SOC-Semi-Automation-Project/rules/100620-misp_rules.xml at main · bayuerik/SOC-Semi-Automation-Project · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
<!-- MISP Detection -->
<group name="threat_intel,">
   <rule id="100620" level="2">
    <field name="integration">misp</field>
    <description>MISPs</description>
    <group>misp,</group>
    <options>no_full_log</options>
  </rule>
  <rule id="100621" level="5">
    <if_sid>100620</if_sid>
    <field name="misp.error">\.+</field>
    <description>MISP - Error connecting to API</description>
    <options>no_full_log</options>
    <group>misp,misp_error,</group>
  </rule>
  <rule id="100622" level="10">
    <if_sid>100620</if_sid>
    <field name="misp.category">\.+</field>
    <field name="misp.value">\d+.\d+.\d+.\d+\.*</field>
    <description>MISP - IoC found in Threat Intel - Category: $(misp.category)</description>
    <!-- <description>MISP - IoC found in Threat Intel - Category: $(misp.category), Attribute: $(misp.value)</description> -->
    <options>no_full_log</options>
    <group>misp,misp_alert,</group>
  </rule>
  <rule id="100623" level="14">
    <if_sid>100620</if_sid>
    <field name="misp.category">\.+</field>
    <field name="misp.file_path">\.+</field>
    <!-- Ignore empty file -->
    <field name="misp.value" negate="yes">\.*d41d8cd98f00b204e9800998ecf8427e\.*</field>
    <!-- Ignore part and temporary file -->
    <field name="misp.file_path" negate="yes">\.part$</field>
    <field name="misp.file_path" negate="yes">\.tmp$</field>
     <field name="misp.file_path" negate="yes">\.crdownload$</field>
    <description>MISP - IoC found in Threat Intel - Category: $(misp.category)</description>
    <!-- <description>MISP - IoC found in Threat Intel - Category: $(misp.category), Attribute: $(misp.value)</description> -->
    <options>no_full_log</options>
    <group>misp,misp_alert,</group>
</group>