Skip to content
skopnix
Detections
← All detectionsATT&CK technique

T1071

100 rules44 findings

T1071 on attack.mitre.org ↗

  1. Actor indicator sweep

    APT-C-36 domain indicators

    Every value is a skopnix indicator tied to APT-C-36 with confidence >= 86 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    APT-C-36

    T1071conf 86SIGAQLXQL

  2. Actor indicator sweep

    APT19 IP indicators

    Every value is a skopnix indicator tied to APT19 with confidence >= 86 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    APT19

    T1071conf 86SIGAQLXQL

  3. Actor indicator sweep

    Operation C-Major IP indicators

    Every value is a skopnix indicator tied to Operation C-Major with confidence >= 86 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Operation C-Major

    T1071conf 86SIGAQLXQL

  4. Actor indicator sweep

    blackbyte domain indicators

    Every value is a skopnix indicator tied to blackbyte with confidence >= 82 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    blackbyte

    T1071conf 82SIGAQLXQL

  5. Actor indicator sweep

    ShinyHunters domain indicators

    Every value is a skopnix indicator tied to ShinyHunters with confidence >= 82 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    ShinyHunters

    T1071conf 82SIGAQLXQL

  6. Actor indicator sweep

    Tortoiseshell IP indicators

    Every value is a skopnix indicator tied to Tortoiseshell with confidence >= 81 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Tortoiseshell

    T1071conf 81SIGAQLXQL

  7. Actor indicator sweep

    BRONZE STARLIGHT domain indicators

    Every value is a skopnix indicator tied to BRONZE STARLIGHT with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    BRONZE STARLIGHT

    T1071conf 77SIGAQLXQL

  8. Actor indicator sweep

    Callisto IP indicators

    Every value is a skopnix indicator tied to Callisto with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Callisto

    T1071conf 77SIGAQLXQL

  9. Actor indicator sweep

    Common Raven IP indicators

    Every value is a skopnix indicator tied to Common Raven with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Common Raven

    T1071conf 77SIGAQLXQL

  10. Actor indicator sweep

    GreenSpot IP indicators

    Every value is a skopnix indicator tied to GreenSpot with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    GreenSpot

    T1071conf 77SIGAQLXQL

  11. Actor indicator sweep

    Inception Framework domain indicators

    Every value is a skopnix indicator tied to Inception Framework with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Inception Framework

    T1071conf 77SIGAQLXQL

  12. Actor indicator sweep

    RUBYCARP domain indicators

    Every value is a skopnix indicator tied to RUBYCARP with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    RUBYCARP

    T1071conf 77SIGAQLXQL

  13. Actor indicator sweep

    TeamPCP domain indicators

    Every value is a skopnix indicator tied to TeamPCP with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    TeamPCP

    T1071conf 77SIGAQLXQL

  14. Actor indicator sweep

    UAT-9244 IP indicators

    Every value is a skopnix indicator tied to UAT-9244 with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    UAT-9244

    T1071conf 77SIGAQLXQL

  15. Actor indicator sweep

    Water Sigbin IP indicators

    Every value is a skopnix indicator tied to Water Sigbin with confidence >= 77 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    Water Sigbin

    T1071conf 77SIGAQLXQL

  16. Actor indicator sweep

    WindShift domain indicators

    Every value is a skopnix indicator tied to WindShift with confidence >= 71 from >= 2 independent sources, warninglist-clean (reserved / CDN / cloud / scanners / top sites) — re-validate against last_seen before blocking.

    WindShift

    T1071conf 71SIGAQLXQL

  17. Indicator

    DNS query for known malicious domain scan.aquasecurtiy.org

    Scoped to one indicator with skopnix confidence 85/100 from 3 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    TeamPCP

    T1071conf 85SIGXQL

  18. Indicator

    Traffic to known C2 IP 154.205.154.82

    Scoped to one indicator with skopnix confidence 82/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    UAT-9244

    T1071conf 82SIGXQL

  19. Indicator

    Malicious IPs

    Matches only members of the skopnix reference set (high-confidence, multi-source, warninglist-clean, time-to-live bounded). Add RFC1918 and your known-good destinations to the exclusion building block.

    APT19 · Callisto · Common Raven · GreenSpot · Operation C-Major · Tortoiseshell · 2 more

    T1071conf 77AQL

  20. Indicator

    Outbound connection to known-malicious IP

    Matches only members of the skopnix reference set (high-confidence, multi-source, warninglist-clean, time-to-live bounded). Add RFC1918 and your known-good destinations to the exclusion building block.

    APT19 · Callisto · Common Raven · GreenSpot · Operation C-Major · Tortoiseshell · 2 more

    T1071conf 77AQL

  21. Indicator

    Connection to known-malicious domain

    Matches only members of the skopnix reference set (high-confidence, multi-source, warninglist-clean, time-to-live bounded). Add RFC1918 and your known-good destinations to the exclusion building block.

    APT-C-36 · blackbyte · BRONZE STARLIGHT · Inception Framework · RUBYCARP · ShinyHunters · 2 more

    T1071conf 71AQL

  22. Indicator

    Malicious Domains

    Matches only members of the skopnix reference set (high-confidence, multi-source, warninglist-clean, time-to-live bounded). Add RFC1918 and your known-good destinations to the exclusion building block.

    APT-C-36 · blackbyte · BRONZE STARLIGHT · Inception Framework · RUBYCARP · ShinyHunters · 2 more

    T1071conf 71AQL

  23. Indicator

    DNS query for known malicious domain acortaurl.com

    Scoped to one indicator with skopnix confidence 86/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    APT-C-36

    T1071conf 86SIGXQL

  24. Indicator

    DNS query for known malicious domain cort.as

    Scoped to one indicator with skopnix confidence 86/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    APT-C-36

    T1071conf 86SIGXQL

  25. Indicator

    DNS query for known malicious domain gtly.to

    Scoped to one indicator with skopnix confidence 86/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    APT-C-36

    T1071conf 86SIGXQL

  26. Indicator

    Traffic to known malicious IP 198.200.45.112

    Scoped to one indicator with skopnix confidence 86/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    APT19

    T1071conf 86SIGXQL

  27. Indicator

    Traffic to known malicious IP 209.127.19.241

    Scoped to one indicator with skopnix confidence 86/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Operation C-Major

    T1071conf 86SIGXQL

  28. Indicator

    DNS query for known malicious domain azurenetfiles.net

    Scoped to one indicator with skopnix confidence 82/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    ShinyHunters

    T1071conf 82SIGXQL

  29. Indicator

    DNS query for known malicious domain file.io

    Scoped to one indicator with skopnix confidence 82/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    blackbyte

    T1071conf 82SIGXQL

  30. Indicator

    Traffic to known malicious IP 64.235.60.123

    Scoped to one indicator with skopnix confidence 81/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Tortoiseshell

    T1071conf 81SIGXQL

  31. Indicator

    DNS query for known malicious domain checkmarx.zone

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    TeamPCP

    T1071conf 77SIGXQL

  32. Indicator

    DNS query for known malicious domain cloudme.com

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Inception Framework

    T1071conf 77SIGXQL

  33. Indicator

    DNS query for known malicious domain duckducklive.top

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    BRONZE STARLIGHT

    T1071conf 77SIGXQL

  34. Indicator

    DNS query for known malicious domain sshd.run

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    RUBYCARP

    T1071conf 77SIGXQL

  35. Indicator

    Traffic to known C2 IP 178.73.192.17

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Common Raven

    T1071conf 77SIGXQL

  36. Indicator

    Traffic to known C2 IP 207.148.120.52

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    UAT-9244

    T1071conf 77SIGXQL

  37. Indicator

    Traffic to known C2 IP 207.148.121.95

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    UAT-9244

    T1071conf 77SIGXQL

  38. Indicator

    Traffic to known C2 IP 212.11.64.105

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    UAT-9244

    T1071conf 77SIGXQL

  39. Indicator

    Traffic to known C2 IP 45.133.216.15

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Callisto

    T1071conf 77SIGXQL

  40. Indicator

    Traffic to known C2 IP 46.246.84.17

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Common Raven

    T1071conf 77SIGXQL

  41. Indicator

    Traffic to known malicious IP 152.32.138.108

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    GreenSpot

    T1071conf 77SIGXQL

  42. Indicator

    Traffic to known malicious IP 185.172.128.146

    Scoped to one indicator with skopnix confidence 77/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    Water Sigbin

    T1071conf 77SIGXQL

  43. Indicator

    DNS query for known malicious domain flux2key.com

    Scoped to one indicator with skopnix confidence 71/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    WindShift

    T1071conf 71SIGXQL

  44. Indicator

    DNS query for known malicious domain string2me.com

    Scoped to one indicator with skopnix confidence 71/100 from 2 independent sources; checked against RFC1918/reserved space, CDN / cloud / scanner ranges and top-site lists (MISP warninglists), GreyNoise when enriched, and skopnix's benign-infrastructure list. Re-validate against last_seen before blocking: infrastructure is re-assigned.

    WindShift

    T1071conf 71SIGXQL

How to deploy

SIGSigma

  1. 1.Convert for your SIEM with sigma-cli / pySigma, e.g. sigma convert -t splunk -p sysmon rule.yml.
  2. 2.Run it as a hunt first: every rule ships as status experimental.
  3. 3.Promote to an alert once a week of results is clean on your data.

Check · The processing pipeline must map the logsource (firewall, dns, proxy, webserver, process_creation) to your field names.

AQLIBM QRadar

  1. 1.Create the reference set from its spec (Reference Data API, or Admin > Reference Set Management) and schedule the skopnix feed load.
  2. 2.Paste the AQL into Log Activity > Advanced Search to hunt the last seven days.
  3. 3.For alerting, build the CRE rule from the test stack shown and exclude your known-good building block.

Check · Custom properties ("URL Host", "URL", "File Hash", "Process CommandLine") come from your DSMs and content extensions; rename them if yours differ.

XQLCortex XDR

  1. 1.Paste the XQL into Incident Response > Investigation > Query Builder > XQL Search.
  2. 2.To alert, save it as a Correlation Rule and set the MITRE tactic and technique printed with the rule.
  3. 3.Schedule it on the interval you hunt at; keep the fields stage for the alert's columns.

Check · CVE rules read PAN-OS URL logs (panw_ngfw_url_raw), which need the NGFW integration and, for HTTPS, decryption.