T16:27:25.000+0000’, ‘osint’: False, ‘category’: [], ‘source_name’: ‘Mandiant’}
associated_hashes: {‘id’: ‘md5–381c455d-58ba-51e0-89fa-74534671c9fc’, ‘type’: ‘md5’, ‘value’: ‘9c944bd7a0af0ebd8a52f16d2e09f4ae’},
{‘id’: ‘sha1–2d3d8372-ecef-50bb-947b-8c004c6489dc’, ‘type’: ‘sha1’, ‘value’: ‘03b89c5e964113cb25bf6581d35ca3db97692ae2’},
{‘id’: ‘sha256–55212b49-045d-5f74-a9c7-37907e016e6a’, ‘type’: ‘sha256’, ‘value’: ‘74bb66638683a1a3b6b64d4b90b7979f60e9269418fc07b17eacfd3324688a5e’}
misp: {“akamai”: false, “alexa”: false, “alexa_1M”: false, “amazon-aws”: false, “apple”: false, “automated-malware-analysis”: false, “bank-website”: false, “cisco_1M”: false, “cisco_top1000”: false, “cisco_top10k”: false, “cisco_top20k”: false, “cisco_top5k”: false, “cloudflare”: false, “common-contact-emails”: false, “common-ioc-false-positive”: false, “covid”: false, “covid-19-cyber-threat-coalition-whitelist”: false, “covid-19-krassi-whitelist”: false, “crl-hostname”: false, “crl-ip”: false, “dax30”: false, “disposable-email”: false, “dynamic-dns”: false, “eicar.com”: false, “empty-hashes”: false, “fastly”: false, “google”: false, “google-gcp”: false, “google-gmail-sending-ips”: false, “googlebot”: false, “ipv6-linklocal”: false, “majestic_million”: false, “majestic_million_1M”: false, “microsoft”: false, “microsoft-attack-simulator”: false, “microsoft-azure”: false, “microsoft-azure-china”: false, “microsoft-azure-germany”: false, “microsoft-azure-us-gov”: false, “microsoft-office365”: false, “microsoft-office365-cn”: false, “microsoft-office365-ip”: false, “microsoft-win10-connection-endpoints”: false, “moz-top500”: false, “mozilla-CA”: false, “mozilla-IntermediateCA”: false, “multicast”: false, “nioc-filehash”: false, “ovh-cluster”: false, “phone_numbers”: false, “public-dns-hostname”: false, “public-dns-v4”: false, “public-dns-v6”: false, “rfc1918”: false, “rfc3849”: false, “rfc5735”: false, “rfc6598”: false, “rfc6761”: false, “second-level-tlds”: false, “security-provider-blogpost”: false, “sinkholes”: false, “smtp-receiving-ips”: false, “smtp-sending-ips”: false, “stackpath”: false, “ti-falsepositives”: false, “tlds”: false, “tranco”: false, “tranco10k”: false, “university_domains”: false, “url-shortener”: false, “vpn-ipv4”: false, “vpn-ipv6”: false, “whats-my-ip”: false, “wikimedia”: false}
last_updated: 2022-02-21T02:46:13.698Z
first_seen: 2016-06-09T16:27:25.000Z
last_seen: 2016-06-09T16:27:25.000Z
campaigns:
publications:3 File 9c944bd7a0af0ebd8a52f16d2e09f4ae
ip
Retrieve information about an IP Address from Mandiant
Base Command
ip
Input
| Argument Name | Description | Required |
|---|---|---|
| ip | List of IPs. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| MANDIANTTI.IP.score | Number | The Severity Score of the IP indicator |
| MANDIANTTI.IP.fields.ip | String | The IP address of the IP indicator |
| DBotScore.Score | number | The actual score. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Indicator | String | The indicator that was tested. |
| IP.Address | string | IP address |
Command example
!ip ip=124.248.207.50
Context Example
{
"MANDIANTTI": {
"Campaign": {
"fields": {
"DBot Score": {
"Indicator": null,
"Reliability": "A - Completely reliable",
"Score": 0,
"Type": "Campaign",
"Vendor": "Mandiant"
},
"actors": [
"APT41"
],
"description": "In mid-October 2021, Mandiant observed a wave of APT41 activity targeting multiple U.S. state governments. We believe the actors exploited a vulnerability in a public-facing web application, used by numerous state governments and U.S. educational research institutes, to gain initial access. The actors then conducted reconnaissance and credential harvesting activity, dropping multiple files including the publicly available BADPOTATO privilege escalation tool. Mandiant also identified the DEADEYE dropper, which executed a KEYPLUG backdoor. \n\nThis activity is likely a continuation of a previously observed APT41 campaign targeting multiple U.S. state government entities in May 2021. The specific motivation behind the targeting of U.S. state government entities remains unclear, though we infer, based on the targeting profile, that the purpose may include capturing political intelligence or data related to sensitive technologies with national or state-level applications. It is also possible that the capture of credentials can facilitate future targeting or pivoting to targets of interest.",
"publications": [],
"tags": [
"Governments"
]
},
"rawJSON": {
"actors": [
{
"attribution_scope": "confirmed",
"id": "threat-actor--9c88bd9c-f41b-59fa-bfb6-427b1755ea64",
"motivations": [
{
"attribution_scope": "confirmed",
"id": "motivation--fa4d4992-1762-50ac-b0b1-2c75210645d0",
"name": "Financial Gain",
"releasable": true,
"type": "motivation"
},
{
"attribution_scope": "confirmed",
"id": "motivation--1b8ca82a-7cff-5622-bedd-965c11d38a9e",
"name": "Espionage",
"releasable": true,
"type": "motivation"
}
],
"name": "APT41",
"releasable": true,
"source_locations": [
{
"country": {
"attribution_scope": "confirmed",
"id": "location--740e7e5f-f2a0-55e0-98a3-88872c55b581",
"iso2": "CN",
"name": "China",
"releasable": true,
"type": "location"
},
"region": {
"attribution_scope": "confirmed",
"id": "location--8fc231f3-4e62-57e7-b734-eaee0a734612",
"name": "Asia",
"releasable": true,
"type": "location"
},
"releasable": true,
"sub_region": {
"attribution_scope": "confirmed",
"id": "location--7b33370b-da4b-5c48-9741-b69f69febb77",
"name": "East Asia",
"releasable": true,
"type": "location"
}
}
],
"type": "threat-actor"
}
],
"aliases": {
"actor": [
{
"attribution_scope": "confirmed",
"id": "alias--c63f2b2b-3639-5bd0-be28-b1cb79b00b21",
"name": "Barium (Microsoft)",
"nucleus_name": "Barium",
"releasable": true,
"source": "Microsoft",
"type": "alias"
}
],
"campaign": [],
"malware": [],
"releasable": true
},
"audience": [
{
"license": "INTEL_RBI_OPS",
"name": "intel_oper"
},
{
"license": "INTEL_RBI_FUS",
"name": "intel_fusion"
},
{
"license": "amber",
"name": "tlp_marking"
}
],
"campaign_type": "Individual",
"counts": {
"actor_collaborations": 0,
"actors": 1,
"campaigns": 0,
"industries": 1,
"malware": 19,
"reports": 4,
"timeline": 104,
"tools": 9,
"vulnerabilities": 1
},
"description": "In mid-October 2021, Mandiant observed a wave of APT41 activity targeting multiple U.S. state governments. We believe the actors exploited a vulnerability in a public-facing web application, used by numerous state governments and U.S. educational research institutes, to gain initial access. The actors then conducted reconnaissance and credential harvesting activity, dropping multiple files including the publicly available BADPOTATO privilege escalation tool. Mandiant also identified the DEADEYE dropper, which executed a KEYPLUG backdoor. \n\nThis activity is likely a continuation of a previously observed APT41 campaign targeting multiple U.S. state government entities in May 2021. The specific motivation behind the targeting of U.S. state government entities remains unclear, though we infer, based on the targeting profile, that the purpose may include capturing political intelligence or data related to sensitive technologies with national or state-level applications. It is also possible that the capture of credentials can facilitate future targeting or pivoting to targets of interest.",
"id": "campaign--c344bb9b-cb50-58be-9c33-350b622c1fce",
"industries": [
{
"attribution_scope": "confirmed",
"id": "identity--8d0881d8-d199-5e5a-bef9-be3ca6bb8f0d",
"name": "Governments",
"releasable": true,
"type": "identity"
}
],
"is_publishable": true,
"last_activity_time": "2022-02-26T00:00:00.000Z",
"malware": [
{
"attribution_scope": "confirmed",
"id": "malware--448e822d-8496-5021-88cb-599062f74176",
"name": "BEACON",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--ad51977a-c6fc-5cd3-822e-4e2aa6c832a2",
"name": "FASTPACE",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--e62ff7e0-b076-53bb-9872-5888833df016",
"name": "KEYPLUG.PASSIVE",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--cc16c574-c8ff-5873-8ee2-ca5fe841d86f",
"name": "LOWKEY.PASSIVE",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--826fd422-6e98-5ea9-82c1-0cf54072658f",
"name": "DEADEYE.EMBED",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--81b043a3-44c5-526a-af8c-b2730ba3bfbb",
"name": "DEADEYE.APPEND",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--29ff2215-d745-5855-a3dd-3178121aac8a",
"name": "LOWKEY",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--515cf8ae-3453-5eb6-a07b-a9f0fa586959",
"name": "TRAILBRAKE",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--6732275a-d77a-50d8-84c3-d54c36a93d1b",
"name": "ICECOLD",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--0514a150-7c5a-512f-bec2-8aa51cbcb8b1",
"name": "DEADEYE",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--487dd1af-1763-5af3-878e-dc606dd71f6e",
"name": "KEYPLUG.LINUX",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--440967f3-ca59-5708-837a-b6d0ae58a413",
"name": "JAYPOTATO",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--8e99e597-dda4-57dc-be6e-f1bc8b80a5f3",
"name": "BADPOTATO",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--81737f54-c8df-55cf-96c3-77aa373ab4c9",
"name": "SWEETSHOT",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--e9eda095-4e8b-5c30-a5cd-a531b39a0a2f",
"name": "DUSTCOVER",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--8c31abe5-7cb1-51f4-97d5-a14e0a95eccb",
"name": "KEYPLUG.LINUX.PASSIVE",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--b0e965fb-1737-5c63-85c7-e90a323b1e27",
"name": "HTRAN",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--13e9e1a1-5870-5caa-af40-26b9027df5ef",
"name": "DUSTPAN",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--4484e24c-fbf7-5894-90e2-4c6ed949ec6c",
"name": "KEYPLUG",
"releasable": true,
"type": "malware"
}
],
"name": "APT41 Exploition of .NET Web Applications at U.S. State Governments",
"profile_updated": "2023-03-06T07:10:13.356Z",
"releasable": true,
"short_name": "CAMP.21.014",
"target_locations": {
"countries": [
{
"attribution_scope": "confirmed",
"count": 8,
"id": "location--5c5b39aa-9308-52a6-9daf-0547d5aaa160",
"iso2": "US",
"name": "United States of America",
"region": "location--6d65522f-0166-5e7e-973c-35cf7973e4e3",
"releasable": true,
"sub_region": "location--0daadcfb-ad23-5f16-b53b-6c5b09bf20de",
"type": "location"
}
],
"regions": [
{
"attribution_scope": "confirmed",
"count": 8,
"id": "location--6d65522f-0166-5e7e-973c-35cf7973e4e3",
"name": "Americas",
"releasable": true,
"type": "location"
}
],
"releasable": true,
"sub_regions": [
{
"attribution_scope": "confirmed",
"count": 8,
"id": "location--0daadcfb-ad23-5f16-b53b-6c5b09bf20de",
"name": "North America",
"region": "location--6d65522f-0166-5e7e-973c-35cf7973e4e3",
"releasable": true,
"type": "location"
}
]
},
"timeline": [
{
"description": "Mandiant Declared Campaign",
"event_type": "created",
"name": "Campaign Created",
"releasable": true,
"timestamp": "2021-10-18T00:00:00.000Z"
},
{
"description": "Mandiant Observed First Activity of Campaign",
"event_type": "first_observed",
"name": "First Observed",
"releasable": true,
"timestamp": "2020-06-15T00:00:00.000Z"
},
{
"description": "Mandiant Observed Use of The Technique",
"event_type": "technique_observed",
"mandiant_technique": {
"attribution_scope": "confirmed",
"id": "attack-pattern--ae0d50d8-79de-5193-9223-178fde2c0756",
"name": "Privilege escalation via access token impersonation",
"releasable": true,
"type": "attack-pattern"
},
"mitre_techniques": [
{
"attribution_scope": "confirmed",
"id": "attack-pattern--86850eff-2729-40c3-b85e-c4af26da4a2d",
"mitre_id": "T1134.001",
"name": "Token Impersonation/Theft",
"releasable": true,
"tactics": [
"Privilege Escalation",
"Defense Evasion"
],
"type": "attack-pattern"
},
{
"attribution_scope": "confirmed",
"id": "attack-pattern--dcaa092b-7de9-4a21-977f-7fcb77e89c48",
"mitre_id": "T1134",
"name": "Access Token Manipulation",
"releasable": true,
"tactics": [
"Privilege Escalation",
"Defense Evasion"
],
"type": "attack-pattern"
}
],
"name": "Technique Observed",
"releasable": true,
"used_by": [
{
"actor": {
"attribution_scope": "confirmed",
"id": "threat-actor--9c88bd9c-f41b-59fa-bfb6-427b1755ea64",
"name": "APT41",
"releasable": true,
"type": "threat-actor"
},
"first_observed": "2021-05-05T00:00:00.000Z",
"last_observed": "2021-10-17T00:00:00.000Z",
"releasable": true
}
]
}
],
"tools": [
{
"attribution_scope": "confirmed",
"id": "malware--8130c516-308e-51e1-b16c-f398d80e67b0",
"name": "IMPACKET.PSEXEC",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--bf2fc1e5-7850-5ecd-87a7-263e6da5708d",
"name": "MIMIKATZ",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--934dcadf-f9a8-52c1-9c90-353a1c3144d5",
"name": "PSEXEC",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--47530422-6b2d-5329-95c1-fcf7698edeee",
"name": "7ZIP",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--f872b3e0-c277-5716-baae-885a9c410398",
"name": "WHOAMI",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--e224f74a-ca0e-540b-884f-03753787316f",
"name": "NLTEST",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--2db234c8-596a-58f9-a50f-ce24b58965cd",
"name": "IMPACKET.SMBEXEC",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--0c7945de-0968-55e3-ad4e-1600ddfc6b36",
"name": "PROCDUMP",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--fed3481f-0095-53f2-8c32-7e286013233b",
"name": "DSQUERY",
"releasable": true,
"type": "malware"
}
],
"type": "campaign",
"vulnerabilities": [
{
"attribution_scope": "confirmed",
"cve_id": "CVE-2021-44207",
"id": "vulnerability--362764b4-aa15-55fd-a68b-caf84f25a6b0",
"releasable": true,
"type": "vulnerability"
}
]
},
"relationships": [
{
"entityA": "CAMP.21.014",
"entityAFamily": "Indicator",
"entityAType": "Campaign",
"entityB": "APT41",
"entityBFamily": "Indicator",
"entityBType": "Threat Actor",
"fields": {},
"name": "related-to",
"reverseName": "related-to",
"type": "IndicatorToIndicator"
},
{
"entityA": "CAMP.21.014",
"entityAFamily": "Indicator",
"entityAType": "Campaign",
"entityB": "BEACON",
"entityBFamily": "Indicator",
"entityBType": "Malware",
"fields": {},
"name": "related-to",
"reverseName": "related-to",
"type": "IndicatorToIndicator"
}
],
"type": "Campaign",
"value": "CAMP.21.014"
},
"IP": [
{
"fields": {
"DBotScore": {
"Indicator": "124.248.207.50",
"Reliability": "A - Completely reliable",
"Score": 2,
"Type": "ip",
"Vendor": "Mandiant"
},
"firstseenbysource": "2016-06-09T16:28:01.000Z",
"ip": "124.248.207.50",
"lastseenbysource": "2018-04-19T17:23:59.000Z",
"stixid": "ipv4--3a4d8f76-6fde-5b25-9672-a45a0ac16bc8",
"trafficlightprotocol": "AMBER"
},
"rawJSON": {
"attributed_associations": [
{
"id": "threat-actor--3790b99d-7067-536c-821d-19953727bf7b",
"name": "Turla Team",
"type": "threat-actor"
}
],
"campaigns": [],
"first_seen": "2016-06-09T16:28:01.000Z",
"id": "ipv4--3a4d8f76-6fde-5b25-9672-a45a0ac16bc8",
"is_exclusive": false,
"is_publishable": true,
"last_seen": "2018-04-19T17:23:59.000Z",
"last_updated": "2022-05-14T10:15:13.771Z",
"mscore": 52,
"publications": [],
"sources": [
{
"category": [],
"first_seen": "2018-01-08T21:29:53.000+0000",
"last_seen": "2018-04-19T17:23:59.000+0000",
"osint": false,
"source_name": "Mandiant"
},
{
"category": [],
"first_seen": "2016-06-09T16:28:01.000+0000",
"last_seen": "2016-06-09T16:28:01.000+0000",
"osint": false,
"source_name": "Mandiant"
}
],
"type": "ipv4",
"value": "124.248.207.50"
},
"relationships": [],
"score": 2,
"type": "IP",
"value": "124.248.207.50"
}
]
}
}
Human Readable Output
Results
fields rawJSON relationships score type value firstseenbysource: 2016-06-09T16:28:01.000Z
lastseenbysource: 2018-04-19T17:23:59.000Z
stixid: ipv4–3a4d8f76-6fde-5b25-9672-a45a0ac16bc8
trafficlightprotocol: AMBER
DBotScore: {“Indicator”: “124.248.207.50”, “Type”: “ip”, “Vendor”: “Mandiant”, “Score”: 2, “Reliability”: “A - Completely reliable”}
ip: 124.248.207.50id: ipv4–3a4d8f76-6fde-5b25-9672-a45a0ac16bc8
mscore: 52
type: ipv4
value: 124.248.207.50
is_exclusive: false
is_publishable: true
sources: {‘first_seen’: ‘2018-01-08T21:29:53.000+0000’, ‘last_seen’: ‘2018-04-19T17:23:59.000+0000’, ‘osint’: False, ‘category’: [], ‘source_name’: ‘Mandiant’},
{‘first_seen’: ‘2016-06-09T16:28:01.000+0000’, ‘last_seen’: ‘2016-06-09T16:28:01.000+0000’, ‘osint’: False, ‘category’: [], ‘source_name’: ‘Mandiant’}
attributed_associations: {‘id’: ‘threat-actor–3790b99d-7067-536c-821d-19953727bf7b’, ‘name’: ‘Turla Team’, ‘type’: ‘threat-actor’}
misp: {“akamai”: false, “alexa”: false, “alexa_1M”: false, “amazon-aws”: false, “apple”: false, “automated-malware-analysis”: false, “bank-website”: false, “cisco_1M”: false, “cisco_top1000”: false, “cisco_top10k”: false, “cisco_top20k”: false, “cisco_top5k”: false, “cloudflare”: false, “common-contact-emails”: false, “common-ioc-false-positive”: false, “covid”: false, “covid-19-cyber-threat-coalition-whitelist”: false, “covid-19-krassi-whitelist”: false, “crl-hostname”: false, “crl-ip”: false, “dax30”: false, “disposable-email”: false, “dynamic-dns”: false, “eicar.com”: false, “empty-hashes”: false, “fastly”: false, “google”: false, “google-gcp”: false, “google-gmail-sending-ips”: false, “googlebot”: false, “ipv6-linklocal”: false, “majestic_million”: false, “majestic_million_1M”: false, “microsoft”: false, “microsoft-attack-simulator”: false, “microsoft-azure”: false, “microsoft-azure-china”: false, “microsoft-azure-germany”: false, “microsoft-azure-us-gov”: false, “microsoft-office365”: false, “microsoft-office365-cn”: false, “microsoft-office365-ip”: false, “microsoft-win10-connection-endpoints”: false, “moz-top500”: false, “mozilla-CA”: false, “mozilla-IntermediateCA”: false, “multicast”: false, “nioc-filehash”: false, “ovh-cluster”: false, “phone_numbers”: false, “public-dns-hostname”: false, “public-dns-v4”: false, “public-dns-v6”: false, “rfc1918”: false, “rfc3849”: false, “rfc5735”: false, “rfc6598”: false, “rfc6761”: false, “second-level-tlds”: false, “security-provider-blogpost”: false, “sinkholes”: false, “smtp-receiving-ips”: false, “smtp-sending-ips”: false, “stackpath”: false, “ti-falsepositives”: false, “tlds”: false, “tranco”: false, “tranco10k”: false, “university_domains”: false, “url-shortener”: false, “vpn-ipv4”: false, “vpn-ipv6”: false, “whats-my-ip”: false, “wikimedia”: false}
last_updated: 2022-05-14T10:15:13.771Z
first_seen: 2016-06-09T16:28:01.000Z
last_seen: 2018-04-19T17:23:59.000Z
campaigns:
publications:2 IP 124.248.207.50
url
Retrieve information about a URL from Mandiant
Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.
Base Command
url
Input
| Argument Name | Description | Required |
|---|---|---|
| url | List of URLs. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| MANDIANTTI.URL.score | Number | The Severity Score of the URL indicator |
| MANDIANTTI.URL.fields.url | String | The URL value for the Domain indicator |
| URL.Data | String | URL data. |
| DBotScore.Score | number | The actual score. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Indicator | String | The indicator that was tested. |
Command example
!url url=http://67.205.132.162/a.txt
Context Example
{
"MANDIANTTI": {
"URL": [
{
"fields": {
"DBotScore": {
"Indicator": "http://67.205.132.162/a.txt",
"Reliability": "A - Completely reliable",
"Score": 3,
"Type": "url",
"Vendor": "Mandiant"
},
"firstseenbysource": "2021-06-14T17:46:19.000Z",
"lastseenbysource": "2021-06-14T17:46:41.000Z",
"stixid": "url--e5cc1f98-a9db-5e45-88c3-957fec8f274d",
"trafficlightprotocol": "AMBER",
"url": "http://67.205.132.162/a.txt"
},
"rawJSON": {
"attributed_associations": [
{
"id": "threat-actor--9c88bd9c-f41b-59fa-bfb6-427b1755ea64",
"name": "APT41",
"type": "threat-actor"
}
],
"campaigns": [
{
"id": "campaign--c344bb9b-cb50-58be-9c33-350b622c1fce",
"name": "CAMP.21.014",
"title": "APT41 Exploition of .NET Web Applications at U.S. State Governments"
}
],
"first_seen": "2021-06-14T17:46:19.000Z",
"id": "url--e5cc1f98-a9db-5e45-88c3-957fec8f274d",
"is_exclusive": true,
"is_publishable": true,
"last_seen": "2021-06-14T17:46:41.000Z",
"last_updated": "2022-10-10T23:04:53.568Z",
"mscore": 100,
"publications": [],
"sources": [
{
"category": [],
"first_seen": "2021-06-14T17:46:19.000+0000",
"last_seen": "2021-06-14T17:46:41.000+0000",
"osint": false,
"source_name": "Mandiant"
}
],
"type": "url",
"value": "http://67.205.132.162/a.txt"
},
"relationships": [
{
"entityA": "http://67.205.132.162/a.txt",
"entityAFamily": "Indicator",
"entityAType": "URL",
"entityB": "CAMP.21.014",
"entityBFamily": "Indicator",
"entityBType": "Campaign",
"fields": {},
"name": "related-to",
"reverseName": "related-to",
"type": "IndicatorToIndicator"
}
],
"score": 3,
"type": "URL",
"value": "http://67.205.132.162/a.txt"
}
]
}
}
Human Readable Output
Results
fields rawJSON relationships score type value firstseenbysource: 2021-06-14T17:46:19.000Z
lastseenbysource: 2021-06-14T17:46:41.000Z
stixid: url–e5cc1f98-a9db-5e45-88c3-957fec8f274d
trafficlightprotocol: AMBER
DBotScore: {“Indicator”: “http://67.205.132.162/a.txt”, “Type”: “url”, “Vendor”: “Mandiant”, “Score”: 3, “Reliability”: “A - Completely reliable”}
url: http://67.205.132.162/a.txtid: url–e5cc1f98-a9db-5e45-88c3-957fec8f274d
mscore: 100
type: url
value: http://67.205.132.162/a.txt
is_exclusive: true
is_publishable: true
sources: {‘first_seen’: ‘2021-06-14T17:46:19.000+0000’, ‘last_seen’: ‘2021-06-14T17:46:41.000+0000’, ‘osint’: False, ‘category’: [], ‘source_name’: ‘Mandiant’}
attributed_associations: {‘id’: ‘threat-actor–9c88bd9c-f41b-59fa-bfb6-427b1755ea64’, ‘name’: ‘APT41’, ‘type’: ‘threat-actor’}
misp: {“akamai”: false, “alexa”: false, “alexa_1M”: false, “amazon-aws”: false, “apple”: false, “automated-malware-analysis”: false, “bank-website”: false, “cisco_1M”: false, “cisco_top1000”: false, “cisco_top10k”: false, “cisco_top20k”: false, “cisco_top5k”: false, “cloudflare”: false, “common-contact-emails”: false, “common-ioc-false-positive”: false, “covid”: false, “covid-19-cyber-threat-coalition-whitelist”: false, “covid-19-krassi-whitelist”: false, “crl-hostname”: false, “crl-ip”: false, “dax30”: false, “disposable-email”: false, “dynamic-dns”: false, “eicar.com”: false, “empty-hashes”: false, “fastly”: false, “google”: false, “google-gcp”: false, “google-gmail-sending-ips”: false, “googlebot”: false, “ipv6-linklocal”: false, “majestic_million”: false, “majestic_million_1M”: false, “microsoft”: false, “microsoft-attack-simulator”: false, “microsoft-azure”: false, “microsoft-azure-china”: false, “microsoft-azure-germany”: false, “microsoft-azure-us-gov”: false, “microsoft-office365”: false, “microsoft-office365-cn”: false, “microsoft-office365-ip”: false, “microsoft-win10-connection-endpoints”: false, “moz-top500”: false, “mozilla-CA”: false, “mozilla-IntermediateCA”: false, “multicast”: false, “nioc-filehash”: false, “ovh-cluster”: false, “phone_numbers”: false, “public-dns-hostname”: false, “public-dns-v4”: false, “public-dns-v6”: false, “rfc1918”: false, “rfc3849”: false, “rfc5735”: false, “rfc6598”: false, “rfc6761”: false, “second-level-tlds”: false, “security-provider-blogpost”: false, “sinkholes”: false, “smtp-receiving-ips”: false, “smtp-sending-ips”: false, “stackpath”: false, “tenable-cloud-ipv4”: false, “tenable-cloud-ipv6”: false, “ti-falsepositives”: false, “tlds”: false, “tranco”: false, “tranco10k”: false, “university_domains”: false, “url-shortener”: false, “vpn-ipv4”: true, “vpn-ipv6”: false, “whats-my-ip”: false, “wikimedia”: false}
last_updated: 2022-10-10T23:04:53.568Z
first_seen: 2021-06-14T17:46:19.000Z
last_seen: 2021-06-14T17:46:41.000Z
campaigns: {‘id’: ‘campaign–c344bb9b-cb50-58be-9c33-350b622c1fce’, ‘name’: ‘CAMP.21.014’, ‘title’: ‘APT41 Exploition of .NET Web Applications at U.S. State Governments’}
publications:{‘name’: ‘related-to’, ‘reverseName’: ‘related-to’, ‘type’: ‘IndicatorToIndicator’, ‘entityA’: ‘http://67.205.132.162/a.txt’, ‘entityAFamily’: ‘Indicator’, ‘entityAType’: ‘URL’, ‘entityB’: ‘CAMP.21.014’, ‘entityBFamily’: ‘Indicator’, ‘entityBType’: ‘Campaign’, ‘fields’: {}} 3 URL http://67.205.132.162/a.txt
domain
Retrieve information about an FQDN from Mandiant
Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.
Base Command
domain
Input
| Argument Name | Description | Required |
|---|---|---|
| domain | List of domains. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| MANDIANTTI.DOMAIN.score | Number | The Severity Score of the Domain indicator |
| MANDIANTTI.DOMAIN.fields.dns | String | The DNS record value for the Domain indicator |
| MANDIANTTI.DOMAIN.fields.domain | String | The domain name for the Domain indicator |
| DBotScore.Score | number | The actual score. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Indicator | String | The indicator that was tested. |
| Domain.Name | string | The Domain being checked |
Command example
!domain domain=2011.my03.com
Context Example
{
"MANDIANTTI": {
"DOMAIN": [
{
"fields": {
"DBotScore": {
"Indicator": "2011.my03.com",
"Reliability": "A - Completely reliable",
"Score": 0,
"Type": "domain",
"Vendor": "Mandiant"
},
"dns": "2011.my03.com",
"domain": "2011.my03.com",
"firstseenbysource": "2016-06-09T16:28:00.000Z",
"lastseenbysource": "2023-01-23T16:52:33.000Z",
"stixid": "fqdn--3c525155-bc95-511d-a717-83e50e20aa14",
"trafficlightprotocol": "AMBER"
},
"rawJSON": {
"campaigns": [],
"first_seen": "2016-06-09T16:28:00.000Z",
"id": "fqdn--3c525155-bc95-511d-a717-83e50e20aa14",
"is_publishable": true,
"last_seen": "2023-01-23T16:52:33.000Z",
"last_updated": "2023-02-20T18:43:42.349Z",
"mscore": 50,
"publications": [],
"sources": [
{
"category": [],
"first_seen": "2023-01-23T16:52:33.000+0000",
"last_seen": "2023-01-23T16:52:33.000+0000",
"osint": false,
"source_name": "Mandiant"
},
{
"category": [],
"first_seen": "2016-06-09T16:28:00.000+0000",
"last_seen": "2016-06-09T16:28:00.000+0000",
"osint": false,
"source_name": "Mandiant"
}
],
"type": "fqdn",
"value": "2011.my03.com"
},
"relationships": [],
"score": 0,
"type": "Domain",
"value": "2011.my03.com"
}
]
}
}
Human Readable Output
Results
fields rawJSON relationships score type value firstseenbysource: 2016-06-09T16:28:00.000Z
lastseenbysource: 2023-01-23T16:52:33.000Z
stixid: fqdn–3c525155-bc95-511d-a717-83e50e20aa14
trafficlightprotocol: AMBER
DBotScore: {“Indicator”: “2011.my03.com”, “Type”: “domain”, “Vendor”: “Mandiant”, “Score”: 0, “Reliability”: “A - Completely reliable”}
dns: 2011.my03.com
domain: 2011.my03.comid: fqdn–3c525155-bc95-511d-a717-83e50e20aa14
mscore: 50
type: fqdn
value: 2011.my03.com
is_publishable: true
sources: {‘first_seen’: ‘2023-01-23T16:52:33.000+0000’, ‘last_seen’: ‘2023-01-23T16:52:33.000+0000’, ‘osint’: False, ‘category’: [], ‘source_name’: ‘Mandiant’},
{‘first_seen’: ‘2016-06-09T16:28:00.000+0000’, ‘last_seen’: ‘2016-06-09T16:28:00.000+0000’, ‘osint’: False, ‘category’: [], ‘source_name’: ‘Mandiant’}
misp: {“akamai”: false, “alexa”: false, “alexa_1M”: false, “amazon-aws”: false, “apple”: false, “automated-malware-analysis”: false, “bank-website”: false, “captive-portals”: false, “cisco_1M”: true, “cisco_top1000”: false, “cisco_top10k”: false, “cisco_top20k”: false, “cisco_top5k”: false, “cloudflare”: false, “common-contact-emails”: false, “common-ioc-false-positive”: false, “covid”: false, “covid-19-cyber-threat-coalition-whitelist”: false, “covid-19-krassi-whitelist”: false, “crl-hostname”: false, “crl-ip”: false, “dax30”: false, “disposable-email”: false, “dynamic-dns”: false, “eicar.com”: false, “empty-hashes”: false, “fastly”: false, “google”: false, “google-chrome-crux-1million”: false, “google-gcp”: false, “google-gmail-sending-ips”: false, “googlebot”: false, “ipv6-linklocal”: false, “majestic_million”: false, “majestic_million_1M”: false, “microsoft”: false, “microsoft-attack-simulator”: false, “microsoft-azure”: false, “microsoft-azure-appid”: false, “microsoft-azure-china”: false, “microsoft-azure-germany”: false, “microsoft-azure-us-gov”: false, “microsoft-office365”: false, “microsoft-office365-cn”: false, “microsoft-office365-ip”: false, “microsoft-win10-connection-endpoints”: false, “moz-top500”: false, “mozilla-CA”: false, “mozilla-IntermediateCA”: false, “multicast”: false, “nioc-filehash”: false, “ovh-cluster”: false, “parking-domain”: false, “parking-domain-ns”: false, “phone_numbers”: false, “public-dns-hostname”: false, “public-dns-v4”: false, “public-dns-v6”: false, “public-ipfs-gateways”: false, “rfc1918”: false, “rfc3849”: false, “rfc5735”: false, “rfc6598”: false, “rfc6761”: false, “second-level-tlds”: true, “security-provider-blogpost”: false, “sinkholes”: false, “smtp-receiving-ips”: false, “smtp-sending-ips”: false, “stackpath”: false, “tenable-cloud-ipv4”: false, “tenable-cloud-ipv6”: false, “ti-falsepositives”: false, “tlds”: true, “tranco”: true, “tranco10k”: false, “university_domains”: false, “url-shortener”: false, “vpn-ipv4”: false, “vpn-ipv6”: false, “whats-my-ip”: false, “wikimedia”: false}
last_updated: 2023-02-20T18:43:42.349Z
first_seen: 2016-06-09T16:28:00.000Z
last_seen: 2023-01-23T16:52:33.000Z
campaigns:
publications:0 Domain 2011.my03.com
cve
Retrieve information about a Vulnerability (by CVE) from Mandiant
Base Command
cve
Input
| Argument Name | Description | Required |
|---|---|---|
| cve | List of CVEs. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| MANDIANTTI.CVE.score | Number | The Severity Score of the CVE |
| MANDIANTTI.CVE.id | String | The CVE ID |
| MANDIANTTI.CVE.fields.cvss | String | The CVSS version of the CVE |
| MANDIANTTI.CVE.fields.cvssvector | String | The CVSS vector string for the CVE |
| MANDIANTTI.CVE.fields.cvss2.metric | String | The name of the CVSS metric |
| MANDIANTTI.CVE.fields.cvss2.values | String | The values of the CVSS metric |
| DBotScore.Score | number | The actual score. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Indicator | String | The indicator that was tested. |
Command example
!cve cve=CVE-2018-8120
Context Example
{
"MANDIANTTI": {
"CVE": [
{
"fields": {
"DBotScore": {
"Indicator": null,
"Reliability": "A - Completely reliable",
"Score": 0,
"Type": "cve",
"Vendor": "Mandiant"
},
"cvss": "v2.0",
"cvss2": [
{
"metric": "Access Complexity",
"values": "MEDIUM"
},
{
"metric": "Access Vector",
"values": "LOCAL"
},
{
"metric": "Authentication",
"values": "NONE"
},
{
"metric": "Availability Impact",
"values": "COMPLETE"
},
{
"metric": "Base Score",
"values": 6.9
},
{
"metric": "Confidentiality Impact",
"values": "COMPLETE"
},
{
"metric": "Exploitability",
"values": "FUNCTIONAL"
},
{
"metric": "Integrity Impact",
"values": "COMPLETE"
},
{
"metric": "Remediation Level",
"values": "OFFICIAL_FIX"
},
{
"metric": "Report Confidence",
"values": "CONFIRMED"
},
{
"metric": "Temporal Score",
"values": 5.7
},
{
"metric": "Vector String",
"values": "AV:L/AC:M/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C"
}
],
"cvssvector": "AV:L/AC:M/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C",
"id": null,
"stixid": "vulnerability--6dc0a4db-e822-5c76-bca2-b7eb750da2ad",
"trafficlightprotocol": "AMBER"
},
"rawJSON": {
"affects_ot": false,
"aliases": [],
"analysis": "<p>An attacker could exploit this vulnerability to execute arbitrary code. An attacker would need to gain low privilege access to the vulnerable system to exploit this issue. Further, upon obtaining the low privilege access, an attacker would need to craft a program which can change the privilege of the current process, using the call gate functions. A failed attempt at exploitation could potentially cause a crash of the application, resulting in a denial-of-service condition.</p>\n<p> </p>\n<p>A non-weaponized exploit is publicly available on VirusTotal, in the form of a PDF sample. This exploit code creates a new windowstation object and assigns it to the current process in user-mode, making the spklList Pointer field equal to zero. This code writes an arbitrary address in the kernel space by mapping the NULL page and setting a pointer to offset 0x2C. Upon writing an arbitrary address, the attacker changes the privilege level of a process by setting call gate to Ring 0. Further, the exploit uses the CALL FAR instruction to perform an inter-privilege level call, giving an attacker administrative access on the system. A similar exploit code is also publicly available via GitHub.</p>\n<p> </p>\n<p>An exploit code in the form of a Metasploit module has been publicly released. This exploit can trigger the null pointer dereference issue which is caused when the Win32k component does not properly handle objects in memory. Successful exploitation via this code will allow an attacker to perform privileged tasks on the compromised machine.</p>\n<p> </p>\n<p>Microsoft has reported this vulnerability has been exploited. Additionally, it is reported that threat actor ScarCruft is utilizing the publicly available exploit code to drop a backdoor, known as ROKRAT, used for data exfiltration. FireEye tracks most elements of the group publicly reported as Scarcruft as APT37 (Reaper).</p>\n<p> </p>\n<p>Trend Micro has reported observation of a malverstising campaign at the end of October 2019 using an exploit kit they refer to as Capesand to deliver DarkRAT and njRAT malware. This vulnerability was reportedly leveraged after successful exploitation via Capesand in order to gain escalated privileges and execute njcrypt.exe.</p>\n<p> </p>\n<p>No workaround is available, although the Microsoft reportedly addressed this vulnerability in a fix. FireEye iSIGHT Intelligence considers this a Medium-risk vulnerability because of possibility of arbitrary code execution offset by the local access required.</p>\n<p><br />CISA added this vulnerability to its Known Exploited Vulnerabilities Catalog on March 15, 2022, with a required remediation date of April 5, 2022.</p>",
"associated_actors": [
{
"aliases": [
{
"attribution_scope": "confirmed",
"name": "Odinaff (Symantec)"
},
{
"attribution_scope": "confirmed",
"name": "Sectoj04 (NSHC Group)"
},
{
"attribution_scope": "confirmed",
"name": "TA505 (Proofpoint)"
},
{
"attribution_scope": "confirmed",
"name": "TEMP.Warlock"
},
{
"attribution_scope": "confirmed",
"name": "Ta505 (Norfolkinfosec)"
},
{
"attribution_scope": "confirmed",
"name": "Ta505 (Trend Micro)"
}
],
"country_code": "unknown",
"description": "FIN11 is a financially motivated threat group that has conducted some of the largest and longest running malware distribution campaigns observed amongst our FIN groups to date. Mandiant has observed FIN11 attempt to monetize their operations at least once using named point-of-sale (POS) malware, and more recently using CLOP ransomware and/or data theft extortion. The volume of FIN11's high-volume spam campaigns slowed in 2021, before ceasing altogether in 2022, when the group shifted to server exploitation for initial access. The group has been active since at least 2016, but identified overlaps with activity tracked by security researchers as TA505 suggest they may have been conducting operations as early as 2014.",
"id": "threat-actor--b8ee8129-5ecc-581a-a636-fb17051d2ffe",
"intel_free": false,
"last_updated": "2023-03-04T07:03:58Z",
"name": "FIN11"
}
],
"associated_malware": [
{
"aliases": [],
"description": "BADPOTATO is a publicly available privilege escalation tool that abuses Impersonation Privileges on Windows 10 and Windows Server 2019. ",
"has_yara": true,
"id": "malware--8e99e597-dda4-57dc-be6e-f1bc8b80a5f3",
"intel_free": false,
"is_malicious": true,
"last_updated": "2023-03-06T02:10:40.000Z",
"name": "BADPOTATO"
},
{
"aliases": [],
"description": "COMAHAWK is a privilege escalation tool that attempts to exploit CVE-2019-1405 and CVE-2019-1322.",
"has_yara": true,
"id": "malware--0073c12d-177a-5353-8170-e72ac8fc75bb",
"intel_free": false,
"is_malicious": true,
"last_updated": "2023-03-06T02:13:12.000Z",
"name": "COMAHAWK"
}
],
"associated_reports": [
{
"audience": [
"vulnerability"
],
"published_date": "2018-05-08T23:36:07.596Z",
"report_id": "18-00007543",
"report_type": "Patch Report",
"title": "Microsoft May 2018 Security Advisory Release"
},
{
"audience": [
"vulnerability"
],
"published_date": "2019-06-12T13:15:13.875Z",
"report_id": "19-00009557",
"report_type": "Trends and Forecasting",
"title": "May 2019 Month in Vulnerabilities"
},
{
"audience": [
"strategic",
"vulnerability"
],
"published_date": "2019-12-18T13:16:56.301Z",
"report_id": "19-00021769",
"report_type": "Trends and Forecasting",
"title": "Analysis of Time to Exploit in Tracked Vulnerabilities Exploited in 2018\u20132019"
},
{
"audience": [
"cyber crime",
"fusion"
],
"published_date": "2018-10-19T20:32:50.054Z",
"report_id": "18-00017419",
"report_type": "Trends and Forecasting",
"title": "Operational Net Assessment of Cyber Crime Threats\u00e2July to September 2018"
},
{
"audience": [
"vulnerability"
],
"published_date": "2018-06-18T23:04:39.328Z",
"report_id": "18-00009795",
"report_type": "Vulnerability Report",
"title": "May 2018 Month in Vulnerabilities"
},
{
"audience": [
"cyber crime",
"fusion",
"vulnerability"
],
"published_date": "2018-06-28T18:46:09.706Z",
"report_id": "18-00010584",
"report_type": "Threat Activity Alert",
"title": "Threat Activity Alert: Russian-Speaking Actor Advertises a Malicious PDF Builder with CVE-2018-4990 and CVE-2018-8120 Exploits"
},
{
"audience": [
"cyber crime",
"fusion"
],
"published_date": "2019-02-05T22:02:15.475Z",
"report_id": "19-00002007",
"report_type": "Actor Profile",
"title": "Threat Actor Profile: GandCrab "
},
{
"audience": [
"cyber crime",
"fusion"
],
"published_date": "2018-10-16T18:37:46.427Z",
"report_id": "18-00017293",
"report_type": "Trends and Forecasting",
"title": "Monthly Report on Cyber Crime Threats to the Financial Sector \u2013 September 2018"
},
{
"audience": [
"vulnerability"
],
"published_date": "2022-04-05T14:17:42.242Z",
"report_id": "18-00007690",
"report_type": "Vulnerability Report",
"title": "Microsoft Windows Server 2008 NtUserSetImeInfoEx() Null Pointer Dereference Vulnerability"
},
{
"audience": [
"cyber crime",
"operational"
],
"published_date": "2019-12-16T19:20:00.473Z",
"report_id": "18-00003542",
"report_type": "Malware Profile",
"title": "GandCrab Ransomware Malware Profile"
}
],
"audience": [
"intel_vuln"
],
"available_mitigation": [
"Patch"
],
"cisa_known_exploited": null,
"common_vulnerability_scores": {
"v2.0": {
"access_complexity": "MEDIUM",
"access_vector": "LOCAL",
"authentication": "NONE",
"availability_impact": "COMPLETE",
"base_score": 6.9,
"confidentiality_impact": "COMPLETE",
"exploitability": "FUNCTIONAL",
"integrity_impact": "COMPLETE",
"remediation_level": "OFFICIAL_FIX",
"report_confidence": "CONFIRMED",
"temporal_score": 5.7,
"vector_string": "AV:L/AC:M/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C"
},
"v3.0": {
"attack_complexity": "HIGH",
"attack_vector": "LOCAL",
"availability_impact": "HIGH",
"base_score": 7,
"confidentiality_impact": "HIGH",
"exploit_code_maturity": "FUNCTIONAL",
"integrity_impact": "HIGH",
"privileges_required": "LOW",
"remediation_level": "OFFICIAL_FIX",
"report_confidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporal_score": 6.5,
"user_interaction": "NONE",
"vector_string": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
},
"cpe_ranges": [],
"cve_id": "CVE-2018-8120",
"cwe": "Null Pointer Dereference",
"cwe_details": null,
"date_of_disclosure": "2018-05-04T06:00:00.000Z",
"days_to_patch": null,
"description": "<p><a href=\"https://www.microsoft.com/en-sg/windows\">Windows </a>is the flagship operating system by Microsoft.</p>\n<p> </p>\n<p>A vulnerability exists in the NtUserSetImeInfoEx() function within the win32k kernel component in Microsoft Windows Server. The issue occurs because the SetImeInfoEx subroutine, within the NtUserSetImeInfoEx() function, does not validate a data pointer, this results in issue where an application dereferences a pointer which is Null.</p>",
"epss": null,
"executive_summary": "<p>A null pointer dereference vulnerability exists in the NtUserSetImeInfoEx() function within the Win32k component in Microsoft Windows Server 2008 and earlier that, when exploited, allows an attacker to locally gain elevated privileges. Exploit code is publicly available and Microsoft reported that this vulnerability has been exploited in the wild. Mitigation options include a vendor fix. Exploitation Rating: Confirmed</p>",
"exploitation_consequence": "Code Execution",
"exploitation_state": "Confirmed",
"exploitation_vectors": [
"Local Access"
],
"exploits": [
{
"description": "This exploit is a Metasploit module that can trigger the null pointer dereference issue on an affected server and yield an attacker elevated privileges on the affected system.",
"exploit_url": "https://www.exploit-db.com/exploits/45653/",
"file_size": 4498,
"grade": "",
"hashes": {},
"md5": "5dd08479823a39d8d808ead98110a070",
"name": "ms18_8120_win32k_privesc.rb",
"release_date": "2018-10-20T06:00:00Z",
"reliability": "Untested",
"replication_urls": []
},
{
"description": "This exploit will trigger this vulnerability to gain elevated privileges.",
"exploit_url": "https://github.com/leeqwind/HolicPOC/blob/master/windows/win32k/CVE-2018-8120/x86.cpp",
"file_size": 13367,
"grade": "",
"hashes": {},
"md5": "1A0D48A31B50691F8613B31A53C4D16A",
"name": "CVE-2018-8120_exploit",
"release_date": "2018-05-14T06:00:00Z",
"reliability": "Untested",
"replication_urls": []
}
],
"id": "vulnerability--6dc0a4db-e822-5c76-bca2-b7eb750da2ad",
"intel_free": false,
"is_publishable": true,
"last_modified_date": "2022-12-09T02:36:33.290Z",
"observed_in_the_wild": true,
"publish_date": "2022-04-05T14:17:00.000Z",
"risk_rating": "MEDIUM",
"sources": [
{
"date": "2018-05-08T17:00:00.000Z",
"is_vendor_fix": false,
"source_description": "CVE-2018-8120",
"source_name": "Microsoft Corp.",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8120"
},
{
"date": "2018-05-15T16:00:00.000Z",
"is_vendor_fix": false,
"source_description": "A tale of two zero-days",
"source_name": "WeLiveSecurity",
"url": "https://www.welivesecurity.com/2018/05/15/tale-two-zero-days/"
},
{
"date": "2019-05-13T16:00:00.000Z",
"is_vendor_fix": false,
"source_name": "Kaspersky Lab",
"url": "https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/"
},
{
"date": "2019-11-05T05:00:00.000Z",
"is_vendor_fix": false,
"source_description": "New Exploit Kit Capesand Reuses Old and New Public Exploits and Tools, Blockchain Ruse",
"source_name": "Trend Micro",
"url": "https://blog.trendmicro.com/trendlabs-security-intelligence/new-exploit-kit-capesand-reuses-old-and-new-public-exploits-and-tools-blockchain-ruse/"
},
{
"date": "2022-03-15T12:00:00.000Z",
"is_vendor_fix": false,
"source_description": "CISA Known Exploited Vulnerabilities Catalog",
"source_name": "CISA",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
},
{
"date": "2022-03-24T04:00:00.000Z",
"is_vendor_fix": false,
"source_name": "Tenable Inc.",
"url": "https://www.tenable.com/blog/contileaks-chats-reveal-over-30-vulnerabilities-used-by-conti-ransomware-affiliates"
}
],
"title": "Microsoft Windows Server 2008 NtUserSetImeInfoEx() Null Pointer Dereference Vulnerability",
"type": "vulnerability",
"updated_date": "2022-04-05T14:17:00.000Z",
"vendor_fix_references": [
{
"name": "Microsoft Security Update Information",
"unique_id": "",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8120"
}
],
"version_history": [],
"vulnerable_cpes": [
{
"cpe": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:itanium:*:*:*:*:*",
"cpe_title": "microsoft windows_server_2008 r2",
"technology_name": "windows_server_2008 r2",
"vendor_name": "microsoft"
},
{
"cpe": "cpe:2.3:o:microsoft:windows_server_2008:sp2:*:x64:*:*:*:*:*",
"cpe_title": "microsoft windows_server_2008 sp2",
"technology_name": "windows_server_2008 sp2",
"vendor_name": "microsoft"
},
{
"cpe": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:x64:*:*:*:*:*",
"cpe_title": "microsoft windows_server_2008 r2",
"technology_name": "windows_server_2008 r2",
"vendor_name": "microsoft"
},
{
"cpe": "cpe:2.3:o:microsoft:windows_7:-:sp1:x64:*:*:*:*:*",
"cpe_title": "microsoft windows_7 -",
"technology_name": "windows_7 -",
"vendor_name": "microsoft"
},
{
"cpe": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*",
"cpe_title": "microsoft windows_server_2008 -",
"technology_name": "windows_server_2008 -",
"vendor_name": "microsoft"
},
{
"cpe": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*",
"cpe_title": "microsoft windows_server_2008 -",
"technology_name": "windows_server_2008 -",
"vendor_name": "microsoft"
},
{
"cpe": "cpe:2.3:o:microsoft:windows_7:-:sp1:x86:*:*:*:*:*",
"cpe_title": "microsoft windows_7 -",
"technology_name": "windows_7 -",
"vendor_name": "microsoft"
}
],
"vulnerable_products": "<p>Microsoft reports that the following products and versions are vulnerable:</p>\n<ul>\n<li>Windows 7 for 32-bit Systems Service Pack 1</li>\n<li>Windows 7 for x64-based Systems Service Pack 1</li>\n<li>Windows Server 2008 for 32-bit Systems Service Pack2</li>\n<li>Windows Server 2008 for Itanium-based Systems Service Pack2</li>\n<li>Windows Server 2008 for x64-based Systems Service Pack2</li>\n<li>Windows Server 2008 for R2 for Itanium-based Systems Service Pack 1</li>\n<li>Windows Server 2008 for x64-based Systems Service Pack 1</li>\n</ul>",
"was_zero_day": true,
"workarounds": "<p>Aside from the available vendor fix, FireEye iSIGHT Intelligence is unaware of any alternate mitigation procedures for this vulnerability.</p>",
"workarounds_list": []
},
"relationships": [],
"score": 0,
"type": "CVE",
"value": null
}
]
}
}
Human Readable Output
Results
fields rawJSON relationships score type value stixid: vulnerability–6dc0a4db-e822-5c76-bca2-b7eb750da2ad
trafficlightprotocol: AMBER
DBotScore: {“Indicator”: null, “Type”: “cve”, “Vendor”: “Mandiant”, “Score”: 0, “Reliability”: “A - Completely reliable”}
id: null
cvss: v2.0
cvssvector: AV:L/AC:M/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C
cvss2: {‘metric’: ‘Access Complexity’, ‘values’: ‘MEDIUM’},
{‘metric’: ‘Access Vector’, ‘values’: ‘LOCAL’},
{‘metric’: ‘Authentication’, ‘values’: ‘NONE’},
{‘metric’: ‘Availability Impact’, ‘values’: ‘COMPLETE’},
{‘metric’: ‘Base Score’, ‘values’: 6.9},
{‘metric’: ‘Confidentiality Impact’, ‘values’: ‘COMPLETE’},
{‘metric’: ‘Exploitability’, ‘values’: ‘FUNCTIONAL’},
{‘metric’: ‘Integrity Impact’, ‘values’: ‘COMPLETE’},
{‘metric’: ‘Remediation Level’, ‘values’: ‘OFFICIAL_FIX’},
{‘metric’: ‘Report Confidence’, ‘values’: ‘CONFIRMED’},
{‘metric’: ‘Temporal Score’, ‘values’: 5.7},
{‘metric’: ‘Vector String’, ‘values’: ‘AV:L/AC:M/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C’}id: vulnerability–6dc0a4db-e822-5c76-bca2-b7eb750da2ad
type: vulnerability
is_publishable: true
risk_rating: MEDIUM
analysis: <p>An attacker could exploit this vulnerability to execute arbitrary code. An attacker would need to gain low privilege access to the vulnerable system to exploit this issue. Further, upon obtaining the low privilege access, an attacker would need to craft a program which can change the privilege of the current process, using the call gate functions. A failed attempt at exploitation could potentially cause a crash of the application, resulting in a denial-of-service condition.</p>
<p> </p>
<p>A non-weaponized exploit is publicly available on VirusTotal, in the form of a PDF sample. This exploit code creates a new windowstation object and assigns it to the current process in user-mode, making the spklList Pointer field equal to zero. This code writes an arbitrary address in the kernel space by mapping the NULL page and setting a pointer to offset 0x2C. Upon writing an arbitrary address, the attacker changes the privilege level of a process by setting call gate to Ring 0. Further, the exploit uses the CALL FAR instruction to perform an inter-privilege level call, giving an attacker administrative access on the system. A similar exploit code is also publicly available via GitHub.</p>
<p> </p>
<p>An exploit code in the form of a Metasploit module has been publicly released. This exploit can trigger the null pointer dereference issue which is caused when the Win32k component does not properly handle objects in memory. Successful exploitation via this code will allow an attacker to perform privileged tasks on the compromised machine.</p>
<p> </p>
<p>Microsoft has reported this vulnerability has been exploited. Additionally, it is reported that threat actor ScarCruft is utilizing the publicly available exploit code to drop a backdoor, known as ROKRAT, used for data exfiltration. FireEye tracks most elements of the group publicly reported as Scarcruft as APT37 (Reaper).</p>
<p> </p>
<p>Trend Micro has reported observation of a malverstising campaign at the end of October 2019 using an exploit kit they refer to as Capesand to deliver DarkRAT and njRAT malware. This vulnerability was reportedly leveraged after successful exploitation via Capesand in order to gain escalated privileges and execute njcrypt.exe.</p>
<p> </p>
<p>No workaround is available, although the Microsoft reportedly addressed this vulnerability in a fix. FireEye iSIGHT Intelligence considers this a Medium-risk vulnerability because of possibility of arbitrary code execution offset by the local access required.</p>
<p>
CISA added this vulnerability to its Known Exploited Vulnerabilities Catalog on March 15, 2022, with a required remediation date of April 5, 2022.</p>
executive_summary: <p>A null pointer dereference vulnerability exists in the NtUserSetImeInfoEx() function within the Win32k component in Microsoft Windows Server 2008 and earlier that, when exploited, allows an attacker to locally gain elevated privileges. Exploit code is publicly available and Microsoft reported that this vulnerability has been exploited in the wild. Mitigation options include a vendor fix. Exploitation Rating: Confirmed</p>
description: <p>Windows is the flagship operating system by Microsoft.</p>
<p> </p>
<p>A vulnerability exists in the NtUserSetImeInfoEx() function within the win32k kernel component in Microsoft Windows Server. The issue occurs because the SetImeInfoEx subroutine, within the NtUserSetImeInfoEx() function, does not validate a data pointer, this results in issue where an application dereferences a pointer which is Null.</p>
exploitation_vectors: Local Access
title: Microsoft Windows Server 2008 NtUserSetImeInfoEx() Null Pointer Dereference Vulnerability
associated_actors: {‘last_updated’: ‘2023-03-04T07:03:58Z’, ‘aliases’: [{‘name’: ‘Odinaff (Symantec)’, ‘attribution_scope’: ‘confirmed’}, {‘name’: ‘Sectoj04 (NSHC Group)’, ‘attribution_scope’: ‘confirmed’}, {‘name’: ‘TA505 (Proofpoint)’, ‘attribution_scope’: ‘confirmed’}, {‘name’: ‘TEMP.Warlock’, ‘attribution_scope’: ‘confirmed’}, {‘name’: ‘Ta505 (Norfolkinfosec)’, ‘attribution_scope’: ‘confirmed’}, {‘name’: ‘Ta505 (Trend Micro)’, ‘attribution_scope’: ‘confirmed’}], ‘name’: ‘FIN11’, ‘description’: “FIN11 is a financially motivated threat group that has conducted some of the largest and longest running malware distribution campaigns observed amongst our FIN groups to date. Mandiant has observed FIN11 attempt to monetize their operations at least once using named point-of-sale (POS) malware, and more recently using CLOP ransomware and/or data theft extortion. The volume of FIN11’s high-volume spam campaigns slowed in 2021, before ceasing altogether in 2022, when the group shifted to server exploitation for initial access. The group has been active since at least 2016, but identified overlaps with activity tracked by security researchers as TA505 suggest they may have been conducting operations as early as 2014.”, ‘id’: ‘threat-actor–b8ee8129-5ecc-581a-a636-fb17051d2ffe’, ‘intel_free’: False, ‘country_code’: ‘unknown’}
associated_malware: {‘last_updated’: ‘2023-03-06T02:10:40.000Z’, ‘aliases’: [], ‘name’: ‘BADPOTATO’, ‘description’: ‘BADPOTATO is a publicly available privilege escalation tool that abuses Impersonation Privileges on Windows 10 and Windows Server 2019. ‘, ‘id’: ‘malware–8e99e597-dda4-57dc-be6e-f1bc8b80a5f3’, ‘intel_free’: False, ‘has_yara’: True, ‘is_malicious’: True},
{‘last_updated’: ‘2023-03-06T02:13:12.000Z’, ‘aliases’: [], ‘name’: ‘COMAHAWK’, ‘description’: ‘COMAHAWK is a privilege escalation tool that attempts to exploit CVE-2019-1405 and CVE-2019-1322.’, ‘id’: ‘malware–0073c12d-177a-5353-8170-e72ac8fc75bb’, ‘intel_free’: False, ‘has_yara’: True, ‘is_malicious’: True}
associated_reports: {‘report_id’: ‘18-00007543’, ‘report_type’: ‘Patch Report’, ‘title’: ‘Microsoft May 2018 Security Advisory Release’, ‘published_date’: ‘2018-05-08T23:36:07.596Z’, ‘audience’: [‘vulnerability’]},
{‘report_id’: ‘19-00009557’, ‘report_type’: ‘Trends and Forecasting’, ‘title’: ‘May 2019 Month in Vulnerabilities’, ‘published_date’: ‘2019-06-12T13:15:13.875Z’, ‘audience’: [‘vulnerability’]},
{‘report_id’: ‘19-00021769’, ‘report_type’: ‘Trends and Forecasting’, ‘title’: ‘Analysis of Time to Exploit in Tracked Vulnerabilities Exploited in 2018–2019’, ‘published_date’: ‘2019-12-18T13:16:56.301Z’, ‘audience’: [‘strategic’, ‘vulnerability’]},
{‘report_id’: ‘18-00017419’, ‘report_type’: ‘Trends and Forecasting’, ‘title’: ‘Operational Net Assessment of Cyber Crime ThreatsâJuly to September 2018’, ‘published_date’: ‘2018-10-19T20:32:50.054Z’, ‘audience’: [‘cyber crime’, ‘fusion’]},
{‘report_id’: ‘18-00009795’, ‘report_type’: ‘Vulnerability Report’, ‘title’: ‘May 2018 Month in Vulnerabilities’, ‘published_date’: ‘2018-06-18T23:04:39.328Z’, ‘audience’: [‘vulnerability’]},
{‘report_id’: ‘18-00010584’, ‘report_type’: ‘Threat Activity Alert’, ‘title’: ‘Threat Activity Alert: Russian-Speaking Actor Advertises a Malicious PDF Builder with CVE-2018-4990 and CVE-2018-8120 Exploits’, ‘published_date’: ‘2018-06-28T18:46:09.706Z’, ‘audience’: [‘cyber crime’, ‘fusion’, ‘vulnerability’]},
{‘report_id’: ‘19-00002007’, ‘report_type’: ‘Actor Profile’, ‘title’: ‘Threat Actor Profile: GandCrab ‘, ‘published_date’: ‘2019-02-05T22:02:15.475Z’, ‘audience’: [‘cyber crime’, ‘fusion’]},
{‘report_id’: ‘18-00017293’, ‘report_type’: ‘Trends and Forecasting’, ‘title’: ‘Monthly Report on Cyber Crime Threats to the Financial Sector – September 2018’, ‘published_date’: ‘2018-10-16T18:37:46.427Z’, ‘audience’: [‘cyber crime’, ‘fusion’]},
{‘report_id’: ‘18-00007690’, ‘report_type’: ‘Vulnerability Report’, ‘title’: ‘Microsoft Windows Server 2008 NtUserSetImeInfoEx() Null Pointer Dereference Vulnerability’, ‘published_date’: ‘2022-04-05T14:17:42.242Z’, ‘audience’: [‘vulnerability’]},
{‘report_id’: ‘18-00003542’, ‘report_type’: ‘Malware Profile’, ‘title’: ‘GandCrab Ransomware Malware Profile’, ‘published_date’: ‘2019-12-16T19:20:00.473Z’, ‘audience’: [‘cyber crime’, ‘operational’]}
exploitation_consequence: Code Execution
cwe: Null Pointer Dereference
cve_id: CVE-2018-8120
vulnerable_products: <p>Microsoft reports that the following products and versions are vulnerable:</p>
<ul>
<li>Windows 7 for 32-bit Systems Service Pack 1</li>
<li>Windows 7 for x64-based Systems Service Pack 1</li>
<li>Windows Server 2008 for 32-bit Systems Service Pack2</li>
<li>Windows Server 2008 for Itanium-based Systems Service Pack2</li>
<li>Windows Server 2008 for x64-based Systems Service Pack2</li>
<li>Windows Server 2008 for R2 for Itanium-based Systems Service Pack 1</li>
<li>Windows Server 2008 for x64-based Systems Service Pack 1</li>
</ul>
exploitation_state: Confirmed
vendor_fix_references: {‘url’: ‘https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8120’, ‘name’: ‘Microsoft Security Update Information’, ‘unique_id’: ‘’}
date_of_disclosure: 2018-05-04T06:00:00.000Z
observed_in_the_wild: true
vulnerable_cpes: {‘vendor_name’: ‘microsoft’, ‘technology_name’: ‘windows_server_2008 r2’, ‘cpe’: ‘cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:itanium:::::’, ‘cpe_title’: ‘microsoft windows_server_2008 r2’},
{‘vendor_name’: ‘microsoft’, ‘technology_name’: ‘windows_server_2008 sp2’, ‘cpe’: ‘cpe:2.3:o:microsoft:windows_server_2008:sp2::x64:::::’, ‘cpe_title’: ‘microsoft windows_server_2008 sp2’},
{‘vendor_name’: ‘microsoft’, ‘technology_name’: ‘windows_server_2008 r2’, ‘cpe’: ‘cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:x64:::::’, ‘cpe_title’: ‘microsoft windows_server_2008 r2’},
{‘vendor_name’: ‘microsoft’, ‘technology_name’: ‘windows_7 -‘, ‘cpe’: ‘cpe:2.3:o:microsoft:windows_7:-:sp1:x64:::::’, ‘cpe_title’: ‘microsoft windows_7 -‘},
{‘vendor_name’: ‘microsoft’, ‘technology_name’: ‘windows_server_2008 -‘, ‘cpe’: ‘cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:::::’, ‘cpe_title’: ‘microsoft windows_server_2008 -‘},
{‘vendor_name’: ‘microsoft’, ‘technology_name’: ‘windows_server_2008 -‘, ‘cpe’: ‘cpe:2.3:o:microsoft:windows_server_2008:-:sp2::::::’, ‘cpe_title’: ‘microsoft windows_server_2008 -‘},
{‘vendor_name’: ‘microsoft’, ‘technology_name’: ‘windows_7 -‘, ‘cpe’: ‘cpe:2.3:o:microsoft:windows_7:-:sp1:x86:::::*’, ‘cpe_title’: ‘microsoft windows_7 -‘}
was_zero_day: true
workarounds: <p>Aside from the available vendor fix, FireEye iSIGHT Intelligence is unaware of any alternate mitigation procedures for this vulnerability.</p>
publish_date: 2022-04-05T14:17:00.000Z
updated_date: 2022-04-05T14:17:00.000Z
last_modified_date: 2022-12-09T02:36:33.290Z
available_mitigation: Patch
sources: {‘source_name’: ‘Microsoft Corp.’, ‘source_description’: ‘CVE-2018-8120’, ‘date’: ‘2018-05-08T17:00:00.000Z’, ‘url’: ‘https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8120’, ‘is_vendor_fix’: False},
{‘source_name’: ‘WeLiveSecurity’, ‘source_description’: ‘A tale of two zero-days’, ‘date’: ‘2018-05-15T16:00:00.000Z’, ‘url’: ‘https://www.welivesecurity.com/2018/05/15/tale-two-zero-days/’, ‘is_vendor_fix’: False},
{‘source_name’: ‘Kaspersky Lab’, ‘date’: ‘2019-05-13T16:00:00.000Z’, ‘url’: ‘https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/’, ‘is_vendor_fix’: False},
{‘source_name’: ‘Trend Micro’, ‘source_description’: ‘New Exploit Kit Capesand Reuses Old and New Public Exploits and Tools, Blockchain Ruse’, ‘date’: ‘2019-11-05T05:00:00.000Z’, ‘url’: ‘https://blog.trendmicro.com/trendlabs-security-intelligence/new-exploit-kit-capesand-reuses-old-and-new-public-exploits-and-tools-blockchain-ruse/’, ‘is_vendor_fix’: False},
{‘source_name’: ‘CISA’, ‘source_description’: ‘CISA Known Exploited Vulnerabilities Catalog’, ‘date’: ‘2022-03-15T12:00:00.000Z’, ‘url’: ‘https://www.cisa.gov/known-exploited-vulnerabilities-catalog’, ‘is_vendor_fix’: False},
{‘source_name’: ‘Tenable Inc.’, ‘date’: ‘2022-03-24T04:00:00.000Z’, ‘url’: ‘https://www.tenable.com/blog/contileaks-chats-reveal-over-30-vulnerabilities-used-by-conti-ransomware-affiliates’, ‘is_vendor_fix’: False}
exploits: {‘name’: ‘ms18_8120_win32k_privesc.rb’, ‘description’: ‘This exploit is a Metasploit module that can trigger the null pointer dereference issue on an affected server and yield an attacker elevated privileges on the affected system.’, ‘reliability’: ‘Untested’, ‘file_size’: 4498, ‘md5’: ‘5dd08479823a39d8d808ead98110a070’, ‘release_date’: ‘2018-10-20T06:00:00Z’, ‘exploit_url’: ‘https://www.exploit-db.com/exploits/45653/’, ‘replication_urls’: [], ‘grade’: ‘’, ‘hashes’: {}},
{‘name’: ‘CVE-2018-8120_exploit’, ‘description’: ‘This exploit will trigger this vulnerability to gain elevated privileges.’, ‘reliability’: ‘Untested’, ‘file_size’: 13367, ‘md5’: ‘1A0D48A31B50691F8613B31A53C4D16A’, ‘release_date’: ‘2018-05-14T06:00:00Z’, ‘exploit_url’: ‘https://github.com/leeqwind/HolicPOC/blob/master/windows/win32k/CVE-2018-8120/x86.cpp’, ‘replication_urls’: [], ‘grade’: ‘’, ‘hashes’: {}}
common_vulnerability_scores: {“v2.0”: {“access_complexity”: “MEDIUM”, “access_vector”: “LOCAL”, “authentication”: “NONE”, “availability_impact”: “COMPLETE”, “base_score”: 6.9, “confidentiality_impact”: “COMPLETE”, “exploitability”: “FUNCTIONAL”, “integrity_impact”: “COMPLETE”, “remediation_level”: “OFFICIAL_FIX”, “report_confidence”: “CONFIRMED”, “temporal_score”: 5.7, “vector_string”: “AV:L/AC:M/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C”}, “v3.0”: {“attack_complexity”: “HIGH”, “attack_vector”: “LOCAL”, “availability_impact”: “HIGH”, “base_score”: 7, “confidentiality_impact”: “HIGH”, “exploit_code_maturity”: “FUNCTIONAL”, “integrity_impact”: “HIGH”, “privileges_required”: “LOW”, “remediation_level”: “OFFICIAL_FIX”, “report_confidence”: “CONFIRMED”, “scope”: “UNCHANGED”, “temporal_score”: 6.5, “user_interaction”: “NONE”, “vector_string”: “CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H”}}
audience: intel_vuln
intel_free: false
affects_ot: false
aliases:
cisa_known_exploited: null
cpe_ranges:
cwe_details: null
days_to_patch: null
epss: null
version_history:
workarounds_list:0 CVE
mati-get-campaign
Retrieve information about a Campaign from Mandiant
Base Command
mati-get-campaign
Input
| Argument Name | Description | Required |
|---|---|---|
| campaign_id | ID of the campaign to lookup. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| MANDIANTTI.Campaign.value | String | The name of the Campaign |
| MANDIANTTI.Campaign.fields.actors | String | The Threat Actors associated with the Campaign |
| MANDIANTTI.Campaign.fields.description | String | The description of the Campaign |
| MANDIANTTI.Campaign.fields.tags | String | The industries associated with the Campaign |
| MANDIANTTI.Campaign.fields.publications.title | String | The title of a report associated with the Campaign |
| MANDIANTTI.Campaign.fields.publications.link | String | The link to the report in Mandiant Advantage |
Command example
!mati-get-campaign campaign_id=CAMP.21.014
Context Example
{
"MANDIANTTI": {
"Campaign": {
"fields": {
"DBot Score": {
"Indicator": null,
"Reliability": "A - Completely reliable",
"Score": 0,
"Type": "Campaign",
"Vendor": "Mandiant"
},
"actors": [
"APT41"
],
"description": "In mid-October 2021, Mandiant observed a wave of APT41 activity targeting multiple U.S. state governments. We believe the actors exploited a vulnerability in a public-facing web application, used by numerous state governments and U.S. educational research institutes, to gain initial access. The actors then conducted reconnaissance and credential harvesting activity, dropping multiple files including the publicly available BADPOTATO privilege escalation tool. Mandiant also identified the DEADEYE dropper, which executed a KEYPLUG backdoor. \n\nThis activity is likely a continuation of a previously observed APT41 campaign targeting multiple U.S. state government entities in May 2021. The specific motivation behind the targeting of U.S. state government entities remains unclear, though we infer, based on the targeting profile, that the purpose may include capturing political intelligence or data related to sensitive technologies with national or state-level applications. It is also possible that the capture of credentials can facilitate future targeting or pivoting to targets of interest.",
"publications": [],
"tags": [
"Governments"
]
},
"rawJSON": {
"actors": [
{
"attribution_scope": "confirmed",
"id": "threat-actor--9c88bd9c-f41b-59fa-bfb6-427b1755ea64",
"motivations": [
{
"attribution_scope": "confirmed",
"id": "motivation--fa4d4992-1762-50ac-b0b1-2c75210645d0",
"name": "Financial Gain",
"releasable": true,
"type": "motivation"
},
{
"attribution_scope": "confirmed",
"id": "motivation--1b8ca82a-7cff-5622-bedd-965c11d38a9e",
"name": "Espionage",
"releasable": true,
"type": "motivation"
}
],
"name": "APT41",
"releasable": true,
"source_locations": [
{
"country": {
"attribution_scope": "confirmed",
"id": "location--740e7e5f-f2a0-55e0-98a3-88872c55b581",
"iso2": "CN",
"name": "China",
"releasable": true,
"type": "location"
},
"region": {
"attribution_scope": "confirmed",
"id": "location--8fc231f3-4e62-57e7-b734-eaee0a734612",
"name": "Asia",
"releasable": true,
"type": "location"
},
"releasable": true,
"sub_region": {
"attribution_scope": "confirmed",
"id": "location--7b33370b-da4b-5c48-9741-b69f69febb77",
"name": "East Asia",
"releasable": true,
"type": "location"
}
}
],
"type": "threat-actor"
}
],
"aliases": {
"actor": [
{
"attribution_scope": "confirmed",
"id": "alias--c63f2b2b-3639-5bd0-be28-b1cb79b00b21",
"name": "Barium (Microsoft)",
"nucleus_name": "Barium",
"releasable": true,
"source": "Microsoft",
"type": "alias"
}
],
"campaign": [],
"malware": [],
"releasable": true
},
"audience": [
{
"license": "INTEL_RBI_OPS",
"name": "intel_oper"
},
{
"license": "INTEL_RBI_FUS",
"name": "intel_fusion"
},
{
"license": "amber",
"name": "tlp_marking"
}
],
"campaign_type": "Individual",
"counts": {
"actor_collaborations": 0,
"actors": 1,
"campaigns": 0,
"industries": 1,
"malware": 19,
"reports": 4,
"timeline": 104,
"tools": 9,
"vulnerabilities": 1
},
"description": "In mid-October 2021, Mandiant observed a wave of APT41 activity targeting multiple U.S. state governments. We believe the actors exploited a vulnerability in a public-facing web application, used by numerous state governments and U.S. educational research institutes, to gain initial access. The actors then conducted reconnaissance and credential harvesting activity, dropping multiple files including the publicly available BADPOTATO privilege escalation tool. Mandiant also identified the DEADEYE dropper, which executed a KEYPLUG backdoor. \n\nThis activity is likely a continuation of a previously observed APT41 campaign targeting multiple U.S. state government entities in May 2021. The specific motivation behind the targeting of U.S. state government entities remains unclear, though we infer, based on the targeting profile, that the purpose may include capturing political intelligence or data related to sensitive technologies with national or state-level applications. It is also possible that the capture of credentials can facilitate future targeting or pivoting to targets of interest.",
"id": "campaign--c344bb9b-cb50-58be-9c33-350b622c1fce",
"industries": [
{
"attribution_scope": "confirmed",
"id": "identity--8d0881d8-d199-5e5a-bef9-be3ca6bb8f0d",
"name": "Governments",
"releasable": true,
"type": "identity"
}
],
"is_publishable": true,
"last_activity_time": "2022-02-26T00:00:00.000Z",
"malware": [
{
"attribution_scope": "confirmed",
"id": "malware--448e822d-8496-5021-88cb-599062f74176",
"name": "BEACON",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--ad51977a-c6fc-5cd3-822e-4e2aa6c832a2",
"name": "FASTPACE",
"releasable": true,
"type": "malware"
}
],
"name": "APT41 Exploition of .NET Web Applications at U.S. State Governments",
"profile_updated": "2023-03-06T07:10:13.356Z",
"releasable": true,
"short_name": "CAMP.21.014",
"target_locations": {
"countries": [
{
"attribution_scope": "confirmed",
"count": 8,
"id": "location--5c5b39aa-9308-52a6-9daf-0547d5aaa160",
"iso2": "US",
"name": "United States of America",
"region": "location--6d65522f-0166-5e7e-973c-35cf7973e4e3",
"releasable": true,
"sub_region": "location--0daadcfb-ad23-5f16-b53b-6c5b09bf20de",
"type": "location"
}
],
"regions": [
{
"attribution_scope": "confirmed",
"count": 8,
"id": "location--6d65522f-0166-5e7e-973c-35cf7973e4e3",
"name": "Americas",
"releasable": true,
"type": "location"
}
],
"releasable": true,
"sub_regions": [
{
"attribution_scope": "confirmed",
"count": 8,
"id": "location--0daadcfb-ad23-5f16-b53b-6c5b09bf20de",
"name": "North America",
"region": "location--6d65522f-0166-5e7e-973c-35cf7973e4e3",
"releasable": true,
"type": "location"
}
]
},
"timeline": [
{
"description": "Mandiant Declared Campaign",
"event_type": "created",
"name": "Campaign Created",
"releasable": true,
"timestamp": "2021-10-18T00:00:00.000Z"
},
{
"description": "Mandiant Observed First Activity of Campaign",
"event_type": "first_observed",
"name": "First Observed",
"releasable": true,
"timestamp": "2020-06-15T00:00:00.000Z"
}
],
"tools": [
{
"attribution_scope": "confirmed",
"id": "malware--8130c516-308e-51e1-b16c-f398d80e67b0",
"name": "IMPACKET.PSEXEC",
"releasable": true,
"type": "malware"
},
{
"attribution_scope": "confirmed",
"id": "malware--bf2fc1e5-7850-5ecd-87a7-263e6da5708d",
"name": "MIMIKATZ",
"releasable": true,
"type": "malware"
}
],
"type": "campaign",
"vulnerabilities": [
{
"attribution_scope": "confirmed",
"cve_id": "CVE-2021-44207",
"id": "vulnerability--362764b4-aa15-55fd-a68b-caf84f25a6b0",
"releasable": true,
"type": "vulnerability"
}
]
},
"relationships": [
{
"entityA": "CAMP.21.014",
"entityAFamily": "Indicator",
"entityAType": "Campaign",
"entityB": "APT41",
"entityBFamily": "Indicator",
"entityBType": "Threat Actor",
"fields": {},
"name": "related-to",
"reverseName": "related-to",
"type": "IndicatorToIndicator"
},
{
"entityA": "CAMP.21.014",
"entityAFamily": "Indicator",
"entityAType": "Campaign",
"entityB": "BEACON",
"entityBFamily": "Indicator",
"entityBType": "Malware",
"fields": {},
"name": "related-to",
"reverseName": "related-to",
"type": "IndicatorToIndicator"
}
],
"type": "Campaign",
"value": "CAMP.21.014"
}
}
}
Human Readable Output
Results
fields rawJSON relationships type value actors: APT41
description: In mid-October 2021, Mandiant observed a wave of APT41 activity targeting multiple U.S. state governments. We believe the actors exploited a vulnerability in a public-facing web application, used by numerous state governments and U.S. educational research institutes, to gain initial access. The actors then conducted reconnaissance and credential harvesting activity, dropping multiple files including the publicly available BADPOTATO privilege escalation tool. Mandiant also identified the DEADEYE dropper, which executed a KEYPLUG backdoor.
This activity is likely a continuation of a previously observed APT41 campaign targeting multiple U.S. state government entities in May 2021. The specific motivation behind the targeting of U.S. state government entities remains unclear, though we infer, based on the targeting profile, that the purpose may include capturing political intelligence or data related to sensitive technologies with national or state-level applications. It is also possible that the capture of credentials can facilitate future targeting or pivoting to targets of interest.
tags: Governments
DBot Score: {“Indicator”: null, “Type”: “Campaign”, “Vendor”: “Mandiant”, “Score”: 0, “Reliability”: “A - Completely reliable”}
publications:type: campaign
id: campaign–c344bb9b-cb50-58be-9c33-350b622c1fce
name: APT41 Exploition of .NET Web Applications at U.S. State Governments
description: In mid-October 2021, Mandiant observed a wave of APT41 activity targeting multiple U.S. state governments. We believe the actors exploited a vulnerability in a public-facing web application, used by numerous state governments and U.S. educational research institutes, to gain initial access. The actors then conducted reconnaissance and credential harvesting activity, dropping multiple files including the publicly available BADPOTATO privilege escalation tool. Mandiant also identified the DEADEYE dropper, which executed a KEYPLUG backdoor.
This activity is likely a continuation of a previously observed APT41 campaign targeting multiple U.S. state government entities in May 2021. The specific motivation behind the targeting of U.S. state government entities remains unclear, though we infer, based on the targeting profile, that the purpose may include capturing political intelligence or data related to sensitive technologies with national or state-level applications. It is also possible that the capture of credentials can facilitate future targeting or pivoting to targets of interest.
releasable: true
counts: {“actors”: 1, “reports”: 4, “malware”: 19, “campaigns”: 0, “industries”: 1, “timeline”: 104, “vulnerabilities”: 1, “actor_collaborations”: 0, “tools”: 9}
audience: {‘name’: ‘intel_oper’, ‘license’: ‘INTEL_RBI_OPS’},
{‘name’: ‘intel_fusion’, ‘license’: ‘INTEL_RBI_FUS’},
{‘name’: ‘tlp_marking’, ‘license’: ‘amber’}
profile_updated: 2023-03-06T07:10:13.356Z
campaign_type: Individual
short_name: CAMP.21.014
last_activity_time: 2022-02-26T00:00:00.000Z
timeline: {‘name’: ‘Campaign Created’, ‘description’: ‘Mandiant Declared Campaign’, ‘releasable’: True, ‘event_type’: ‘created’, ‘timestamp’: ‘2021-10-18T00:00:00.000Z’},
{‘name’: ‘First Observed’, ‘description’: ‘Mandiant Observed First Activity of Campaign’, ‘releasable’: True, ‘event_type’: ‘first_observed’, ‘timestamp’: ‘2020-06-15T00:00:00.000Z’},
{‘name’: ‘Technique Observed’, ‘description’: ‘Mandiant Observed Use of The Technique’, ‘releasable’: True, ‘event_type’: ‘technique_observed’, ‘mandiant_technique’: {‘type’: ‘attack-pattern’, ‘id’: ‘attack-pattern–ae0d50d8-79de-5193-9223-178fde2c0756’, ‘name’: ‘Privilege escalation via access token impersonation’, ‘attribution_scope’: ‘confirmed’, ‘releasable’: True}, ‘mitre_techniques’: [{‘type’: ‘attack-pattern’, ‘id’: ‘attack-pattern–86850eff-2729-40c3-b85e-c4af26da4a2d’, ‘name’: ‘Token Impersonation/Theft’, ‘attribution_scope’: ‘confirmed’, ‘releasable’: True, ‘mitre_id’: ‘T1134.001’, ‘tactics’: [‘Privilege Escalation’, ‘Defense Evasion’]}, {‘type’: ‘attack-pattern’, ‘id’: ‘attack-pattern–dcaa092b-7de9-4a21-977f-7fcb77e89c48’, ‘name’: ‘Access Token Manipulation’, ‘attribution_scope’: ‘confirmed’, ‘releasable’: True, ‘mitre_id’: ‘T1134’, ‘tactics’: [‘Privilege Escalation’, ‘Defense Evasion’]}], ‘used_by’: [{‘releasable’: True, ‘actor’: {‘type’: ‘threat-actor’, ‘id’: ‘threat-actor–9c88bd9c-f41b-59fa-bfb6-427b1755ea64’, ‘name’: ‘APT41’, ‘attribution_scope’: ‘confirmed’, ‘releasable’: True}, ‘first_observed’: ‘2021-05-05T00:00:00.000Z’, ‘last_observed’: ‘2021-10-17T00:00:00.000Z’}]},
aliases: {“releasable”: true, “actor”: [{“type”: “alias”, “id”: “alias–c63f2b2b-3639-5bd0-be28-b1cb79b00b21”, “name”: “Barium (Microsoft)”, “attribution_scope”: “confirmed”, “releasable”: true, “source”: “Microsoft”, “nucleus_name”: “Barium”}], “malware”: [], “campaign”: []}
actors: {‘type’: ‘threat-actor’, ‘id’: ‘threat-actor–9c88bd9c-f41b-59fa-bfb6-427b1755ea64’, ‘name’: ‘APT41’, ‘attribution_scope’: ‘confirmed’, ‘releasable’: True, ‘motivations’: [{‘type’: ‘motivation’, ‘id’: ‘motivation–fa4d4992-1762-50ac-b0b1-2c75210645d0’, ‘name’: ‘Financial Gain’, ‘attribution_scope’: ‘confirmed’, ‘releasable’: True}, {‘type’: ‘motivation’, ‘id’: ‘motivation–1b8ca82a-7cff-5622-bedd-965c11d38a9e’, ‘name’: ‘Espionage’, ‘attribution_scope’: ‘confirmed’, ‘releasable’: True}], ‘source_locations’: [{‘releasable’: True, ‘country’: {‘type’: ‘location’, ‘id’: ‘location–740e7e5f-f2a0-55e0-98a3-88872c55b581’, ‘name’: ‘China’, ‘attribution_scope’: ‘confirmed’, ‘releasable’: True, ‘iso2’: ‘CN’}, ‘region’: {‘type’: ‘location’, ‘id’: ‘location–8fc231f3-4e62-57e7-b734-eaee0a734612’, ‘name’: ‘Asia’, ‘attribution_scope’: ‘confirmed’, ‘releasable’: True}, ‘sub_region’: {‘type’: ‘location’, ‘id’: ‘location–7b33370b-da4b-5c48-9741-b69f69febb77’, ‘name’: ‘East Asia’, ‘attribution_scope’: ‘confirmed’, ‘releasable’: True}}]}
malware: {‘type’: ‘malware’, ‘id’: ‘malware–448e822d-8496-5021-88cb-599062f74176’, ‘name’: ‘BEACON’, ‘attribution_scope’: ‘confirmed’, ‘releasable’: True},
{‘type’: ‘malware’, ‘id’: ‘malware–ad51977a-c6fc-5cd3-822e-4e2aa6c832a2’, ‘name’: ‘FASTPACE’, ‘attribution_scope’: ‘confirmed’, ‘releasable’: True}
vulnerabilities: {‘type’: ‘vulnerability’, ‘id’: ‘vulnerability–362764b4-aa15-55fd-a68b-caf84f25a6b0’, ‘attribution_scope’: ‘confirmed’, ‘releasable’: True, ‘cve_id’: ‘CVE-2021-44207’}
industries: {‘type’: ‘identity’, ‘id’: ‘identity–8d0881d8-d199-5e5a-bef9-be3ca6bb8f0d’, ‘name’: ‘Governments’, ‘attribution_scope’: ‘confirmed’, ‘releasable’: True}
target_locations: {“releasable”: true, “countries”: [{“type”: “location”, “id”: “location–5c5b39aa-9308-52a6-9daf-0547d5aaa160”, “name”: “United States of America”, “attribution_scope”: “confirmed”, “iso2”: “US”, “region”: “location–6d65522f-0166-5e7e-973c-35cf7973e4e3”, “sub_region”: “location–0daadcfb-ad23-5f16-b53b-6c5b09bf20de”, “releasable”: true, “count”: 8}], “regions”: [{“type”: “location”, “id”: “location–6d65522f-0166-5e7e-973c-35cf7973e4e3”, “name”: “Americas”, “attribution_scope”: “confirmed”, “releasable”: true, “count”: 8}], “sub_regions”: [{“type”: “location”, “id”: “location–0daadcfb-ad23-5f16-b53b-6c5b09bf20de”, “name”: “North America”, “attribution_scope”: “confirmed”, “region”: “location–6d65522f-0166-5e7e-973c-35cf7973e4e3”, “releasable”: true, “count”: 8}]}
is_publishable: true{‘name’: ‘related-to’, ‘reverseName’: ‘related-to’, ‘type’: ‘IndicatorToIndicator’, ‘entityA’: ‘CAMP.21.014’, ‘entityAFamily’: ‘Indicator’, ‘entityAType’: ‘Campaign’, ‘entityB’: ‘APT41’, ‘entityBFamily’: ‘Indicator’, ‘entityBType’: ‘Threat Actor’, ‘fields’: {}},
{‘name’: ‘related-to’, ‘reverseName’: ‘related-to’, ‘type’: ‘IndicatorToIndicator’, ‘entityA’: ‘CAMP.21.014’, ‘entityAFamily’: ‘Indicator’, ‘entityAType’: ‘Campaign’, ‘entityB’: ‘BEACON’, ‘entityBFamily’: ‘Indicator’, ‘entityBType’: ‘Malware’, ‘fields’: {}}Campaign CAMP.21.014
Configuration parameters
api_base_url— API Base URLapi_key— API Key (required)secret_key— Secret Key (required)feed— Fetch indicatorsfeedReputation— Indicator ReputationfeedReliability— Source Reliability (required)tlp_color— Traffic Light Protocol ColorfeedExpirationPolicy—feedExpirationInterval—feedFetchInterval— Feed Fetch IntervalfeedMinimumConfidence— Feed Minimum Confidence Score (required)feedExcludeOSIntel— Feed Exclude Open Source Intelligencetype— Mandiant indicator typefirst_fetch— First fetch timemax_fetch— Maximum number of indicators per fetchfeedTags— Tagstimeout— TimeoutfeedBypassExclusionList— Bypass exclusion listindicatorMetadata— Retrieve indicator metadataindicatorRelationships— Create relationshipsinsecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (10)
-
cveRetrieve information about a Vulnerability (by CVE) from Mandiant.
-
domainRetrieve information about an FQDN from Mandiant.
-
fileRetrieve information about a File Hash from Mandiant.
-
ipRetrieve information about an IP Address from Mandiant.
-
mati-feed-get-indicatorsGet Mandiant Indicators.
-
mati-get-actorGet information about a Threat Actor from Mandiant.
-
mati-get-campaignRetrieve information about a Campaign from Mandiant.
-
mati-get-indicatorGet information about a single Indicator of Compromise (IP Address, FQDN, URL, or File Hash) from Mandiant.
-
mati-get-malwareGet information about a Malware Family from Mandiant.
-
urlRetrieve information about a URL from Mandiant.
from collections.abc import Callable import dateutil.parser import pytz from CommonServerPython import * # noqa # pylint: disable=unused-wildcard-import from CommonServerUserPython import * # noqa # Disable insecure warnings requests.packages.urllib3.disable_warnings() # type:ignore """ CONSTANTS """ DATE_FORMAT = "%Y-%m-%dT%H:%M:%SZ" # ISO8601 format with UTC, default in XSOAR MAP_TYPE_TO_URL = { "Malware": "malware", "Actors": "actor", "Indicators": "indicator", "Vulnerability": "vulnerability", "Campaign": "campaign", } MAP_TYPE_TO_RESPONSE = { "Malware": "malware", "Actors": "threat-actors", "Indicators": "indicators", } MAP_INDICATORS = { "fqdn": {"name": FeedIndicatorType.Domain, "dbotscore": DBotScoreType.DOMAIN}, "ipv4": {"name": FeedIndicatorType.IP, "dbotscore": DBotScoreType.IP}, "md5": {"name": FeedIndicatorType.File, "dbotscore": DBotScoreType.FILE}, "sha1": {"name": FeedIndicatorType.File, "dbotscore": DBotScoreType.FILE}, "sha256": {"name": FeedIndicatorType.File, "dbotscore": DBotScoreType.FILE}, "url": {"name": FeedIndicatorType.URL, "dbotscore": DBotScoreType.URL}, "vulnerability": {"name": FeedIndicatorType.CVE, "dbotscore": DBotScoreType.CVE}, "Malware": { "name": ThreatIntel.ObjectsNames.MALWARE, "dbotscore": DBotScoreType.CUSTOM, }, "Actors": { "name": ThreatIntel.ObjectsNames.THREAT_ACTOR, "dbotscore": DBotScoreType.CUSTOM, }, "Campaign": {"name": ThreatIntel.ObjectsNames.CAMPAIGN}, } MAP_TYPE_TO_ATTACKPATTERN_KEY = {"Actors": "threat-actors", "Malware": "malware"} DEFAULT_TIMEOUT = 60 ENRICHMENT_TIMEOUT = 10 """ CLIENT CLASS """ class MandiantClient(BaseClient): """Client class to interact with the service API""" def __init__( self, base_url: str, api_key: str, secret_key: str, verify: bool, proxy: bool, timeout: int, first_fetch: str, limit: int, types: List, metadata: bool = False, enrichment: bool = False, tags: List = None, tlp_color: str = "RED", ): if not tags: tags = [] super().__init__(base_url=base_url, verify=verify, proxy=proxy, ok_codes=(200,)) self._api_credentials = (api_key, secret_key) self._headers = { "X-App-Name": "content.xsoar.cortex.mandiantadvantage.v1.0", "Accept": "application/json", "Authorization": f"Bearer {self._get_token()}", } self.timeout = timeout if is_time_sensitive(): # For reputation commands which run during an enrichment we limit the timeout self.timeout = ENRICHMENT_TIMEOUT self.first_fetch = first_fetch self.limit = limit self.types = types self.metadata = metadata self.tlp_color = tlp_color self.tags = tags self.enrichment = enrichment add_sensitive_log_strs(self._get_token()) def _get_token(self) -> str: """ Returns the token from the integration context if available and has not expired Otherwise, a new token is retrieved from the Mandiant API and stored in the integration context Returns: str: the bearer token that is currently in the integration context """ integration_context = get_integration_context() token = integration_context.get("token", "") valid_until = integration_context.get("valid_until") now_timestamp = arg_to_datetime("now").timestamp() # type:ignore # if there is a key and valid_until, and the current time is smaller than the valid until # return the current token if token and valid_until and now_timestamp < valid_until: return token # else generate a token and update the integration context accordingly token = self._retrieve_token() return token def _retrieve_token(self) -> str: """ Retrieve a new token from the Mandiant API """ headers = {"accept": "application/json"} data = {"grant_type": "client_credentials"} resp = self._http_request( method="POST", auth=self._api_credentials, headers=headers, url_suffix="token", resp_type="json", data=data, ) self._token = resp.get("access_token") integration_context = get_integration_context() integration_context.update({"token": self._token}) token_expiration = resp.get("expires_in", datetime.timestamp(datetime.now(timezone.utc))) # Subtract 10 minutes from the expiration time as a buffer integration_context.update({"valid_until": token_expiration - 600}) set_integration_context(integration_context) return self._token def get_indicator_info_endpoint(self, identifier: str, indicator_type: str, info_type: str) -> List: """ Retrieve detailed information for a given indicator. Args: identifier (Dict): Indicator's identifier. indicator_type (str): The indicator type. info_type (str): Type of additional info Returns: List: A list containing the response values """ url = f"v4/{MAP_TYPE_TO_URL[indicator_type]}" url = urljoin(url, identifier) url = urljoin(url, info_type) if url[-1] == "/": url = url[:-1] call_result = {} try: call_result = self._http_request(method="GET", url_suffix=url, timeout=self.timeout) except DemistoException as e: # If there is an internal issue inside the server, don't fail the entire fetch session if e.res.status_code != 500: raise e if info_type == "attack-pattern": res = call_result.get(MAP_TYPE_TO_ATTACKPATTERN_KEY[indicator_type], []) if len(res) >= 1: res = res[0].get("attack-patterns", []) else: return [] if isinstance(res, str) and res == "redacted": return [] elif res and isinstance(res, dict): return list(res.keys()) else: return [] else: return call_result.get(info_type, []) def get_indicator_info(self, identifier: str, indicator_type: str) -> dict: """ Retrieve detailed information for a given indicator. Args: identifier (Dict): Indicator's identifier. indicator_type (str): The indicator type Returns: Dict: Additional data of the indicator. """ url = f"v4/{MAP_TYPE_TO_URL[indicator_type]}" url = urljoin(url, identifier) if url[-1] == "/": url = url[:-1] call_result = {} try: call_result = self._http_request(method="GET", url_suffix=url, timeout=self.timeout) except DemistoException as e: # If there is an internal issue inside the server, don't fail the entire fetch session if e.res.status_code != 500: raise e return call_result def get_indicators(self, indicator_type: str = "Indicators", params: dict = None) -> List: """ Retrieve a list of indicators from Mandiant Threat Intelligence Args: indicator_type (str): The indicator type. Defaults to `indicators` (all indicators). params (Dict): HTTP call params Returns: List: A list of indicators """ params = params or {} try: url = f"/v4/{MAP_TYPE_TO_URL[indicator_type]}" response = self._http_request(method="GET", url_suffix=url, timeout=self.timeout, params=params) response = response.get(MAP_TYPE_TO_RESPONSE[indicator_type], []) except DemistoException as e: demisto.error(f"Error retrieving objects from Mandiant Threat Intel: {e}") response = [] return response def get_indicators_by_value(self, indicator_value: str, params: dict = None): params = params or {} request_body = { "requests": [{"values": [indicator_value]}], "include_campaigns": True, } try: url = "/v4/indicator" response = self._http_request( method="POST", url_suffix=url, timeout=self.timeout, params=params, json_data=request_body, ) response = response.get("indicators", []) if self.enrichment: for indicator in response: reports = self.get_indicator_info_endpoint( indicator_type="Indicators", identifier=indicator["id"], info_type="reports", ) indicator["publications"] = reports except DemistoException as e: demisto.error(f"Error retrieving objects from Mandiant Threat Intel: {e}") response = [] return response """ HELPER FUNCTIONS """ def get_last_updated(indicator: dict) -> datetime: last_updated = arg_to_datetime(indicator.get("last_updated")) if not last_updated: raise RuntimeError("Unable to retrieve `last_updated` date") else: return last_updated def filter_last_updated(indicator: dict, start_time: datetime) -> bool: indicator_last_updated = get_last_updated(indicator) return indicator_last_updated.timestamp() > start_time.timestamp() def last_updated_filter(start_time: datetime): return lambda indicator: get_last_updated(indicator).timestamp() > start_time.timestamp() def get_verdict(mscore: Optional[int]) -> int: """ Convert mscore to dbot score Args: mscore (str): mscore, value from 0 to 100 Returns: int: DBotScore """ if mscore is None: return Common.DBotScore.NONE mscore_int: int = int(mscore) if 0 <= mscore_int <= 20: return Common.DBotScore.GOOD elif 21 <= mscore_int <= 50: return Common.DBotScore.NONE elif 51 <= mscore_int <= 80: return Common.DBotScore.SUSPICIOUS elif 81 <= mscore_int <= 100: return Common.DBotScore.BAD else: return Common.DBotScore.NONE def get_dbot_score(indicator: dict, indicator_type: str = None) -> dict: if indicator_type is None: indicator_type = MAP_INDICATORS[indicator["type"]]["dbotscore"] return { "Indicator": indicator.get("value"), "Type": indicator_type, "Vendor": "Mandiant Advantage Threat Intelligence", "Score": get_verdict(indicator.get("mscore", 0)), "Reliability": demisto.params().get("feedReliability", DBotScoreReliability.A_PLUS), } def get_dbot_score_obj(dbot_score: dict) -> Common.DBotScore: return Common.DBotScore( indicator=dbot_score["Indicator"], indicator_type=dbot_score["Type"], score=dbot_score["Score"], reliability=dbot_score["Reliability"], ) def get_indicator_relationships( raw_indicator: dict, indicator_field: str, entity_a_field: str, entity_a_type: str, entity_b_field: str, entity_b_type: str, name: str, reverse_name: str, ) -> List[dict]: """ Creates relationships for the given indicator Args: raw_indicator (Dict): indicator indicator_field (str): indicator field that contains the entities list entity_a_field (str): indicator field that contains the entity name entity_a_type (str): indicator field that contains the entity type entity_b_field (str): entity field that contains the entity name entity_b_type (str): entity field that contains the entity type name (str): the relationship name reverse_name (str): the relationship reverse name Returns: """ entities_list = raw_indicator.get(indicator_field, []) relationships = [] if entities_list != "redacted": relationships = [ EntityRelationship( entity_a=raw_indicator.get(entity_a_field, ""), entity_a_type=entity_a_type, name=name, entity_b=entity.get(entity_b_field, ""), entity_b_type=entity_b_type, reverse_name=reverse_name, brand="Mandiant Advantage Threat Intelligence", source_reliability="A - Completely reliable", ).to_indicator() for entity in entities_list ] return relationships def create_malware_indicator(client: MandiantClient, raw_indicator: dict) -> tuple[None, dict]: """ Creates a malware indicator Args: client (MandiantClient): client raw_indicator (Dict): indicator Returns: Dict: malware indicator """ raw_indicator = {k: v for k, v in raw_indicator.items() if v and v != "redacted"} # filter none and redacted values fields = { "operatingsystemrefs": raw_indicator.get("operating_systems"), "aliases": [i["name"] for i in raw_indicator.get("aliases", [])], "capabilities": raw_indicator.get("capabilities"), "tags": [ i.get("name", "") for i in argToList( # type:ignore raw_indicator.get("industries") ) ] + client.tags, # type:ignore "mandiantdetections": raw_indicator.get("detections"), "yara": [ (yara.get("name"), yara.get("id")) for yara in raw_indicator.get("yara", []) # type: ignore ] if raw_indicator.get("yara", []) != "redacted" else [], "roles": raw_indicator.get("roles"), "stixid": raw_indicator.get("id"), "name": raw_indicator.get("name"), "description": raw_indicator.get("description"), "updateddate": raw_indicator.get("last_updated"), "lastseenbysource": raw_indicator.get("last_activity_time"), "trafficlightprotocol": client.tlp_color, "Is Malware Family": raw_indicator.get("inherently_malicious", 0) == 1, "DBot Score": get_dbot_score(raw_indicator, indicator_type="Malware"), } fields = {k: v for k, v in fields.items() if v and v != "redacted"} # filter none and redacted values relationships = get_indicator_relationships( raw_indicator, "actors", "name", ThreatIntel.ObjectsNames.MALWARE, "name", ThreatIntel.ObjectsNames.THREAT_ACTOR, EntityRelationship.Relationships.RELATED_TO, EntityRelationship.Relationships.RELATED_TO, ) relationships += get_indicator_relationships( raw_indicator, "cve", "name", ThreatIntel.ObjectsNames.MALWARE, "name", FeedIndicatorType.CVE, EntityRelationship.Relationships.RELATED_TO, EntityRelationship.Relationships.RELATED_TO, ) relationships += get_indicator_relationships( raw_indicator, "malware", "name", ThreatIntel.ObjectsNames.MALWARE, "name", ThreatIntel.ObjectsNames.MALWARE, EntityRelationship.Relationships.RELATED_TO, EntityRelationship.Relationships.RELATED_TO, ) indicator_obj = { "value": raw_indicator.get("name"), "type": ThreatIntel.ObjectsNames.MALWARE, "rawJSON": raw_indicator, "fields": fields, "relationships": relationships, "score": get_verdict(raw_indicator.get("mscore")), } return None, indicator_obj def create_campaign_indicator(client: MandiantClient, raw_indicator: dict) -> dict: """ Creates a campaign indicator Args: client (MandiantClient): client raw_indicator (Dict): indicator Returns: Dict: campaign indicator """ raw_indicator = {k: v for k, v in raw_indicator.items() if v and v != "redacted"} # filter none and redacted values fields = { "actors": [a["name"] for a in raw_indicator.get("actors", [])], "description": raw_indicator.get("description"), "tags": [i.get("name", "") for i in argToList(raw_indicator.get("industries", []))] + client.tags, "DBot Score": get_dbot_score(raw_indicator, indicator_type="Campaign"), "publications": generate_publications(raw_indicator.get("reports", [])), } relationships = get_indicator_relationships( raw_indicator, "actors", "short_name", ThreatIntel.ObjectsNames.CAMPAIGN, "name", ThreatIntel.ObjectsNames.THREAT_ACTOR, EntityRelationship.Relationships.RELATED_TO, EntityRelationship.Relationships.RELATED_TO, ) relationships += get_indicator_relationships( raw_indicator, "malware", "short_name", ThreatIntel.ObjectsNames.CAMPAIGN, "name", ThreatIntel.ObjectsNames.MALWARE, EntityRelationship.Relationships.RELATED_TO, EntityRelationship.Relationships.RELATED_TO, ) relationships += get_indicator_relationships( raw_indicator, "vulnerabilities", "short_name", ThreatIntel.ObjectsNames.CAMPAIGN, "name", FeedIndicatorType.CVE, EntityRelationship.Relationships.RELATED_TO, EntityRelationship.Relationships.RELATED_TO, ) indicator_obj = { "value": raw_indicator.get("short_name"), "type": ThreatIntel.ObjectsNames.CAMPAIGN, "rawJSON": raw_indicator, "fields": fields, "relationships": relationships, } return indicator_obj def create_actor_indicator(client: MandiantClient, raw_indicator: dict) -> tuple[None, dict]: """ Create indicator Args: client (MandiantClient): client raw_indicator (Dict): raw indicator Returns: Dict: Parsed indicator """ raw_indicator = {k: v for k, v in raw_indicator.items() if v and v != "redacted"} # filter none and redacted values primary_motivation = None if len(raw_indicator.get("motivations", [])) >= 1: primary_motivation = raw_indicator["motivations"][0].get("name") fields = { "primarymotivation": primary_motivation, "tags": [ industry.get("name") for industry in raw_indicator.get("industries", []) # type: ignore ] + client.tags, "aliases": [alias.get("name") for alias in raw_indicator.get("aliases", [])], # type:ignore "firstseenbysource": [item.get("earliest") for item in raw_indicator.get("observed", [])], # type:ignore "lastseenbysource": [item.get("recent") for item in raw_indicator.get("observed", [])], # type:ignore "targets": [ target.get("name") for target in raw_indicator.get( # type:ignore "locations", {} ).get("target", []) ], # type:ignore "stixid": raw_indicator.get("id"), "name": raw_indicator.get("name"), "description": raw_indicator.get("description"), "updateddate": raw_indicator.get("last_updated"), "trafficlightprotocol": client.tlp_color, "DBot Score": get_dbot_score(raw_indicator, indicator_type="Actor"), } fields = {k: v for k, v in fields.items() if v and v != "redacted"} # filter none and redacted values relationships = get_indicator_relationships( raw_indicator, "malware", "name", ThreatIntel.ObjectsNames.THREAT_ACTOR, "name", ThreatIntel.ObjectsNames.MALWARE, EntityRelationship.Relationships.RELATED_TO, EntityRelationship.Relationships.RELATED_TO, ) relationships += get_indicator_relationships( raw_indicator, "cve", "name", ThreatIntel.ObjectsNames.THREAT_ACTOR, "cve_id", FeedIndicatorType.CVE, EntityRelationship.Relationships.TARGETS, EntityRelationship.Relationships.TARGETED_BY, ) relationships += get_indicator_relationships( raw_indicator, "tools", "name", ThreatIntel.ObjectsNames.THREAT_ACTOR, "name", ThreatIntel.ObjectsNames.TOOL, EntityRelationship.Relationships.USES, EntityRelationship.Relationships.USED_BY, ) relationships += get_indicator_relationships( raw_indicator, "associated_uncs", "name", ThreatIntel.ObjectsNames.THREAT_ACTOR, "name", ThreatIntel.ObjectsNames.THREAT_ACTOR, EntityRelationship.Relationships.RELATED_TO, EntityRelationship.Relationships.RELATED_TO, ) indicator_obj = { "value": raw_indicator.get("name"), "type": ThreatIntel.ObjectsNames.THREAT_ACTOR, "rawJSON": raw_indicator, "score": get_verdict(raw_indicator.get("mscore")), "fields": fields, "relationships": relationships, } return None, indicator_obj def parse_cvss(cve: dict) -> dict: """ Parse CVSS information into XSOAR format Args: cve: A raw CVE indicator dict Returns: dict: The parsed CVE fields for use in a CVE indicator """ cvss = {} if "v3.1" in cve.get("common_vulnerability_scores", {}): cve_details = cve["common_vulnerability_scores"]["v3.1"] cvss = { "cvss": "v3.1", "cvssvector": cve_details.get("vector_string"), "cvssscore": cve_details.get("base_score", 0), "cvss3": [ { "metric": camel_case_to_underscore(k).replace("_", " ").title(), "values": v, } for k, v in cve_details.items() ], } elif "v2.0" in cve.get("common_vulnerability_scores", {}): cve_details = cve["common_vulnerability_scores"]["v2.0"] cvss = { "cvss": "v2.0", "cvssvector": cve_details.get("vector_string"), "cvssscore": cve_details.get("base_score", 0), "cvss2": [ { "metric": camel_case_to_underscore(k).replace("_", " ").title(), "values": v, } for k, v in cve_details.items() ], } return cvss def create_cve_indicator(client: MandiantClient, raw_indicator: dict) -> tuple[Common.CVE, dict]: """ Create CVE indicator Args: client: MandiantClient raw_indicator (Dict): raw indicator Returns: Dict: Parsed indicator """ cvss_data = parse_cvss(raw_indicator) indicator_obj = create_base_indicator(client, raw_indicator, FeedIndicatorType.CVE) additional_fields = {"id": raw_indicator.get("value")} additional_fields = additional_fields | cvss_data indicator_obj["fields"] = indicator_obj["fields"] | additional_fields indicator = Common.CVE( id=additional_fields["id"], cvss=str(cvss_data["cvssscore"]), published=indicator_obj["rawJSON"]["publish_date"], modified=indicator_obj["rawJSON"]["last_modified_date"], description=indicator_obj["rawJSON"]["title"], ) return indicator, indicator_obj def create_file_indicator(client: MandiantClient, raw_indicator: dict) -> tuple[Common.File, dict]: """ Args: client: MandiantClient raw_indicator (Dict): raw indicator Returns: Dict: Parsed indicator """ indicator_obj = create_base_indicator(client, raw_indicator, FeedIndicatorType.File) sha1_hashes = [ associated_hash["value"] for associated_hash in raw_indicator.get("associated_hashes", []) if associated_hash["type"] == "sha1" ] sha256_hashes = [ associated_hash["value"] for associated_hash in raw_indicator.get("associated_hashes", []) if associated_hash["type"] == "sha256" ] if len(sha1_hashes) != 1: sha1_hashes = [None] if len(sha256_hashes) != 1: sha256_hashes = [None] additional_fields = { "md5": raw_indicator.get("value"), "sha256": sha256_hashes[0] or None, "sha1": sha1_hashes[0] or None, } additional_fields = {k: v for k, v in additional_fields.items() if v and v != "redacted"} # filter none and redacted values indicator_obj["fields"] = indicator_obj["fields"] | additional_fields indicator = Common.File( dbot_score=get_dbot_score_obj(indicator_obj["fields"]["dbotscore"]), md5=additional_fields.get("md5"), sha1=additional_fields.get("sha1"), sha256=additional_fields.get("sha256"), ) return indicator, indicator_obj def create_ip_indicator(client: MandiantClient, raw_indicator: dict) -> tuple[Common.IP, dict]: """ Args: client: MandiantClient raw_indicator (Dict): raw indicator Returns: Parsed indicator """ indicator_obj = create_base_indicator(client, raw_indicator, FeedIndicatorType.IP) additional_fields = { "ip": raw_indicator.get("value"), } indicator_obj["fields"] = indicator_obj["fields"] | additional_fields indicator = Common.IP(dbot_score=get_dbot_score_obj(indicator_obj["fields"]["dbotscore"]), ip=additional_fields["ip"]) return indicator, indicator_obj def create_fqdn_indicator(client: MandiantClient, raw_indicator: dict) -> tuple[Common.Domain, dict]: """ Args: client: MandiantClient raw_indicator (Dict): raw indicator Returns: Parsed indicator """ indicator_obj = create_base_indicator(client, raw_indicator, FeedIndicatorType.FQDN) additional_fields = { "dns": raw_indicator.get("value"), "domain": raw_indicator.get("value"), } indicator_obj["fields"] = indicator_obj["fields"] | additional_fields indicator = Common.Domain( domain=raw_indicator.get("value"), dns=raw_indicator.get("value"), dbot_score=get_dbot_score_obj(indicator_obj["fields"]["dbotscore"]), ) return indicator, indicator_obj def create_url_indicator(client: MandiantClient, raw_indicator: dict) -> tuple[Common.URL, dict]: """ Args: client: MandiantClient raw_indicator (Dict): raw indicator Returns: Parsed indicator """ indicator_obj = create_base_indicator(client, raw_indicator, FeedIndicatorType.URL) additional_fields = { "url": raw_indicator.get("value"), } indicator_obj["fields"] = indicator_obj["fields"] | additional_fields indicator = Common.URL(url=additional_fields["url"], dbot_score=get_dbot_score_obj(indicator_obj["fields"]["dbotscore"])) return indicator, indicator_obj def create_indicator(client: MandiantClient, raw_indicator: dict) -> tuple[Common.Indicator, dict]: """ Create indicator Args: client (MandiantClient): client raw_indicator (Dict): raw indicator Returns: Parsed indicator """ return MAP_INDICATORS_FUNCTIONS[raw_indicator.get("type", "")](client, raw_indicator) # return create_base_indicator(client, raw_indicator, indicator_type) def create_base_indicator(client: MandiantClient, raw_indicator: dict, indicator_type: str) -> dict: """ Create indicator Args: client (MandiantClient): client raw_indicator (Dict): raw indicator indicator_type (str): Type of indicator Returns: Parsed indicator Additional keys under "fields" must be added after creation """ # If the indicator is only Open-Source intelligence, mark the TLP Color as # GREEN. Otherwise, use the configured value information_is_osint = True for source in raw_indicator.get("sources", []): if not source.get("osint", False): information_is_osint = False tlp_color = "GREEN" if information_is_osint else client.tlp_color campaign_relationships = [ EntityRelationship( entity_a=raw_indicator["value"], entity_a_type=indicator_type, name=EntityRelationship.Relationships.RELATED_TO, entity_b=campaign.get("name"), entity_b_type=ThreatIntel.ObjectsNames.CAMPAIGN, reverse_name=EntityRelationship.Relationships.RELATED_TO, ).to_indicator() for campaign in raw_indicator.get("campaigns", []) if campaign ] fields = { "primarymotivation": raw_indicator.get("motivations"), "firstseenbysource": raw_indicator.get("first_seen"), "lastseenbysource": raw_indicator.get("last_seen"), "stixid": raw_indicator.get("id"), "trafficlightprotocol": tlp_color, "publications": generate_publications(raw_indicator.get("publications", [])), "dbotscore": get_dbot_score(raw_indicator), "tags": client.tags, } fields = {k: v for k, v in fields.items() if v and v != "redacted"} # filter none and redacted values indicator_obj = { "value": raw_indicator.get("value"), "score": get_verdict(raw_indicator.get("mscore")), # "DBotScore": get_dbot_score(raw_indicator), "rawJSON": raw_indicator, "type": indicator_type, "fields": fields, "relationships": campaign_relationships, } return indicator_obj MAP_INDICATORS_FUNCTIONS: dict[str, Callable] = { "Malware": create_malware_indicator, "Actors": create_actor_indicator, "Indicators": create_indicator, "file": create_file_indicator, "md5": create_file_indicator, "ip": create_ip_indicator, "ipv4": create_ip_indicator, "domain": create_fqdn_indicator, "url": create_url_indicator, "fqdn": create_fqdn_indicator, "cve": create_cve_indicator, } def generate_publications(reports_list: list[dict]): if not reports_list: return [] return [ { "source": "Mandiant", "title": report.get("title", ""), "link": f"https://advantage.mandiant.com/reports/{report.get('report_id')}", "timestamp": dateutil.parser.parse(report.get("published_date", str(datetime.utcnow()))).timestamp(), } for report in reports_list ] def enrich_indicators(client: MandiantClient, indicators_list: List, indicator_type: str) -> None: """ For each indicator in indicators_list create relationships and adding the relevant indicators Args: client (MandiantClient): client indicators_list (List): list of raw indicators indicator_type (str): the current indicator type Returns: List of relevant indicators """ for indicator in indicators_list: indicator_id = indicator.get("fields", {}).get("stixid", "") indicator_name = indicator.get("fields", {}).get("name", "") reports_list = client.get_indicator_info_endpoint( indicator_type=indicator_type, identifier=indicator_id, info_type="reports" ) reports_relationships = [ EntityRelationship( entity_a=indicator_name, entity_a_type=MAP_INDICATORS[indicator_type]["name"], name=EntityRelationship.Relationships.RELATED_TO, entity_b=report.get("title"), entity_b_type=ThreatIntel.ObjectsNames.REPORT, reverse_name=EntityRelationship.Relationships.RELATED_TO, fields=report, ).to_indicator() for report in reports_list if report ] general_list = client.get_indicator_info_endpoint( indicator_type=indicator_type, identifier=indicator_id, info_type="indicators", ) general_relationships = [ EntityRelationship( entity_a=indicator_name, entity_a_type=MAP_INDICATORS[indicator_type]["name"], name=EntityRelationship.Relationships.INDICATED_BY, entity_b=general_indicator.get("value"), entity_b_type=MAP_INDICATORS[general_indicator.get("type", "")]["name"], reverse_name=EntityRelationship.Relationships.INDICATOR_OF, ).to_indicator() for general_indicator in general_list if general_indicator ] attack_pattern_list = client.get_indicator_info_endpoint( indicator_type=indicator_type, identifier=indicator_id, info_type="attack-pattern", ) attack_pattern_relationships = [ EntityRelationship( entity_a=indicator_name, entity_a_type=MAP_INDICATORS[indicator_type]["name"], name=EntityRelationship.Relationships.USES, entity_b=attack_pattern, entity_b_type=ThreatIntel.ObjectsNames.ATTACK_PATTERN, reverse_name=EntityRelationship.Relationships.USED_BY, ).to_indicator() for attack_pattern in attack_pattern_list if attack_pattern ] campaigns_list = client.get_indicator_info_endpoint( indicator_type=indicator_type, identifier=indicator_id, info_type="campaigns", ) campaign_relationships = [ EntityRelationship( entity_a=indicator_name, entity_a_type=MAP_INDICATORS[indicator_type]["name"], name=EntityRelationship.Relationships.RELATED_TO, entity_b=campaign.get("short_name"), entity_b_type=ThreatIntel.ObjectsNames.CAMPAIGN, reverse_name=EntityRelationship.Relationships.RELATED_TO, ).to_indicator() for campaign in campaigns_list if campaign ] relationships = reports_relationships + general_relationships + attack_pattern_relationships + campaign_relationships indicator["relationships"] = indicator.get("relationships", []) + relationships indicator["fields"]["publications"] = indicator["fields"].get("publications", []) + generate_publications( reports_list=reports_list ) def get_new_indicators(client: MandiantClient, last_run: str, indicator_type: str, limit: int) -> tuple[List, str]: """ Get a list of new indicators Args: client (MandiantClient): client last_run (str): last run as free text or date format indicator_type (str): the desired type to fetch limit (int): number of indicator to fetch Returns: tuple[List, str]: A list of new indicators, and the new "last updated" checkpoint """ start_date = arg_to_datetime(last_run) minimum_mscore = int(demisto.params().get("feedMinimumConfidence", 80)) exclude_osint = demisto.params().get("feedExcludeOSIntel", True) params = {} if indicator_type == "Indicators": # for indicator type the earliest time to fetch is 90 days ago earliest_fetch = arg_to_datetime("89 days ago") assert earliest_fetch is not None param_start_date: datetime = datetime.fromtimestamp(0) if start_date is not None: param_start_date = max(earliest_fetch.replace(tzinfo=pytz.UTC), start_date.replace(tzinfo=pytz.UTC)) # type:ignore else: param_start_date = earliest_fetch params = { "start_epoch": int(param_start_date.timestamp()), "limit": limit, "exclude_osint": exclude_osint, "sort_by": "last_updated:asc", } # type:ignore new_indicators_list = client.get_indicators(indicator_type, params=params) if indicator_type != "Indicators": # new to old new_indicators_list.sort(key=get_last_updated, reverse=True) # type:ignore new_indicators_list = list( filter(last_updated_filter(start_date), new_indicators_list) # type: ignore ) if new_indicators_list: return new_indicators_list, new_indicators_list[-1]["last_updated"] else: return [], last_run else: updated_indicators = [] # For Indicators of Compromise only for indicator in new_indicators_list: # Check if indicator should be added no matter what # E.g. it meets the `param` requirements if indicator["mscore"] >= minimum_mscore: updated_indicators.append(indicator) else: existing_indicators = list(IndicatorsSearcher(value=indicator["value"])) if len(existing_indicators) > 0 and int(existing_indicators[0].get("total", 0)) > 0: updated_indicators.append(indicator) return updated_indicators, new_indicators_list[-1]["last_updated"] def get_indicator_list(client: MandiantClient, limit: int, first_fetch: str, indicator_type: str) -> tuple[List[dict], str]: """ Get a list of indicators of the given type Args: client (MandiantClient): client limit (int): number of indicators to return. first_fetch (str): Get indicators newer than first_fetch. indicator_type (str): indicator type Returns: tuple[List[dict], str]: A list of indicators, and the new "last updated" checkpoint """ last_run_dict = demisto.getLastRun() indicators_list = last_run_dict.get(f"{indicator_type}List", []) new_last_updated = last_run = last_run_dict.get(f"{indicator_type}LastFetch", first_fetch) if len(indicators_list) < limit: new_indicators_list, new_last_updated = get_new_indicators(client, last_run, indicator_type, limit) indicators_list += new_indicators_list if indicators_list: new_indicators_list = indicators_list[:limit] indicators_list = new_indicators_list return indicators_list, new_last_updated def fetch_indicators(client: MandiantClient, args: dict = None) -> tuple[List, dict]: """ For each type the fetch indicator command will: 1. Fetch a list of indicators from the Mandiant Threat Intelligence API 2. Fetch additional information about each indicator from the Mandiant Threat Intelligence API and add it to the original indicator 3. Enrich indicators by retrieving relationship information from the Mandiant Threat Intelligence API and adding it to the original indicator NOTE: This requires an additional 3 API calls per indicator Args: client (MandiantClient): client args (Dict): If provided, these arguments override those in the `client` Returns: List of all indicators """ if not args: args = {} limit = int(args.get("limit", client.limit)) # Cap maximum number of indicators to 1000 if limit > 1000: limit = 1000 metadata = argToBoolean(args.get("indicatorMetadata", client.metadata)) enrichment = argToBoolean(args.get("indicatorRelationships", client.enrichment)) types = argToList(args.get("type", client.types)) first_fetch = client.first_fetch result = [] last_run_dict = demisto.getLastRun() demisto.debug("fetching indicators") for indicator_type in types: indicators_list, new_last_updated = get_indicator_list(client, limit, first_fetch, indicator_type) if metadata: indicators_list = [ client.get_indicator_info( identifier=indicator.get("id"), # type:ignore indicator_type=indicator_type, ) for indicator in indicators_list ] demisto.debug("getting indicators") indicators = [MAP_INDICATORS_FUNCTIONS[indicator_type](client, indicator)[1] for indicator in indicators_list] if enrichment and indicator_type != "Indicators": enrich_indicators(client, indicators, indicator_type) result += indicators last_run_dict[f"{indicator_type}List"] = indicators[limit:] if indicators_list: last_run_dict[f"{indicator_type}LastFetch"] = new_last_updated return (result, last_run_dict) def debug_fetch_indicators(client: MandiantClient, args: dict = None): indicators, _ = fetch_indicators(client, args) return [ CommandResults(outputs=indicator, outputs_prefix="MANDIANTTI.Feed", ignore_auto_extract=True) for indicator in indicators ] def batch_fetch_indicators(client: MandiantClient): """ For each type the fetch indicator command will: 1. Fetch a list of indicators from the Mandiant Threat Intelligence API 2. Fetch additional information about each indicator from the Mandiant Threat Intelligence API and add it to the original indicator 3. Enrich indicators by retrieving relationship information from the Mandiant Threat Intelligence API and adding it to the original indicator NOTE: This requires an additional 3 API calls per indicator Args: client (MandiantClient): client Returns: List of all indicators """ result, last_run_dict = fetch_indicators(client=client) for b in batch(result, batch_size=2000): demisto.createIndicators(b) demisto.setLastRun(last_run_dict) def fetch_indicator_by_value(client: MandiantClient, args: dict = None): args = args if args else {} indicator_value: str = args["indicator_value"] INDICATOR_TYPE_MAP: dict[str, str] = {"ipv4": "ip", "fqdn": "domain", "url": "url", "md5": "file"} indicators_list = client.get_indicators_by_value(indicator_value=indicator_value) indicators = [ MAP_INDICATORS_FUNCTIONS[INDICATOR_TYPE_MAP[indicator["type"]]](client, indicator) for indicator in indicators_list ] for indicator in indicators: indicator[1]["value"] = indicators_value_to_clickable([indicator[1]["value"]]) if indicators: table = { "Value": indicators[0][1]["rawJSON"]["value"], "MScore": indicators[0][1]["rawJSON"]["mscore"], "Last Seen": indicators[0][1]["rawJSON"]["last_seen"], } indicator_type = indicators[0][1]["rawJSON"]["type"].lower() markdown = tableToMarkdown( f'Mandiant Advantage Threat Intelligence information for {table["Value"]}\n' f'[View on Mandiant Advantage](https://advantage.mandiant.com/indicator/' f'{indicator_type}/{table["Value"]})', table, ) return CommandResults( readable_output=markdown, content_format=formats["json"], outputs_prefix=f"MANDIANTTI.{INDICATOR_TYPE_MAP[indicators_list[0]['type']].upper()}", outputs=[i[1] for i in indicators], outputs_key_field="name", ignore_auto_extract=True, ) else: return f"No indicators found matching value {indicator_value}" def fetch_threat_actor(client: MandiantClient, args: dict = None): args = args if args else {} actor_name: str = args["actor_name"] indicator_obj: dict = client.get_indicator_info(identifier=actor_name, indicator_type="Actors") indicator = [create_actor_indicator(client, indicator_obj)[1]] if client.enrichment: enrich_indicators(client, indicator, "Actors") demisto.createIndicators(indicator) # indicator[0]['fields']['name'] = indicators_value_to_clickable([indicator[0]['fields']['name']]) return CommandResults( content_format=formats["json"], outputs=indicator, outputs_prefix="MANDIANTTI.ThreatActor", outputs_key_field="name", ignore_auto_extract=True, ) def fetch_malware_family(client: MandiantClient, args: dict = None): args = args if args else {} malware_name: str = str(args.get("malware_name")) indicator = client.get_indicator_info(identifier=malware_name, indicator_type="Malware") indicator_list = [create_malware_indicator(client, indicator)[1]] if client.enrichment: enrich_indicators(client, indicator_list, "Malware") demisto.createIndicators(indicator_list) indicator_list[0]["fields"]["name"] = indicators_value_to_clickable([indicator_list[0]["fields"]["name"]]) return CommandResults( content_format=formats["json"], outputs=indicator_list, outputs_prefix="MANDIANTTI.Malware", outputs_key_field="name", ignore_auto_extract=True, ) def fetch_campaign(client: MandiantClient, args: dict = None): args = args if args else {} campaign: str = str(args.get("campaign_id")) indicator = client.get_indicator_info(identifier=campaign, indicator_type="Campaign") indicator_list = [create_campaign_indicator(client, indicator)] demisto.createIndicators(indicator_list) return CommandResults( content_format=formats["json"], outputs=indicator_list, outputs_prefix="MANDIANTTI.Campaign", outputs_key_field="name", ignore_auto_extract=True, ) def fetch_reputation(client: MandiantClient, args: dict = None): args = args if args else {} input_type: str = demisto.command() indicator_values: list[str] = argToList(str(args.get(input_type))) if input_type == "cve": indicators_list = [client.get_indicator_info(i, "Vulnerability") for i in indicator_values] else: indicators_list = [] for i in indicator_values: indicators_list.extend(client.get_indicators_by_value(i)) indicators = [MAP_INDICATORS_FUNCTIONS[input_type](client, indicator) for indicator in indicators_list] demisto.createIndicators([i[1] for i in indicators]) if indicators: output = [] for indicator_obj, indicator in indicators: demisto.debug(json.dumps(indicator)) table = { "Value": indicator["value"], "MScore": indicator["rawJSON"].get("mscore", ""), "Last Seen": indicator["rawJSON"].get("last_seen", ""), } indicator_type = indicator["rawJSON"]["type"].lower() markdown = tableToMarkdown( f'Mandiant Advantage Threat Intelligence information for {indicator["value"]}\n' f'[View on Mandiant Advantage](https://advantage.mandiant.com/indicator/' f'{indicator_type}/{indicator["value"]})', table, ) output.append( CommandResults( readable_output=markdown, outputs_prefix=f"MANDIANTTI.{input_type.upper()}", outputs=indicator, indicator=indicator_obj, ignore_auto_extract=True, ) ) return output else: return f"No indicators found matching value {indicator_values}" """ COMMAND FUNCTIONS """ def test_module(client: MandiantClient) -> str: """Tests API connectivity and authentication Returning 'ok' indicates that the integration works like it is supposed to. Connection to the service is successful. Raises exceptions if something goes wrong. :type client: ``MandiantClient`` :param client: client to use :return: 'ok' if test passed, anything else will fail the test. :rtype: ``str`` """ # Note: As part of client initialization, a token is retrieved, which requires successful authentication # Therefor, if a user has reached this point with a valid MandiantClient, everything is working indicators = client.get_indicators(params={"limit": 1}) if indicators is not None: return "ok" else: return "failed to retrieve indicator" """ MAIN FUNCTION """ def main() -> None: """main function, parses params and runs command functions :return: :rtype: """ params = demisto.params() command = demisto.command() args = demisto.args() verify_certificate = not params.get("insecure", False) proxy = params.get("proxy", False) api_key = params.get("api_key", "") secret_key = params.get("secret_key", "") base_url = params.get("api_base_url", "") timeout = int(params.get("timeout", DEFAULT_TIMEOUT)) tlp_color = params.get("tlp_color") feedTags = argToList(params.get("feedTags")) first_fetch = params.get("first_fetch", "3 days ago") limit = int(params.get("max_fetch", 50)) metadata = argToBoolean(params.get("indicatorMetadata", False)) enrichment = argToBoolean(params.get("indicatorRelationships", False)) types = argToList(params.get("type")) demisto.debug(f"Command being called is {command}") try: client = MandiantClient( base_url=base_url, verify=verify_certificate, proxy=proxy, api_key=api_key, secret_key=secret_key, timeout=timeout, tags=feedTags, tlp_color=tlp_color, first_fetch=first_fetch, limit=limit, metadata=metadata, enrichment=enrichment, types=types, ) command_map: dict[str, Callable] = { "mati-get-indicator": fetch_indicator_by_value, "mati-get-actor": fetch_threat_actor, "mati-get-malware": fetch_malware_family, "mati-get-campaign": fetch_campaign, "file": fetch_reputation, "ip": fetch_reputation, "url": fetch_reputation, "domain": fetch_reputation, "cve": fetch_reputation, "mati-feed-get-indicators": debug_fetch_indicators, } params_only_cmds: dict[str, Callable] = { "test-module": test_module, "fetch-indicators": batch_fetch_indicators, } if command in command_map: return_results(command_map[command](client, args)) elif command in params_only_cmds: return_results(params_only_cmds[command](client)) # Log exceptions and return errors except Exception as e: return_error(f"Failed to execute {command} command.\nError:\n{str(e)}") """ ENTRY POINT """ if __name__ in ("__main__", "__builtin__", "builtins"): main()