Sigma

Behaviour (ATT&CK technique)

Requires both 'comsvcs' and the MiniDump export (by name or ordinal

APT1 · APT15 · APT27 · APT28 · APT3 · APT32 · 35 more

Behaviour (ATT&CK technique)

Matches only ntdsutil with both 'ifm' and 'create'; routine ntdsutil maintenance (metadata cleanup, snapshot listing) does not match.

APT10 · APT15 · APT28 · Chimera · ENERGETIC BEAR · FIN13 · 10 more

Behaviour (ATT&CK technique)

Each branch needs both the binary and the destructive verb (delete shadows / shadowcopy delete / recoveryenabled no / delete catalog); listing or creating shadow copies does not match.

blackbyte · Medusa Group · Sandworm · Scattered Spider · Storm-0501 · Void Manticore · 1 more

Behaviour (ATT&CK technique)

Needs certutil, a download switch and an http(s) URL together; certutil hashing, encoding or CA administration does not match.

APT-C-36 · APT10 · APT15 · APT18 · APT23 · APT27 · 76 more

Behaviour (ATT&CK technique)

Local .hta files without a URL or inline script handler do not match.

APT29 · APT32 · Confucius · Earth Lusca · Gamaredon Group · GOLD CABIN · 7 more

Behaviour (ATT&CK technique)

All three conditions must hold (PowerShell binary, a download method, an execute verb); plain Invoke-WebRequest file downloads and encoded management scripts do not match.

APT-C-36 · APT10 · APT19 · APT27 · APT28 · APT29 · 71 more

Behaviour (ATT&CK technique)

Only the clear verbs match; wevtutil queries, exports and log configuration do not.

APT28 · APT32 · Chimera · ENERGETIC BEAR · FIN5 · FIN8 · 5 more

Behaviour (ATT&CK technique)

Requires Set-MpPreference together with a Disable* protection switch; exclusion management alone does not match. The value is not parsed — a re-enable ($false) also matches, so review before auto-response.

APT2 · APT35 · APT5 · blackbyte · Contagious Interview · FIN6 · 21 more

Behaviour (ATT&CK technique)

Requires adfind plus a trust / DC enumeration switch; generic LDAP queries with other tools do not match.

APT35 · blackbyte · Chimera · Earth Lusca · FIN8 · LOTUS PANDA · 4 more

Behaviour (ATT&CK technique)

Matches only rclone running copy/sync; listing, config and mount do not match. Renamed rclone binaries are not covered by the Cortex/QRadar versions (Sigma also checks the PE description).

APT27 · APT31 · APT40 · BRONZE STARLIGHT · Chimera · Confucius · 17 more

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2016-3081

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2023-46805 · GhostEmperor · UNC5337 · UTA0178 · WARP PANDA

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2024-21887 · UNC5325 · UNC5330 · UNC5337 · UTA0178 · WARP PANDA

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2025-61882

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2026-34908

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2026-34910

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2002-1131

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2006-2842

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2007-4504

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2008-1059

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2008-2650

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2008-4668

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2008-5587

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2008-6080

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2008-6172

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2008-6222

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2008-6668

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2009-0545

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2009-0932

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2009-1496

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2009-1872

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2009-2015

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2009-2100

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2009-3053

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2009-3318

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2009-4202

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2009-4679

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2009-5114

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-0157

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-0467

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-0696

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-0942

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-0943

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-0944

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-0972

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-0982

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-0985

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-1056

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-1081

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-1217

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-1219

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-1302

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-1304

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-1305

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-1306

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-1307

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-1308

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-1312

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-1313

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-1314

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-1315

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-1340

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-1345

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-1352

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-1353

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2010-1354

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2018-13379 · APT29 · APT35 · DEV-0270 · ENERGETIC BEAR · Fox Kitten · lockbit · 3 more

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2019-11510 · APT29 · ENERGETIC BEAR · Fox Kitten · OilRig · Turla

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2019-19781 · APT29 · APT41 · Fox Kitten

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2020-14750 · Prophet Spider

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2020-14882 · Prophet Spider

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2020-5902 · BackdoorDiplomacy · Fox Kitten

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2021-34473 · APT35 · blackbyte · BRONZE STARLIGHT · Witchetty

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2021-35464 · Scattered Spider

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2021-44228 · APT35 · APT41 · BRONZE STARLIGHT · Sea Turtle · Water Sigbin

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2022-44877 · CRYSTALRAY

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2023-22515 · Storm-0062 · Ukrainian Cyber Alliance

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2023-47246 · DEV-0950

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2026-12227

CVE exploitation

Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

CVE-2026-54617

Actor indicator sweep

Every value is a skopnix indicator tied to APT-C-36 with confidence >= 86 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

APT-C-36

Actor indicator sweep

Every value is a skopnix indicator tied to APT19 with confidence >= 86 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

APT19

Actor indicator sweep

Every value is a skopnix indicator tied to Operation C-Major with confidence >= 86 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

Operation C-Major

Actor indicator sweep

Every value is a skopnix indicator tied to blackbyte with confidence >= 82 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

blackbyte

Actor indicator sweep

Every value is a skopnix indicator tied to ShinyHunters with confidence >= 82 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

ShinyHunters

Actor indicator sweep

Every value is a skopnix indicator tied to Tortoiseshell with confidence >= 81 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

Tortoiseshell

Actor indicator sweep

Every value is a skopnix indicator tied to BRONZE STARLIGHT with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

BRONZE STARLIGHT

Actor indicator sweep

Every value is a skopnix indicator tied to Callisto with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

Callisto

Actor indicator sweep

Every value is a skopnix indicator tied to CeranaKeeper with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

CeranaKeeper

Actor indicator sweep

Every value is a skopnix indicator tied to Common Raven with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

Common Raven

Actor indicator sweep

Every value is a skopnix indicator tied to GreenSpot with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

GreenSpot

Actor indicator sweep

Every value is a skopnix indicator tied to Inception Framework with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

Inception Framework

Actor indicator sweep

Every value is a skopnix indicator tied to Kinsing with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

Kinsing

Actor indicator sweep

Every value is a skopnix indicator tied to RUBYCARP with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

RUBYCARP

Actor indicator sweep

Every value is a skopnix indicator tied to TeamPCP with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

TeamPCP

Actor indicator sweep

Every value is a skopnix indicator tied to UAT-9244 with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

UAT-9244

Actor indicator sweep

Every value is a skopnix indicator tied to Volt Typhoon with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

Volt Typhoon

Actor indicator sweep

Every value is a skopnix indicator tied to Water Sigbin with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

Water Sigbin

Actor indicator sweep

Every value is a skopnix indicator tied to Water Sigbin with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

Water Sigbin

Actor indicator sweep

Every value is a skopnix indicator tied to Tortoiseshell with confidence >= 76 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

Tortoiseshell

Actor indicator sweep

Every value is a skopnix indicator tied to Whitefly with confidence >= 76 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

Whitefly

Actor indicator sweep

Every value is a skopnix indicator tied to APT41 with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

APT41

Actor indicator sweep

Every value is a skopnix indicator tied to blackbyte with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

blackbyte

Actor indicator sweep

Every value is a skopnix indicator tied to Caliente Bandits with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

Caliente Bandits

Actor indicator sweep

Every value is a skopnix indicator tied to DragonSpark with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

DragonSpark

Actor indicator sweep

Every value is a skopnix indicator tied to FIN7 with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

FIN7

Actor indicator sweep

Every value is a skopnix indicator tied to global with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

global

Actor indicator sweep

Every value is a skopnix indicator tied to GOLD CABIN with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

GOLD CABIN

Actor indicator sweep

Every value is a skopnix indicator tied to HAZY TIGER with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

HAZY TIGER

Actor indicator sweep

Every value is a skopnix indicator tied to Kimsuky with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

Kimsuky

Actor indicator sweep

Every value is a skopnix indicator tied to Mr_Rot13 with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

Mr_Rot13

Actor indicator sweep

Every value is a skopnix indicator tied to Predatory Sparrow with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

Predatory Sparrow

Actor indicator sweep

Every value is a skopnix indicator tied to rhysida with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

rhysida

Actor indicator sweep

Every value is a skopnix indicator tied to RomCom with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

RomCom

Actor indicator sweep

Every value is a skopnix indicator tied to SaintBear with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

SaintBear

Actor indicator sweep

Every value is a skopnix indicator tied to Scarab with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

Scarab

Actor indicator sweep

Every value is a skopnix indicator tied to TA402 with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

TA402

Actor indicator sweep

Every value is a skopnix indicator tied to Turla with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

Turla

Actor indicator sweep

Every value is a skopnix indicator tied to Winter Vivern with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

Winter Vivern

Actor indicator sweep

Every value is a skopnix indicator tied to XDSpy with confidence >= 72 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

XDSpy

Actor indicator sweep

Every value is a skopnix indicator tied to WindShift with confidence >= 71 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

WindShift

Indicator

Scoped to one indicator with skopnix confidence 100/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Indicator

Scoped to one indicator with skopnix confidence 100/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Indicator

Scoped to one indicator with skopnix confidence 100/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Indicator

Scoped to one indicator with skopnix confidence 85/100 from 3 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

TeamPCP

Indicator

Scoped to one indicator with skopnix confidence 82/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

UAT-9244

Indicator

Scoped to one indicator with skopnix confidence 81/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Whitefly

Indicator

Scoped to one indicator with skopnix confidence 86/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

APT-C-36

Indicator

Scoped to one indicator with skopnix confidence 86/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

APT-C-36

Indicator

Scoped to one indicator with skopnix confidence 86/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

APT-C-36

Indicator

Scoped to one indicator with skopnix confidence 86/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

APT19

Indicator

Scoped to one indicator with skopnix confidence 86/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Operation C-Major

Indicator

Scoped to one indicator with skopnix confidence 82/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

ShinyHunters

Indicator

Scoped to one indicator with skopnix confidence 82/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

blackbyte

Indicator

Scoped to one indicator with skopnix confidence 81/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Tortoiseshell

Indicator

Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

TeamPCP

Indicator

Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Inception Framework

Indicator

Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

BRONZE STARLIGHT

Indicator

Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

RUBYCARP

Indicator

Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

blackbyte

Indicator

Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Water Sigbin

Indicator

Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Water Sigbin

Indicator

Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Volt Typhoon

Indicator

Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Kinsing

Indicator

Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

CeranaKeeper

Indicator

Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Water Sigbin

Indicator

Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Water Sigbin

Indicator

Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

TA505

Indicator

Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Common Raven

Indicator

Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

UAT-9244

Indicator

Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

UAT-9244

Indicator

Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

UAT-9244

Indicator

Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Callisto

Indicator

Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Common Raven

Indicator

Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

GreenSpot

Indicator

Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Water Sigbin

Indicator

Scoped to one indicator with skopnix confidence 76/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Tortoiseshell

Indicator

Scoped to one indicator with skopnix confidence 76/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Tortoiseshell

Indicator

Scoped to one indicator with skopnix confidence 76/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Whitefly

Indicator

Scoped to one indicator with skopnix confidence 76/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Tortoiseshell

Indicator

Scoped to one indicator with skopnix confidence 76/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Tortoiseshell

Indicator

Scoped to one indicator with skopnix confidence 75/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

RomCom

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

blackbyte

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Turla

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

HAZY TIGER

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Mr_Rot13

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

TA402

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

SaintBear

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

blackbyte

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

GOLD CABIN

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Scarab

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Caliente Bandits

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Caliente Bandits

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

GOLD CABIN

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

APT41

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

rhysida

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

RomCom

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

DragonSpark

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Predatory Sparrow

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

blackbyte

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

TA402

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Winter Vivern

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

XDSpy

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

GOLD CABIN

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Kimsuky

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

global

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Predatory Sparrow

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

HAZY TIGER

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

FIN7

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

SaintBear

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

SaintBear

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

HAZY TIGER

Indicator

Scoped to one indicator with skopnix confidence 72/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

Angry Likho

Indicator

Scoped to one indicator with skopnix confidence 71/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

WindShift

Indicator

Scoped to one indicator with skopnix confidence 71/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

WindShift