malicialab
commented
3 years ago Hi there, We are planning to release a MISP taxonomy and/or galaxy soon. In the meantime these are what we believe are the most related existing taxonomies:
CLASS --> ms-caro-malware:malware-type, malware-category:malware-category FILE --> ms-caro-malware:malware-platform FAM --> ms-caro-malware:malware-family, mwdb:family BEH --> maec-malware-behavior:maec-malware-behavior
If this addresses your question, please close the issue
imidoriya
I'm looking to use avclass2 to classify malware in my MISP instance. After getting a result from avclass, I'd like to give it an appropriate tag. Just wondering if you had a recommendation for tag taxonomies that would best align with the return of avclass.
Here are the MISP taxonomies
The ones that look like they might fit.
ms-caro-malware-full
Malware Type and Platform classification based on Microsoft's implementation of the Computer Antivirus Research Organization (CARO) Naming Scheme and Malware Terminology. Based on https://www.microsoft.com/en-us/security/portal/mmpc/shared/malwarenaming.aspx, https://www.microsoft.com/security/portal/mmpc/shared/glossary.aspx, https://www.microsoft.com/security/portal/mmpc/shared/objectivecriteria.aspx, and http://www.caro.org/definitions/index.html. Malware families are extracted from Microsoft SIRs since 2008 based on https://www.microsoft.com/security/sir/archive/default.aspx and https://www.microsoft.com/en-us/security/portal/threat/threats.aspx. Note that SIRs do NOT include all Microsoft malware families.
mwdb
Malware Database (mwdb) Taxonomy - Tags used across the platform
malware_classification
Classification based on different categories. Based on https://www.sans.org/reading-room/whitepapers/incident/malware-101-viruses-32848