{
  "namespace": "threatmatch",
  "expanded": "ThreatMatch categories for sharing into ThreatMatch and MISP",
  "version": 3,
  "description": "The ThreatMatch Sectors, Incident types, Malware types and Alert types are applicable for any ThreatMatch instances and should be used for all CIISI and TIBER Projects.",
  "refs": [
    "https://www.secalliance.com/platform/",
    "https://www.ecb.europa.eu/press/pr/date/2020/html/ecb.pr200227_1~062992656b.en.html"
  ],
  "predicates": [
    {
      "value": "sector",
      "expanded": "Extensive list of sector definition tags",
      "uuid": "7a8d517a-61d9-5410-9cd4-029356f106dc"
    },
    {
      "value": "incident-type",
      "expanded": "Incident tags are used by the ThreatMatch platform to categorise a relevant incident event.",
      "uuid": "c0e32c4c-6c51-5cf8-b57e-d566f97887d1"
    },
    {
      "value": "malware-type",
      "expanded": "Malware tags are used by the ThreatMatch platform to categorise malware types.",
      "uuid": "ecfb9e37-da31-5119-b141-dc93358ce6aa"
    },
    {
      "value": "alert-type",
      "expanded": "Alert tags are used by the ThreatMatch platform to categorise a relevant threat.",
      "uuid": "e47f3b87-8fed-51cd-bf19-19f96c14fc92"
    }
  ],
  "values": [
    {
      "predicate": "sector",
      "entry": [
        {
          "value": "Banking & Capital Markets",
          "expanded": "Banking & capital markets",
          "uuid": "bee7fe76-7f87-5bcb-b417-966bb432df9d"
        },
        {
          "value": "Financial Services",
          "expanded": "Financial Services",
          "uuid": "618602a1-fb5b-5120-9cbf-4ddc5c3adcdc"
        },
        {
          "value": "Insurance",
          "expanded": "Insurance",
          "uuid": "439cb2e5-82f9-589c-94de-4c5a6acd98a5"
        },
        {
          "value": "Pension",
          "expanded": "Pension",
          "uuid": "356d8128-4c41-5490-8ae9-47540e83a23f"
        },
        {
          "value": "Government & Public Service",
          "expanded": "Government & Public Service",
          "uuid": "e52d3e60-f562-57c0-bd00-675c785d8cbb"
        },
        {
          "value": "Diplomatic Services",
          "expanded": "Diplomatic Services",
          "uuid": "28a16573-d3f0-5418-b2cc-af6847c237a9"
        },
        {
          "value": "Energy, Utilities & Mining",
          "expanded": "Energy, Utilities & Mining",
          "uuid": "8d237a0d-eefc-5a1b-81ad-4c87c60de00d"
        },
        {
          "value": "Telecommunications",
          "expanded": "Telecommunications",
          "uuid": "a89ff5a8-8260-5bf1-81a3-5023f8163a55"
        },
        {
          "value": "Technology",
          "expanded": "Technology",
          "uuid": "b96df439-9893-581f-9036-aec8b66ea7cb"
        },
        {
          "value": "Academic/Research Institutes",
          "expanded": "Academic/Research Institutes",
          "uuid": "b724d2e7-1226-5b18-a2ad-d64ef74217da"
        },
        {
          "value": "Aerospace, Defence & Security",
          "expanded": "Aerospace, Defence & Security",
          "uuid": "b0d6f524-d85a-58a4-8eda-64d0e408ff9f"
        },
        {
          "value": "Agriculture",
          "expanded": "Agriculture",
          "uuid": "eaa94040-e1dc-5124-aed7-b5877f2b4c7f"
        },
        {
          "value": "Asset & Wealth Management",
          "expanded": "Asset & Wealth Management",
          "uuid": "b568a286-a958-550e-afd7-97ea1521581d"
        },
        {
          "value": "Automotive",
          "expanded": "Automotive",
          "uuid": "178e93d7-913e-59a9-b19f-72da9ddba27c"
        },
        {
          "value": "Business and Professional Services",
          "expanded": "Business and Professional Services",
          "uuid": "74e4e0c8-c053-59ce-9f49-2d41003fd8e0"
        },
        {
          "value": "Capital Projects & Infrastructure",
          "expanded": "Capital Projects & Infrastructure",
          "uuid": "e59b3ec9-a20c-5030-8299-4ab967a1c453"
        },
        {
          "value": "Charity/Not-for-Profit",
          "expanded": "Charity/Not-for-Profit",
          "uuid": "14b03d4b-1e30-58c2-a149-67af48b8d260"
        },
        {
          "value": "Chemicals",
          "expanded": "Chemicals",
          "uuid": "cfee7915-1438-5e60-8ade-5078b89ec03f"
        },
        {
          "value": "Commercial Aviation",
          "expanded": "Commercial Aviation",
          "uuid": "21e905f1-2a4b-5058-8ab0-3c0fe165e815"
        },
        {
          "value": "Commodities",
          "expanded": "Commodities",
          "uuid": "91484099-1186-5f73-9ea1-b532c2d399b9"
        },
        {
          "value": "Education",
          "expanded": "Education",
          "uuid": "3c18719b-b362-5b2a-9278-6d9cbed7ea71"
        },
        {
          "value": "Engineering & Construction",
          "expanded": "Engineering & Construction",
          "uuid": "8619c9a6-4521-5e44-82b7-14d8610bf0d3"
        },
        {
          "value": "Entertainment & Media",
          "expanded": "Entertainment & Media",
          "uuid": "2c9f906b-43e0-5650-8516-74540937f45c"
        },
        {
          "value": "Forest, Paper & Packaging",
          "expanded": "Forest, Paper & Packaging",
          "uuid": "ac0754c5-6074-55ae-981b-295dd7df71cf"
        },
        {
          "value": "Healthcare",
          "expanded": "Healthcare",
          "uuid": "a8aae588-a2cb-5cb2-8b96-61d1c9a489cc"
        },
        {
          "value": "Hospitality & Leisure",
          "expanded": "Hospitality & Leisure",
          "uuid": "3900be8e-b575-5532-97c3-4dbc9bc0cab4"
        },
        {
          "value": "Industrial Manufacturing",
          "expanded": "Industrial Manufacturing",
          "uuid": "89ff4384-bee1-5677-855e-87bfb5a29f05"
        },
        {
          "value": "IT Industry",
          "expanded": "IT Industry",
          "uuid": "c17fdbc7-885a-59d4-9e9b-9e5c6c6d31e1"
        },
        {
          "value": "Legal",
          "expanded": "Legal",
          "uuid": "f9442d92-7511-56c1-a0c0-67184c03cdac"
        },
        {
          "value": "Metals",
          "expanded": "Metals",
          "uuid": "45cf4ea2-df89-5d22-a48f-a26b77431c32"
        },
        {
          "value": "Pharmaceuticals & Life Sciences",
          "expanded": "Pharmaceuticals & Life Sciences",
          "uuid": "ba175401-7a83-5e3e-b001-cb299b27d22a"
        },
        {
          "value": "Private Equity",
          "expanded": "Private Equity",
          "uuid": "7fed4289-db8a-5290-8b25-7a25ca6e3cbb"
        },
        {
          "value": "Retail & Consumer",
          "expanded": "Retail & Consumer",
          "uuid": "6b3c13ab-4759-56e4-9b91-ccd75b2c7c4d"
        },
        {
          "value": "Semiconductors",
          "expanded": "Semiconductors",
          "uuid": "a72c88d8-1712-5a85-9c64-74c84b183b99"
        },
        {
          "value": "Sovereign Investment Funds",
          "expanded": "Sovereign Investment Funds",
          "uuid": "546872b8-82ee-5d17-a9bf-45389ecccb84"
        },
        {
          "value": "Transport & Logistics",
          "expanded": "Transport & Logistics",
          "uuid": "2b338708-fd92-55c4-ad14-f082f40abc8b"
        }
      ]
    },
    {
      "predicate": "incident-type",
      "entry": [
        {
          "value": "ATM Attacks",
          "expanded": "ATM Attacks",
          "uuid": "430afbb3-0af9-554a-aa11-4031aa0b9b12"
        },
        {
          "value": "ATM Breach",
          "expanded": "ATM Breach",
          "uuid": "a8995a2d-7eb0-5301-b653-4a6d3928b1c9"
        },
        {
          "value": "Attempted Exploitation",
          "expanded": "Attempted Exploitation",
          "uuid": "c87b9609-db62-5b7b-b155-2e2415ff3c69"
        },
        {
          "value": "Botnet Activity",
          "expanded": "Botnet Activity",
          "uuid": "c2aa5ded-2104-58a7-81b5-a6ce852574bc"
        },
        {
          "value": "Business Email Compromise",
          "expanded": "Business Email Compromise",
          "uuid": "0f528ebe-a6c8-5679-ba12-0ec9d5853372"
        },
        {
          "value": "Crypto Mining",
          "expanded": "Crypto Mining",
          "uuid": "cacf719b-741d-5f0e-9ba1-c2d92650c413"
        },
        {
          "value": "Data Breach/Compromise",
          "expanded": "Data Breach/Compromise",
          "uuid": "957f00ed-77ca-51b5-bfc0-f54aed9b0793"
        },
        {
          "value": "Data Dump",
          "expanded": "Data Dump",
          "uuid": "7266b8ea-7405-516d-900c-98687e2ae6c3"
        },
        {
          "value": "Data Leakage",
          "expanded": "Data Leakage",
          "uuid": "2b24207e-cb2a-5ffd-9e0b-d36d80472d12"
        },
        {
          "value": "DDoS",
          "expanded": "DDoS",
          "uuid": "89022bfd-2d33-5e50-9ae9-a2e80412d1d1"
        },
        {
          "value": "Defacement Activity",
          "expanded": "Defacement Activity",
          "uuid": "2a292e00-54f1-5fb5-a8a4-b93a85e461e6"
        },
        {
          "value": "Denial of Service (DoS)",
          "expanded": "Denial of Service (DoS)",
          "uuid": "84b4d6fe-8a95-5719-b02e-fdf6c0150c5e"
        },
        {
          "value": "Disruption Activity",
          "expanded": "Disruption Activity",
          "uuid": "f7c46a41-b899-5c8d-8b72-46354bcf7fa0"
        },
        {
          "value": "Espionage",
          "expanded": "Espionage",
          "uuid": "178c424f-49db-54d1-a883-e0f3963a4389"
        },
        {
          "value": "Espionage Activity",
          "expanded": "Espionage Activity",
          "uuid": "4ebf35b1-52c4-5196-aaf1-66d6936cfabc"
        },
        {
          "value": "Exec Targeting ",
          "expanded": "Exec Targeting ",
          "uuid": "a0ba6b75-9f99-548e-bf20-2c904b6e7edd"
        },
        {
          "value": "Exposure of Data",
          "expanded": "Exposure of Data",
          "uuid": "eeb282c9-81ba-58f5-b519-b1b07b8c9726"
        },
        {
          "value": "Extortion Activity",
          "expanded": "Extortion Activity",
          "uuid": "bd79a718-1bec-5070-af6b-6ac3947d2642"
        },
        {
          "value": "Fraud Activity",
          "expanded": "Fraud Activity",
          "uuid": "091828bc-ed77-5135-9bca-a0a1f303e0e5"
        },
        {
          "value": "General Notification",
          "expanded": "General Notification",
          "uuid": "02a27573-b823-57b9-9872-ec175928103c"
        },
        {
          "value": "Hacktivism Activity",
          "expanded": "Hacktivism Activity",
          "uuid": "c003281e-1905-504c-9014-3b76c609ac8a"
        },
        {
          "value": "Malicious Insider",
          "expanded": "Malicious Insider",
          "uuid": "8f0890a2-d584-58cb-b237-50a3509fc0ab"
        },
        {
          "value": "Malware Infection",
          "expanded": "Malware Infection",
          "uuid": "96dd55f8-e06d-5006-9746-f89213953b1d"
        },
        {
          "value": "Man in the Middle Attacks",
          "expanded": "Man in the Middle Attacks",
          "uuid": "3b51b04a-978d-5391-b9ba-8cd4ca4601ce"
        },
        {
          "value": "MFA Attack",
          "expanded": "MFA Attack",
          "uuid": "9bf03f80-a487-54f6-8f1c-4e6e59ac75a3"
        },
        {
          "value": "Mobile Malware",
          "expanded": "Mobile Malware",
          "uuid": "b7f9ae56-0e69-5833-a33e-2cdac066b1d9"
        },
        {
          "value": "Phishing Activity",
          "expanded": "Phishing Activity",
          "uuid": "fcd78d34-db0a-5ba7-b708-f43443e5077f"
        },
        {
          "value": "Ransomware Activity",
          "expanded": "Ransomware Activity",
          "uuid": "4d70745f-a91f-5b63-b4d9-608c68ba5c47"
        },
        {
          "value": "Social Engineering Activity",
          "expanded": "Social Engineering Activity",
          "uuid": "dd1904c4-2b4b-5162-8566-9d3fbc0dc413"
        },
        {
          "value": "Social Media Compromise",
          "expanded": "Social Media Compromise",
          "uuid": "6daa0517-54b9-5426-977c-29c09614b345"
        },
        {
          "value": "Spear-phishing Activity",
          "expanded": "Spear-phishing Activity",
          "uuid": "9f65401c-808b-5666-b5fc-57b5820ac7bc"
        },
        {
          "value": "Spyware",
          "expanded": "Spyware",
          "uuid": "8beaad8a-d6ed-5b7f-a1be-bbf791d1c2f6"
        },
        {
          "value": "SQL Injection Activity",
          "expanded": "SQL Injection Activity",
          "uuid": "ba750208-f815-529a-b3e8-0f9a8a1e3262"
        },
        {
          "value": "Supply Chain Compromise",
          "expanded": "Supply Chain Compromise",
          "uuid": "82631345-94ca-507d-aa5c-67880994d114"
        },
        {
          "value": "Trojanised Software",
          "expanded": "Trojanised Software",
          "uuid": "7d23a55e-d19d-5c9a-9c88-c2c070b312d9"
        },
        {
          "value": "Vishing",
          "expanded": "Vishing",
          "uuid": "19b98679-4807-5c84-b178-457805d53b2d"
        },
        {
          "value": "Website Attack (Other)",
          "expanded": "Website Attack (Other)",
          "uuid": "156ad5da-e488-5b04-882c-f1a7f30d32cd"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown",
          "uuid": "2219dd23-fc85-5622-923f-edba79a7c634"
        }
      ]
    },
    {
      "predicate": "malware-type",
      "entry": [
        {
          "value": "Adware",
          "expanded": "Adware",
          "uuid": "79eeab14-3876-5516-ad27-b52e74d4788d"
        },
        {
          "value": "Backdoor",
          "expanded": "Backdoor",
          "uuid": "a95c96e2-7d6c-5bd4-9630-b496e8a3d209"
        },
        {
          "value": "Banking Trojan",
          "expanded": "Banking Trojan",
          "uuid": "d1c14eae-05bc-531d-af24-1924b1a30eb1"
        },
        {
          "value": "Botnet",
          "expanded": "Botnet",
          "uuid": "55949ed2-7dd6-5392-9b3a-f4b6576243f7"
        },
        {
          "value": "Destructive",
          "expanded": "Destructive",
          "uuid": "e18c170a-b301-51a5-9c32-a150ac3b373c"
        },
        {
          "value": "Downloader",
          "expanded": "Downloader",
          "uuid": "c7124674-3216-5e98-b8c6-b0925d2fec22"
        },
        {
          "value": "Exploit Kit",
          "expanded": "Exploit Kit",
          "uuid": "c901cdb0-776d-561b-8d03-14398f2778f9"
        },
        {
          "value": "Fileless Malware",
          "expanded": "Fileless Malware",
          "uuid": "db2a3e2e-fb52-5d11-a2e2-c839b654959d"
        },
        {
          "value": "Keylogger",
          "expanded": "Keylogger",
          "uuid": "20820838-020e-5970-be82-e542148651e0"
        },
        {
          "value": "Legitimate Tool",
          "expanded": "Legitimate Tool",
          "uuid": "f7734512-d5eb-576d-addc-567afa54f3af"
        },
        {
          "value": "Mobile Application",
          "expanded": "Mobile Application",
          "uuid": "fa21398b-e9ba-59b0-8068-4704d13e5961"
        },
        {
          "value": "Mobile Malware",
          "expanded": "Mobile Malware",
          "uuid": "afa84af4-97fe-54b1-ac53-be6e25b91ccf"
        },
        {
          "value": "Point-of-Sale (PoS)",
          "expanded": "Point-of-Sale (PoS)",
          "uuid": "84639900-3475-5af7-8efa-faefc17b7a7f"
        },
        {
          "value": "Remote Access Trojan",
          "expanded": "Remote Access Trojan",
          "uuid": "abc62b7a-ff51-53b2-8d5f-33158dd64861"
        },
        {
          "value": "Rootkit",
          "expanded": "Rootkit",
          "uuid": "10428571-249a-5af2-acb0-07a177243fa7"
        },
        {
          "value": "Skimmer",
          "expanded": "Skimmer",
          "uuid": "3dfe3096-58e2-5ccf-b3e5-793051185b72"
        },
        {
          "value": "Spyware",
          "expanded": "Spyware",
          "uuid": "3f0d5529-53cb-5027-abac-9d6808f492cd"
        },
        {
          "value": "Surveillance Tool",
          "expanded": "Surveillance Tool",
          "uuid": "c52ea67e-3ae4-5344-b37f-b84bb7961f10"
        },
        {
          "value": "Trojan",
          "expanded": "Trojan",
          "uuid": "16aa67e3-0522-5e58-a9f8-b3d8b8f69106"
        },
        {
          "value": "Virus",
          "expanded": "Virus ",
          "uuid": "e730d730-74a7-5196-b169-8d1c83cfd614"
        },
        {
          "value": "Worm",
          "expanded": "Worm",
          "uuid": "ae3479f5-3942-5e73-89c9-2f81fe88d1aa"
        },
        {
          "value": "Zero-day",
          "expanded": "Zero-day",
          "uuid": "d469d174-7eaf-520c-92f4-9280ddd530d0"
        },
        {
          "value": "Unknown",
          "expanded": "Unknown",
          "uuid": "244fcc90-684d-5f7f-8a87-1f55ac97c803"
        }
      ]
    },
    {
      "predicate": "alert-type",
      "entry": [
        {
          "value": "Actor Campaigns",
          "expanded": "Actor Campaigns",
          "uuid": "6826a87f-65ab-5800-8946-6a5e5caf4cbe"
        },
        {
          "value": "Credential Breach",
          "expanded": "Credential Breach",
          "uuid": "cb6e5467-2f77-5e00-91fc-7acbbcdf5e03"
        },
        {
          "value": "DDoS",
          "expanded": "DDoS",
          "uuid": "bb79fa97-38d3-5ee9-9ec4-bdcb6022fdb9"
        },
        {
          "value": "Exploit Alert",
          "expanded": "Exploit Alert",
          "uuid": "d3007cb3-d06f-56a7-af09-0399b71b96e0"
        },
        {
          "value": "General Notification",
          "expanded": "General Notification",
          "uuid": "c8040bee-8127-59f6-9a58-f4a1d018dbdb"
        },
        {
          "value": "Vulnerability",
          "expanded": "Vulnerability",
          "uuid": "aa3ac3c4-bbf2-584d-8aab-cef0f6e82c45"
        },
        {
          "value": "Information Leakages",
          "expanded": "Information Leakages",
          "uuid": "dd557a39-4b0f-5b02-9d8c-aabce6633fa6"
        },
        {
          "value": "Malware",
          "expanded": "Malware",
          "uuid": "3842c5ed-9292-55eb-8b64-29a446c88b8e"
        },
        {
          "value": "Suspicious Domain",
          "expanded": "Suspicious Domain",
          "uuid": "dbf77d20-c36e-5aee-b3eb-d1c01aa6a832"
        },
        {
          "value": "Forum Mention",
          "expanded": "Forum Mention",
          "uuid": "4d11cbef-b5d0-5761-a35d-5104dacf66ea"
        },
        {
          "value": "Phishing Attempts",
          "expanded": "Phishing Attempts",
          "uuid": "5738ab16-ce86-5887-8c38-8defb2473715"
        },
        {
          "value": "Social Media Alerts",
          "expanded": "Social Media Alerts",
          "uuid": "0c88c975-53d2-5446-9068-0a7b32f2fcb3"
        },
        {
          "value": "Supply Chain Event",
          "expanded": "Supply Chain Event",
          "uuid": "16f389a4-2b28-5851-b587-2c0608f12636"
        },
        {
          "value": "Technical Exposure",
          "expanded": "Technical Exposure",
          "uuid": "c357b0da-ec53-5867-8122-ad7dfee885a1"
        },
        {
          "value": "Threat Actor Update",
          "expanded": "Threat Actor Update",
          "uuid": "955b9f8a-4569-52f1-93e2-c2464d6915d1"
        },
        {
          "value": "Direct Targeting ",
          "expanded": "Direct Targeting ",
          "uuid": "a29aad55-a614-50c8-8917-be837a156c0f"
        },
        {
          "value": "Protest Activity",
          "expanded": "Protest Activity",
          "uuid": "f350b3f9-d60e-51ed-9379-f531f43065f8"
        },
        {
          "value": "Violent Event",
          "expanded": "Violent Event",
          "uuid": "ce5156c0-a299-5566-9101-16a088711877"
        },
        {
          "value": "Strategic Event",
          "expanded": "Strategic Event",
          "uuid": "f2750541-aae1-58a3-b8da-b5f64eaaa97a"
        },
        {
          "value": "Insider Threat",
          "expanded": "Insider Threat",
          "uuid": "b0624a23-741a-595c-95a7-3de74cf96f14"
        }
      ]
    }
  ],
  "uuid": "f2cd4dc4-1c05-5b9c-8e49-63c9763c25d2"
}