karl/NetScaler_forensik
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add public search indicators to default catalog and Sigma rules

Browse Source
This commit is contained in:
StasonJatham committed 2026-10-05 16:54:16 +02:00
1 parent b709b311d0
commit 837a7ec184
10 files changed
+1384 -10
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

config/threat_intel.json
+465 -1
View File
@@ -1,6 +1,6 @@
{
"schema_version": 2,
"updated": "2026-10-01",
"updated": "2026-10-05",
"sources": [
{
"id": "cisa-direct",
@@ -10798,6 +10798,209 @@
"matching": "exact",
"context_only": false
},
{
"id": "ioc-9ec7945d-865e-596c-a7f4-0a6da1c81f0a",
"type": "ipv4",
"value": "107.172.221.57",
"status": "reference_only",
"provenance": "unattributed_public_indicator",
"source_ids": [],
"source_urls": [],
"observations": [
{
"status": "reference_only",
"original_status": "reference_only",
"role": "search_candidate",
"confidence": "low",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"source_ids": [],
"source_urls": [],
"source_dates": []
}
],
"source": [],
"roles": [
"search_candidate"
],
"role": "search_candidate",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"matching": "exact",
"context_only": false
},
{
"id": "ioc-50fff1fb-6c39-5b8a-a596-308e3eaf6a1e",
"type": "ipv4",
"value": "144.126.221.237",
"status": "reference_only",
"provenance": "unattributed_public_indicator",
"source_ids": [],
"source_urls": [],
"observations": [
{
"status": "reference_only",
"original_status": "reference_only",
"role": "search_candidate",
"confidence": "low",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"source_ids": [],
"source_urls": [],
"source_dates": []
}
],
"source": [],
"roles": [
"search_candidate"
],
"role": "search_candidate",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"matching": "exact",
"context_only": false
},
{
"id": "ioc-3c6a1c17-8362-5c47-82d2-2d43e6daccef",
"type": "ipv4",
"value": "149.248.21.5",
"status": "reference_only",
"provenance": "unattributed_public_indicator",
"source_ids": [],
"source_urls": [],
"observations": [
{
"status": "reference_only",
"original_status": "reference_only",
"role": "search_candidate",
"confidence": "low",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"source_ids": [],
"source_urls": [],
"source_dates": []
}
],
"source": [],
"roles": [
"search_candidate"
],
"role": "search_candidate",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"matching": "exact",
"context_only": false
},
{
"id": "ioc-0dc83b54-5562-5446-9fec-5d2114810676",
"type": "ipv4",
"value": "149.28.121.199",
"status": "reference_only",
"provenance": "unattributed_public_indicator",
"source_ids": [],
"source_urls": [],
"observations": [
{
"status": "reference_only",
"original_status": "reference_only",
"role": "search_candidate",
"confidence": "low",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"source_ids": [],
"source_urls": [],
"source_dates": []
}
],
"source": [],
"roles": [
"search_candidate"
],
"role": "search_candidate",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"matching": "exact",
"context_only": false
},
{
"id": "ioc-6704dc2d-7a73-51bc-8d3b-feaba5d8ac8f",
"type": "ipv4",
"value": "172.98.178.104",
"status": "reference_only",
"provenance": "unattributed_public_indicator",
"source_ids": [],
"source_urls": [],
"observations": [
{
"status": "reference_only",
"original_status": "reference_only",
"role": "search_candidate",
"confidence": "low",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"source_ids": [],
"source_urls": [],
"source_dates": []
}
],
"source": [],
"roles": [
"search_candidate"
],
"role": "search_candidate",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"matching": "exact",
"context_only": false
},
{
"id": "ioc-60aac534-cde8-50b3-bb2d-798f451acb8d",
"type": "ipv4",
"value": "66.55.159.67",
"status": "reference_only",
"provenance": "unattributed_public_indicator",
"source_ids": [],
"source_urls": [],
"observations": [
{
"status": "reference_only",
"original_status": "reference_only",
"role": "search_candidate",
"confidence": "low",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"source_ids": [],
"source_urls": [],
"source_dates": []
}
],
"source": [],
"roles": [
"search_candidate"
],
"role": "search_candidate",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"matching": "exact",
"context_only": false
},
{
"id": "ioc-51b89e76-fb7a-5eae-9f05-06413d0e3db2",
"type": "ipv4",
"value": "88.218.105.254",
"status": "reference_only",
"provenance": "unattributed_public_indicator",
"source_ids": [],
"source_urls": [],
"observations": [
{
"status": "reference_only",
"original_status": "reference_only",
"role": "search_candidate",
"confidence": "low",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"source_ids": [],
"source_urls": [],
"source_dates": []
}
],
"source": [],
"roles": [
"search_candidate"
],
"role": "search_candidate",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"matching": "exact",
"context_only": false
},
{
"id": "ioc-41d198a3-3a03-5082-b7fb-8181df570fee",
"type": "literal",
@@ -16556,6 +16759,267 @@
"matching": "exact",
"context_only": false
},
{
"id": "ioc-6ac8fcee-0ae5-52e9-b3e0-e5b3b0f9313f",
"type": "sha256",
"value": "53f923284f286715df2c7993e4e65228d3f78d9c6594714be5c4da276b01ad15",
"status": "reference_only",
"provenance": "unattributed_public_indicator",
"source_ids": [],
"source_urls": [],
"observations": [
{
"status": "reference_only",
"original_status": "reference_only",
"role": "search_candidate",
"confidence": "low",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"source_ids": [],
"source_urls": [],
"source_dates": []
}
],
"source": [],
"roles": [
"search_candidate"
],
"role": "search_candidate",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"matching": "exact",
"context_only": false
},
{
"id": "ioc-a9d5f5c9-336e-5f2d-bfb5-db7b373a8a35",
"type": "sha256",
"value": "62f4c9972f86346585b1f1dc22c065769d5c8391f24aa9811819b30bf628c9f4",
"status": "reference_only",
"provenance": "unattributed_public_indicator",
"source_ids": [],
"source_urls": [],
"observations": [
{
"status": "reference_only",
"original_status": "reference_only",
"role": "search_candidate",
"confidence": "low",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"source_ids": [],
"source_urls": [],
"source_dates": []
}
],
"source": [],
"roles": [
"search_candidate"
],
"role": "search_candidate",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"matching": "exact",
"context_only": false
},
{
"id": "ioc-135b9d7d-6619-5cee-ba16-548196e71999",
"type": "sha256",
"value": "8115f306dfa15483cd990a36ee3acd19aff335a26a555c4e5113e99fc5e381a4",
"status": "reference_only",
"provenance": "unattributed_public_indicator",
"source_ids": [],
"source_urls": [],
"observations": [
{
"status": "reference_only",
"original_status": "reference_only",
"role": "search_candidate",
"confidence": "low",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"source_ids": [],
"source_urls": [],
"source_dates": []
}
],
"source": [],
"roles": [
"search_candidate"
],
"role": "search_candidate",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"matching": "exact",
"context_only": false
},
{
"id": "ioc-52059bbe-4c5d-5494-8b87-c91252d67c65",
"type": "sha256",
"value": "81b0bcf945c08ebfa9e10276bd19f554c62e42a458efaf2b91b416b0c9da829d",
"status": "reference_only",
"provenance": "unattributed_public_indicator",
"source_ids": [],
"source_urls": [],
"observations": [
{
"status": "reference_only",
"original_status": "reference_only",
"role": "search_candidate",
"confidence": "low",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"source_ids": [],
"source_urls": [],
"source_dates": []
}
],
"source": [],
"roles": [
"search_candidate"
],
"role": "search_candidate",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"matching": "exact",
"context_only": false
},
{
"id": "ioc-a9cb81f2-189f-56c5-9e51-e5dba0618386",
"type": "sha256",
"value": "ac7cc79df320df6d7a954d32fe1638dac5b12e134369becf7342869f98a98c81",
"status": "reference_only",
"provenance": "unattributed_public_indicator",
"source_ids": [],
"source_urls": [],
"observations": [
{
"status": "reference_only",
"original_status": "reference_only",
"role": "search_candidate",
"confidence": "low",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"source_ids": [],
"source_urls": [],
"source_dates": []
}
],
"source": [],
"roles": [
"search_candidate"
],
"role": "search_candidate",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"matching": "exact",
"context_only": false
},
{
"id": "ioc-9976f53c-b6bf-5aa7-bd36-40565777f617",
"type": "sha256",
"value": "b094bd5e34ed2bb96d289b8e26a1e0de1a87796f8047bb45a61dac03b47c617d",
"status": "reference_only",
"provenance": "unattributed_public_indicator",
"source_ids": [],
"source_urls": [],
"observations": [
{
"status": "reference_only",
"original_status": "reference_only",
"role": "search_candidate",
"confidence": "low",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"source_ids": [],
"source_urls": [],
"source_dates": []
}
],
"source": [],
"roles": [
"search_candidate"
],
"role": "search_candidate",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"matching": "exact",
"context_only": false
},
{
"id": "ioc-849554d4-80a5-51bf-933f-d597aa130138",
"type": "sha256",
"value": "e96049b559fc028d2dbbf5761d01124362957264fcd342f7133b055318480945",
"status": "reference_only",
"provenance": "unattributed_public_indicator",
"source_ids": [],
"source_urls": [],
"observations": [
{
"status": "reference_only",
"original_status": "reference_only",
"role": "search_candidate",
"confidence": "low",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"source_ids": [],
"source_urls": [],
"source_dates": []
}
],
"source": [],
"roles": [
"search_candidate"
],
"role": "search_candidate",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"matching": "exact",
"context_only": false
},
{
"id": "ioc-78aac967-820a-59f8-9dd7-99a5511de4e3",
"type": "sha256",
"value": "e9c3760e3afaa713710cf6d7669cbf2024ff81c3707ad8f141951812e22f8eb9",
"status": "reference_only",
"provenance": "unattributed_public_indicator",
"source_ids": [],
"source_urls": [],
"observations": [
{
"status": "reference_only",
"original_status": "reference_only",
"role": "search_candidate",
"confidence": "low",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"source_ids": [],
"source_urls": [],
"source_dates": []
}
],
"source": [],
"roles": [
"search_candidate"
],
"role": "search_candidate",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"matching": "exact",
"context_only": false
},
{
"id": "ioc-8b74a63c-e8d2-5f86-8fc0-b2d8b2a2a81d",
"type": "sha256",
"value": "ec894d6ac7d0e11dd4aae9e74e101490c8fcbf52afaf4b2a35f840086eaeee6b",
"status": "reference_only",
"provenance": "unattributed_public_indicator",
"source_ids": [],
"source_urls": [],
"observations": [
{
"status": "reference_only",
"original_status": "reference_only",
"role": "search_candidate",
"confidence": "low",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"source_ids": [],
"source_urls": [],
"source_dates": []
}
],
"source": [],
"roles": [
"search_candidate"
],
"role": "search_candidate",
"description": "Public search candidate without published attribution in this inventory. Malicious attribution has not been independently verified; a match does not establish compromise.",
"matching": "exact",
"context_only": false
},
{
"id": "ioc-ed202314-1f91-5a66-8c36-502623bdbfd3",
"type": "url",