Skip to content
skopnix
Detections
← All detectionsKind

Actor indicator sweep

117 rules41 findings

  1. Actor indicator sweep

    APT-C-36 domain indicators

    Every value is a skopnix indicator tied to APT-C-36 with confidence >= 86 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    APT-C-36

    T1071conf 86SIGAQLXQL

  2. Actor indicator sweep

    APT19 IP indicators

    Every value is a skopnix indicator tied to APT19 with confidence >= 86 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    APT19

    T1071conf 86SIGAQLXQL

  3. Actor indicator sweep

    Operation C-Major IP indicators

    Every value is a skopnix indicator tied to Operation C-Major with confidence >= 86 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Operation C-Major

    T1071conf 86SIGAQLXQL

  4. Actor indicator sweep

    blackbyte domain indicators

    Every value is a skopnix indicator tied to blackbyte with confidence >= 82 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    blackbyte

    T1071conf 82SIGAQLXQL

  5. Actor indicator sweep

    ShinyHunters domain indicators

    Every value is a skopnix indicator tied to ShinyHunters with confidence >= 82 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    ShinyHunters

    T1071conf 82SIGAQLXQL

  6. Actor indicator sweep

    Tortoiseshell IP indicators

    Every value is a skopnix indicator tied to Tortoiseshell with confidence >= 81 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Tortoiseshell

    T1071conf 81SIGAQLXQL

  7. Actor indicator sweep

    BRONZE STARLIGHT domain indicators

    Every value is a skopnix indicator tied to BRONZE STARLIGHT with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    BRONZE STARLIGHT

    T1071conf 77SIGAQLXQL

  8. Actor indicator sweep

    Callisto IP indicators

    Every value is a skopnix indicator tied to Callisto with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Callisto

    T1071conf 77SIGAQLXQL

  9. Actor indicator sweep

    CeranaKeeper file hash indicators

    Every value is a skopnix indicator tied to CeranaKeeper with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    CeranaKeeper

    T1204.002conf 77SIGAQLXQL

  10. Actor indicator sweep

    Common Raven IP indicators

    Every value is a skopnix indicator tied to Common Raven with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Common Raven

    T1071conf 77SIGAQLXQL

  11. Actor indicator sweep

    GreenSpot IP indicators

    Every value is a skopnix indicator tied to GreenSpot with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    GreenSpot

    T1071conf 77SIGAQLXQL

  12. Actor indicator sweep

    Inception Framework domain indicators

    Every value is a skopnix indicator tied to Inception Framework with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Inception Framework

    T1071conf 77SIGAQLXQL

  13. Actor indicator sweep

    Kinsing file hash indicators

    Every value is a skopnix indicator tied to Kinsing with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Kinsing

    T1204.002conf 77SIGAQLXQL

  14. Actor indicator sweep

    RUBYCARP domain indicators

    Every value is a skopnix indicator tied to RUBYCARP with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    RUBYCARP

    T1071conf 77SIGAQLXQL

  15. Actor indicator sweep

    TeamPCP domain indicators

    Every value is a skopnix indicator tied to TeamPCP with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    TeamPCP

    T1071conf 77SIGAQLXQL

  16. Actor indicator sweep

    UAT-9244 IP indicators

    Every value is a skopnix indicator tied to UAT-9244 with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    UAT-9244

    T1071conf 77SIGAQLXQL

  17. Actor indicator sweep

    Volt Typhoon file hash indicators

    Every value is a skopnix indicator tied to Volt Typhoon with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Volt Typhoon

    T1204.002conf 77SIGAQLXQL

  18. Actor indicator sweep

    Water Sigbin file hash indicators

    Every value is a skopnix indicator tied to Water Sigbin with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Water Sigbin

    T1204.002conf 77SIGAQLXQL

  19. Actor indicator sweep

    Water Sigbin IP indicators

    Every value is a skopnix indicator tied to Water Sigbin with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Water Sigbin

    T1071conf 77SIGAQLXQL

  20. Actor indicator sweep

    Tortoiseshell file hash indicators

    Every value is a skopnix indicator tied to Tortoiseshell with confidence >= 76 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Tortoiseshell

    T1204.002conf 76SIGAQLXQL

  21. Actor indicator sweep

    Whitefly file hash indicators

    Every value is a skopnix indicator tied to Whitefly with confidence >= 76 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Whitefly

    T1204.002conf 76SIGAQLXQL

  22. Actor indicator sweep

    APT41 file hash indicators

    Every value is a skopnix indicator tied to APT41 with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    APT41

    T1204.002conf 72SIGAQLXQL

  23. Actor indicator sweep

    blackbyte file hash indicators

    Every value is a skopnix indicator tied to blackbyte with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    blackbyte

    T1204.002conf 72SIGAQLXQL

  24. Actor indicator sweep

    Caliente Bandits file hash indicators

    Every value is a skopnix indicator tied to Caliente Bandits with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Caliente Bandits

    T1204.002conf 72SIGAQLXQL

  25. Actor indicator sweep

    DragonSpark file hash indicators

    Every value is a skopnix indicator tied to DragonSpark with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    DragonSpark

    T1204.002conf 72SIGAQL

  26. Actor indicator sweep

    FIN7 file hash indicators

    Every value is a skopnix indicator tied to FIN7 with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    FIN7

    T1204.002conf 72SIGAQLXQL

  27. Actor indicator sweep

    global file hash indicators

    Every value is a skopnix indicator tied to global with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    global

    T1204.002conf 72SIGAQLXQL

  28. Actor indicator sweep

    GOLD CABIN file hash indicators

    Every value is a skopnix indicator tied to GOLD CABIN with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    GOLD CABIN

    T1204.002conf 72SIGAQLXQL

  29. Actor indicator sweep

    HAZY TIGER file hash indicators

    Every value is a skopnix indicator tied to HAZY TIGER with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    HAZY TIGER

    T1204.002conf 72SIGAQLXQL

  30. Actor indicator sweep

    Kimsuky file hash indicators

    Every value is a skopnix indicator tied to Kimsuky with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Kimsuky

    T1204.002conf 72SIGAQLXQL

  31. Actor indicator sweep

    Mr_Rot13 file hash indicators

    Every value is a skopnix indicator tied to Mr_Rot13 with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Mr_Rot13

    T1204.002conf 72SIGAQLXQL

  32. Actor indicator sweep

    Predatory Sparrow file hash indicators

    Every value is a skopnix indicator tied to Predatory Sparrow with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Predatory Sparrow

    T1204.002conf 72SIGAQLXQL

  33. Actor indicator sweep

    rhysida file hash indicators

    Every value is a skopnix indicator tied to rhysida with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    rhysida

    T1204.002conf 72SIGAQL

  34. Actor indicator sweep

    RomCom file hash indicators

    Every value is a skopnix indicator tied to RomCom with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    RomCom

    T1204.002conf 72SIGAQLXQL

  35. Actor indicator sweep

    SaintBear file hash indicators

    Every value is a skopnix indicator tied to SaintBear with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    SaintBear

    T1204.002conf 72SIGAQL

  36. Actor indicator sweep

    Scarab file hash indicators

    Every value is a skopnix indicator tied to Scarab with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Scarab

    T1204.002conf 72SIGAQL

  37. Actor indicator sweep

    TA402 file hash indicators

    Every value is a skopnix indicator tied to TA402 with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    TA402

    T1204.002conf 72SIGAQLXQL

  38. Actor indicator sweep

    Turla file hash indicators

    Every value is a skopnix indicator tied to Turla with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Turla

    T1204.002conf 72SIGAQLXQL

  39. Actor indicator sweep

    Winter Vivern file hash indicators

    Every value is a skopnix indicator tied to Winter Vivern with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Winter Vivern

    T1204.002conf 72SIGAQL

  40. Actor indicator sweep

    XDSpy file hash indicators

    Every value is a skopnix indicator tied to XDSpy with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    XDSpy

    T1204.002conf 72SIGAQL

  41. Actor indicator sweep

    WindShift domain indicators

    Every value is a skopnix indicator tied to WindShift with confidence >= 71 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    WindShift

    T1071conf 71SIGAQLXQL

How to deploy

SIGSigma

  1. 1.Convert for your SIEM with sigma-cli / pySigma, e.g. sigma convert -t splunk -p sysmon rule.yml.
  2. 2.Run it as a hunt first: every rule ships as status experimental.
  3. 3.Promote to an alert once a week of results is clean on your data.

Check · The processing pipeline must map the logsource (firewall, dns, proxy, webserver, process_creation) to your field names.

AQLIBM QRadar

  1. 1.Create the reference set from its spec (Reference Data API, or Admin > Reference Set Management) and schedule the skopnix feed load.
  2. 2.Paste the AQL into Log Activity > Advanced Search to hunt the last seven days.
  3. 3.For alerting, build the CRE rule from the test stack shown and exclude your known-good building block.

Check · Custom properties ("URL Host", "URL", "File Hash", "Process CommandLine") come from your DSMs and content extensions; rename them if yours differ.

XQLCortex XDR

  1. 1.Paste the XQL into Incident Response > Investigation > Query Builder > XQL Search.
  2. 2.To alert, save it as a Correlation Rule and set the MITRE tactic and technique printed with the rule.
  3. 3.Schedule it on the interval you hunt at; keep the fields stage for the alert's columns.

Check · CVE rules read PAN-OS URL logs (panw_ngfw_url_raw), which need the NGFW integration and, for HTTPS, decryption.