For use with Maltego CaseFile (http://www.paterva.com/web6/products/casefile.php).

Maltego CaseFile is a trademarked product of Paterva. I am presenting these entities and add-ons as a community contribution. I am in no way affiliated, directly or in-directly, with Paterva or the Maltego product line.

This is a basic group to entities to help analysts and investigators use Maltego CaseFile for information security, malware analysis and incident response specific cases. More entities and categories will be added in the very near future, these were throw together rather quickly.

A full list of all the entities included so far is listed below.

The current entities are organized into different categories, some of them new and some are additions to existing categories. The biggest addition is the 'Malware' category which adds entities for things like file hashes, paths, process and service names, etc.

Hopefully this will be useful to some people while performing investigations and attempting to get a good graph or visualization of what happened during the course of events. I'll be expanding on this overtime and I'm definitely open to feedback and suggestions. Feel free to send in Git commits or shoot me an email if you think anything else should be added.

Full Entity List

Devices

Zombie Compromised bot or zombie host C2 Command and Control host Botnet DNS Relay DNS server relay for botnet Compromised Host Infected or compromised device

Events

Exploit Exploit or attack vector, CVE id or other vulnerability identifier Exploitation Chain Multiple exploit or attack vector chain Phishing Phishing entity for individual event or campaign classification.

Malware

Filename File used for or by malware. Hash Malware sample checksum Registry Entry Malicious Host Browser Cookie Browser cookie stored or created by malware Malicious Process Process ID, name or other identifier Service Name Malicious service name User Account User account created or used by malware Certificate SSL or code-signing certificate used by malware File Path File/directory path created or used by malware Hidden File File hidden by malware HTTP Request HTTP or HTTPS requested used for malware communication

Threat Actors

Advanced Targeted Attacker Advanced threat group or individual Insider threat Internal threat actor such as contractor or employee Organized Crime Organized cyber crime group Opportunity Attacker Non-targeted, opportunity attacker