98 lines
4.9 KiB
XML
98 lines
4.9 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="581ba774-6db4-441c-b981-49798e96ca05" last-modified="2016-04-18T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
|
|
<short_description>Event #2</short_description>
|
|
<description>Tracking UP007 and SLServer Espionage Campaigns</description>
|
|
<keywords />
|
|
<authored_by>citizenlab</authored_by>
|
|
<authored_date>2016-04-18T00:00:00</authored_date>
|
|
<links />
|
|
<definition>
|
|
<Indicator operator="OR" id="581ba774-6db4-441c-b981-49798e96ca05">
|
|
<IndicatorItem id="safetyssl.security-centers.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="computer.security-centers.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="hkemail.f3322.org" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="www.olinaodi.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="tenday.mysecondarydns.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="59.188.12.123" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="210.61.12.153" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="d579d7a42ff140952da57264614c37bc" condition="is">
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
|
<Content type="md5"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="d8becbd6f188e3fb2c4d23a2d36d137b" condition="is">
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
|
<Content type="md5"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="09ddd70517cb48a46d9f93644b29c72f" condition="is">
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
|
<Content type="md5"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="f70b295c6a5121b918682310ce0c2165" condition="is">
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
|
<Content type="md5"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="f80edbb0fcfe7cec17592f61a06e4df2" condition="is">
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
|
<Content type="md5"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="d8ede9e6c3a1a30398b0b98130ee3b38" condition="is">
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
|
<Content type="md5"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="ce8ec932be16b69ffa06626b3b423395" condition="is">
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
|
<Content type="md5"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="6a541de84074a2c4ff99eb43252d9030" condition="is">
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
|
<Content type="md5"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="e0eb981ad6be0bd16246d5d442028687" condition="is">
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
|
<Content type="md5"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="639c7239f40d95f677a99abb059e8338" condition="is">
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
|
<Content type="md5"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="d07b2738840ce3419df651d3a0a3a246" condition="is">
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
|
<Content type="md5"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="397021af7c0284c28db65297a6711235" condition="is">
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
|
<Content type="md5"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="dc195d814ec16fe91690b7e949e696f6" condition="is">
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
|
<Content type="md5"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="cfcd2a90e87156e1a811f9c7b0051002" condition="is">
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
|
<Content type="md5"></Content>
|
|
</IndicatorItem>
|
|
</Indicator>
|
|
</definition>
|
|
</ioc>
|