Indicators

IOCs pulled from the research posts and lab notes on this site, in one searchable place.

Network indicators are defanged. Private and multicast addresses are left out. Indicators marked lab come from training datasets, not live incidents.

Download: JSON · CSV

30 indicators from 3 posts

cve
CVE-2018-8453
Win32k elevation of privilege vulnerability
DFIR Lab - REvil/Sodinokibi Ransomware Incident Response lab
domain
azurepoinbackup.centralus.cloudapp.azure[.]com
Fallback C2 host
The Alert Wasn't the Beginning: Reconstructing a Multi-Host JavaScript RAT Intrusion
domain
nodemetrics9095[.]com
Delivery: archive download (/update/package)
The Alert Wasn't the Beginning: Reconstructing a Multi-Host JavaScript RAT Intrusion
filename
4werasd54re5uhsy5re.ps1
PowerShell loader (in C:\Users\Public\Music\)
The Alert Wasn't the Beginning: Reconstructing a Multi-Host JavaScript RAT Intrusion
filename
AutoKMS.exe
Firewall rule target binary
Splunk Threat Hunting: APT Intrusion & Cobalt Strike lab
filename
BLACKBOARDk35.exe
Sliver C2 stager (DC1)
DFIR Lab - REvil/Sodinokibi Ransomware Incident Response lab
filename
CV.vbs
Initial stager delivered via browser
Splunk Threat Hunting: APT Intrusion & Cobalt Strike lab
filename
FodhelperBypass.ps1
UAC bypass script
DFIR Lab - REvil/Sodinokibi Ransomware Incident Response lab
filename
invoice.bat
Initial access dropper script
DFIR Lab - REvil/Sodinokibi Ransomware Incident Response lab
filename
invoice.zip
Phishing lure archive
DFIR Lab - REvil/Sodinokibi Ransomware Incident Response lab
filename
Mimikatz.exe
Credential dumping tool
DFIR Lab - REvil/Sodinokibi Ransomware Incident Response lab
filename
PowerView.ps1
AD enumeration (PowerSploit)
DFIR Lab - REvil/Sodinokibi Ransomware Incident Response lab
filename
Rundl32.exe
Ransomware payload
DFIR Lab - REvil/Sodinokibi Ransomware Incident Response lab
filename
Scvhost.exe
Sliver C2 stager (WORKSTATION1)
DFIR Lab - REvil/Sodinokibi Ransomware Incident Response lab
filename
SharpHound.exe
AD enumeration tool
Splunk Threat Hunting: APT Intrusion & Cobalt Strike lab
filename
svchost.exe
Masqueraded binary in C:\users\public\
Splunk Threat Hunting: APT Intrusion & Cobalt Strike lab
filename
updater.bat
Batch script executed via WmiPrvSE
Splunk Threat Hunting: APT Intrusion & Cobalt Strike lab
ip
100.10.168[.]192
Suspicious external IP
Splunk Threat Hunting: APT Intrusion & Cobalt Strike lab
md5
42618a07644aca3da05e912ef23c3227
Scvhost.exe
DFIR Lab - REvil/Sodinokibi Ransomware Incident Response lab
md5
b572a0486274ee9c0ba816c1b91b87c7
Rundl32.exe
DFIR Lab - REvil/Sodinokibi Ransomware Incident Response lab
md5
f5b6109d59f4c961b1bbf4bab7bc151e
BLACKBOARDk35.exe
DFIR Lab - REvil/Sodinokibi Ransomware Incident Response lab
md5
fd31d71eda87c3251f2ba5b4becc0dd0
CV.vbs - Cobalt Strike stager
Splunk Threat Hunting: APT Intrusion & Cobalt Strike lab
registry
...\CurrentVersion\Run\DesktopBridge
Run-key persistence
The Alert Wasn't the Beginning: Reconstructing a Multi-Host JavaScript RAT Intrusion
registry
...\CurrentVersion\Run\SecurityHealth
Run-key persistence (imitates a Windows entry)
The Alert Wasn't the Beginning: Reconstructing a Multi-Host JavaScript RAT Intrusion
registry
hklm\sam
SAM hive backup for credential theft
DFIR Lab - REvil/Sodinokibi Ransomware Incident Response lab
sha256
15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b
Rundl32.exe - REvil ransomware payload
DFIR Lab - REvil/Sodinokibi Ransomware Incident Response lab
sha256
c93a0a916bd0db48ea419204e74f2609edf3b2fd39bb87a94b4e094b65a419db
Scvhost.exe - Sliver C2 stager
DFIR Lab - REvil/Sodinokibi Ransomware Incident Response lab
sha256
dbc72ca000494659f5ffd3b8994a73dd9c4abe622808fb2ed72238b44a0c7073
BLACKBOARDk35.exe - Sliver C2 stager
DFIR Lab - REvil/Sodinokibi Ransomware Incident Response lab
task
\Microsoft\Windows\Chkdsk\TempDefrag
Scheduled-task persistence
The Alert Wasn't the Beginning: Reconstructing a Multi-Host JavaScript RAT Intrusion
url
hxxps://lokol8374594.blob.core.windows[.]net/verpol/
Attacker Blob storage container (memory image destination)
The Alert Wasn't the Beginning: Reconstructing a Multi-Host JavaScript RAT Intrusion