← IBM QRadar detectionsIBM QRadar · Indicator

Malicious IPs

AQLhighconfidence 77/100generated 2026-10-18

QRadar reference set (IP) with the 12 current skopnix IP indicators — the feed the "Skopnix: Outbound connection to known-malicious IP" rule reads.

ATT&CK: T1071 mitre ↗
Linked actors: APT19 · Callisto · Common Raven · GreenSpot · Operation C-Major · Tortoiseshell · UAT-9244 · Water Sigbin
False positives: Matches only members of the skopnix reference set (high-confidence, multi-source, warninglist-clean, time-to-live bounded). Add RFC1918 and your known-good destinations to the exclusion building block.

Reference set spec

skopnix-qradar-ioc-refset-ip-72453c88.jsondownload .json ↓

{
 "name": "Skopnix: Malicious IPs",
 "element_type": "IP",
 "element_type_label": "IP",
 "time_to_live": "30 days",
 "timeout_type": "LAST_SEEN",
 "create": "POST /api/reference_data/sets?name=Skopnix%3A%20Malicious%20IPs&element_type=IP&time_to_live=30%20days&timeout_type=LAST_SEEN",
 "load": "POST /api/reference_data/sets/bulk_load/Skopnix%3A%20Malicious%20IPs  (body: JSON array of the elements)",
 "feed": "skopnix publishes this set as a feed; load it via the QRadar Reference Data API on a schedule (or Admin > Reference Set Management > Import). Elements age out on the time-to-live, so a retired skopnix indicator stops matching without a manual purge.",
 "elements": [
  "152.32.138.108",
  "154.205.154.82",
  "178.73.192.17",
  "185.172.128.146",
  "198.200.45.112",
  "207.148.120.52",
  "207.148.121.95",
  "209.127.19.241",
  "212.11.64.105",
  "45.133.216.15",
  "46.246.84.17",
  "64.235.60.123"
 ]
}

12 elements · one per line for a bulk import ↓

How to deploy on IBM QRadar

1.Create the reference set from its spec (Reference Data API, or Admin > Reference Set Management) and schedule the skopnix feed load.
2.Paste the AQL into Log Activity > Advanced Search to hunt the last seven days.
3.For alerting, build the CRE rule from the test stack shown and exclude your known-good building block.

Check · Custom properties ("URL Host", "URL", "File Hash", "Process CommandLine") come from your DSMs and content extensions; rename them if yours differ.

References

skopnix.com/detections ↗