UNC5820 IP indicators (historical, hunt only)
XQLlowconfidence 75/100generated 2026-10-19
4 IP indicators skopnix attributes to UNC5820, named in published reports without live feed evidence. Retro-hunt only.
- Correlation
- set the rule's MITRE tactic to command-and-control and technique to T1071
- Linked actors
- UNC5820
- False positives
- HISTORICAL, HUNT ONLY: do not block on this. These indicators come from published reports and do not meet the bar of the live sweep. 4 indicators. Evidence: 4 listed only by scanner / honeypot feeds (not counted as evidence). No feed sighting date exists for any of them. Screened against reserved space, MISP warninglists (CDN / cloud / scanners / top sites), GreyNoise when enriched, and sinkhole address lists. Re-validate against last_seen before blocking: infrastructure is re-assigned.
XQL query
skopnix-cortex-actor-unc5820-ip-hist-8f361372.xqldownload .xql ↓preset = network_story
| filter action_remote_ip in ("104.238.141.143", "158.247.199.37", "195.85.114.78", "45.32.41.202")
| fields agent_hostname, action_local_ip, action_remote_ip, action_remote_port, action_app_id, _time
| sort desc _time
How to deploy on Cortex XDR
- 1.Paste the XQL into Incident Response > Investigation > Query Builder > XQL Search.
- 2.To alert, save it as a Correlation Rule and set the MITRE tactic and technique printed with the rule.
- 3.Schedule it on the interval you hunt at; keep the fields stage for the alert's columns.
Check · CVE rules read PAN-OS URL logs (panw_ngfw_url_raw), which need the NGFW integration and, for HTTPS, decryption.