sssnake/autarch
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

Browse Source
This commit is contained in:
SsSnake
2026-07-13 15:45:47 -07:00
parent 925216290f
commit e48d577bd5
387 changed files with 211976 additions and 921 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
data/ioc/spyware/citizen_lab/201702_NilePhish/README.md Normal file
View File

@@ -0,0 +1,9 @@
## NilePhish IOCs
This directory contains IOCs from the Citizen Lab report [Nile Phish: Large-Scale Phishing Campaign Targeting Egyptian Civil Society](https://citizenlab.org/2017/02/nilephish-report/) published the 2nd of February 2017.
Files included in this directory:
* openioc.ioc : IOCs in OpenIOC format
* stix.xml : IOCs in STIX XML format
* iocs.csv : IOCs in csv format
* misp.json : IOC in MISP JSON format

39
data/ioc/spyware/citizen_lab/201702_NilePhish/iocs.csv Normal file
View File

@@ -0,0 +1,39 @@
uuid,event_id,category,type,value,comment,to_ids,date
587cf53e-ee64-4e85-a4f5-0bbb8e96ca05,89,Network activity,ip-dst,"176.123.26.42","",1,20170116
587cfa0f-0b54-44f1-9f4c-0bbb8e96ca05,89,Network activity,ip-dst,"108.61.176.96","IPs hosting phishing websites",1,20170116
587cfa22-d240-4c6a-ba53-0bbb8e96ca05,89,Network activity,ip-dst,"104.238.191.204","IP hosting phishing websites",1,20170116
588778af-1470-4b9e-a921-07288e96ca05,89,Network activity,domain,"google-maps.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-1708-4caa-bef5-07288e96ca05,89,Network activity,domain,"googledriver-sign.ddns.net","Domains used in the phishing attack",1,20170124
588778af-2d08-493e-962a-07288e96ca05,89,Network activity,domain,"googlesecure-serv.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-3604-4351-9e9e-07288e96ca05,89,Network activity,domain,"googledrive-sign.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-3f6c-4a59-9c2f-07288e96ca05,89,Network activity,domain,"fedex-sign.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-4184-41bd-932b-07288e96ca05,89,Network activity,domain,"dropbox-sign.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-421c-4ab6-8fc9-07288e96ca05,89,Network activity,domain,"verification-acc.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-4754-4997-9fdc-07288e96ca05,89,Network activity,domain,"secure-team.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-4e10-41de-9d5b-07288e96ca05,89,Network activity,domain,"dropbox-service.serveftp.com","Domains used in the phishing attack",1,20170124
588778af-5614-4198-bfc8-07288e96ca05,89,Network activity,domain,"fedex-mail.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-5724-4ccd-b5f0-07288e96ca05,89,Network activity,domain,"aramex-shipping.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-7d08-4995-ae9d-07288e96ca05,89,Network activity,domain,"myaccount.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-7ff4-4200-a7ee-07288e96ca05,89,Network activity,domain,"security-myaccount.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-aaf4-49c7-9028-07288e96ca05,89,Network activity,domain,"googleverify-signin.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-cf24-4254-ad98-07288e96ca05,89,Network activity,domain,"account-google.serveftp.com","Domains used in the phishing attack",1,20170124
588778af-d37c-406e-8703-07288e96ca05,89,Network activity,domain,"fedex-shipping.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-d7e4-4b55-8b85-07288e96ca05,89,Network activity,domain,"dropboxsupport.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-ea9c-4be6-a936-07288e96ca05,89,Network activity,domain,"mailgooglesign.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-ee60-4f45-8efb-07288e96ca05,89,Network activity,domain,"device-activation.servehttp.com","Domains used in the phishing attack",1,20170124
588778af-f554-4b11-b19b-07288e96ca05,89,Network activity,domain,"googlesignin.servehttp.com","Domains used in the phishing attack",1,20170124
58877af7-3218-42ee-ab63-07288e96ca05,89,Network activity,domain,"fedex-s.servehttp.com","Related phishing domain",1,20170124
58877af7-c9f8-4198-acf2-07288e96ca05,89,Network activity,domain,"watchyoutube.servehttp.com","Related phishing domain",1,20170124
58877af7-e064-4ea8-8048-07288e96ca05,89,Network activity,domain,"dropbox-verfy.servehttp.com","Related phishing domain",1,20170124
58877ce3-2fa4-43b0-9be6-07298e96ca05,89,Network activity,domain,"securityteam-notify.servehttp.com","Related phishing domain",1,20170124
58877ce3-5b10-49d8-b03d-07298e96ca05,89,Network activity,domain,"restricted-videos.servehttp.com","Related phishing domain",1,20170124
58877ce3-5d28-4361-983f-07298e96ca05,89,Network activity,domain,"fedex-notification.servehttp.com","Related phishing domain",1,20170124
58877ce3-9b20-4e75-a2f1-07298e96ca05,89,Network activity,domain,"quota-notification.servehttp.com","Related phishing domain",1,20170124
58877ce3-acd4-4365-ac46-07298e96ca05,89,Network activity,domain,"docs-mails.servehttp.com","Related phishing domain",1,20170124
58877ce3-c1c4-40d8-baa5-07298e96ca05,89,Network activity,domain,"verification-team.servehttp.com","Related phishing domain",1,20170124
58877ce3-e2bc-4fc7-b7a0-07298e96ca05,89,Network activity,domain,"notification-team.servehttp.com","Related phishing domain",1,20170124
58877ce3-f668-4eb1-828a-07298e96ca05,89,Network activity,domain,"dropboxnotification.servehttp.com","Related phishing domain",1,20170124
58877ce3-fb60-4972-a691-07298e96ca05,89,Network activity,domain,"secure-alert.servehttp.com","Related phishing domain",1,20170124
5887a880-559c-4680-a403-0bbb8e96ca05,89,Network activity,domain,"moi-gov.serveftp.com","Related phishing domain",1,20170124
5890c466-51f8-425d-850f-07298e96ca05,89,Network activity,domain,"activate-google.servehttp.com","Domain used in the phishing attack",1,20170131
5890c521-f8f4-4df3-ab2c-07298e96ca05,89,Network activity,domain,"googlemaps.servehttp.com","Domain used in the phishing attack",1,20170131
1 uuid event_id category type value comment to_ids date
2 587cf53e-ee64-4e85-a4f5-0bbb8e96ca05 89 Network activity ip-dst 176.123.26.42 1 20170116
3 587cfa0f-0b54-44f1-9f4c-0bbb8e96ca05 89 Network activity ip-dst 108.61.176.96 IPs hosting phishing websites 1 20170116
4 587cfa22-d240-4c6a-ba53-0bbb8e96ca05 89 Network activity ip-dst 104.238.191.204 IP hosting phishing websites 1 20170116
5 588778af-1470-4b9e-a921-07288e96ca05 89 Network activity domain google-maps.servehttp.com Domains used in the phishing attack 1 20170124
6 588778af-1708-4caa-bef5-07288e96ca05 89 Network activity domain googledriver-sign.ddns.net Domains used in the phishing attack 1 20170124
7 588778af-2d08-493e-962a-07288e96ca05 89 Network activity domain googlesecure-serv.servehttp.com Domains used in the phishing attack 1 20170124
8 588778af-3604-4351-9e9e-07288e96ca05 89 Network activity domain googledrive-sign.servehttp.com Domains used in the phishing attack 1 20170124
9 588778af-3f6c-4a59-9c2f-07288e96ca05 89 Network activity domain fedex-sign.servehttp.com Domains used in the phishing attack 1 20170124
10 588778af-4184-41bd-932b-07288e96ca05 89 Network activity domain dropbox-sign.servehttp.com Domains used in the phishing attack 1 20170124
11 588778af-421c-4ab6-8fc9-07288e96ca05 89 Network activity domain verification-acc.servehttp.com Domains used in the phishing attack 1 20170124
12 588778af-4754-4997-9fdc-07288e96ca05 89 Network activity domain secure-team.servehttp.com Domains used in the phishing attack 1 20170124
13 588778af-4e10-41de-9d5b-07288e96ca05 89 Network activity domain dropbox-service.serveftp.com Domains used in the phishing attack 1 20170124
14 588778af-5614-4198-bfc8-07288e96ca05 89 Network activity domain fedex-mail.servehttp.com Domains used in the phishing attack 1 20170124
15 588778af-5724-4ccd-b5f0-07288e96ca05 89 Network activity domain aramex-shipping.servehttp.com Domains used in the phishing attack 1 20170124
16 588778af-7d08-4995-ae9d-07288e96ca05 89 Network activity domain myaccount.servehttp.com Domains used in the phishing attack 1 20170124
17 588778af-7ff4-4200-a7ee-07288e96ca05 89 Network activity domain security-myaccount.servehttp.com Domains used in the phishing attack 1 20170124
18 588778af-aaf4-49c7-9028-07288e96ca05 89 Network activity domain googleverify-signin.servehttp.com Domains used in the phishing attack 1 20170124
19 588778af-cf24-4254-ad98-07288e96ca05 89 Network activity domain account-google.serveftp.com Domains used in the phishing attack 1 20170124
20 588778af-d37c-406e-8703-07288e96ca05 89 Network activity domain fedex-shipping.servehttp.com Domains used in the phishing attack 1 20170124
21 588778af-d7e4-4b55-8b85-07288e96ca05 89 Network activity domain dropboxsupport.servehttp.com Domains used in the phishing attack 1 20170124
22 588778af-ea9c-4be6-a936-07288e96ca05 89 Network activity domain mailgooglesign.servehttp.com Domains used in the phishing attack 1 20170124
23 588778af-ee60-4f45-8efb-07288e96ca05 89 Network activity domain device-activation.servehttp.com Domains used in the phishing attack 1 20170124
24 588778af-f554-4b11-b19b-07288e96ca05 89 Network activity domain googlesignin.servehttp.com Domains used in the phishing attack 1 20170124
25 58877af7-3218-42ee-ab63-07288e96ca05 89 Network activity domain fedex-s.servehttp.com Related phishing domain 1 20170124
26 58877af7-c9f8-4198-acf2-07288e96ca05 89 Network activity domain watchyoutube.servehttp.com Related phishing domain 1 20170124
27 58877af7-e064-4ea8-8048-07288e96ca05 89 Network activity domain dropbox-verfy.servehttp.com Related phishing domain 1 20170124
28 58877ce3-2fa4-43b0-9be6-07298e96ca05 89 Network activity domain securityteam-notify.servehttp.com Related phishing domain 1 20170124
29 58877ce3-5b10-49d8-b03d-07298e96ca05 89 Network activity domain restricted-videos.servehttp.com Related phishing domain 1 20170124
30 58877ce3-5d28-4361-983f-07298e96ca05 89 Network activity domain fedex-notification.servehttp.com Related phishing domain 1 20170124
31 58877ce3-9b20-4e75-a2f1-07298e96ca05 89 Network activity domain quota-notification.servehttp.com Related phishing domain 1 20170124
32 58877ce3-acd4-4365-ac46-07298e96ca05 89 Network activity domain docs-mails.servehttp.com Related phishing domain 1 20170124
33 58877ce3-c1c4-40d8-baa5-07298e96ca05 89 Network activity domain verification-team.servehttp.com Related phishing domain 1 20170124
34 58877ce3-e2bc-4fc7-b7a0-07298e96ca05 89 Network activity domain notification-team.servehttp.com Related phishing domain 1 20170124
35 58877ce3-f668-4eb1-828a-07298e96ca05 89 Network activity domain dropboxnotification.servehttp.com Related phishing domain 1 20170124
36 58877ce3-fb60-4972-a691-07298e96ca05 89 Network activity domain secure-alert.servehttp.com Related phishing domain 1 20170124
37 5887a880-559c-4680-a403-0bbb8e96ca05 89 Network activity domain moi-gov.serveftp.com Related phishing domain 1 20170124
38 5890c466-51f8-425d-850f-07298e96ca05 89 Network activity domain activate-google.servehttp.com Domain used in the phishing attack 1 20170131
39 5890c521-f8f4-4df3-ab2c-07298e96ca05 89 Network activity domain googlemaps.servehttp.com Domain used in the phishing attack 1 20170131

1080
data/ioc/spyware/citizen_lab/201702_NilePhish/misp.json Normal file
View File

File diff suppressed because it is too large Load Diff

165
data/ioc/spyware/citizen_lab/201702_NilePhish/openioc.ioc Normal file
View File

@@ -0,0 +1,165 @@
<?xml version="1.0" encoding="utf-8"?>
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="587cf513-b324-485c-b65e-07298e96ca05" last-modified="2017-01-16T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
<short_description>Event #89</short_description>
<description>Nile Phish - attacks again Egyptian civil society</description>
<keywords />
<authored_by>citizenlab</authored_by>
<authored_date>2017-01-16T00:00:00</authored_date>
<links />
<definition>
<Indicator operator="OR" id="587cf513-b324-485c-b65e-07298e96ca05">
<IndicatorItem id="account-google.serveftp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="aramex-shipping.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="device-activation.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="dropbox-service.serveftp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="dropbox-sign.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="dropboxsupport.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="fedex-mail.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="fedex-shipping.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="fedex-sign.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="googledriver-sign.ddns.net" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="googledrive-sign.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="google-maps.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="googlesecure-serv.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="googlesignin.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="googleverify-signin.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="mailgooglesign.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="myaccount.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="secure-team.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="security-myaccount.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="verification-acc.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="dropbox-verfy.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="fedex-s.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="watchyoutube.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="verification-team.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="securityteam-notify.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="secure-alert.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="quota-notification.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="notification-team.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="fedex-notification.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="docs-mails.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="restricted-videos.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="dropboxnotification.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="moi-gov.serveftp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="activate-google.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="googlemaps.servehttp.com" condition="is">
<Context document="Network" search="Network/DNS" type="mir" />
<Content type="string"></Content>
</IndicatorItem>
<IndicatorItem id="108.61.176.96" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="104.238.191.204" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
<IndicatorItem id="176.123.26.42" condition="is">
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
<Content type="IP"></Content>
</IndicatorItem>
</Indicator>
</definition>
</ioc>

1249
data/ioc/spyware/citizen_lab/201702_NilePhish/stix.xml Normal file
View File

File diff suppressed because it is too large Load Diff