autarch/data/ioc/spyware/citizen_lab/201603_Shifting_Tactics/openioc.ioc

<?xml version="1.0" encoding="utf-8"?>
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="581c1131-3fec-4068-bb74-49798e96ca05" last-modified="2016-03-10T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
  <short_description>Event #11</short_description>
  <description>Shifting Tactics: Tracking changes in years-long espionage campaign against Tibetans</description>
  <keywords />
  <authored_by>citizenlab</authored_by>
  <authored_date>2016-03-10T00:00:00</authored_date>
  <links />
  <definition>
    <Indicator operator="OR" id="581c1131-3fec-4068-bb74-49798e96ca05">
      <IndicatorItem id="ea45265fe98b25e719d5a9cc3b412d66" condition="is">
        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
        <Content type="md5"></Content>
      </IndicatorItem>
      <IndicatorItem id="filegoogle.firewall-gateway.com" condition="is">
        <Context document="Network" search="Network/DNS" type="mir" />
        <Content type="string"></Content>
      </IndicatorItem>
      <IndicatorItem id="accountgoogle.firewall-gateway.com" condition="is">
        <Context document="Network" search="Network/DNS" type="mir" />
        <Content type="string"></Content>
      </IndicatorItem>
      <IndicatorItem id="sys.firewall-gateway.net" condition="is">
        <Context document="Network" search="Network/DNS" type="mir" />
        <Content type="string"></Content>
      </IndicatorItem>
      <IndicatorItem id="news.firewall-gateway.com" condition="is">
        <Context document="Network" search="Network/DNS" type="mir" />
        <Content type="string"></Content>
      </IndicatorItem>
      <IndicatorItem id="accountsgoogle.firewall-gateway.com" condition="is">
        <Context document="Network" search="Network/DNS" type="mir" />
        <Content type="string"></Content>
      </IndicatorItem>
      <IndicatorItem id="accounts-google.firewall-gateway.com" condition="is">
        <Context document="Network" search="Network/DNS" type="mir" />
        <Content type="string"></Content>
      </IndicatorItem>
      <IndicatorItem id="accountsgoogles.firewall-gateway.com" condition="is">
        <Context document="Network" search="Network/DNS" type="mir" />
        <Content type="string"></Content>
      </IndicatorItem>
      <IndicatorItem id="googlefile.firewall-gateway.net" condition="is">
        <Context document="Network" search="Network/DNS" type="mir" />
        <Content type="string"></Content>
      </IndicatorItem>
      <IndicatorItem id="firewallupdate.firewall-gateway.com" condition="is">
        <Context document="Network" search="Network/DNS" type="mir" />
        <Content type="string"></Content>
      </IndicatorItem>
      <IndicatorItem id="firewallupdate.firewall-gateway.net" condition="is">
        <Context document="Network" search="Network/DNS" type="mir" />
        <Content type="string"></Content>
      </IndicatorItem>
      <IndicatorItem id="drivgoogle.firewall-gateway.com" condition="is">
        <Context document="Network" search="Network/DNS" type="mir" />
        <Content type="string"></Content>
      </IndicatorItem>
      <IndicatorItem id="detail43.myfirewall.org" condition="is">
        <Context document="Network" search="Network/DNS" type="mir" />
        <Content type="string"></Content>
      </IndicatorItem>
      <IndicatorItem id="95.154.195.159" condition="is">
        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
        <Content type="IP"></Content>
      </IndicatorItem>
      <IndicatorItem id="95.154.195.171" condition="is">
        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
        <Content type="IP"></Content>
      </IndicatorItem>
      <IndicatorItem id="5.54.19.17" condition="is">
        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
        <Content type="IP"></Content>
      </IndicatorItem>
      <IndicatorItem id="78.129.252.159" condition="is">
        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
        <Content type="IP"></Content>
      </IndicatorItem>
      <IndicatorItem id="87.117.229.109" condition="is">
        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
        <Content type="IP"></Content>
      </IndicatorItem>
      <IndicatorItem id="109.169.40.172" condition="is">
        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
        <Content type="IP"></Content>
      </IndicatorItem>
      <IndicatorItem id="46.127.56.109" condition="is">
        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
        <Content type="IP"></Content>
      </IndicatorItem>
      <IndicatorItem id="192.253.251.118" condition="is">
        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
        <Content type="IP"></Content>
      </IndicatorItem>
      <IndicatorItem id="109.169.77.230" condition="is">
        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
        <Content type="IP"></Content>
      </IndicatorItem>
      <IndicatorItem id="http://filegoogle.firewall-gateway.com/servicelogin" condition="is">
        <Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
        <Content type="string"></Content>
      </IndicatorItem>
      <IndicatorItem id="5c030802ad411fea059cc9cc4c118125" condition="is">
        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
        <Content type="md5"></Content>
      </IndicatorItem>
      <IndicatorItem id="7735e571d0450e2a31e97e4f8e0f66fa" condition="is">
        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
        <Content type="md5"></Content>
      </IndicatorItem>
      <IndicatorItem id="d2e9412428c3bcf3ec98dba8a78adb7b" condition="is">
        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
        <Content type="md5"></Content>
      </IndicatorItem>
      <IndicatorItem id="1bf438b5744db73eea58379a3b9f30e5" condition="is">
        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
        <Content type="md5"></Content>
      </IndicatorItem>
      <IndicatorItem id="3b869c8e23d66ad0527882fc79ff7237" condition="is">
        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
        <Content type="md5"></Content>
      </IndicatorItem>
      <IndicatorItem id="fef27f432e0ae8218143bc410fda340e" condition="is">
        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
        <Content type="md5"></Content>
      </IndicatorItem>
      <IndicatorItem id="8b83fc5d3a6a80281269f9e337fe3fff" condition="is">
        <Context document="FileItem" search="FileItem/Md5sum" type="mir" />
        <Content type="md5"></Content>
      </IndicatorItem>
    </Indicator>
  </definition>
</ioc>