{
    "Event": {
        "Attribute": [
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [
                    {
                        "colour": "#00ae7a",
                        "exportable": true,
                        "hide_tag": false,
                        "id": "705",
                        "name": "DescriptionTechnique",
                        "numerical_value": null,
                        "user_id": "0"
                    }
                ],
                "category": "Other",
                "comment": "",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036738",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556919",
                "to_ids": true,
                "type": "comment",
                "uuid": "942729f1-dc11-4e13-8887-9f282f1352a8",
                "value": "Domaines de hame\u00e7onnage et de C2 utilis\u00e9s par TA505 entre mars 2020 et juin 2020"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "Domaine de page d\u2019hame\u00e7onnage - Juin 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036740",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "b68359d9-9301-4ba4-b9df-096853e1b735",
                "value": "sl-downloads.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "Domaine de page d\u2019hame\u00e7onnage - Juin 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036741",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "6b02bf27-2a6c-4fb5-b45e-76fc760665f6",
                "value": "downloads-links.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "Domaine de page d\u2019hame\u00e7onnage - Juin 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036742",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "6fbf93a2-2066-4c56-83e4-c72131e2a652",
                "value": "eu-download.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "Domaine de page d\u2019hame\u00e7onnage - Juin 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036743",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "818d0170-bbdf-4661-925d-986aa753c282",
                "value": "store-downloads.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "Domaine de page d\u2019hame\u00e7onnage - Juin 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036744",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "2dec0b08-0cdc-4ad4-8f2d-a5053407d657",
                "value": "fasts-downloads.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "Domaine de page d\u2019hame\u00e7onnage - Juin 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036745",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "ce5e1872-b8ee-4eaf-aec5-102a9adda7bd",
                "value": "rmt-downloads.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "C2 Get2 - Juin 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036746",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "d7539fc4-b16a-48e9-8f21-c47084c72e10",
                "value": "filessz.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "C2 Get2 - Juin 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036747",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "b6afe9b1-40d7-40f5-8ab9-373d4c18c260",
                "value": "def-update.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "C2 Get2 - Juin 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036748",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "0935cdcd-8c07-4a65-aaa1-22c177013537",
                "value": "sdff-corp.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "C2 Get2 - Juin 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036749",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "51a1e547-2308-45c4-b7be-c3bbd1361ada",
                "value": "shr-links.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "C2 Get2 - Juin 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036750",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "520b590e-d193-4931-b97e-40ef4041277e",
                "value": "sharefileszz.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "C2 Get2 - Juin 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036751",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "9bcab7bd-5287-4921-ae32-0b2f4e978b10",
                "value": "corp-storage.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "Possible domaine de page d\u2019hame\u00e7onnage - Juin 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036752",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "fd4e509d-b05d-44b9-a728-10f962c73b71",
                "value": "s89065339-onedrive.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "Possible domaine de page d\u2019hame\u00e7onnage - Juin 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036753",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "5a68a0e0-f5df-4532-9878-9d4c8e2c18ae",
                "value": "s77657453-onedrive.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "Potentiel C2 SDBBot - Avril-mai 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036754",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "7d50e7e4-903d-46de-8a53-1de5f6db2601",
                "value": "us-microsoft-store.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "Domaine de page d\u2019hame\u00e7onnage - Avril-mai 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036755",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "a58b493d-ced0-41a5-8a8d-6e584a41be03",
                "value": "mslinks-downloads.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "Domaine de page d\u2019hame\u00e7onnage - Avril-mai 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036756",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "d76e40ae-0275-4aac-a7c6-45d166f0640f",
                "value": "corp-downloads.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "Domaine de page d\u2019hame\u00e7onnage - Mars-mai 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036757",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "18e400bc-f511-468d-b6b2-b38f72c73048",
                "value": "dyn-downloads.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "Domaine de page d\u2019hame\u00e7onnage - Mars-mai 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036758",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "8bb64ada-2d3f-450f-a180-4faa37c955ac",
                "value": "getlink-service.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "Domaine de page d\u2019hame\u00e7onnage - Mars-mai 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036759",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "53843925-9719-4b03-8d16-23b1671a5d8b",
                "value": "clients-share.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "Domaine de page d\u2019hame\u00e7onnage - Mars-mai 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036760",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "d811bcbf-b58e-43e7-bb7a-8ebdb31343cd",
                "value": "static-downloads.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "Domaine de page d\u2019hame\u00e7onnage - Mars-mai 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036761",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "07adf0c2-9369-416e-b847-37263b8cadcd",
                "value": "clietns-download.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "Domaine de page d\u2019hame\u00e7onnage - Mars-mai 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036762",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "c0312cf9-3bd5-4024-9fa4-a2e0751e31cf",
                "value": "sharespoint-en.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "Domaine de page d\u2019hame\u00e7onnage - Mars-mai 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036763",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "dbf6ed60-4aa0-4c8e-90eb-33996c1ddd70",
                "value": "get-downloads.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "C2 CobaltStrike - Mars 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036764",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "333f47ea-d40f-4cd7-b307-ddd3951bbc87",
                "value": "dysoool.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [],
                "category": "Network activity",
                "comment": "Potentiel C2 SDBBot - Mars-mai 2020",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "5",
                "event_id": "14442",
                "id": "1036765",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592556920",
                "to_ids": true,
                "type": "domain",
                "uuid": "f940c56f-246a-496e-a560-148e67c6dc9b",
                "value": "rdmsom.com"
            },
            {
                "Galaxy": [],
                "ShadowAttribute": [],
                "Tag": [
                    {
                        "colour": "#000000",
                        "exportable": true,
                        "hide_tag": false,
                        "id": "706",
                        "name": "cossi:relevantTimespan=\"from\"",
                        "numerical_value": null,
                        "user_id": "0"
                    }
                ],
                "category": "Other",
                "comment": "",
                "deleted": false,
                "disable_correlation": false,
                "distribution": "0",
                "event_id": "14442",
                "id": "1036766",
                "object_id": "0",
                "object_relation": null,
                "sharing_group_id": "0",
                "timestamp": "1592557098",
                "to_ids": true,
                "type": "comment",
                "uuid": "508cdcfc-57d7-43cf-9ae0-242f83107fdd",
                "value": "2020-03-01"
            }
        ],
        "Galaxy": [],
        "Object": [],
        "Org": {
            "id": "1",
            "name": "CERT-FR",
            "uuid": "56bdf779-46f8-4353-bdf9-2bb95bce2212"
        },
        "Orgc": {
            "id": "1",
            "name": "CERT-FR",
            "uuid": "56bdf779-46f8-4353-bdf9-2bb95bce2212"
        },
        "RelatedEvent": [],
        "ShadowAttribute": [],
        "Tag": [
            {
                "colour": "#f89595",
                "exportable": true,
                "hide_tag": false,
                "id": "40",
                "name": "fr-classif:non-classifiees=\"NON-CLASSIFIEES\"",
                "numerical_value": null,
                "user_id": "0"
            },
            {
                "colour": "#ffffff",
                "exportable": true,
                "hide_tag": false,
                "id": "482",
                "name": "cossi:TLP=\"white\"",
                "numerical_value": null,
                "user_id": "0"
            },
            {
                "colour": "#008d63",
                "exportable": true,
                "hide_tag": false,
                "id": "456",
                "name": "cossi:RechercheSourceOuverte=\"Autorisee\"",
                "numerical_value": null,
                "user_id": "0"
            },
            {
                "colour": "#00704f",
                "exportable": true,
                "hide_tag": false,
                "id": "473",
                "name": "cossi:fiabilite=\"Bonne\"",
                "numerical_value": null,
                "user_id": "0"
            },
            {
                "colour": "#9c3245",
                "exportable": true,
                "hide_tag": false,
                "id": "8710",
                "name": "misp-galaxy:threat-actor=\"TA505\"",
                "numerical_value": null,
                "user_id": "0"
            }
        ],
        "analysis": "0",
        "date": "2020-06-19",
        "disable_correlation": false,
        "distribution": "0",
        "extends_uuid": "",
        "id": "14442",
        "info": "[CERT-FR] Le groupe cybercriminel TA505",
        "locked": false,
        "org_id": "1",
        "orgc_id": "1",
        "proposal_email_lock": false,
        "publish_timestamp": "0",
        "published": false,
        "sharing_group_id": "0",
        "threat_level_id": "4",
        "timestamp": "1592618583",
        "uuid": "5eec7d77-302c-45b8-ade6-c3d20aba047c"
    }
}