[
  {
    "type": "cve",
    "value": "CVE-2018-8453",
    "description": "Win32k elevation of privilege vulnerability",
    "source": "DFIR Lab - REvil/Sodinokibi Ransomware Incident Response",
    "url": "https://secbysrg.com/notes/dfir/revil-ransomware-ir/",
    "lab": true
  },
  {
    "type": "domain",
    "value": "azurepoinbackup.centralus.cloudapp.azure[.]com",
    "description": "Fallback C2 host",
    "source": "The Alert Wasn't the Beginning: Reconstructing a Multi-Host JavaScript RAT Intrusion",
    "url": "https://secbysrg.com/research/case-node-rat-multi-host-intrusion/",
    "lab": false
  },
  {
    "type": "domain",
    "value": "nodemetrics9095[.]com",
    "description": "Delivery: archive download (/update/package)",
    "source": "The Alert Wasn't the Beginning: Reconstructing a Multi-Host JavaScript RAT Intrusion",
    "url": "https://secbysrg.com/research/case-node-rat-multi-host-intrusion/",
    "lab": false
  },
  {
    "type": "filename",
    "value": "4werasd54re5uhsy5re.ps1",
    "description": "PowerShell loader (in C:\\Users\\Public\\Music\\)",
    "source": "The Alert Wasn't the Beginning: Reconstructing a Multi-Host JavaScript RAT Intrusion",
    "url": "https://secbysrg.com/research/case-node-rat-multi-host-intrusion/",
    "lab": false
  },
  {
    "type": "filename",
    "value": "AutoKMS.exe",
    "description": "Firewall rule target binary",
    "source": "Splunk Threat Hunting: APT Intrusion & Cobalt Strike",
    "url": "https://secbysrg.com/notes/threat-hunting/splunk-apt-cobalt-strike/",
    "lab": true
  },
  {
    "type": "filename",
    "value": "BLACKBOARDk35.exe",
    "description": "Sliver C2 stager (DC1)",
    "source": "DFIR Lab - REvil/Sodinokibi Ransomware Incident Response",
    "url": "https://secbysrg.com/notes/dfir/revil-ransomware-ir/",
    "lab": true
  },
  {
    "type": "filename",
    "value": "CV.vbs",
    "description": "Initial stager delivered via browser",
    "source": "Splunk Threat Hunting: APT Intrusion & Cobalt Strike",
    "url": "https://secbysrg.com/notes/threat-hunting/splunk-apt-cobalt-strike/",
    "lab": true
  },
  {
    "type": "filename",
    "value": "FodhelperBypass.ps1",
    "description": "UAC bypass script",
    "source": "DFIR Lab - REvil/Sodinokibi Ransomware Incident Response",
    "url": "https://secbysrg.com/notes/dfir/revil-ransomware-ir/",
    "lab": true
  },
  {
    "type": "filename",
    "value": "invoice.bat",
    "description": "Initial access dropper script",
    "source": "DFIR Lab - REvil/Sodinokibi Ransomware Incident Response",
    "url": "https://secbysrg.com/notes/dfir/revil-ransomware-ir/",
    "lab": true
  },
  {
    "type": "filename",
    "value": "invoice.zip",
    "description": "Phishing lure archive",
    "source": "DFIR Lab - REvil/Sodinokibi Ransomware Incident Response",
    "url": "https://secbysrg.com/notes/dfir/revil-ransomware-ir/",
    "lab": true
  },
  {
    "type": "filename",
    "value": "Mimikatz.exe",
    "description": "Credential dumping tool",
    "source": "DFIR Lab - REvil/Sodinokibi Ransomware Incident Response",
    "url": "https://secbysrg.com/notes/dfir/revil-ransomware-ir/",
    "lab": true
  },
  {
    "type": "filename",
    "value": "PowerView.ps1",
    "description": "AD enumeration (PowerSploit)",
    "source": "DFIR Lab - REvil/Sodinokibi Ransomware Incident Response",
    "url": "https://secbysrg.com/notes/dfir/revil-ransomware-ir/",
    "lab": true
  },
  {
    "type": "filename",
    "value": "Rundl32.exe",
    "description": "Ransomware payload",
    "source": "DFIR Lab - REvil/Sodinokibi Ransomware Incident Response",
    "url": "https://secbysrg.com/notes/dfir/revil-ransomware-ir/",
    "lab": true
  },
  {
    "type": "filename",
    "value": "Scvhost.exe",
    "description": "Sliver C2 stager (WORKSTATION1)",
    "source": "DFIR Lab - REvil/Sodinokibi Ransomware Incident Response",
    "url": "https://secbysrg.com/notes/dfir/revil-ransomware-ir/",
    "lab": true
  },
  {
    "type": "filename",
    "value": "SharpHound.exe",
    "description": "AD enumeration tool",
    "source": "Splunk Threat Hunting: APT Intrusion & Cobalt Strike",
    "url": "https://secbysrg.com/notes/threat-hunting/splunk-apt-cobalt-strike/",
    "lab": true
  },
  {
    "type": "filename",
    "value": "svchost.exe",
    "description": "Masqueraded binary in C:\\users\\public\\",
    "source": "Splunk Threat Hunting: APT Intrusion & Cobalt Strike",
    "url": "https://secbysrg.com/notes/threat-hunting/splunk-apt-cobalt-strike/",
    "lab": true
  },
  {
    "type": "filename",
    "value": "updater.bat",
    "description": "Batch script executed via WmiPrvSE",
    "source": "Splunk Threat Hunting: APT Intrusion & Cobalt Strike",
    "url": "https://secbysrg.com/notes/threat-hunting/splunk-apt-cobalt-strike/",
    "lab": true
  },
  {
    "type": "ip",
    "value": "100.10.168[.]192",
    "description": "Suspicious external IP",
    "source": "Splunk Threat Hunting: APT Intrusion & Cobalt Strike",
    "url": "https://secbysrg.com/notes/threat-hunting/splunk-apt-cobalt-strike/",
    "lab": true
  },
  {
    "type": "md5",
    "value": "42618a07644aca3da05e912ef23c3227",
    "description": "Scvhost.exe",
    "source": "DFIR Lab - REvil/Sodinokibi Ransomware Incident Response",
    "url": "https://secbysrg.com/notes/dfir/revil-ransomware-ir/",
    "lab": true
  },
  {
    "type": "md5",
    "value": "b572a0486274ee9c0ba816c1b91b87c7",
    "description": "Rundl32.exe",
    "source": "DFIR Lab - REvil/Sodinokibi Ransomware Incident Response",
    "url": "https://secbysrg.com/notes/dfir/revil-ransomware-ir/",
    "lab": true
  },
  {
    "type": "md5",
    "value": "f5b6109d59f4c961b1bbf4bab7bc151e",
    "description": "BLACKBOARDk35.exe",
    "source": "DFIR Lab - REvil/Sodinokibi Ransomware Incident Response",
    "url": "https://secbysrg.com/notes/dfir/revil-ransomware-ir/",
    "lab": true
  },
  {
    "type": "md5",
    "value": "fd31d71eda87c3251f2ba5b4becc0dd0",
    "description": "CV.vbs - Cobalt Strike stager",
    "source": "Splunk Threat Hunting: APT Intrusion & Cobalt Strike",
    "url": "https://secbysrg.com/notes/threat-hunting/splunk-apt-cobalt-strike/",
    "lab": true
  },
  {
    "type": "registry",
    "value": "...\\CurrentVersion\\Run\\DesktopBridge",
    "description": "Run-key persistence",
    "source": "The Alert Wasn't the Beginning: Reconstructing a Multi-Host JavaScript RAT Intrusion",
    "url": "https://secbysrg.com/research/case-node-rat-multi-host-intrusion/",
    "lab": false
  },
  {
    "type": "registry",
    "value": "...\\CurrentVersion\\Run\\SecurityHealth",
    "description": "Run-key persistence (imitates a Windows entry)",
    "source": "The Alert Wasn't the Beginning: Reconstructing a Multi-Host JavaScript RAT Intrusion",
    "url": "https://secbysrg.com/research/case-node-rat-multi-host-intrusion/",
    "lab": false
  },
  {
    "type": "registry",
    "value": "hklm\\sam",
    "description": "SAM hive backup for credential theft",
    "source": "DFIR Lab - REvil/Sodinokibi Ransomware Incident Response",
    "url": "https://secbysrg.com/notes/dfir/revil-ransomware-ir/",
    "lab": true
  },
  {
    "type": "sha256",
    "value": "15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b",
    "description": "Rundl32.exe - REvil ransomware payload",
    "source": "DFIR Lab - REvil/Sodinokibi Ransomware Incident Response",
    "url": "https://secbysrg.com/notes/dfir/revil-ransomware-ir/",
    "lab": true
  },
  {
    "type": "sha256",
    "value": "c93a0a916bd0db48ea419204e74f2609edf3b2fd39bb87a94b4e094b65a419db",
    "description": "Scvhost.exe - Sliver C2 stager",
    "source": "DFIR Lab - REvil/Sodinokibi Ransomware Incident Response",
    "url": "https://secbysrg.com/notes/dfir/revil-ransomware-ir/",
    "lab": true
  },
  {
    "type": "sha256",
    "value": "dbc72ca000494659f5ffd3b8994a73dd9c4abe622808fb2ed72238b44a0c7073",
    "description": "BLACKBOARDk35.exe - Sliver C2 stager",
    "source": "DFIR Lab - REvil/Sodinokibi Ransomware Incident Response",
    "url": "https://secbysrg.com/notes/dfir/revil-ransomware-ir/",
    "lab": true
  },
  {
    "type": "task",
    "value": "\\Microsoft\\Windows\\Chkdsk\\TempDefrag",
    "description": "Scheduled-task persistence",
    "source": "The Alert Wasn't the Beginning: Reconstructing a Multi-Host JavaScript RAT Intrusion",
    "url": "https://secbysrg.com/research/case-node-rat-multi-host-intrusion/",
    "lab": false
  },
  {
    "type": "url",
    "value": "hxxps://lokol8374594.blob.core.windows[.]net/verpol/",
    "description": "Attacker Blob storage container (memory image destination)",
    "source": "The Alert Wasn't the Beginning: Reconstructing a Multi-Host JavaScript RAT Intrusion",
    "url": "https://secbysrg.com/research/case-node-rat-multi-host-intrusion/",
    "lab": false
  }
]