130 lines
6.4 KiB
XML
130 lines
6.4 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="5bec8d43-b990-4129-a9f4-45d08064ab0b" last-modified="2019-09-24T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
|
|
<short_description>Event #140</short_description>
|
|
<description>MISSING LINK: Tibetan Groups Targeted with Mobile Exploits</description>
|
|
<keywords />
|
|
<authored_by>citizenlab</authored_by>
|
|
<authored_date>2019-09-24T00:00:00</authored_date>
|
|
<links />
|
|
<definition>
|
|
<Indicator operator="OR" id="5bec8d43-b990-4129-a9f4-45d08064ab0b">
|
|
<IndicatorItem id="0d2ee9ade24163613772fdda201af985d852ab506e3d3e7f07fb3fa8b0853560" condition="is">
|
|
<Context document="FileItem" search="FileItem/Sha256sum" type="mir" />
|
|
<Content type="sha256"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="www.energy-mail.org" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="antmoving.online" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="beemail.online" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="bf.mk" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="energy-mail.org" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="gmailapp.me" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="izelense.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="mailanalysis.services" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="mailcontactanalysis.online" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="mailnotes.online" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="polarismail.services" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="rf.mk" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="walkingnote.online" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="www.msap.services" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="msap.services" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="45.32.75.217" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="45.76.149.154" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="45.78.79.100" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="149.28.93.11" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="95.169.2.57" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="206.189.65.198" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="140.82.17.222" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="45.76.53.26" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="45.32.91.137" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="144.202.59.23" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="66.42.58.59" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="43.251.16.87" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="hots scot" condition="is">
|
|
<Context document="Network" search="Network/UserAgent" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
</Indicator>
|
|
</definition>
|
|
</ioc>
|