17 lines
684 B
JSON
17 lines
684 B
JSON
|
{
|
||
|
|
"sources": [
|
||
|
|
{"id": "synthetic_example", "title": "Documentation examples, not threat intelligence"}
|
||
|
|
],
|
||
|
|
"patterns": [
|
||
|
|
{
|
||
|
|
"id": "example_download_command",
|
||
|
|
"pattern": "(?i)\\b(?:curl|wget)\\s+https?://",
|
||
|
|
"description": "A download command appears in the log. Check its destination, arguments and execution evidence; legitimate administration can match.",
|
||
|
|
"source": "synthetic_example"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"indicators": [
|
||
|
|
{"type": "ipv4", "value": "192.0.2.42", "status": "reference_only", "source": "synthetic_example"},
|
||
|
|
{"type": "domain", "value": "triage-demo.example.invalid", "status": "reference_only", "source": "synthetic_example"}
|
||
|
|
]
|
||
|
|
}
|