STIX

Exemple :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
{
  "type": "bundle",
  "id": "bundle--3c4f8b42-47f2-4976-bf3a-2bd57e67b63c",
  "spec_version": "2.1",
  "objects": [
    {
      "type": "threat-actor",
      "id": "threat-actor--8e6a4f12-132b-4c6f-b3a3-621bdc7f94b5",
      "created": "2025-03-10T10:00:00.000Z",
      "modified": "2025-03-10T10:00:00.000Z",
      "name": "APT-42",
      "description": "Un groupe APT connu pour des attaques ciblées sur des infrastructures critiques.",
      "threat_actor_types": ["nation-state"],
      "aliases": ["Groupe Fantôme"],
      "roles": ["sponsor"],
      "primary_motivation": "espionage"
    },
    {
      "type": "malware",
      "id": "malware--3d3b4a44-d8f3-4c67-8051-9b1f3235f46a",
      "created": "2025-03-10T10:00:00.000Z",
      "modified": "2025-03-10T10:00:00.000Z",
      "name": "ShadowSpy",
      "description": "Un malware utilisé par APT-42 pour la collecte de données.",
      "malware_types": ["remote-access-trojan"],
      "is_family": false
    },
    {
      "type": "indicator",
      "id": "indicator--d7e4d6f7-52df-4b89-9b71-d54352f42d56",
      "created": "2025-03-10T10:00:00.000Z",
      "modified": "2025-03-10T10:00:00.000Z",
      "name": "IP suspecte de ShadowSpy",
      "description": "Cette adresse IP est associée aux activités du malware ShadowSpy.",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '203.0.113.45']",
      "pattern_type": "stix",
      "valid_from": "2025-03-10T10:00:00.000Z"
    },
    {
      "type": "attack-pattern",
      "id": "attack-pattern--6f2d63ab-60cd-4984-8c3c-e40f7df60e2f",
      "created": "2025-03-10T10:00:00.000Z",
      "modified": "2025-03-10T10:00:00.000Z",
      "name": "Phishing via pièce jointe malveillante",
      "description": "Utilisation d'un document Word piégé pour exécuter un malware.",
      "external_references": [
        {
          "source_name": "MITRE ATT&CK",
          "url": "https://attack.mitre.org/techniques/T1566/001/",
          "external_id": "T1566.001"
        }
      ]
    },
    {
      "type": "observed-data",
      "id": "observed-data--c9b9c9d4-b792-4d1c-bf7a-3e5ff2b172e8",
      "created": "2025-03-10T10:00:00.000Z",
      "modified": "2025-03-10T10:00:00.000Z",
      "first_observed": "2025-03-09T22:15:00.000Z",
      "last_observed": "2025-03-09T22:30:00.000Z",
      "number_observed": 3,
      "object_refs": ["ipv4-addr--a67dbd13-9c6e-4f76-91f8-3cfb67a7b0b7"]
    },
    {
      "type": "ipv4-addr",
      "id": "ipv4-addr--a67dbd13-9c6e-4f76-91f8-3cfb67a7b0b7",
      "value": "203.0.113.45"
    },
    {
      "type": "relationship",
      "id": "relationship--e6b3498c-7c2c-4a8f-b02b-1e0b5f1d5c44",
      "relationship_type": "uses",
      "source_ref": "threat-actor--8e6a4f12-132b-4c6f-b3a3-621bdc7f94b5",
      "target_ref": "malware--3d3b4a44-d8f3-4c67-8051-9b1f3235f46a",
      "description": "APT-42 utilise ShadowSpy pour espionner ses cibles."
    },
    {
      "type": "relationship",
      "id": "relationship--f3a9c1d6-2d4e-48ad-9a5b-3f23f76e2a16",
      "relationship_type": "indicates",
      "source_ref": "indicator--d7e4d6f7-52df-4b89-9b71-d54352f42d56",
      "target_ref": "malware--3d3b4a44-d8f3-4c67-8051-9b1f3235f46a",
      "description": "L'indicateur IP est lié au malware ShadowSpy."
    },
    {
      "type": "relationship",
      "id": "relationship--d2e16b59-f798-4c43-9a5d-4b8c516b63ab",
      "relationship_type": "uses",
      "source_ref": "malware--3d3b4a44-d8f3-4c67-8051-9b1f3235f46a",
      "target_ref": "attack-pattern--6f2d63ab-60cd-4984-8c3c-e40f7df60e2f",
      "description": "Le malware ShadowSpy est propagé via un phishing avec document piégé."
    }
  ]
}