misp-galaxy
MISP galaxy is a simple method to express a large object called cluster that can be attached to MISP events or attributes. A cluster can be composed of one or more elements. Elements are expressed as key-values. There are default knowledge base (such as Threat Actors, Tools, Ransomware, ATT&CK matrixes) available in MISP galaxy but those can be overwritten, replaced, updated, forked and shared as you wish.
Existing clusters and vocabularies can be used as-is or as a common knowledge base. MISP distribution can be applied to each cluster to permit a limited or broader distribution scheme.
Galaxies can be also used to expressed existing matrix-like standards such as MITRE ATT&CK(tm) or custom ones.
The objective is to have a comment set of clusters for organizations starting analysis but that can be expanded to localized information (which is not shared) or additional information (that can be shared).
Available Galaxy - clusters
360.net Threat Actors
360.net Threat Actors - Known or estimated adversary groups as identified by 360.net.
Category: actor - source: https://apt.360.net/aptlist - total: 42 elements
Ammunitions
Ammunitions - Common ammunitions galaxy
Category: firearm - source: https://ammo.com/ - total: 409 elements
Android
Android - Android malware galaxy based on multiple open sources.
Category: tool - source: Open Sources - total: 433 elements
Azure Threat Research Matrix
Azure Threat Research Matrix - The purpose of the Azure Threat Research Matrix (ATRM) is to educate readers on the potential of Azure-based tactics, techniques, and procedures (TTPs). It is not to teach how to weaponize or specifically abuse them. For this reason, some specific commands will be obfuscated or parts will be omitted to prevent abuse.
Category: atrm - source: https://github.com/microsoft/Azure-Threat-Research-Matrix - total: 90 elements
attck4fraud
attck4fraud - attck4fraud - Principles of MITRE ATT&CK in the fraud domain
Category: guidelines - source: Open Sources - total: 71 elements
Backdoor
Backdoor - A list of backdoor malware.
Category: tool - source: Open Sources - total: 28 elements
Banker
Banker - A list of banker malware.
Category: tool - source: Open Sources - total: 53 elements
Bhadra Framework
Bhadra Framework - Bhadra Threat Modeling Framework
Category: mobile - source: https://arxiv.org/pdf/2005.05110.pdf - total: 47 elements
Botnet
Botnet - botnet galaxy
Category: tool - source: MISP Project - total: 130 elements
Branded Vulnerability
Branded Vulnerability - List of known vulnerabilities and attacks with a branding
Category: vulnerability - source: Open Sources - total: 14 elements
Cert EU GovSector
Cert EU GovSector - Cert EU GovSector
Category: sector - source: CERT-EU - total: 6 elements
China Defence Universities Tracker
China Defence Universities Tracker - The China Defence Universities Tracker is a database of Chinese institutions engaged in military or security-related science and technology research. It was created by ASPI’s International Cyber Policy Centre.
Category: academic-institution - source: ASPI International Cyber Policy Centre - total: 159 elements
CONCORDIA Mobile Modelling Framework - Attack Pattern
CONCORDIA Mobile Modelling Framework - Attack Pattern - A list of Techniques in CONCORDIA Mobile Modelling Framework.
Category: cmtmf-attack-pattern - source: https://5g4iot.vlab.cs.hioa.no/ - total: 93 elements
Country
Country - Country meta information based on the database provided by geonames.org.
Category: country - source: MISP Project - total: 252 elements
Cryptominers
Cryptominers - A list of cryptominer and cryptojacker malware.
Category: Cryptominers - source: Open Source Intelligence - total: 5 elements
Actor Types
Actor Types - DISARM is a framework designed for describing and understanding disinformation incidents.
Category: disarm - source: https://github.com/DISARMFoundation/DISARMframeworks - total: 33 elements
Countermeasures
Countermeasures - DISARM is a framework designed for describing and understanding disinformation incidents.
Category: disarm - source: https://github.com/DISARMFoundation/DISARMframeworks - total: 139 elements
Detections
Detections - DISARM is a framework designed for describing and understanding disinformation incidents.
Category: disarm - source: https://github.com/DISARMFoundation/DISARMframeworks - total: 94 elements
Techniques
Techniques - DISARM is a framework designed for describing and understanding disinformation incidents.
Category: disarm - source: https://github.com/DISARMFoundation/DISARMframeworks - total: 298 elements
Election guidelines
Election guidelines - Universal Development and Security Guidelines as Applicable to Election Technology.
Category: guidelines - source: Open Sources - total: 23 elements
Entity
Entity - Description of entities that can be involved in events.
Category: actor - source: MISP Project - total: 4 elements
Exploit-Kit
Exploit-Kit - Exploit-Kit is an enumeration of some exploitation kits used by adversaries. The list includes document, browser and router exploit kits.It's not meant to be totally exhaustive but aim at covering the most seen in the past 5 years
Category: tool - source: MISP Project - total: 52 elements
Firearms
Firearms - Common firearms galaxy
Category: firearm - source: https://www.impactguns.com - total: 5953 elements
FIRST DNS Abuse Techniques Matrix
FIRST DNS Abuse Techniques Matrix - The Domain Name System (DNS) is a critical part of the Internet, including mapping domain names to IP addresses. Malicious threat actors use domain names, their corresponding technical resources, and other parts of the DNS infrastructure, including its protocols, for their malicious cyber operations. CERTs are confronted with reported DNS abuse on a continuous basis, and rely heavily on DNS analysis and infrastructure to protect their constituencies. Understanding the international customary norms applicable for detecting and mitigating DNS abuse from the perspective of the global incident response community is critical for the open Internet’s stability, security and resiliency. See also https://www.first.org/global/sigs/dns/ for more information.
Category: first-dns - source: https://www.first.org/global/sigs/dns/ - total: 21 elements
GSMA MoTIF
GSMA MoTIF - Mobile Threat Intelligence Framework (MoTIF) Principles.
Category: attack-pattern - source: https://www.gsma.com/solutions-and-impact/technologies/security/latest-news/establishing-motif-the-mobile-threat-intelligence-framework/ - total: 50 elements
Intelligence Agencies
Intelligence Agencies - List of intelligence agencies
Category: Intelligence Agencies - source: https://en.wikipedia.org/wiki/List_of_intelligence_agencies - total: 436 elements
INTERPOL DWVA Taxonomy
INTERPOL DWVA Taxonomy - This taxonomy defines common forms of abuses and entities that represent real-world actors and service that are part of a larger Darknet- and Cryptoasset Ecosystems.
Category: dwva - source: https://interpol-innovation-centre.github.io/DW-VA-Taxonomy/ - total: 94 elements
Malpedia
Malpedia - Malware galaxy cluster based on Malpedia.
Category: tool - source: Malpedia - total: 3038 elements
Microsoft Activity Group actor
Microsoft Activity Group actor - Activity groups as described by Microsoft
Category: actor - source: MISP Project - total: 79 elements
Misinformation Pattern
Misinformation Pattern - AM!TT Technique
Category: misinformation-pattern - source: https://github.com/misinfosecproject/amitt_framework - total: 61 elements
MITRE ATLAS Attack Pattern
MITRE ATLAS Attack Pattern - MITRE ATLAS Attack Pattern - Adversarial Threat Landscape for Artificial-Intelligence Systems
Category: attack-pattern - source: https://github.com/mitre-atlas/atlas-navigator-data - total: 82 elements
MITRE ATLAS Course of Action
MITRE ATLAS Course of Action - MITRE ATLAS Mitigation - Adversarial Threat Landscape for Artificial-Intelligence Systems
Category: course-of-action - source: https://github.com/mitre-atlas/atlas-navigator-data - total: 20 elements
Attack Pattern
Attack Pattern - ATT&CK tactic
Category: attack-pattern - source:
编辑推荐精选
扣子-AI办公
职场AI，就用扣子
AI办公助手，复杂任务高效处理。办公效率低？扣子空间AI助手支持播客生成、PPT制作、网页开发及报告写作，覆盖科研、商业、舆情等领域的专家Agent 7x24小时响应，生活工作无缝切换，提升50%效率！
堆友
多风格AI绘画神器
堆友平台由阿里巴巴设计团队创建，作为一款AI驱动的设计工具，专为设计师提供一站式增长服务。功能覆盖海量3D素材、AI绘画、实时渲染以及专业抠图，显著提升设计品质和效率。平台不仅提供工具，还是一个促进创意交流和个人发展的空间，界面友好，适合所有级别的设计师和创意工作者。
码上飞
零代码AI应用开发平台
零代码AI应用开发平台，用户只需一句话简单描述需求，AI能自动生成小程序、APP或H5网页应用，无需编写代码。
Vora
免费创建高清无水印Sora视频
Vora是一个免费创建高清无水印Sora视频的AI工具
Refly.AI
最适合小白的AI自动化工作流平台
无需编码，轻松生成可复用、可变现的AI自动化工作流
酷表ChatExcel
大模型驱动的Excel数据处理工具
基于大模型交互的表格处理系统，允许用户通过对话方式完成数据整理和可视化分析。系统采用机器学习算法解析用户指令，自动执行排序、公式计算和数据透视等操作，支持多种文件格式导入导出。数据处理响应速度保持在0.8秒以内，支持超过100万行数据的即时分析。
TRAE编程
AI辅助编程，代码自动修复
Trae是一种自适应的集成开发环境（IDE），通过自动化和多元协作改变开发流程。利用Trae，团队能够更快速、精确地编写和部署代码，从而提高编程效率和项目交付速度。Trae具备上下文感知和代码自动完成功能，是提升开发效率的理想工具。
AIWritePaper论文写作
AI论文写作指导平台
AIWritePaper论文写作是一站式AI论文写作辅助工具，简化了选题、文献检索至论文撰写的整个过程。通过简单设定，平台可快速生成高质量论文大纲和全文，配合图表、参考文献等一应俱全，同时提供开题报告和答辩PPT等增值服务，保障数据安全，有效提升写作效率和论文质量。
博思AIPPT
AI一键生成PPT，就用博思AIPPT！
博思AIPPT，新一代的AI生成PPT平台，支持智能生成PPT、AI美化PPT、文本&链接生成PPT、导入Word/PDF/Markdown文档生成PPT等，内置海量精美PPT模板，涵盖商务、教育、科技等不同风格，同时针对每个页面提供多种版式，一键自适应切换，完美适配各种办公场景。
潮际好麦
AI赋能电商视觉革命，一站式智能商拍平台
潮际好麦深耕服装行业，是国内AI试衣效果最好的软件。使用先进AIGC能力为电商卖家批量提供优质的、低成本的商拍图。合作品牌有Shein、Lazada、安踏、百丽等65个国内外头部品牌，以及国内10万+淘宝、天猫、京东等主流平台的品牌商家，为卖家节省将近85%的出图成本，提升约3倍出图效率，让品牌能够快速上架。
推荐工具精选
AI云服务特惠
懂AI专属折扣关注微信公众号
最新AI工具、AI资讯
独家AI资源、AI项目落地
微信扫一扫关注公众号