← IBM QRadar detectionsIBM QRadar · Indicator

Malicious URLs

AQLhighconfidence 72/100generated 2026-10-18

QRadar reference set (AlphaNumeric (Ignore Case)) with the 6 current skopnix URL indicators — the feed the "Skopnix: Request to known-malicious URL" rule reads.

ATT&CK: T1105 mitre ↗
Linked actors: Angry Likho · TA505
False positives: Matches only members of the skopnix reference set (high-confidence, multi-source, warninglist-clean, time-to-live bounded). Add RFC1918 and your known-good destinations to the exclusion building block.

Reference set spec

skopnix-qradar-ioc-refset-url-bd6821e1.jsondownload .json ↓

{
 "name": "Skopnix: Malicious URLs",
 "element_type": "ALNIC",
 "element_type_label": "AlphaNumeric (Ignore Case)",
 "time_to_live": "60 days",
 "timeout_type": "LAST_SEEN",
 "create": "POST /api/reference_data/sets?name=Skopnix%3A%20Malicious%20URLs&element_type=ALNIC&time_to_live=60%20days&timeout_type=LAST_SEEN",
 "load": "POST /api/reference_data/sets/bulk_load/Skopnix%3A%20Malicious%20URLs  (body: JSON array of the elements)",
 "feed": "skopnix publishes this set as a feed; load it via the QRadar Reference Data API on a schedule (or Admin > Reference Set Management > Import). Elements age out on the time-to-live, so a retired skopnix indicator stops matching without a manual purge.",
 "elements": [
  "http://192.162.199.249/hbspbloprxh3iu2h",
  "http://officemysuppbox.com/staterepository",
  "https://cdn.wovplaying.help/update.zip",
  "https://frame-kite.com/curl/pwnbcptu5/8jpm8xq5yprwztoh.txt",
  "https://frame-kite.com/f/rjcf4ggdrb1wp5syzplnda/5r7r2qc0",
  "https://testdomain123123.shop/frameworksurvivor.exe"
 ]
}

6 elements · one per line for a bulk import ↓

How to deploy on IBM QRadar

1.Create the reference set from its spec (Reference Data API, or Admin > Reference Set Management) and schedule the skopnix feed load.
2.Paste the AQL into Log Activity > Advanced Search to hunt the last seven days.
3.For alerting, build the CRE rule from the test stack shown and exclude your known-good building block.

Check · Custom properties ("URL Host", "URL", "File Hash", "Process CommandLine") come from your DSMs and content extensions; rename them if yours differ.

References

skopnix.com/detections ↗