Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

data/ioc/spyware/citizen_lab/201909_MissingLink/README.md

@@ -0,0 +1,4 @@
+# MISSING LINK: Tibetan Groups Targeted with Mobile Exploits
+
+Indicators for the campaign "[MISSING LINK: Tibetan Groups Targeted with Mobile Exploits](https://citizenlab.ca/2019/09/poison-carp-tibetan-groups-targeted-with-1-click-mobile-exploits)" published by the Citizen Lab
+

data/ioc/spyware/citizen_lab/201909_MissingLink/decode_scotch_c2_communications.py

@@ -0,0 +1,137 @@
+#!/usr/bin/env python3
+"""
+Python script decoding network capture of the Scotch malware C2 communications
+"""
+__author__ = "Etienne Maynier"
+__license__ = "MIT"
+
+import base64
+import pyshark
+from io import BytesIO
+import gzip
+import json
+import argparse
+
+COMMANDS = {
+   -1: "VOID",
+    0: "OFFLINE",
+    1: "ONLINE",
+    2: "DEV_INFO",
+    3: "GET_PLUGIN_INFO",
+    4: "GET_CALLLOG",
+    5: "GET_CONTACT",
+    6: "GET_LOCATION",
+    7: "GET_SMS",
+    8: "GET_FILE",
+    9: "CLEAR",
+    10: "SHELL",
+    11: "NOTIFICATION",
+    12: "CAMERA",
+    13: "RECORD",
+    14: "SCREEN_SNAP"
+}
+
+ERRORS = {
+    -1 : "UNKNOW",
+    0: "SUCCESS",
+    1: "SERVER_ERROR",
+    2: "PLUGIN_DATA_NOT_FOUND",
+    3: "PLUGIN_NO_NEED_UPDATE",
+    4: "COMMAND_NOT_MATCH",
+    5: "CONTEXT_NOT_FOUND",
+    6: "GET_WHISKY_ID_FAILED",
+    7: "GET_DEVICE_ID_FAILED",
+    8: "COMMAND_TYPE_NOT_REGISTERED",
+    9: "PERMISION_NOT_GRANTED",
+    10: "CONTENT_RESOLVER_CURSOR_EXCEPTION",
+    11: "CONTENT_RESOLVER_CURSOR_NULL_OR_ZERO",
+    12: "CONTENT_RESOLVER_CURSOR_GET_EXCEPTION",
+    13: "GET_ACTIVITY_FAILED",
+    14: "OBSERVER_ALREADY_REGISTER",
+    15: "OBSERVER_ALREADY_UNREGISTER",
+    16: "GET_DEVICE_INFO_FAILED",
+    17: "GET_SMS_FAILED",
+    18: "GET_SMS_TO_JSON_FAILED",
+    19: "GET_CONTACT_FAILED",
+    20: "GET_CONTACT_TO_JSON_FAILED",
+    21: "GET_CALLLOG_FAILED",
+    22: "GET_CALLLOG_TO_JSON_FAILED",
+    23: "GET_LOCATION_FAILED",
+    24: "GET_LOCATION_TO_JSON_FAILED",
+    25: "GET_LOCATION_SERVICE_FAILED",
+    26: "GPS_PROVIDER_NOT_ENABLE",
+    27: "NETWORK_PROVIDER_NOT_ENABLE",
+    28: "FETCH_FILE_NO_PATH_SUBCMD",
+    29: "FETCH_FILE_NO_SUCH_FILE",
+    30: "FETCH_FILE_READ_FILE_FAILED",
+    31: "FETCH_FILE_NO_READ_PERMISSION",
+    32: "FETCH_FILE_TO_LARGE",
+    33: "UPLOAD_FILE_FAILED",
+    34: "LIST_DIR_NO_PATH_SUBCMD",
+    35: "LIST_DIR_NOT_EXIST",
+    36: "LIST_DIR_IS_NOT_DIR",
+    37: "LIST_DIR_NO_READ_PERMISSION",
+    38: "UPDATE_FILE_NO_FORCE_SUBCMD",
+    39: "UPDATE_FILE_NO_PATH_SUBCMD",
+    40: "UPDATE_FILE_NO_MODIFY_SUBCMD",
+    41: "UPDATE_FILE_NO_SHA256_SUBCMD",
+    42: "UPDATE_FILE_NO_SUCH_FILE",
+    43: "UPDATE_FILE_READ_FILE_FAILED",
+    44: "UPDATE_FILE_NO_READ_PERMISSION",
+    45: "UPDATE_FILE_TO_LARGE",
+    46: "UPDATE_FILE_NO_NEED_UPDATE",
+    47: "UPDATE_FILE_CALC_SHA256_FAILED",
+    48: "UPDATE_FILE_NO_SUCH_SUBCMD",
+    49: "GET_PACKAGE_NAME_FAILED",
+    50: "GET_REPLACE_SO_PATH_FAILED",
+    51: "CLEAR_SOME_FILE_FAILED",
+    52: "CLEAR_NO_IS_ALL_ARGUMENT",
+    53: "CLEAR_RETURN_TO_JSON_FAILED",
+    54: "GET_SHELL_RESULT_FAILED",
+    55: "GET_CAMERA_FEATURE_FAILED",
+    56: "GET_CAMERA_JSON_FAILED",
+    57: "GET_CAMERA_PREVIEW_FAILED",
+    58: "GET_CAMERA_SNAP_TO_FILE_FAILED",
+    59: "SEND_SMS_GENERIC_FAILURE",
+    60: "SEND_SMS_RADIO_OFF",
+    61: "SEND_SMS_NULL_PDU",
+    62: "SEND_SMS_NO_SERVER",
+    63: "SEND_SMS_CODE_ERROR",
+    64: "GET_RECORD_TO_FILE_FALIED",
+    65: "GET_RECORD_TIME_TOO_LONG_FAILED",
+    66: "GET_RECORD_RECORDING_FAILED",
+    67: "SCREEN_SNAP_IN_HOST_FAILED",
+    68: "SCREEN_SNAP_CREATE_BITMAP_FAILED",
+    69: "SCREEN_SNAP_OUT_HOST_FAILED",
+    70: "SCREEN_SNAP_GET_MEDIA_PROJECTION_FAILED",
+    71: "PLUGIN_LOAD_FAILED",
+    72: "PLUGIN_DOWNLOAD_FAILED"
+}
+
+
+def decode(data):
+    d = base64.b64decode(data)
+    return gzip.GzipFile(fileobj=BytesIO(d)).read()
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description='Scotch Whisky C2 communications')
+    parser.add_argument('PCAP')
+    args = parser.parse_args()
+
+    cap = pyshark.FileCapture(args.PCAP)
+
+    for p in cap:
+        if 'DATA-TEXT-LINES' in p:
+            # pyshark bug here when there are multiple lines
+            # Ugly, but the world is ugly
+            data = str(p['DATA-TEXT-LINES'])[24:].replace('\n', '').replace('\t', '').replace("\\n", '')
+            if "[truncated]" in data:
+                # Even worse :o
+                data = bytearray.fromhex(p.tcp.payload.replace(':', ''))[4:].decode('utf-8')
+            cleartext = decode(data)
+            js = json.loads(cleartext)
+            if p.tcp.dstport == "10011":
+                print("CLIENT -> SERVER : {:15s} | {:27s} -> [{}]".format(COMMANDS[js['cmd_type']], ERRORS[js['error']], js['data'] if 'data' in js else ''))
+            else:
+                print("SERVER -> CLIENT : {:15s} | {:27s} -> [{}]".format(COMMANDS[js['cmd_type']], ERRORS[js['error']], js['data'] if 'data' in js else ''))

data/ioc/spyware/citizen_lab/201909_MissingLink/iocs.csv

@@ -0,0 +1,72 @@
+uuid,event_id,category,type,value,comment,to_ids,date
+5bec8d6d-6cc8-4aef-b8c9-171c8064ab0b,140,Network activity,domain,"msap.services","",1,20181114
+5bec8d6d-71e0-40b6-add8-171c8064ab0b,140,Network activity,domain,"www.msap.services","",1,20181114
+5bec8d7b-b658-4050-8b3c-45cc8064ab0b,140,Network activity,ip-dst,"144.202.59.23","iOS exploit server",1,20190920
+5bed8343-d968-4c72-a106-2b328064ab0b,140,Network activity,ip-dst,"66.42.58.59","iOS C2",1,20190920
+5bed84bf-8710-4cba-b9eb-05688064ab0b,140,Network activity,ip-dst,"43.251.16.87","",1,20181115
+5d76c6d3-0658-494c-afb4-61de8064ab0b,140,Network activity,url,"http://www.msap.services/S5gDoN","",0,20190909
+5d76c6d3-0d28-4b27-9ac6-61de8064ab0b,140,Network activity,url,"http://bit.ly/2B4GwEf","",0,20190909
+5d76c6d3-1170-4f0e-ade3-61de8064ab0b,140,Network activity,url,"http://www.msap.services/EzpOhU","",0,20190909
+5d76c6d3-14c4-4b77-85be-61de8064ab0b,140,Network activity,url,"http://bit.ly/2AYy61a","",0,20190909
+5d76c6d3-1708-4847-8b18-61de8064ab0b,140,Network activity,url,"http://news.cmitcsubs.tk:5000/web/info?org=aHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL29wZW4/aWQ9MUlTakl2eFoxX1g5YkdJSnQtMlpKeDRDRWwzdVVhRmlv","",0,20190909
+5d76c6d3-2150-4f97-80c4-61de8064ab0b,140,Network activity,url,"http://msap.services/yHJbS6","",0,20190909
+5d76c6d3-2f9c-40b2-8cd5-61de8064ab0b,140,Network activity,url,"http://www.msap.services/70FtQX","",0,20190909
+5d76c6d3-578c-4a96-88fe-61de8064ab0b,140,Network activity,url,"http://bit.ly/2PSvdau","",0,20190909
+5d76c6d3-5824-4b00-8dda-61de8064ab0b,140,Network activity,url,"http://suo.im/5okeFb","",0,20190909
+5d76c6d3-7058-403d-a9b1-61de8064ab0b,140,Network activity,url,"http://www.msap.services/GfHuRi","",0,20190909
+5d76c6d3-8604-4125-b369-61de8064ab0b,140,Network activity,url,"http://www.msap.services/XgL5A9","",0,20190909
+5d76c6d3-8624-44df-8338-61de8064ab0b,140,Network activity,url,"http://bit.ly/2T2CoeX","",0,20190909
+5d76c6d3-936c-411b-a0c9-61de8064ab0b,140,Network activity,url,"http://bit.ly/2QroNMt","",0,20190909
+5d76c6d3-a174-4130-a62c-61de8064ab0b,140,Network activity,url,"http://www.msap.services/6FeBOy","",0,20190909
+5d76c6d3-a530-4671-8fab-61de8064ab0b,140,Network activity,url,"http://bit.ly/2SVPqdY","",0,20190909
+5d76c6d3-b644-45e2-a9d7-61de8064ab0b,140,Network activity,url,"http://www.msap.services/1R7mqD","",0,20190909
+5d76c6d3-b878-442a-b476-61de8064ab0b,140,Network activity,url,"http://bit.ly/2z1WayM","",0,20190909
+5d76c6d3-b8ec-438c-8161-61de8064ab0b,140,Network activity,url,"http://news.cmitcsubs.tk:5000/web/info?org=aHR0cHM6Ly93d3cubnl0aW1lcy5jb20vMjAxOC8xMS8wMi9vYml0dWFyaWVzL2xvZGktZ3lhcmktZGVhZC5odG1s","",0,20190909
+5d76c6d3-bb64-4b8d-b773-61de8064ab0b,140,Network activity,url,"http://www.msap.services/yHJbS6","",0,20190909
+5d76c6d3-bd08-4528-9fab-61de8064ab0b,140,Network activity,url,"http://www.msap.services/F8XGNe","",0,20190909
+5d76c6d3-ce00-497f-9284-61de8064ab0b,140,Network activity,url,"http://suo.im/5ot25j","",0,20190909
+5d76c6d3-d218-49a3-96f3-61de8064ab0b,140,Network activity,url,"http://bit.ly/2qHg3Xt","",0,20190909
+5d76c6d3-f8f0-4399-a2ae-61de8064ab0b,140,Network activity,url,"http//www.msap.services/2bKr8Z","",0,20190909
+5d76c6d4-0854-4d51-8fb7-61de8064ab0b,140,Network activity,url,"http://www.msap.services/ZpzstM","",0,20190909
+5d76c6d4-12f0-4f58-9a9b-61de8064ab0b,140,Network activity,url,"http://www.msap.services/ZQfqzs","",0,20190909
+5d76c6d4-2fb8-46f2-a589-61de8064ab0b,140,Network activity,url,"http://bit.ly/2Drl90q","",0,20190909
+5d76c6d4-3b64-4591-b0df-61de8064ab0b,140,Network activity,url,"http://45.76.149.154:5000/web/info?org=aHR0cDovL3d3dy5waGF5dWwuY29tL25ld3MvYXJ0aWNsZS5hc3B4P2lkPTQxNDc0JmZiY2xpZD1Jd0FSM1RadGdjanppUkhNZFJuOEdhZ1RMUV9iMHFrX0VBZWY2YldxRU5SanhaZkkzRFdPNFpsRExPcFdz","",0,20190909
+5d76c6d4-52b4-413f-bf04-61de8064ab0b,140,Network activity,url,"https://www.energy-mail.org/B20V54","",0,20190909
+5d76c6d4-7398-45b0-b5e9-61de8064ab0b,140,Network activity,url,"http://bit.ly/2T6pCMf","",0,20190909
+5d76c6d4-c2a8-4ee3-bf3d-61de8064ab0b,140,Network activity,url,"https://bit.ly/2MgSRwL","",0,20190909
+5d76c6d4-dde0-484e-ac13-61de8064ab0b,140,Network activity,url,"https://bit.ly/2XePmYt","",0,20190909
+5d76c70f-df94-4cd0-b977-4cea8064ab0b,140,Network activity,domain,"www.energy-mail.org","",1,20190909
+5d76c730-b4c0-4746-af7e-61db8064ab0b,140,Network activity,url,"http://43.251.16.87:5000//dev/loader","",0,20190909
+5d76c7a0-2dac-4e65-a0ca-67208064ab0b,140,Network activity,ip-dst,"45.32.75.217","",1,20190909
+5d76c7a0-3c28-4110-aa88-67208064ab0b,140,Network activity,ip-dst,"45.76.149.154","Android exploit server",1,20190920
+5d76c98c-0998-4c3d-94fa-61de8064ab0b,140,Network activity,domain,"bf.mk","",1,20190909
+5d76c98c-0cb4-4be5-b3d6-61de8064ab0b,140,Network activity,domain,"rf.mk","",1,20190909
+5d76c98c-1b78-4933-98f8-61de8064ab0b,140,Network activity,domain,"mailcontactanalysis.online","",1,20190909
+5d76c98c-3358-4897-a52b-61de8064ab0b,140,Network activity,domain,"mailnotes.online","",1,20190909
+5d76c98c-52b4-4bb9-b61b-61de8064ab0b,140,Network activity,domain,"mailanalysis.services","",1,20190909
+5d76c98c-6be4-4b4a-9a37-61de8064ab0b,140,Network activity,domain,"polarismail.services","",1,20190909
+5d76c98c-77cc-4a32-b989-61de8064ab0b,140,Network activity,domain,"energy-mail.org","",1,20190909
+5d76c98c-8960-4e6c-be1c-61de8064ab0b,140,Network activity,domain,"izelense.com","",1,20190909
+5d76c98c-95a0-4186-9d08-61de8064ab0b,140,Network activity,domain,"antmoving.online","",1,20190909
+5d76c98c-a620-4e86-969b-61de8064ab0b,140,Network activity,domain,"gmailapp.me","",1,20190909
+5d76c98c-be94-4716-9cc3-61de8064ab0b,140,Network activity,domain,"beemail.online","",1,20190909
+5d76c98c-f230-436d-a69f-61de8064ab0b,140,Network activity,domain,"walkingnote.online","",1,20190909
+5d76c9b2-5654-4b42-a28f-61dc8064ab0b,140,Attribution,whois-registrant-email,"ornaments798@outlook.com","",0,20190909
+5d76c9b2-8b24-4fb2-8ff3-61dc8064ab0b,140,Attribution,whois-registrant-email,"dashenqu832@outlook.com","",0,20190909
+5d76cc33-7aac-4eb8-a1be-66c48064ab0b,140,Network activity,ip-dst,"45.78.79.100","",1,20190909
+5d76cf56-94f8-4a16-84d5-67af8064ab0b,140,Network activity,ip-dst,"149.28.93.11","",1,20190909
+5d76d19b-0704-42fa-95c5-61df8064ab0b,140,Network activity,ip-dst,"95.169.2.57","",1,20190909
+5d76d6f2-f44c-4b21-ba2d-67578064ab0b,140,Network activity,ip-dst,"206.189.65.198","",1,20190909
+5d76dae6-bdc4-4cca-8161-61de8064ab0b,140,Network activity,ip-dst,"140.82.17.222","",1,20190909
+5d76dcf6-f094-47a0-8fd4-4cea8064ab0b,140,Network activity,ip-dst,"45.76.53.26","",1,20190909
+5d76de15-2544-4f39-baed-61db8064ab0b,140,Network activity,ip-dst,"45.32.91.137","",1,20190909
+5d76dfaf-574c-4253-b1f1-67578064ab0b,140,Artifacts dropped,sha256,"0d2ee9ade24163613772fdda201af985d852ab506e3d3e7f07fb3fa8b0853560","iOS payload",1,20190909
+5d76e2eb-37c8-4b75-b5d7-67578064ab0b,140,Payload delivery,email-src,"touchxun658@gmail.com","OAuth email addresses",0,20190909
+5d76e2eb-abe8-44bb-8dbf-67578064ab0b,140,Payload delivery,email-src,"antmoving.online@gmail.com","OAuth email addresses",0,20190909
+5d76e2eb-df2c-4913-b458-67578064ab0b,140,Payload delivery,email-src,"energymail.org@gmail.com","OAuth email addresses",0,20190909
+5d76e2eb-e004-41d8-bc9d-67578064ab0b,140,Payload delivery,email-src,"jameslewis199106@gmail.com","OAuth email addresses",0,20190909
+5d8545bf-ec98-4d0c-a8a3-55038064ab0b,140,Payload delivery,sha256,"6977e6098815cd91016be9d76f194ed4622640d03c6cdd66b1032306a2190af7","libbourbon",0,20190920
+5d8545d4-ee30-435b-827e-55078064ab0b,140,Payload delivery,sha256,"e510c361c8101384277dd95cc2c8e76715dd241f58553f592245b620422beaf3","Whisky",0,20190920
+5d8545e3-c264-43d8-9666-55068064ab0b,140,Payload delivery,sha256,"0d13e403303b52edae6beb76a6fe7ed454f340aae1246b9a3f55ca728da2d6aa","Scotch",0,20190920
+5d854603-8bf4-44fe-96ae-47ce8064ab0b,140,Payload delivery,sha256,"b85fe634f3c5b1022a1adbc21f3b85b58451ca2b89e9380fc5f22b9340a18b88","Loader",0,20190920
+5d892cd4-fba0-4c21-90d9-0b328064ab0b,140,Network activity,user-agent,"hots scot","Scotch user agent",1,20190923

data/ioc/spyware/citizen_lab/201909_MissingLink/openioc.ioc

@@ -0,0 +1,129 @@
+<?xml version="1.0" encoding="utf-8"?>
+<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="5bec8d43-b990-4129-a9f4-45d08064ab0b" last-modified="2019-09-24T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
+  <short_description>Event #140</short_description>
+  <description>MISSING LINK: Tibetan Groups Targeted with Mobile Exploits</description>
+  <keywords />
+  <authored_by>citizenlab</authored_by>
+  <authored_date>2019-09-24T00:00:00</authored_date>
+  <links />
+  <definition>
+    <Indicator operator="OR" id="5bec8d43-b990-4129-a9f4-45d08064ab0b">
+      <IndicatorItem id="0d2ee9ade24163613772fdda201af985d852ab506e3d3e7f07fb3fa8b0853560" condition="is">
+        <Context document="FileItem" search="FileItem/Sha256sum" type="mir" />
+        <Content type="sha256"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="www.energy-mail.org" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="antmoving.online" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="beemail.online" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="bf.mk" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="energy-mail.org" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="gmailapp.me" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="izelense.com" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="mailanalysis.services" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="mailcontactanalysis.online" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="mailnotes.online" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="polarismail.services" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="rf.mk" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="walkingnote.online" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="www.msap.services" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="msap.services" condition="is">
+        <Context document="Network" search="Network/DNS" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="45.32.75.217" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="45.76.149.154" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="45.78.79.100" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="149.28.93.11" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="95.169.2.57" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="206.189.65.198" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="140.82.17.222" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="45.76.53.26" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="45.32.91.137" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="144.202.59.23" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="66.42.58.59" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="43.251.16.87" condition="is">
+        <Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
+        <Content type="IP"></Content>
+      </IndicatorItem>
+      <IndicatorItem id="hots scot" condition="is">
+        <Context document="Network" search="Network/UserAgent" type="mir" />
+        <Content type="string"></Content>
+      </IndicatorItem>
+    </Indicator>
+  </definition>
+</ioc>

data/ioc/spyware/citizen_lab/201909_MissingLink/snort.rules

@@ -0,0 +1 @@
+alert tcp $HOME_NET any -> $EXTERNAL_NET 10011 (msg:"MOONSHINE payload C2 activity"; flow:established,to_server; content:"GET"; content:"/ws?whisky_id|3d|"; content:"User-Agent: hots scot"; content:"Upgrade: websocket"; reference:url,https://citizenlab.ca/2019/09/poison-carp-tibetan-groups-targeted-with-1-click-mobile-exploits; classtype:trojan-activity; sid:3000003; rev:1;)