Rule name: "Skopnix: UNC5820 IP match (historical, hunt only)"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [any]
  - and when any of Destination IP is contained in any of Reference Set - "Skopnix: UNC5820 - IPs (historical)"
  - and NOT when an event matches any of the following BB:Skopnix Known-Good Exclusions
Response: dispatch new event / create offense indexed by Source IP; annotate "Skopnix C2 match".
FP-safety: BB:Skopnix Known-Good Exclusions = RFC1918 + the customer's known-good destinations. HISTORICAL, HUNT ONLY: do not block on this. These indicators come from published reports and do not meet the bar of the live sweep. 4 indicators. Evidence: 1 with feed evidence below that bar or not fresh; 3 listed only by scanner / honeypot feeds (not counted as evidence). Feed publishers: bin.re. Newest feed sighting 2026-10-19, oldest 2026-10-19. Screened against reserved space, MISP warninglists (CDN / cloud / scanners / top sites), GreyNoise when enriched, and sinkhole address lists. Re-validate against last_seen before blocking: infrastructure is re-assigned. Reference set time-to-live 30 days, timeout on last seen.