Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
10 IOCs
Looking for a Language [Guest Diary], (Wed, Oct 21st)
Excerpt
[This is a Guest Diary by Jeffray Spence, an ISC intern as part of the SANS.edu BACS program] Around Here, we start our day with coffee, but our day does not begin until we have our data...So much data. Where to even begin? When approaching a massive dataset, such as those from a DShield SIEM Honeypot, the first step is to actually find something to analyze. As for myself, I usually go looking for something that makes me go; " Huh. " Today we will be…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →10 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | brossy.com.cn | High | Score 58/100 | First seen |
| Domain | tzrhxln.cn | High | Score 58/100 | First seen |
| IP | 165.154.29.93 | High | Score 58/100 | First seen |
| Domain | mail.brossy.com.cn | High | Score 58/100 | First seen |
| IP | 165.154.120.226 | High | Score 58/100 | First seen |
| IP | 165.154.182.221 | High | Score 74/100 | First seen |
| Domain | leheedu.cn | High | Score 58/100 | First seen |
| IP | 165.154.11.140 | High | Score 58/100 | First seen |
| IP | 165.154.36.91 | High | Score 58/100 | First seen |
| IP | 165.154.33.72 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…