UNC5820
Actor indicator sweep
UNC5820 IP indicators (historical, hunt only)HISTORICAL, HUNT ONLY: do not block on this. These indicators come from published reports and do not meet the bar of the live sweep. 4 indicators. Evidence: 4 listed only by scanner / honeypot feeds (not counted as evidence). No feed sighting date exists for any of them. Screened against reserved space, MISP warninglists (CDN / cloud / scanners / top sites), GreyNoise when enriched, and sinkhole address lists. Re-validate against last_seen before blocking: infrastructure is re-assigned.
How to deploy
SIGSigma
- 1.Convert for your SIEM with sigma-cli / pySigma, e.g. sigma convert -t splunk -p sysmon rule.yml.
- 2.Run it as a hunt first: every rule ships as status experimental.
- 3.Promote to an alert once a week of results is clean on your data.
Check · The processing pipeline must map the logsource (firewall, dns, proxy, webserver, process_creation) to your field names.
AQLIBM QRadar
- 1.Create the reference set from its spec (Reference Data API, or Admin > Reference Set Management) and schedule the skopnix feed load.
- 2.Paste the AQL into Log Activity > Advanced Search to hunt the last seven days.
- 3.For alerting, build the CRE rule from the test stack shown and exclude your known-good building block.
Check · Custom properties ("URL Host", "URL", "File Hash", "Process CommandLine") come from your DSMs and content extensions; rename them if yours differ.
XQLCortex XDR
- 1.Paste the XQL into Incident Response > Investigation > Query Builder > XQL Search.
- 2.To alert, save it as a Correlation Rule and set the MITRE tactic and technique printed with the rule.
- 3.Schedule it on the interval you hunt at; keep the fields stage for the alert's columns.
Check · CVE rules read PAN-OS URL logs (panw_ngfw_url_raw), which need the NGFW integration and, for HTTPS, decryption.