Water Sigbin
CVE exploitation
CVE-2021-44228 exploitation attemptKeys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.
CVE-2021-44228 · APT35 · APT41 · BRONZE STARLIGHT · Sea Turtle · Water Sigbin
Actor indicator sweep
Water Sigbin file hash indicatorsEvery value is a skopnix indicator tied to Water Sigbin with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.
Actor indicator sweep
Water Sigbin IP indicatorsEvery value is a skopnix indicator tied to Water Sigbin with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.
Indicator
Malicious IPsMatches only members of the skopnix reference set (high-confidence, multi-source, warninglist-clean, time-to-live bounded). Add RFC1918 and your known-good destinations to the exclusion building block.
APT19 · Callisto · Common Raven · GreenSpot · Operation C-Major · Tortoiseshell · 2 more
Indicator
Outbound connection to known-malicious IPMatches only members of the skopnix reference set (high-confidence, multi-source, warninglist-clean, time-to-live bounded). Add RFC1918 and your known-good destinations to the exclusion building block.
APT19 · Callisto · Common Raven · GreenSpot · Operation C-Major · Tortoiseshell · 2 more
Indicator
Known-malicious file hash observedMatches only members of the skopnix reference set (high-confidence, multi-source, warninglist-clean, time-to-live bounded). Add RFC1918 and your known-good destinations to the exclusion building block.
APT41 · blackbyte · Caliente Bandits · CeranaKeeper · DragonSpark · FIN7 · 19 more
Indicator
Malicious HashesMatches only members of the skopnix reference set (high-confidence, multi-source, warninglist-clean, time-to-live bounded). Add RFC1918 and your known-good destinations to the exclusion building block.
APT41 · blackbyte · Caliente Bandits · CeranaKeeper · DragonSpark · FIN7 · 19 more
Indicator
Execution of known malicious file 4180c193f366021f…Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.
Indicator
Execution of known malicious file 780965bad574e4e7…Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.
Indicator
Execution of known malicious file eb2f5e1b8f818cf6…Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.
Indicator
Execution of known malicious file f0551696774f66ad…Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.
Indicator
Traffic to known malicious IP 185.172.128.146Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.
How to deploy
SIGSigma
- 1.Convert for your SIEM with sigma-cli / pySigma, e.g. sigma convert -t splunk -p sysmon rule.yml.
- 2.Run it as a hunt first: every rule ships as status experimental.
- 3.Promote to an alert once a week of results is clean on your data.
Check · The processing pipeline must map the logsource (firewall, dns, proxy, webserver, process_creation) to your field names.
AQLIBM QRadar
- 1.Create the reference set from its spec (Reference Data API, or Admin > Reference Set Management) and schedule the skopnix feed load.
- 2.Paste the AQL into Log Activity > Advanced Search to hunt the last seven days.
- 3.For alerting, build the CRE rule from the test stack shown and exclude your known-good building block.
Check · Custom properties ("URL Host", "URL", "File Hash", "Process CommandLine") come from your DSMs and content extensions; rename them if yours differ.
XQLCortex XDR
- 1.Paste the XQL into Incident Response > Investigation > Query Builder > XQL Search.
- 2.To alert, save it as a Correlation Rule and set the MITRE tactic and technique printed with the rule.
- 3.Schedule it on the interval you hunt at; keep the fields stage for the alert's columns.
Check · CVE rules read PAN-OS URL logs (panw_ngfw_url_raw), which need the NGFW integration and, for HTTPS, decryption.