Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs
This commit is contained in:
SsSnake
8
data/ioc/spyware/citizen_lab/201608_NSO_Group/README.md
Normal file
8
data/ioc/spyware/citizen_lab/201608_NSO_Group/README.md
Normal file
@@ -0,0 +1,8 @@
|
||||
## NSO Group IOCs
|
||||
|
||||
This directory contains IOC from the Citizen Lab report ["The Million Dollar Dissident: NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender"](https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/) published the 24th of August 2016. More information about the Pegasus malware can be found ini [Lookout report](https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegasus-technical-analysis.pdf).
|
||||
|
||||
Files included in this directory:
|
||||
* openioc.ioc : IOCs in OpenIOC format
|
||||
* stix.xml : IOCs in STIX XML format
|
||||
* iocs.csv : IOCs in csv format
|
||||
63
data/ioc/spyware/citizen_lab/201608_NSO_Group/iocs.csv
Normal file
63
data/ioc/spyware/citizen_lab/201608_NSO_Group/iocs.csv
Normal file
@@ -0,0 +1,63 @@
|
||||
uuid,event_id,category,type,value,comment,to_ids,date
|
||||
029c89df-139e-463a-b1f1-c259b913d05f,10,Network activity,ip-dst,"52.8.153.44","IP linked to sms.webadv.co",1,20160824
|
||||
0d1164d5-7670-41da-8857-1247d0b67561,10,Network activity,domain,"redcrossworld.com","",1,20160824
|
||||
0f203872-71ec-4b51-ba56-c50918f71f39,10,Network activity,domain,"topcontactco.com","",1,20160824
|
||||
126c3480-6ad3-417f-9855-4e915b9ae528,10,Network activity,domain,"kenyasms.org","",1,20160824
|
||||
14df3986-e958-4612-ba2f-daa9fd95b868,10,Network activity,domain,"bahrainsms.co","",1,20160824
|
||||
17a374eb-20d6-4790-bee4-45b7073115f1,10,Network activity,domain,"icrcworld.com","",1,20160824
|
||||
208dbaaf-39c3-4930-8304-1c76e9b1e7b8,10,Network activity,ip-dst,"54.251.49.214","",1,20160824
|
||||
252cc33c-8786-4dee-b77a-af52acb1661b,10,Network activity,domain,"alawaeltech.com","",1,20160824
|
||||
27a5b383-3c23-4f93-9341-8dd8d90575f6,10,Network activity,ip-dst,"82.80.202.204","",1,20160824
|
||||
2ad610a4-2177-4e7f-b525-8621a80e2ebe,10,Network activity,domain,"icloudcacher.com","",1,20160824
|
||||
2f6d312b-8db7-4fa0-9522-cc68090b4a3b,10,Network activity,ip-dst,"52.8.52.166","IP behind aalaan.tv",1,20160824
|
||||
325e4a00-7b2f-4c27-bff2-89f390e3c13c,10,Network activity,domain,"asrararabiya.co","",1,20160824
|
||||
340ccd5a-2520-4ccb-abeb-b264fb2bf645,10,Network activity,domain,"mail1.nsogroup.com","",1,20160824
|
||||
58222e62-1020-4d67-b83f-49798e96ca05,10,Payload delivery,url,"https://sms.webadv.co/3589003s/","link delivered by sms",1,20160824
|
||||
58222e78-135c-434e-966e-49798e96ca05,10,Payload delivery,url,"https://sms.webadv.co/9573305s/","link delivered by sms",1,20160824
|
||||
58223036-8d6c-4c3e-a427-497a8e96ca05,10,Network activity,domain,"alljazeera.co","",1,20160824
|
||||
582230b8-049c-47ec-90e2-497a8e96ca05,10,Network activity,domain,"googleplay-store.com","",1,20160824
|
||||
582230b8-0880-4c1c-a507-497a8e96ca05,10,Network activity,domain,"bulbazaur.com","",1,20160824
|
||||
582230b8-0cf8-4c54-8e57-497a8e96ca05,10,Network activity,domain,"checkinonlinehere.com","",1,20160824
|
||||
582230b8-2670-47d2-8389-497a8e96ca05,10,Network activity,domain,"univision.click","",1,20160824
|
||||
582230b8-36e4-4843-93db-497a8e96ca05,10,Network activity,domain,"turkishairines.info","",1,20160824
|
||||
582230b8-3754-42c7-af73-497a8e96ca05,10,Network activity,domain,"newtarrifs.net","",1,20160824
|
||||
582230b8-6748-496e-a951-497a8e96ca05,10,Network activity,domain,"bbc-africa.com","",1,20160824
|
||||
582230b8-7c38-47df-b3b1-497a8e96ca05,10,Network activity,domain,"fb-accounts.com","",1,20160824
|
||||
582230b8-839c-4f04-949e-497a8e96ca05,10,Network activity,domain,"cnn-africa.co","",1,20160824
|
||||
582230b8-8440-4d71-97b4-497a8e96ca05,10,Network activity,domain,"emiratesfoundation.net","",1,20160824
|
||||
582230b8-8640-4db9-8cdf-497a8e96ca05,10,Network activity,domain,"mz-vodacom.info","",1,20160824
|
||||
582230b8-93cc-4f2b-8ae4-497a8e96ca05,10,Network activity,domain,"iusacell-movil.com.mx","",1,20160824
|
||||
582230b8-a9f4-4590-bb10-497a8e96ca05,10,Network activity,domain,"pickuchu.com","",1,20160824
|
||||
582230b8-aa70-4ee9-8fad-497a8e96ca05,10,Network activity,domain,"y0utube.com.mx","",1,20160824
|
||||
582230b8-c5ac-4743-862b-497a8e96ca05,10,Network activity,domain,"sabafon.info","",1,20160824
|
||||
582230b8-ceec-4dcb-8c51-497a8e96ca05,10,Network activity,domain,"track-your-fedex-package.org","",1,20160824
|
||||
582230b8-e524-449e-8e0c-497a8e96ca05,10,Network activity,domain,"accounts.mx","",1,20160824
|
||||
582230b8-e9e0-4a50-b94c-497a8e96ca05,10,Network activity,domain,"unonoticias.net","",1,20160824
|
||||
582230b8-ecc8-4bce-966d-497a8e96ca05,10,Network activity,domain,"adjust-local-settings.com","",1,20160824
|
||||
582230b8-fbc0-42e5-b56c-497a8e96ca05,10,Network activity,domain,"whatsapp-app.com","",1,20160824
|
||||
58223264-6050-4883-8676-497a8e96ca05,10,Network activity,domain,"damanhealth.online","",1,20160824
|
||||
5822327c-2050-46cb-b310-497a8e96ca05,10,Network activity,domain,"uaenews.online","",1,20160824
|
||||
58223346-c23c-4751-9d82-69fe8e96ca05,10,Payload delivery,url,"http://fb-accounts.com/2408931s/","",1,20160824
|
||||
58223375-b860-4462-9d5a-49798e96ca05,10,Payload delivery,url,"http://unonoticias.net/1867745s/","",1,20160824
|
||||
582233be-b3c8-4238-82b5-49798e96ca05,10,Payload delivery,url,"https://ideas-telcel.com.mx/3975827s/","",1,20160824
|
||||
582233c5-8108-41eb-ba12-49798e96ca05,10,Network activity,domain,"ideas-telcel.com.mx","",1,20160824
|
||||
58223592-ad84-44d5-9e29-49798e96ca05,10,Payload delivery,url,"nation-news.com/4077017s/","",1,20160824
|
||||
582235a0-ea0c-4301-b87b-49798e96ca05,10,Network activity,domain,"nation-news.com","",1,20160824
|
||||
6540311c-8872-47a3-ada2-24757eaa35ee,10,Network activity,domain,"turkeynewsupdates.com","",1,20160824
|
||||
73293a7a-acd5-47a0-81b6-a73f6dde67e1,10,Payload delivery,domain,"manoraonline.net","NSO anonymizer relay",1,20160824
|
||||
7d63d6cb-90dc-454c-a505-a313150c1426,10,Network activity,domain,"qaintqa.com","",1,20160824
|
||||
7db51886-46b4-496f-86fd-6b75a7b5f8c8,10,Network activity,ip-dst,"82.80.202.200","",1,20160824
|
||||
7dd57279-a151-44d4-a21d-bb62ee3435aa,10,Payload delivery,url,"http://fb-accounts.com/1074139s/","",1,20160824
|
||||
812c4cbf-60a7-431d-ae7a-a9fd1d6044aa,10,Network activity,domain,"nsoqa.com","",1,20160824
|
||||
96bd845b-b8a7-4c91-92e1-c9060cc01239,10,Network activity,url,"https://smser.net/9918216t/","",1,20160824
|
||||
9a804548-73c4-4258-9b88-51f952f75d17,10,Network activity,domain,"asrararablya.com","",1,20160824
|
||||
9be3a48f-e540-43f8-a2c0-8dc915a3dd48,10,Network activity,domain,"ooredoodeals.com","",1,20160824
|
||||
9c494d42-797d-4c62-978a-8a888fb179c8,10,Network activity,domain,"asrarrarabiya.com","",1,20160824
|
||||
a2f8ef48-d6f7-46b1-9ee0-71fcb1c65cb9,10,Network activity,domain,"thainews.asia","",1,20160824
|
||||
c9181cb8-1400-47e1-b45b-fc4d17cebe52,10,Network activity,url,"https://smser.net/redirect.aspx","",1,20160824
|
||||
ca1121b7-d273-4aac-83e8-e69b4bce5604,10,Payload delivery,domain,"sms.webadv.co","",1,20160824
|
||||
cb442bf4-0d18-4d60-b1a7-e0fe5c7614fa,10,Network activity,ip-dst,"162.209.103.68","IP behind manoraonline.net",1,20160824
|
||||
cd9ef05f-b3ea-41c2-a750-a431f9dfb508,10,Network activity,domain,"smser.net","",1,20160824
|
||||
cdde7699-d231-458d-80a5-338b9e985702,10,Payload delivery,domain,"aalaan.tv","NSO anonymizer relay",1,20160824
|
||||
eed4deb8-c8a8-4722-8e29-8ba5772e3059,10,Payload delivery,url,"http://unonoticias.net/3423768s/","",1,20160824
|
||||
f13b8f95-e6ca-47a8-8c25-fe1f4817a439,10,Network activity,domain,"webadv.co","",1,20160824
|
||||
|
261
data/ioc/spyware/citizen_lab/201608_NSO_Group/openioc.ioc
Normal file
261
data/ioc/spyware/citizen_lab/201608_NSO_Group/openioc.ioc
Normal file
@@ -0,0 +1,261 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="581c1022-5c68-4617-9ea4-497a8e96ca05" last-modified="2016-08-24T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
|
||||
<short_description>Event #10</short_description>
|
||||
<description>The Million Dollar Dissident: NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender</description>
|
||||
<keywords />
|
||||
<authored_by>citizenlab</authored_by>
|
||||
<authored_date>2016-08-24T00:00:00</authored_date>
|
||||
<links />
|
||||
<definition>
|
||||
<Indicator operator="OR" id="581c1022-5c68-4617-9ea4-497a8e96ca05">
|
||||
<IndicatorItem id="alljazeera.co" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="bbc-africa.com" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="cnn-africa.co" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="unonoticias.net" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="univision.click" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="track-your-fedex-package.org" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="mz-vodacom.info" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="iusacell-movil.com.mx" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="sabafon.info" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="newtarrifs.net" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="y0utube.com.mx" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="fb-accounts.com" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="googleplay-store.com" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="whatsapp-app.com" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="accounts.mx" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="adjust-local-settings.com" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="emiratesfoundation.net" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="checkinonlinehere.com" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="turkishairines.info" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="bulbazaur.com" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="pickuchu.com" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="damanhealth.online" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="uaenews.online" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="ideas-telcel.com.mx" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="nation-news.com" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="webadv.co" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="icloudcacher.com" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="asrarrarabiya.com" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="asrararabiya.co" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="asrararablya.com" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="smser.net" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="icrcworld.com" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="redcrossworld.com" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="topcontactco.com" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="thainews.asia" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="kenyasms.org" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="qaintqa.com" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="nsoqa.com" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="ooredoodeals.com" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="alawaeltech.com" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="bahrainsms.co" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="turkeynewsupdates.com" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="mail1.nsogroup.com" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="52.8.153.44" condition="is">
|
||||
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
||||
<Content type="IP"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="52.8.52.166" condition="is">
|
||||
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
||||
<Content type="IP"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="162.209.103.68" condition="is">
|
||||
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
||||
<Content type="IP"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="82.80.202.200" condition="is">
|
||||
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
||||
<Content type="IP"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="82.80.202.204" condition="is">
|
||||
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
||||
<Content type="IP"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="54.251.49.214" condition="is">
|
||||
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
||||
<Content type="IP"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="https://smser.net/9918216t/" condition="is">
|
||||
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="https://smser.net/redirect.aspx" condition="is">
|
||||
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="aalaan.tv" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="manoraonline.net" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="sms.webadv.co" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="https://sms.webadv.co/3589003s/" condition="is">
|
||||
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="https://sms.webadv.co/9573305s/" condition="is">
|
||||
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="http://fb-accounts.com/2408931s/" condition="is">
|
||||
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="http://unonoticias.net/1867745s/" condition="is">
|
||||
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="https://ideas-telcel.com.mx/3975827s/" condition="is">
|
||||
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="nation-news.com/4077017s/" condition="is">
|
||||
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="http://fb-accounts.com/1074139s/" condition="is">
|
||||
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="http://unonoticias.net/3423768s/" condition="is">
|
||||
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
</Indicator>
|
||||
</definition>
|
||||
</ioc>
|
||||
2302
data/ioc/spyware/citizen_lab/201608_NSO_Group/stix.xml
Normal file
2302
data/ioc/spyware/citizen_lab/201608_NSO_Group/stix.xml
Normal file
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user