62 lines
3.0 KiB
XML
62 lines
3.0 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="5926f385-8a58-4fc0-a075-5d828e96ca05" last-modified="2017-05-25T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
|
|
<short_description>Event #100</short_description>
|
|
<description>TAINTED LEAKS: Disinformation and Phishing With a Russian Nexus</description>
|
|
<keywords />
|
|
<authored_by>citizenlab</authored_by>
|
|
<authored_date>2017-05-25T00:00:00</authored_date>
|
|
<links />
|
|
<definition>
|
|
<Indicator operator="OR" id="5926f385-8a58-4fc0-a075-5d828e96ca05">
|
|
<IndicatorItem id="id833.ga" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="id834.ga" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="id9954.gq" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="id4242.ga" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="mail-google-login.blogspot.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="com-securitysettingpage.tk" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="89.40.181.119" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="89.32.40.238" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="80.255.12.237" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="g.mail2017@yandex.com" condition="is">
|
|
<Context document="Email" search="Email/From" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="annaablony@mail.com" condition="is">
|
|
<Context document="Email" search="Email/From" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="myprimaryreger@gmail.com" condition="is">
|
|
<Context document="Email" search="Email/From" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
</Indicator>
|
|
</definition>
|
|
</ioc>
|