From 9:30 to 12:00 CET (a small break is foreseen)
Short url: https://tinyurl.com/BTS-MISP2
- MISP Introduction and history
- MISP data model
- Best practices - from evidences to actionable evidences
- Practical excercises GRU
Training instance: https://iglocska.eu/
username: training[1-50]@misp.test ([email protected])
password: MudWizard2023
From: "Telecommunication CSIRT of Fake-Company" <[email protected]>
To: "Telecommunication CSIRT of Luxembourg" <[email protected]>
Subject: Attempted spearphishing attempt
Dear xy,
We have had a failed spearphishing attempt targeting our CEO recently with the following details:
Our CEO received an E-mail on 13/09/2022 15:56 containing a personalised message about a report card for their child. The attacker pretended to be working for the school of the CEO’s daughter, sending the mail from a spoofed address ([email protected]). John Doe is a teacher of the student. The email was received from throwaway-email-provider.com (137.221.106.104).
The e-mail contained a malicious file (find it attached) that would try to download a secondary payload from https://evilprovider.com/this-is-not-malicious.exe (also attached, resolves to 2607:5300:60:cd52:304b:760d:da7:d5). It looks like the sample is trying to exploit CVE-2015-5465. After a brief triage, the secondary payload has a hardcoded C2 at https://another.evil.provider.com:57666 (118.217.182.36) to which it tries to exfiltrate local credentials. This is how far we have gotten so far. Please be mindful that this is an ongoing investigation, we would like to avoid informing the attacker of the detection and kindly ask you to only use the contained information to protect your constituents.
Best regards,
- Sample 1: malicious.exe
- Sample 2: this-is-not-malicious.exe
- Cheatsheet: Concepts & Data model
- Synchronisation logic
- Authentication logic
- For your lawyers or if you are interested in legal docs: MISP legal compliance (such as GDPR and alike)
- Virtual machines (VirtualBox and VMWare format): https://vm.misp-project.org/
- All Slide Deck (source file and compiled): https://github.com/MISP/misp-training
- PyMISP: https://github.com/MISP/PyMISP/
- OpenAPI documentation: https://www.misp-project.org/documentation/openapi.html
- misp-stix a generic library for MISP standard format to STIX (1.1, 1.2, 2.0 and 2.1): documentation
- MISP Mastodon - @[email protected]
- MISP Twitter - Follow to get latest news
- Gitter MISP Support chat
- Benefits of running your own MISP instance
- Targeted phishing - PDF documents / phishkit - YARA tracking - graph, tracking via YARA rules
- Investigation Syrian Electronic Army Activities - graph, timeline usage
- ATM Vulnerabilities Allow Deposit Forgery Attacks - Galaxy for finance, eventreport
- Kobalos - Linux threat to high performance computing infrastructure - EventReport, EventGraph
- Decaying Example
- Dirty harry example - EventGraph, custom objects and timeline
- Incident report email - Solved exercise