262 lines
13 KiB
XML
262 lines
13 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
||
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="581c1022-5c68-4617-9ea4-497a8e96ca05" last-modified="2016-08-24T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
|
||
<short_description>Event #10</short_description>
|
||
<description>The Million Dollar Dissident: NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender</description>
|
||
<keywords />
|
||
<authored_by>citizenlab</authored_by>
|
||
<authored_date>2016-08-24T00:00:00</authored_date>
|
||
<links />
|
||
<definition>
|
||
<Indicator operator="OR" id="581c1022-5c68-4617-9ea4-497a8e96ca05">
|
||
<IndicatorItem id="alljazeera.co" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="bbc-africa.com" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="cnn-africa.co" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="unonoticias.net" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="univision.click" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="track-your-fedex-package.org" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="mz-vodacom.info" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="iusacell-movil.com.mx" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="sabafon.info" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="newtarrifs.net" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="y0utube.com.mx" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="fb-accounts.com" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="googleplay-store.com" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="whatsapp-app.com" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="accounts.mx" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="adjust-local-settings.com" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="emiratesfoundation.net" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="checkinonlinehere.com" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="turkishairines.info" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="bulbazaur.com" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="pickuchu.com" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="damanhealth.online" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="uaenews.online" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="ideas-telcel.com.mx" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="nation-news.com" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="webadv.co" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="icloudcacher.com" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="asrarrarabiya.com" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="asrararabiya.co" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="asrararablya.com" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="smser.net" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="icrcworld.com" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="redcrossworld.com" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="topcontactco.com" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="thainews.asia" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="kenyasms.org" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="qaintqa.com" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="nsoqa.com" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="ooredoodeals.com" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="alawaeltech.com" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="bahrainsms.co" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="turkeynewsupdates.com" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="mail1.nsogroup.com" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="52.8.153.44" condition="is">
|
||
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
||
<Content type="IP"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="52.8.52.166" condition="is">
|
||
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
||
<Content type="IP"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="162.209.103.68" condition="is">
|
||
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
||
<Content type="IP"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="82.80.202.200" condition="is">
|
||
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
||
<Content type="IP"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="82.80.202.204" condition="is">
|
||
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
||
<Content type="IP"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="54.251.49.214" condition="is">
|
||
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
||
<Content type="IP"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="https://smser.net/9918216t/" condition="is">
|
||
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="https://smser.net/redirect.aspx" condition="is">
|
||
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="aalaan.tv" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="manoraonline.net" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="sms.webadv.co" condition="is">
|
||
<Context document="Network" search="Network/DNS" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="https://sms.webadv.co/3589003s/" condition="is">
|
||
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="https://sms.webadv.co/9573305s/" condition="is">
|
||
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="http://fb-accounts.com/2408931s/" condition="is">
|
||
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="http://unonoticias.net/1867745s/" condition="is">
|
||
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="https://ideas-telcel.com.mx/3975827s/" condition="is">
|
||
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="nation-news.com/4077017s/" condition="is">
|
||
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="http://fb-accounts.com/1074139s/" condition="is">
|
||
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
<IndicatorItem id="http://unonoticias.net/3423768s/" condition="is">
|
||
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
|
||
<Content type="string"></Content>
|
||
</IndicatorItem>
|
||
</Indicator>
|
||
</definition>
|
||
</ioc>
|