Skip to content
skopnix
Section E · Detections
← All detectionsPlatform

Cortex XDR

180 rules180 findings

  1. Behaviour (ATT&CK technique)

    LSASS memory dump via comsvcs.dll MiniDump (T1003.001)

    Requires both 'comsvcs' and the MiniDump export (by name or ordinal

    APT1 · APT15 · APT27 · APT28 · APT3 · APT32 · 35 more

    T1003.001conf 90XQL

  2. Behaviour (ATT&CK technique)

    NTDS.dit copy via ntdsutil IFM (T1003.003)

    Matches only ntdsutil with both 'ifm' and 'create'; routine ntdsutil maintenance (metadata cleanup, snapshot listing) does not match.

    APT10 · APT15 · APT28 · Chimera · ENERGETIC BEAR · FIN13 · 10 more

    T1003.003conf 85XQL

  3. Behaviour (ATT&CK technique)

    Shadow copy or backup catalog deletion (T1490)

    Each branch needs both the binary and the destructive verb (delete shadows / shadowcopy delete / recoveryenabled no / delete catalog); listing or creating shadow copies does not match.

    blackbyte · Medusa Group · Sandworm · Scattered Spider · Storm-0501 · Void Manticore · 1 more

    T1490conf 85XQL

  4. Behaviour (ATT&CK technique)

    certutil used to download a remote file (T1105)

    Needs certutil, a download switch and an http(s) URL together; certutil hashing, encoding or CA administration does not match.

    APT-C-36 · APT10 · APT15 · APT18 · APT23 · APT27 · 76 more

    T1105conf 80XQL

  5. Behaviour (ATT&CK technique)

    mshta executing remote or inline script (T1218.005)

    Local .hta files without a URL or inline script handler do not match.

    APT29 · APT32 · Confucius · Earth Lusca · Gamaredon Group · GOLD CABIN · 7 more

    T1218.005conf 80XQL

  6. Behaviour (ATT&CK technique)

    PowerShell download cradle executed from the command line (T1059.001)

    All three conditions must hold (PowerShell binary, a download method, an execute verb); plain Invoke-WebRequest file downloads and encoded management scripts do not match.

    APT-C-36 · APT10 · APT19 · APT27 · APT28 · APT29 · 71 more

    T1059.001conf 80XQL

  7. Behaviour (ATT&CK technique)

    Windows event log cleared with wevtutil (T1685.005)

    Only the clear verbs match; wevtutil queries, exports and log configuration do not.

    APT28 · APT32 · Chimera · ENERGETIC BEAR · FIN5 · FIN8 · 5 more

    T1685.005conf 80XQL

  8. Behaviour (ATT&CK technique)

    Microsoft Defender protection disabled via Set-MpPreference (T1685)

    Requires Set-MpPreference together with a Disable* protection switch; exclusion management alone does not match. The value is not parsed — a re-enable ($false) also matches, so review before auto-response.

    APT2 · APT35 · APT5 · blackbyte · Contagious Interview · FIN6 · 21 more

    T1685conf 75XQL

  9. Behaviour (ATT&CK technique)

    AdFind domain trust or controller enumeration (T1482)

    Requires adfind plus a trust / DC enumeration switch; generic LDAP queries with other tools do not match.

    APT35 · blackbyte · Chimera · Earth Lusca · FIN8 · LOTUS PANDA · 4 more

    T1482conf 70XQL

  10. Behaviour (ATT&CK technique)

    rclone copy or sync to remote storage (T1567.002)

    Matches only rclone running copy/sync; listing, config and mount do not match. Renamed rclone binaries are not covered by the Cortex/QRadar versions (Sigma also checks the PE description).

    APT27 · APT31 · APT40 · BRONZE STARLIGHT · Chimera · Confucius · 17 more

    T1567.002conf 70XQL

  11. CVE exploitation

    CVE-2016-3081 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2016-3081

    T1190conf 90XQL

  12. CVE exploitation

    CVE-2023-46805 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2023-46805 · GhostEmperor · UNC5337 · UTA0178 · WARP PANDA

    T1190conf 90XQL

  13. CVE exploitation

    CVE-2024-21887 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2024-21887 · UNC5325 · UNC5330 · UNC5337 · UTA0178 · WARP PANDA

    T1190conf 90XQL

  14. CVE exploitation

    CVE-2025-61882 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2025-61882

    T1190conf 90XQL

  15. CVE exploitation

    CVE-2026-34908 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2026-34908

    T1190conf 90XQL

  16. CVE exploitation

    CVE-2026-34910 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2026-34910

    T1190conf 90XQL

  17. CVE exploitation

    CVE-2002-1131 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2002-1131

    T1190conf 70XQL

  18. CVE exploitation

    CVE-2006-2842 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2006-2842

    T1190conf 70XQL

  19. CVE exploitation

    CVE-2007-4504 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2007-4504

    T1190conf 70XQL

  20. CVE exploitation

    CVE-2008-1059 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-1059

    T1190conf 70XQL

  21. CVE exploitation

    CVE-2008-2650 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-2650

    T1190conf 70XQL

  22. CVE exploitation

    CVE-2008-4668 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-4668

    T1190conf 70XQL

  23. CVE exploitation

    CVE-2008-5587 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-5587

    T1190conf 70XQL

  24. CVE exploitation

    CVE-2008-6080 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-6080

    T1190conf 70XQL

  25. CVE exploitation

    CVE-2008-6172 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-6172

    T1190conf 70XQL

  26. CVE exploitation

    CVE-2008-6222 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-6222

    T1190conf 70XQL

  27. CVE exploitation

    CVE-2008-6668 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-6668

    T1190conf 70XQL

  28. CVE exploitation

    CVE-2009-0545 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-0545

    T1190conf 70XQL

  29. CVE exploitation

    CVE-2009-0932 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-0932

    T1190conf 70XQL

  30. CVE exploitation

    CVE-2009-1496 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-1496

    T1190conf 70XQL

  31. CVE exploitation

    CVE-2009-1872 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-1872

    T1190conf 70XQL

  32. CVE exploitation

    CVE-2009-2015 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-2015

    T1190conf 70XQL

  33. CVE exploitation

    CVE-2009-2100 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-2100

    T1190conf 70XQL

  34. CVE exploitation

    CVE-2009-3053 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-3053

    T1190conf 70XQL

  35. CVE exploitation

    CVE-2009-3318 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-3318

    T1190conf 70XQL

  36. CVE exploitation

    CVE-2009-4202 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-4202

    T1190conf 70XQL

  37. CVE exploitation

    CVE-2009-4679 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-4679

    T1190conf 70XQL

  38. CVE exploitation

    CVE-2009-5114 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-5114

    T1190conf 70XQL

  39. CVE exploitation

    CVE-2010-0157 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0157

    T1190conf 70XQL

  40. CVE exploitation

    CVE-2010-0467 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0467

    T1190conf 70XQL

  41. CVE exploitation

    CVE-2010-0696 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0696

    T1190conf 70XQL

  42. CVE exploitation

    CVE-2010-0942 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0942

    T1190conf 70XQL

  43. CVE exploitation

    CVE-2010-0943 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0943

    T1190conf 70XQL

  44. CVE exploitation

    CVE-2010-0944 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0944

    T1190conf 70XQL

  45. CVE exploitation

    CVE-2010-0972 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0972

    T1190conf 70XQL

  46. CVE exploitation

    CVE-2010-0982 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0982

    T1190conf 70XQL

  47. CVE exploitation

    CVE-2010-0985 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0985

    T1190conf 70XQL

  48. CVE exploitation

    CVE-2010-1056 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1056

    T1190conf 70XQL

  49. CVE exploitation

    CVE-2010-1081 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1081

    T1190conf 70XQL

  50. CVE exploitation

    CVE-2010-1217 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1217

    T1190conf 70XQL

  51. CVE exploitation

    CVE-2010-1219 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1219

    T1190conf 70XQL

  52. CVE exploitation

    CVE-2010-1302 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1302

    T1190conf 70XQL

  53. CVE exploitation

    CVE-2010-1304 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1304

    T1190conf 70XQL

  54. CVE exploitation

    CVE-2010-1305 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1305

    T1190conf 70XQL

  55. CVE exploitation

    CVE-2010-1306 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1306

    T1190conf 70XQL

  56. CVE exploitation

    CVE-2010-1307 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1307

    T1190conf 70XQL

  57. CVE exploitation

    CVE-2010-1308 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1308

    T1190conf 70XQL

  58. CVE exploitation

    CVE-2010-1312 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1312

    T1190conf 70XQL

  59. CVE exploitation

    CVE-2010-1313 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1313

    T1190conf 70XQL

  60. CVE exploitation

    CVE-2010-1314 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1314

    T1190conf 70XQL

  61. CVE exploitation

    CVE-2010-1315 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1315

    T1190conf 70XQL

  62. CVE exploitation

    CVE-2010-1340 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1340

    T1190conf 70XQL

  63. CVE exploitation

    CVE-2010-1345 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1345

    T1190conf 70XQL

  64. CVE exploitation

    CVE-2010-1352 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1352

    T1190conf 70XQL

  65. CVE exploitation

    CVE-2010-1353 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1353

    T1190conf 70XQL

  66. CVE exploitation

    CVE-2010-1354 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1354

    T1190conf 70XQL

  67. CVE exploitation

    CVE-2018-13379 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2018-13379 · APT29 · APT35 · DEV-0270 · ENERGETIC BEAR · Fox Kitten · lockbit · 3 more

    T1190conf 70XQL

  68. CVE exploitation

    CVE-2019-11510 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2019-11510 · APT29 · ENERGETIC BEAR · Fox Kitten · OilRig · Turla

    T1190conf 70XQL

  69. CVE exploitation

    CVE-2019-19781 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2019-19781 · APT29 · APT41 · Fox Kitten

    T1190conf 70XQL

  70. CVE exploitation

    CVE-2020-14750 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2020-14750 · Prophet Spider

    T1190conf 70XQL

  71. CVE exploitation

    CVE-2020-14882 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2020-14882 · Prophet Spider

    T1190conf 70XQL

  72. CVE exploitation

    CVE-2020-5902 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2020-5902 · BackdoorDiplomacy · Fox Kitten

    T1190conf 70XQL

  73. CVE exploitation

    CVE-2021-34473 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2021-34473 · APT35 · blackbyte · BRONZE STARLIGHT · Witchetty

    T1190conf 70XQL

  74. CVE exploitation

    CVE-2021-35464 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2021-35464 · Scattered Spider

    T1190conf 70XQL

  75. CVE exploitation

    CVE-2021-44228 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2021-44228 · APT35 · APT41 · BRONZE STARLIGHT · Sea Turtle · Water Sigbin

    T1190conf 70XQL

  76. CVE exploitation

    CVE-2022-44877 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2022-44877 · CRYSTALRAY

    T1190conf 70XQL

  77. CVE exploitation

    CVE-2023-22515 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2023-22515 · Storm-0062 · Ukrainian Cyber Alliance

    T1190conf 70XQL

  78. CVE exploitation

    CVE-2023-47246 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2023-47246 · DEV-0950

    T1190conf 70XQL

  79. CVE exploitation

    CVE-2026-12227 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2026-12227

    T1190conf 70XQL

  80. CVE exploitation

    CVE-2026-54617 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2026-54617

    T1190conf 70XQL

  81. Actor indicator sweep

    APT-C-36 domain indicators

    Every value is a skopnix indicator tied to APT-C-36 with confidence >= 86 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    APT-C-36

    T1071conf 86XQL

  82. Actor indicator sweep

    APT19 IP indicators

    Every value is a skopnix indicator tied to APT19 with confidence >= 86 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    APT19

    T1071conf 86XQL

  83. Actor indicator sweep

    Operation C-Major IP indicators

    Every value is a skopnix indicator tied to Operation C-Major with confidence >= 86 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Operation C-Major

    T1071conf 86XQL

  84. Actor indicator sweep

    blackbyte domain indicators

    Every value is a skopnix indicator tied to blackbyte with confidence >= 82 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    blackbyte

    T1071conf 82XQL

  85. Actor indicator sweep

    ShinyHunters domain indicators

    Every value is a skopnix indicator tied to ShinyHunters with confidence >= 82 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    ShinyHunters

    T1071conf 82XQL

  86. Actor indicator sweep

    Tortoiseshell IP indicators

    Every value is a skopnix indicator tied to Tortoiseshell with confidence >= 81 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Tortoiseshell

    T1071conf 81XQL

  87. Actor indicator sweep

    BRONZE STARLIGHT domain indicators

    Every value is a skopnix indicator tied to BRONZE STARLIGHT with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    BRONZE STARLIGHT

    T1071conf 77XQL

  88. Actor indicator sweep

    Callisto IP indicators

    Every value is a skopnix indicator tied to Callisto with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Callisto

    T1071conf 77XQL

  89. Actor indicator sweep

    CeranaKeeper file hash indicators

    Every value is a skopnix indicator tied to CeranaKeeper with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    CeranaKeeper

    T1204.002conf 77XQL

  90. Actor indicator sweep

    Common Raven IP indicators

    Every value is a skopnix indicator tied to Common Raven with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Common Raven

    T1071conf 77XQL

  91. Actor indicator sweep

    GreenSpot IP indicators

    Every value is a skopnix indicator tied to GreenSpot with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    GreenSpot

    T1071conf 77XQL

  92. Actor indicator sweep

    Inception Framework domain indicators

    Every value is a skopnix indicator tied to Inception Framework with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Inception Framework

    T1071conf 77XQL

  93. Actor indicator sweep

    Kinsing file hash indicators

    Every value is a skopnix indicator tied to Kinsing with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Kinsing

    T1204.002conf 77XQL

  94. Actor indicator sweep

    RUBYCARP domain indicators

    Every value is a skopnix indicator tied to RUBYCARP with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    RUBYCARP

    T1071conf 77XQL

  95. Actor indicator sweep

    TeamPCP domain indicators

    Every value is a skopnix indicator tied to TeamPCP with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    TeamPCP

    T1071conf 77XQL

  96. Actor indicator sweep

    UAT-9244 IP indicators

    Every value is a skopnix indicator tied to UAT-9244 with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    UAT-9244

    T1071conf 77XQL

  97. Actor indicator sweep

    Volt Typhoon file hash indicators

    Every value is a skopnix indicator tied to Volt Typhoon with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Volt Typhoon

    T1204.002conf 77XQL

  98. Actor indicator sweep

    Water Sigbin file hash indicators

    Every value is a skopnix indicator tied to Water Sigbin with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Water Sigbin

    T1204.002conf 77XQL

  99. Actor indicator sweep

    Water Sigbin IP indicators

    Every value is a skopnix indicator tied to Water Sigbin with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Water Sigbin

    T1071conf 77XQL

  100. Actor indicator sweep

    Tortoiseshell file hash indicators

    Every value is a skopnix indicator tied to Tortoiseshell with confidence >= 76 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Tortoiseshell

    T1204.002conf 76XQL

  101. Actor indicator sweep

    Whitefly file hash indicators

    Every value is a skopnix indicator tied to Whitefly with confidence >= 76 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Whitefly

    T1204.002conf 76XQL

  102. Actor indicator sweep

    APT41 file hash indicators

    Every value is a skopnix indicator tied to APT41 with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    APT41

    T1204.002conf 72XQL

  103. Actor indicator sweep

    blackbyte file hash indicators

    Every value is a skopnix indicator tied to blackbyte with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    blackbyte

    T1204.002conf 72XQL

  104. Actor indicator sweep

    Caliente Bandits file hash indicators

    Every value is a skopnix indicator tied to Caliente Bandits with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Caliente Bandits

    T1204.002conf 72XQL

  105. Actor indicator sweep

    FIN7 file hash indicators

    Every value is a skopnix indicator tied to FIN7 with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    FIN7

    T1204.002conf 72XQL

  106. Actor indicator sweep

    global file hash indicators

    Every value is a skopnix indicator tied to global with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    global

    T1204.002conf 72XQL

  107. Actor indicator sweep

    GOLD CABIN file hash indicators

    Every value is a skopnix indicator tied to GOLD CABIN with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    GOLD CABIN

    T1204.002conf 72XQL

  108. Actor indicator sweep

    HAZY TIGER file hash indicators

    Every value is a skopnix indicator tied to HAZY TIGER with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    HAZY TIGER

    T1204.002conf 72XQL

  109. Actor indicator sweep

    Kimsuky file hash indicators

    Every value is a skopnix indicator tied to Kimsuky with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Kimsuky

    T1204.002conf 72XQL

  110. Actor indicator sweep

    Mr_Rot13 file hash indicators

    Every value is a skopnix indicator tied to Mr_Rot13 with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Mr_Rot13

    T1204.002conf 72XQL

  111. Actor indicator sweep

    Predatory Sparrow file hash indicators

    Every value is a skopnix indicator tied to Predatory Sparrow with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Predatory Sparrow

    T1204.002conf 72XQL

  112. Actor indicator sweep

    RomCom file hash indicators

    Every value is a skopnix indicator tied to RomCom with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    RomCom

    T1204.002conf 72XQL

  113. Actor indicator sweep

    TA402 file hash indicators

    Every value is a skopnix indicator tied to TA402 with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    TA402

    T1204.002conf 72XQL

  114. Actor indicator sweep

    Turla file hash indicators

    Every value is a skopnix indicator tied to Turla with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Turla

    T1204.002conf 72XQL

  115. Actor indicator sweep

    WindShift domain indicators

    Every value is a skopnix indicator tied to WindShift with confidence >= 71 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    WindShift

    T1071conf 71XQL

  116. Indicator

    Request to known malicious URL on frame-kite.com

    Scoped to one indicator with skopnix confidence 100/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    T1105conf 100XQL

  117. Indicator

    Request to known malicious URL on frame-kite.com

    Scoped to one indicator with skopnix confidence 100/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    T1105conf 100XQL

  118. Indicator

    DNS query for known malicious domain scan.aquasecurtiy.org

    Scoped to one indicator with skopnix confidence 85/100 from 3 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    TeamPCP

    T1071conf 85XQL

  119. Indicator

    Traffic to known C2 IP 154.205.154.82

    Scoped to one indicator with skopnix confidence 82/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    UAT-9244

    T1071conf 82XQL

  120. Indicator

    Execution of known malicious file 7de8b8b314f2d2fb…

    Scoped to one indicator with skopnix confidence 81/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Whitefly

    T1204.002conf 81XQL

  121. Indicator

    DNS query for known malicious domain acortaurl.com

    Scoped to one indicator with skopnix confidence 86/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    APT-C-36

    T1071conf 86XQL

  122. Indicator

    DNS query for known malicious domain cort.as

    Scoped to one indicator with skopnix confidence 86/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    APT-C-36

    T1071conf 86XQL

  123. Indicator

    DNS query for known malicious domain gtly.to

    Scoped to one indicator with skopnix confidence 86/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    APT-C-36

    T1071conf 86XQL

  124. Indicator

    Traffic to known malicious IP 198.200.45.112

    Scoped to one indicator with skopnix confidence 86/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    APT19

    T1071conf 86XQL

  125. Indicator

    Traffic to known malicious IP 209.127.19.241

    Scoped to one indicator with skopnix confidence 86/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Operation C-Major

    T1071conf 86XQL

  126. Indicator

    DNS query for known malicious domain azurenetfiles.net

    Scoped to one indicator with skopnix confidence 82/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    ShinyHunters

    T1071conf 82XQL

  127. Indicator

    DNS query for known malicious domain file.io

    Scoped to one indicator with skopnix confidence 82/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    blackbyte

    T1071conf 82XQL

  128. Indicator

    Traffic to known malicious IP 64.235.60.123

    Scoped to one indicator with skopnix confidence 81/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Tortoiseshell

    T1071conf 81XQL

  129. Indicator

    DNS query for known malicious domain checkmarx.zone

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    TeamPCP

    T1071conf 77XQL

  130. Indicator

    DNS query for known malicious domain cloudme.com

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Inception Framework

    T1071conf 77XQL

  131. Indicator

    DNS query for known malicious domain duckducklive.top

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    BRONZE STARLIGHT

    T1071conf 77XQL

  132. Indicator

    DNS query for known malicious domain sshd.run

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    RUBYCARP

    T1071conf 77XQL

  133. Indicator

    Execution of known malicious file 1df11bc19aa52b62…

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    blackbyte

    T1204.002conf 77XQL

  134. Indicator

    Execution of known malicious file 780965bad574e4e7…

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Water Sigbin

    T1204.002conf 77XQL

  135. Indicator

    Execution of known malicious file baeffeb5fdef2f42…

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Volt Typhoon

    T1204.002conf 77XQL

  136. Indicator

    Execution of known malicious file c38c21120d8c1768…

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Kinsing

    T1204.002conf 77XQL

  137. Indicator

    Execution of known malicious file dafad19900fff383…

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    CeranaKeeper

    T1204.002conf 77XQL

  138. Indicator

    Execution of known malicious file eb2f5e1b8f818cf6…

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Water Sigbin

    T1204.002conf 77XQL

  139. Indicator

    Execution of known malicious file f0551696774f66ad…

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Water Sigbin

    T1204.002conf 77XQL

  140. Indicator

    Request to known malicious URL on officemysuppbox.com

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    TA505

    T1105conf 77XQL

  141. Indicator

    Traffic to known C2 IP 178.73.192.17

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Common Raven

    T1071conf 77XQL

  142. Indicator

    Traffic to known C2 IP 207.148.120.52

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    UAT-9244

    T1071conf 77XQL

  143. Indicator

    Traffic to known C2 IP 207.148.121.95

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    UAT-9244

    T1071conf 77XQL

  144. Indicator

    Traffic to known C2 IP 212.11.64.105

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    UAT-9244

    T1071conf 77XQL

  145. Indicator

    Traffic to known C2 IP 45.133.216.15

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Callisto

    T1071conf 77XQL

  146. Indicator

    Traffic to known C2 IP 46.246.84.17

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Common Raven

    T1071conf 77XQL

  147. Indicator

    Traffic to known malicious IP 152.32.138.108

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    GreenSpot

    T1071conf 77XQL

  148. Indicator

    Traffic to known malicious IP 185.172.128.146

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Water Sigbin

    T1071conf 77XQL

  149. Indicator

    Execution of known malicious file 02a3296238a3d127…

    Scoped to one indicator with skopnix confidence 76/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Tortoiseshell

    T1204.002conf 76XQL

  150. Indicator

    Execution of known malicious file 07d123364d8d04e3…

    Scoped to one indicator with skopnix confidence 76/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Tortoiseshell

    T1204.002conf 76XQL

  151. Indicator

    Execution of known malicious file 263dc5a8121d2040…

    Scoped to one indicator with skopnix confidence 76/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Whitefly

    T1204.002conf 76XQL

  152. Indicator

    Execution of known malicious file d9ac9c950e5495c9…

    Scoped to one indicator with skopnix confidence 76/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Tortoiseshell

    T1204.002conf 76XQL

  153. Indicator

    Execution of known malicious file f71732f997c53fa4…

    Scoped to one indicator with skopnix confidence 76/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Tortoiseshell

    T1204.002conf 76XQL

  154. Indicator

    Request to known malicious URL on cdn.wovplaying.help

    Scoped to one indicator with skopnix confidence 75/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    T1105conf 75XQL

  155. Indicator

    Execution of known malicious file 007a67bfa732084b…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    RomCom

    T1204.002conf 72XQL

  156. Indicator

    Execution of known malicious file 0097b8722c8c0840…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    blackbyte

    T1204.002conf 72XQL

  157. Indicator

    Execution of known malicious file 030cbd1a51f8583c…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Turla

    T1204.002conf 72XQL

  158. Indicator

    Execution of known malicious file 10cec5a84943f9b0…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    HAZY TIGER

    T1204.002conf 72XQL

  159. Indicator

    Execution of known malicious file 2286f126ab4740cc…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Mr_Rot13

    T1204.002conf 72XQL

  160. Indicator

    Execution of known malicious file 2e4671c517040cbd…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    TA402

    T1204.002conf 72XQL

  161. Indicator

    Execution of known malicious file 3fb160e1770fafee…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    blackbyte

    T1204.002conf 72XQL

  162. Indicator

    Execution of known malicious file 4468edc18de42e61…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    GOLD CABIN

    T1204.002conf 72XQL

  163. Indicator

    Execution of known malicious file 561cb93118fef196…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Caliente Bandits

    T1204.002conf 72XQL

  164. Indicator

    Execution of known malicious file 5eaa1f5305f4c252…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Caliente Bandits

    T1204.002conf 72XQL

  165. Indicator

    Execution of known malicious file 62ecc8950e8be104…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    GOLD CABIN

    T1204.002conf 72XQL

  166. Indicator

    Execution of known malicious file 6943fbb194317d34…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    APT41

    T1204.002conf 72XQL

  167. Indicator

    Execution of known malicious file 6f47723e5fc6e96a…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    RomCom

    T1204.002conf 72XQL

  168. Indicator

    Execution of known malicious file 837e9bb07d884385…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Predatory Sparrow

    T1204.002conf 72XQL

  169. Indicator

    Execution of known malicious file 884e96a75dc56807…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    blackbyte

    T1204.002conf 72XQL

  170. Indicator

    Execution of known malicious file 925aff03ab009c8e…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    TA402

    T1204.002conf 72XQL

  171. Indicator

    Execution of known malicious file 9b281a8220a6098f…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    GOLD CABIN

    T1204.002conf 72XQL

  172. Indicator

    Execution of known malicious file a173a425d17b6f23…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Kimsuky

    T1204.002conf 72XQL

  173. Indicator

    Execution of known malicious file a8c28bd6f0f1fe6a…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    global

    T1204.002conf 72XQL

  174. Indicator

    Execution of known malicious file b86678403d77efbd…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Predatory Sparrow

    T1204.002conf 72XQL

  175. Indicator

    Execution of known malicious file c7ab300df27ad41f…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    HAZY TIGER

    T1204.002conf 72XQL

  176. Indicator

    Execution of known malicious file caa7667bfdbcb04c…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    FIN7

    T1204.002conf 72XQL

  177. Indicator

    Execution of known malicious file f6c77098906f5634…

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    HAZY TIGER

    T1204.002conf 72XQL

  178. Indicator

    Request to known malicious URL on testdomain123123.shop

    Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Angry Likho

    T1105conf 72XQL

  179. Indicator

    DNS query for known malicious domain flux2key.com

    Scoped to one indicator with skopnix confidence 71/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    WindShift

    T1071conf 71XQL

  180. Indicator

    DNS query for known malicious domain string2me.com

    Scoped to one indicator with skopnix confidence 71/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    WindShift

    T1071conf 71XQL

How to deploy on Cortex XDR

  1. 1.Paste the XQL into Incident Response > Investigation > Query Builder > XQL Search.
  2. 2.To alert, save it as a Correlation Rule and set the MITRE tactic and technique printed with the rule.
  3. 3.Schedule it on the interval you hunt at; keep the fields stage for the alert's columns.

Check · CVE rules read PAN-OS URL logs (panw_ngfw_url_raw), which need the NGFW integration and, for HTTPS, decryption.