Skip to content
skopnix
← IBM QRadar detectionsIBM QRadar · Indicator

Malicious Domains

AQLhighconfidence 71/100generated 2026-10-18

QRadar reference set (AlphaNumeric (Ignore Case)) with the 12 current skopnix domain indicators — the feed the "Skopnix: Connection to known-malicious domain" rule reads.

ATT&CK
T1071 mitre ↗
Linked actors
APT-C-36 · blackbyte · BRONZE STARLIGHT · Inception Framework · RUBYCARP · ShinyHunters · TeamPCP · WindShift
False positives
Matches only members of the skopnix reference set (high-confidence, multi-source, warninglist-clean, time-to-live bounded). Add RFC1918 and your known-good destinations to the exclusion building block.

Reference set spec

skopnix-qradar-ioc-refset-domain-c9c2d175.jsondownload .json ↓
{
 "name": "Skopnix: Malicious Domains",
 "element_type": "ALNIC",
 "element_type_label": "AlphaNumeric (Ignore Case)",
 "time_to_live": "120 days",
 "timeout_type": "LAST_SEEN",
 "create": "POST /api/reference_data/sets?name=Skopnix%3A%20Malicious%20Domains&element_type=ALNIC&time_to_live=120%20days&timeout_type=LAST_SEEN",
 "load": "POST /api/reference_data/sets/bulk_load/Skopnix%3A%20Malicious%20Domains  (body: JSON array of the elements)",
 "feed": "skopnix publishes this set as a feed; load it via the QRadar Reference Data API on a schedule (or Admin > Reference Set Management > Import). Elements age out on the time-to-live, so a retired skopnix indicator stops matching without a manual purge.",
 "elements": [
  "acortaurl.com",
  "azurenetfiles.net",
  "checkmarx.zone",
  "cloudme.com",
  "cort.as",
  "duckducklive.top",
  "file.io",
  "flux2key.com",
  "gtly.to",
  "scan.aquasecurtiy.org",
  "sshd.run",
  "string2me.com"
 ]
}

12 elements · one per line for a bulk import ↓

How to deploy on IBM QRadar

  1. 1.Create the reference set from its spec (Reference Data API, or Admin > Reference Set Management) and schedule the skopnix feed load.
  2. 2.Paste the AQL into Log Activity > Advanced Search to hunt the last seven days.
  3. 3.For alerting, build the CRE rule from the test stack shown and exclude your known-good building block.

Check · Custom properties ("URL Host", "URL", "File Hash", "Process CommandLine") come from your DSMs and content extensions; rename them if yours differ.

References