Skip to content
skopnix
Section E · Detections
Detection content · Sigma · QRadar · Cortex XDR

Detections.

505 rulesSIG 196AQL 129XQL 180generated 2026-10-18 13:29 UTC

Detections generated from skopnix's own intelligence: the indicators we hold at high confidence from several independent sources, the actively exploited CVEs whose exploit request has a distinctive signature, and the ATT&CK techniques our tracked actors are observed using. Each one is written for Sigma, IBM QRadar and Cortex XDR, mapped to ATT&CK, and linked to the finding that produced it.

Behaviour, exploitation, actor sweeps

121 findings · each in up to three languages

  1. Behaviour (ATT&CK technique)

    LSASS memory dump via comsvcs.dll MiniDump (T1003.001)

    Requires both 'comsvcs' and the MiniDump export (by name or ordinal

    APT1 · APT15 · APT27 · APT28 · APT3 · APT32 · 35 more

    T1003.001conf 90SIGAQLXQL

  2. Behaviour (ATT&CK technique)

    NTDS.dit copy via ntdsutil IFM (T1003.003)

    Matches only ntdsutil with both 'ifm' and 'create'; routine ntdsutil maintenance (metadata cleanup, snapshot listing) does not match.

    APT10 · APT15 · APT28 · Chimera · ENERGETIC BEAR · FIN13 · 10 more

    T1003.003conf 85SIGAQLXQL

  3. Behaviour (ATT&CK technique)

    Shadow copy or backup catalog deletion (T1490)

    Each branch needs both the binary and the destructive verb (delete shadows / shadowcopy delete / recoveryenabled no / delete catalog); listing or creating shadow copies does not match.

    blackbyte · Medusa Group · Sandworm · Scattered Spider · Storm-0501 · Void Manticore · 1 more

    T1490conf 85SIGAQLXQL

  4. Behaviour (ATT&CK technique)

    certutil used to download a remote file (T1105)

    Needs certutil, a download switch and an http(s) URL together; certutil hashing, encoding or CA administration does not match.

    APT-C-36 · APT10 · APT15 · APT18 · APT23 · APT27 · 76 more

    T1105conf 80SIGAQLXQL

  5. Behaviour (ATT&CK technique)

    mshta executing remote or inline script (T1218.005)

    Local .hta files without a URL or inline script handler do not match.

    APT29 · APT32 · Confucius · Earth Lusca · Gamaredon Group · GOLD CABIN · 7 more

    T1218.005conf 80SIGAQLXQL

  6. Behaviour (ATT&CK technique)

    PowerShell download cradle executed from the command line (T1059.001)

    All three conditions must hold (PowerShell binary, a download method, an execute verb); plain Invoke-WebRequest file downloads and encoded management scripts do not match.

    APT-C-36 · APT10 · APT19 · APT27 · APT28 · APT29 · 71 more

    T1059.001conf 80SIGAQLXQL

  7. Behaviour (ATT&CK technique)

    Windows event log cleared with wevtutil (T1685.005)

    Only the clear verbs match; wevtutil queries, exports and log configuration do not.

    APT28 · APT32 · Chimera · ENERGETIC BEAR · FIN5 · FIN8 · 5 more

    T1685.005conf 80SIGAQLXQL

  8. Behaviour (ATT&CK technique)

    Microsoft Defender protection disabled via Set-MpPreference (T1685)

    Requires Set-MpPreference together with a Disable* protection switch; exclusion management alone does not match. The value is not parsed — a re-enable ($false) also matches, so review before auto-response.

    APT2 · APT35 · APT5 · blackbyte · Contagious Interview · FIN6 · 21 more

    T1685conf 75SIGAQLXQL

  9. Behaviour (ATT&CK technique)

    AdFind domain trust or controller enumeration (T1482)

    Requires adfind plus a trust / DC enumeration switch; generic LDAP queries with other tools do not match.

    APT35 · blackbyte · Chimera · Earth Lusca · FIN8 · LOTUS PANDA · 4 more

    T1482conf 70SIGAQLXQL

  10. Behaviour (ATT&CK technique)

    rclone copy or sync to remote storage (T1567.002)

    Matches only rclone running copy/sync; listing, config and mount do not match. Renamed rclone binaries are not covered by the Cortex/QRadar versions (Sigma also checks the PE description).

    APT27 · APT31 · APT40 · BRONZE STARLIGHT · Chimera · Confucius · 17 more

    T1567.002conf 70SIGAQLXQL

  11. CVE exploitation

    CVE-2016-3081 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2016-3081

    T1190conf 90SIGAQLXQL

  12. CVE exploitation

    CVE-2023-46805 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2023-46805 · GhostEmperor · UNC5337 · UTA0178 · WARP PANDA

    T1190conf 90SIGAQLXQL

  13. CVE exploitation

    CVE-2024-21887 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2024-21887 · UNC5325 · UNC5330 · UNC5337 · UTA0178 · WARP PANDA

    T1190conf 90SIGAQLXQL

  14. CVE exploitation

    CVE-2025-61882 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2025-61882

    T1190conf 90SIGAQLXQL

  15. CVE exploitation

    CVE-2026-34908 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2026-34908

    T1190conf 90SIGAQLXQL

  16. CVE exploitation

    CVE-2026-34910 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2026-34910

    T1190conf 90SIGAQLXQL

  17. CVE exploitation

    CVE-2002-1131 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2002-1131

    T1190conf 70SIGAQLXQL

  18. CVE exploitation

    CVE-2006-2842 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2006-2842

    T1190conf 70SIGAQLXQL

  19. CVE exploitation

    CVE-2007-4504 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2007-4504

    T1190conf 70SIGAQLXQL

  20. CVE exploitation

    CVE-2008-1059 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-1059

    T1190conf 70SIGAQLXQL

  21. CVE exploitation

    CVE-2008-2650 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-2650

    T1190conf 70SIGAQLXQL

  22. CVE exploitation

    CVE-2008-4668 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-4668

    T1190conf 70SIGAQLXQL

  23. CVE exploitation

    CVE-2008-5587 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-5587

    T1190conf 70SIGAQLXQL

  24. CVE exploitation

    CVE-2008-6080 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-6080

    T1190conf 70SIGAQLXQL

  25. CVE exploitation

    CVE-2008-6172 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-6172

    T1190conf 70SIGAQLXQL

  26. CVE exploitation

    CVE-2008-6222 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-6222

    T1190conf 70SIGAQLXQL

  27. CVE exploitation

    CVE-2008-6668 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-6668

    T1190conf 70SIGAQLXQL

  28. CVE exploitation

    CVE-2009-0545 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-0545

    T1190conf 70SIGAQLXQL

  29. CVE exploitation

    CVE-2009-0932 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-0932

    T1190conf 70SIGAQLXQL

  30. CVE exploitation

    CVE-2009-1496 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-1496

    T1190conf 70SIGAQLXQL

  31. CVE exploitation

    CVE-2009-1872 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-1872

    T1190conf 70SIGAQLXQL

  32. CVE exploitation

    CVE-2009-2015 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-2015

    T1190conf 70SIGAQLXQL

  33. CVE exploitation

    CVE-2009-2100 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-2100

    T1190conf 70SIGAQLXQL

  34. CVE exploitation

    CVE-2009-3053 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-3053

    T1190conf 70SIGAQLXQL

  35. CVE exploitation

    CVE-2009-3318 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-3318

    T1190conf 70SIGAQLXQL

  36. CVE exploitation

    CVE-2009-4202 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-4202

    T1190conf 70SIGAQLXQL

  37. CVE exploitation

    CVE-2009-4679 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-4679

    T1190conf 70SIGAQLXQL

  38. CVE exploitation

    CVE-2009-5114 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-5114

    T1190conf 70SIGAQLXQL

  39. CVE exploitation

    CVE-2010-0157 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0157

    T1190conf 70SIGAQLXQL

  40. CVE exploitation

    CVE-2010-0467 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0467

    T1190conf 70SIGAQLXQL

  41. CVE exploitation

    CVE-2010-0696 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0696

    T1190conf 70SIGAQLXQL

  42. CVE exploitation

    CVE-2010-0942 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0942

    T1190conf 70SIGAQLXQL

  43. CVE exploitation

    CVE-2010-0943 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0943

    T1190conf 70SIGAQLXQL

  44. CVE exploitation

    CVE-2010-0944 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0944

    T1190conf 70SIGAQLXQL

  45. CVE exploitation

    CVE-2010-0972 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0972

    T1190conf 70SIGAQLXQL

  46. CVE exploitation

    CVE-2010-0982 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0982

    T1190conf 70SIGAQLXQL

  47. CVE exploitation

    CVE-2010-0985 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0985

    T1190conf 70SIGAQLXQL

  48. CVE exploitation

    CVE-2010-1056 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1056

    T1190conf 70SIGAQLXQL

  49. CVE exploitation

    CVE-2010-1081 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1081

    T1190conf 70SIGAQLXQL

  50. CVE exploitation

    CVE-2010-1217 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1217

    T1190conf 70SIGAQLXQL

  51. CVE exploitation

    CVE-2010-1219 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1219

    T1190conf 70SIGAQLXQL

  52. CVE exploitation

    CVE-2010-1302 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1302

    T1190conf 70SIGAQLXQL

  53. CVE exploitation

    CVE-2010-1304 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1304

    T1190conf 70SIGAQLXQL

  54. CVE exploitation

    CVE-2010-1305 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1305

    T1190conf 70SIGAQLXQL

  55. CVE exploitation

    CVE-2010-1306 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1306

    T1190conf 70SIGAQLXQL

  56. CVE exploitation

    CVE-2010-1307 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1307

    T1190conf 70SIGAQLXQL

  57. CVE exploitation

    CVE-2010-1308 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1308

    T1190conf 70SIGAQLXQL

  58. CVE exploitation

    CVE-2010-1312 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1312

    T1190conf 70SIGAQLXQL

  59. CVE exploitation

    CVE-2010-1313 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1313

    T1190conf 70SIGAQLXQL

  60. CVE exploitation

    CVE-2010-1314 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1314

    T1190conf 70SIGAQLXQL

  61. CVE exploitation

    CVE-2010-1315 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1315

    T1190conf 70SIGAQLXQL

  62. CVE exploitation

    CVE-2010-1340 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1340

    T1190conf 70SIGAQLXQL

  63. CVE exploitation

    CVE-2010-1345 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1345

    T1190conf 70SIGAQLXQL

  64. CVE exploitation

    CVE-2010-1352 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1352

    T1190conf 70SIGAQLXQL

  65. CVE exploitation

    CVE-2010-1353 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1353

    T1190conf 70SIGAQLXQL

  66. CVE exploitation

    CVE-2010-1354 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1354

    T1190conf 70SIGAQLXQL

  67. CVE exploitation

    CVE-2018-13379 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2018-13379 · APT29 · APT35 · DEV-0270 · ENERGETIC BEAR · Fox Kitten · lockbit · 3 more

    T1190conf 70SIGAQLXQL

  68. CVE exploitation

    CVE-2019-11510 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2019-11510 · APT29 · ENERGETIC BEAR · Fox Kitten · OilRig · Turla

    T1190conf 70SIGAQLXQL

  69. CVE exploitation

    CVE-2019-19781 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2019-19781 · APT29 · APT41 · Fox Kitten

    T1190conf 70SIGAQLXQL

  70. CVE exploitation

    CVE-2020-14750 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2020-14750 · Prophet Spider

    T1190conf 70SIGAQLXQL

  71. CVE exploitation

    CVE-2020-14882 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2020-14882 · Prophet Spider

    T1190conf 70SIGAQLXQL

  72. CVE exploitation

    CVE-2020-5902 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2020-5902 · BackdoorDiplomacy · Fox Kitten

    T1190conf 70SIGAQLXQL

  73. CVE exploitation

    CVE-2021-34473 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2021-34473 · APT35 · blackbyte · BRONZE STARLIGHT · Witchetty

    T1190conf 70SIGAQLXQL

  74. CVE exploitation

    CVE-2021-35464 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2021-35464 · Scattered Spider

    T1190conf 70SIGAQLXQL

  75. CVE exploitation

    CVE-2021-44228 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2021-44228 · APT35 · APT41 · BRONZE STARLIGHT · Sea Turtle · Water Sigbin

    T1190conf 70SIGAQLXQL

  76. CVE exploitation

    CVE-2022-44877 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2022-44877 · CRYSTALRAY

    T1190conf 70SIGAQLXQL

  77. CVE exploitation

    CVE-2023-22515 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2023-22515 · Storm-0062 · Ukrainian Cyber Alliance

    T1190conf 70SIGAQLXQL

  78. CVE exploitation

    CVE-2023-47246 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2023-47246 · DEV-0950

    T1190conf 70SIGAQLXQL

  79. CVE exploitation

    CVE-2026-12227 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2026-12227

    T1190conf 70SIGAQLXQL

  80. CVE exploitation

    CVE-2026-54617 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2026-54617

    T1190conf 70SIGAQLXQL

  81. Actor indicator sweep

    APT-C-36 domain indicators

    Every value is a skopnix indicator tied to APT-C-36 with confidence >= 86 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    APT-C-36

    T1071conf 86SIGAQLXQL

  82. Actor indicator sweep

    APT19 IP indicators

    Every value is a skopnix indicator tied to APT19 with confidence >= 86 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    APT19

    T1071conf 86SIGAQLXQL

  83. Actor indicator sweep

    Operation C-Major IP indicators

    Every value is a skopnix indicator tied to Operation C-Major with confidence >= 86 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Operation C-Major

    T1071conf 86SIGAQLXQL

  84. Actor indicator sweep

    blackbyte domain indicators

    Every value is a skopnix indicator tied to blackbyte with confidence >= 82 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    blackbyte

    T1071conf 82SIGAQLXQL

  85. Actor indicator sweep

    ShinyHunters domain indicators

    Every value is a skopnix indicator tied to ShinyHunters with confidence >= 82 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    ShinyHunters

    T1071conf 82SIGAQLXQL

  86. Actor indicator sweep

    Tortoiseshell IP indicators

    Every value is a skopnix indicator tied to Tortoiseshell with confidence >= 81 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Tortoiseshell

    T1071conf 81SIGAQLXQL

  87. Actor indicator sweep

    BRONZE STARLIGHT domain indicators

    Every value is a skopnix indicator tied to BRONZE STARLIGHT with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    BRONZE STARLIGHT

    T1071conf 77SIGAQLXQL

  88. Actor indicator sweep

    Callisto IP indicators

    Every value is a skopnix indicator tied to Callisto with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Callisto

    T1071conf 77SIGAQLXQL

  89. Actor indicator sweep

    CeranaKeeper file hash indicators

    Every value is a skopnix indicator tied to CeranaKeeper with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    CeranaKeeper

    T1204.002conf 77SIGAQLXQL

  90. Actor indicator sweep

    Common Raven IP indicators

    Every value is a skopnix indicator tied to Common Raven with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Common Raven

    T1071conf 77SIGAQLXQL

  91. Actor indicator sweep

    GreenSpot IP indicators

    Every value is a skopnix indicator tied to GreenSpot with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    GreenSpot

    T1071conf 77SIGAQLXQL

  92. Actor indicator sweep

    Inception Framework domain indicators

    Every value is a skopnix indicator tied to Inception Framework with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Inception Framework

    T1071conf 77SIGAQLXQL

  93. Actor indicator sweep

    Kinsing file hash indicators

    Every value is a skopnix indicator tied to Kinsing with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Kinsing

    T1204.002conf 77SIGAQLXQL

  94. Actor indicator sweep

    RUBYCARP domain indicators

    Every value is a skopnix indicator tied to RUBYCARP with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    RUBYCARP

    T1071conf 77SIGAQLXQL

  95. Actor indicator sweep

    TeamPCP domain indicators

    Every value is a skopnix indicator tied to TeamPCP with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    TeamPCP

    T1071conf 77SIGAQLXQL

  96. Actor indicator sweep

    UAT-9244 IP indicators

    Every value is a skopnix indicator tied to UAT-9244 with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    UAT-9244

    T1071conf 77SIGAQLXQL

  97. Actor indicator sweep

    Volt Typhoon file hash indicators

    Every value is a skopnix indicator tied to Volt Typhoon with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Volt Typhoon

    T1204.002conf 77SIGAQLXQL

  98. Actor indicator sweep

    Water Sigbin file hash indicators

    Every value is a skopnix indicator tied to Water Sigbin with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Water Sigbin

    T1204.002conf 77SIGAQLXQL

  99. Actor indicator sweep

    Water Sigbin IP indicators

    Every value is a skopnix indicator tied to Water Sigbin with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Water Sigbin

    T1071conf 77SIGAQLXQL

  100. Actor indicator sweep

    Tortoiseshell file hash indicators

    Every value is a skopnix indicator tied to Tortoiseshell with confidence >= 76 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Tortoiseshell

    T1204.002conf 76SIGAQLXQL

  101. Actor indicator sweep

    Whitefly file hash indicators

    Every value is a skopnix indicator tied to Whitefly with confidence >= 76 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Whitefly

    T1204.002conf 76SIGAQLXQL

  102. Actor indicator sweep

    APT41 file hash indicators

    Every value is a skopnix indicator tied to APT41 with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    APT41

    T1204.002conf 72SIGAQLXQL

  103. Actor indicator sweep

    blackbyte file hash indicators

    Every value is a skopnix indicator tied to blackbyte with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    blackbyte

    T1204.002conf 72SIGAQLXQL

  104. Actor indicator sweep

    Caliente Bandits file hash indicators

    Every value is a skopnix indicator tied to Caliente Bandits with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Caliente Bandits

    T1204.002conf 72SIGAQLXQL

  105. Actor indicator sweep

    DragonSpark file hash indicators

    Every value is a skopnix indicator tied to DragonSpark with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    DragonSpark

    T1204.002conf 72SIGAQL

  106. Actor indicator sweep

    FIN7 file hash indicators

    Every value is a skopnix indicator tied to FIN7 with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    FIN7

    T1204.002conf 72SIGAQLXQL

  107. Actor indicator sweep

    global file hash indicators

    Every value is a skopnix indicator tied to global with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    global

    T1204.002conf 72SIGAQLXQL

  108. Actor indicator sweep

    GOLD CABIN file hash indicators

    Every value is a skopnix indicator tied to GOLD CABIN with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    GOLD CABIN

    T1204.002conf 72SIGAQLXQL

  109. Actor indicator sweep

    HAZY TIGER file hash indicators

    Every value is a skopnix indicator tied to HAZY TIGER with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    HAZY TIGER

    T1204.002conf 72SIGAQLXQL

  110. Actor indicator sweep

    Kimsuky file hash indicators

    Every value is a skopnix indicator tied to Kimsuky with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Kimsuky

    T1204.002conf 72SIGAQLXQL

  111. Actor indicator sweep

    Mr_Rot13 file hash indicators

    Every value is a skopnix indicator tied to Mr_Rot13 with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Mr_Rot13

    T1204.002conf 72SIGAQLXQL

  112. Actor indicator sweep

    Predatory Sparrow file hash indicators

    Every value is a skopnix indicator tied to Predatory Sparrow with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Predatory Sparrow

    T1204.002conf 72SIGAQLXQL

  113. Actor indicator sweep

    rhysida file hash indicators

    Every value is a skopnix indicator tied to rhysida with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    rhysida

    T1204.002conf 72SIGAQL

  114. Actor indicator sweep

    RomCom file hash indicators

    Every value is a skopnix indicator tied to RomCom with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    RomCom

    T1204.002conf 72SIGAQLXQL

  115. Actor indicator sweep

    SaintBear file hash indicators

    Every value is a skopnix indicator tied to SaintBear with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    SaintBear

    T1204.002conf 72SIGAQL

  116. Actor indicator sweep

    Scarab file hash indicators

    Every value is a skopnix indicator tied to Scarab with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Scarab

    T1204.002conf 72SIGAQL

  117. Actor indicator sweep

    TA402 file hash indicators

    Every value is a skopnix indicator tied to TA402 with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    TA402

    T1204.002conf 72SIGAQLXQL

  118. Actor indicator sweep

    Turla file hash indicators

    Every value is a skopnix indicator tied to Turla with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Turla

    T1204.002conf 72SIGAQLXQL

  119. Actor indicator sweep

    Winter Vivern file hash indicators

    Every value is a skopnix indicator tied to Winter Vivern with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Winter Vivern

    T1204.002conf 72SIGAQL

  120. Actor indicator sweep

    XDSpy file hash indicators

    Every value is a skopnix indicator tied to XDSpy with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    XDSpy

    T1204.002conf 72SIGAQL

  121. Actor indicator sweep

    WindShift domain indicators

    Every value is a skopnix indicator tied to WindShift with confidence >= 71 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    WindShift

    T1071conf 71SIGAQLXQL

Single-indicator rules are on the Sigma, IBM QRadar and Cortex XDR pages; QRadar reads them from reference sets instead of rule text.

Browse

How to deploy

SIGSigma

  1. 1.Convert for your SIEM with sigma-cli / pySigma, e.g. sigma convert -t splunk -p sysmon rule.yml.
  2. 2.Run it as a hunt first: every rule ships as status experimental.
  3. 3.Promote to an alert once a week of results is clean on your data.

Check · The processing pipeline must map the logsource (firewall, dns, proxy, webserver, process_creation) to your field names.

AQLIBM QRadar

  1. 1.Create the reference set from its spec (Reference Data API, or Admin > Reference Set Management) and schedule the skopnix feed load.
  2. 2.Paste the AQL into Log Activity > Advanced Search to hunt the last seven days.
  3. 3.For alerting, build the CRE rule from the test stack shown and exclude your known-good building block.

Check · Custom properties ("URL Host", "URL", "File Hash", "Process CommandLine") come from your DSMs and content extensions; rename them if yours differ.

XQLCortex XDR

  1. 1.Paste the XQL into Incident Response > Investigation > Query Builder > XQL Search.
  2. 2.To alert, save it as a Correlation Rule and set the MITRE tactic and technique printed with the rule.
  3. 3.Schedule it on the interval you hunt at; keep the fields stage for the alert's columns.

Check · CVE rules read PAN-OS URL logs (panw_ngfw_url_raw), which need the NGFW integration and, for HTTPS, decryption.

How they are made

  • Quality over volume. An indicator gets a rule only at skopnix confidence 70 or more, from two or more independent sources, still active, and clean against the MISP warninglists (private and reserved space, CDN, cloud and scanner ranges, top sites), a GreyNoise verdict where we hold one, and our own benign list.
  • CVE rules key on the exploit, not the product. A CVE gets a rule only when its public exploit request carries something no normal request does: a path traversal, exploit syntax in the query, an unusual parameter. An exploit hidden in a header or body, or aimed at an endpoint the product serves every day, gets no rule rather than a noisy one.
  • Behaviour rules follow the actors. A technique rule is published only for a technique a tracked actor is on record using, and lists those actors.
  • Every rule says how it can misfire. Each carries its false-positive notes; all ship as experimental. Run them as hunts before they page anyone.
  • As data. /api/v1/detections?platform=&technique=&cve=&actor=, keyless.