UNC5820 IP indicators (historical, hunt only)

SELECT sourceip, destinationip, destinationport, QIDNAME(qid) AS event, "URL Host"
FROM events
WHERE REFERENCESETCONTAINS('Skopnix: UNC5820 - IPs (historical)', destinationip)
LAST 7 DAYS

Rule name: "Skopnix: UNC5820 IP match (historical, hunt only)"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [any]
  - and when any of Destination IP is contained in any of Reference Set - "Skopnix: UNC5820 - IPs (historical)"
  - and NOT when an event matches any of the following BB:Skopnix Known-Good Exclusions
Response: dispatch new event / create offense indexed by Source IP; annotate "Skopnix C2 match".
FP-safety: BB:Skopnix Known-Good Exclusions = RFC1918 + the customer's known-good destinations. HISTORICAL, HUNT ONLY: do not block on this. These indicators come from published reports and do not meet the bar of the live sweep. 4 indicators. Evidence: 4 listed only by scanner / honeypot feeds (not counted as evidence). No feed sighting date exists for any of them. Screened against reserved space, MISP warninglists (CDN / cloud / scanners / top sites), GreyNoise when enriched, and sinkhole address lists. Re-validate against last_seen before blocking: infrastructure is re-assigned. Reference set time-to-live 30 days, timeout on last seen.

{
 "name": "Skopnix: UNC5820 - IPs (historical)",
 "element_type": "IP",
 "element_type_label": "IP",
 "time_to_live": "30 days",
 "timeout_type": "LAST_SEEN",
 "create": "POST /api/reference_data/sets?name=Skopnix%3A%20UNC5820%20-%20IPs%20%28historical%29&element_type=IP&time_to_live=30%20days&timeout_type=LAST_SEEN",
 "load": "POST /api/reference_data/sets/bulk_load/Skopnix%3A%20UNC5820%20-%20IPs%20%28historical%29  (body: JSON array of the elements)",
 "feed": "skopnix publishes this set as a feed; load it via the QRadar Reference Data API on a schedule (or Admin > Reference Set Management > Import). Elements age out on the time-to-live, so a retired skopnix indicator stops matching without a manual purge.",
 "elements": [
  "104.238.141.143",
  "158.247.199.37",
  "195.85.114.78",
  "45.32.41.202"
 ],
 "elements_detail": [
  {
   "value": "104.238.141.143",
   "last_seen": "2026-10-18",
   "valid_until": "2027-01-16"
  },
  {
   "value": "158.247.199.37",
   "last_seen": "2026-10-18",
   "valid_until": "2027-01-16"
  },
  {
   "value": "195.85.114.78",
   "last_seen": "2026-10-18",
   "valid_until": "2027-01-16"
  },
  {
   "value": "45.32.41.202",
   "last_seen": "2026-10-18",
   "valid_until": "2027-01-16"
  }
 ]
}

• skopnix.com/actors/unc5820 ↗