adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/b7f8805b-fec8-4491-b866-83a457212437.json

1529 lines
137 KiB
JSON
Raw Normal View History

chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
{
"type": "bundle",
"id": "bundle--b7f8805b-fec8-4491-b866-83a457212437",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T09:38:12.000Z",
"modified": "2021-04-21T09:38:12.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--b7f8805b-fec8-4491-b866-83a457212437",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T09:38:12.000Z",
"modified": "2021-04-21T09:38:12.000Z",
"name": "FireEye Mandiant PulseSecure Exploitation Countermeasures",
"published": "2021-04-21T09:38:28Z",
"object_refs": [
"observed-data--5b5a9d8a-fd3d-4a40-8158-c00f07b5cf04",
"url--5b5a9d8a-fd3d-4a40-8158-c00f07b5cf04",
"observed-data--5cb95524-3fef-4334-9fef-e6d3f00982a4",
"url--5cb95524-3fef-4334-9fef-e6d3f00982a4",
"indicator--d584973b-e85b-431b-a2f2-c3cd33562245",
"indicator--55301c17-7b0e-450d-89be-54eb3f096592",
"indicator--e8e292e5-5fab-4e5b-afa0-89df4eb361d6",
"indicator--4ad4982e-87bf-4edc-915b-4ad84f3b13eb",
"indicator--2b0bd4a3-3f4a-4e9a-b330-52a196385fc0",
"indicator--baccb07a-3ac5-4a08-89d0-5c02114ad60b",
"x-misp-object--57ffce5f-60a8-40ae-b11e-624ca218704d",
"indicator--6854614c-df9f-4bb5-8de0-857c943be550",
"indicator--874ca0e5-827e-43f8-99f5-a2a5aa60e672",
"indicator--cd13cfd7-f4dc-4864-9009-30baa29551a6",
"indicator--1d87313f-7519-4748-bfb1-fc8b60906cf6",
"indicator--0b65ad47-db4b-4f58-a33c-e671746afa05",
"indicator--5c9a0062-ee55-43b0-ad64-3c5f6fdf3d01",
"indicator--efd7b1ec-0fff-498a-ad64-d1d259ebbf82",
"indicator--35ae369e-4ab2-447c-819c-c366f547ca9c",
"indicator--5f99e163-f31e-4994-8a56-4b249d894012",
"indicator--0690ab34-3ffe-4d37-b6a7-4ce477d4de60",
"indicator--30408119-108d-495f-89ca-cbe1dcf0b68b",
"indicator--c0b88e1a-d76c-4226-bffa-45ca59bc2fa9",
"indicator--dbab04b4-1df0-4055-be1a-2ad6d47b15de",
"indicator--5279454c-137c-4df2-ab40-d4f67be95f40",
"indicator--61f23a4d-8a5f-4a4c-b846-4f87797fbb1a",
"indicator--44e27409-7862-42be-bf2b-4d18fa27243f",
"indicator--3347af09-6558-4e07-ac68-c7abe87079b9",
"indicator--ec665abd-0414-4647-b4cd-9fa22e979ab8",
"indicator--3e50f8b8-0dbc-4bec-80de-30e325671f95",
"indicator--2620c50d-6305-45cb-8aff-e37d50425358",
"indicator--cfaa4938-1778-45cd-b95a-61be8ba0837e",
"indicator--0da707a9-b329-4d30-b907-01fe6c1de17c",
"indicator--df51083d-32e2-4812-89bb-f7036472920e",
"indicator--5151611d-c11d-47cf-9a9c-5ef132b1a303",
"indicator--298449a1-8e86-409c-96fb-0c225d9f98a9",
"indicator--cf564f32-56e9-4fe0-87ac-5e5df91b0c9f",
"indicator--bbcc14ea-c7fc-4b15-a020-b619641add7e",
"indicator--60b5f9a7-ffa3-4d56-a1a7-6642638be3e6",
"indicator--04323a10-ee75-43ae-9150-001fe9a27ab7",
"indicator--bbdbb662-a8b1-4c13-85f2-898abde6d3f9",
"indicator--b4a44973-985c-4058-b968-9cd867f1bef6",
"indicator--ca389b0d-fbe4-42bc-96e3-56b5f4886c9b",
"indicator--34384af6-0071-435b-84c1-bf8c3420cd08",
"indicator--1fc8066f-98aa-4e70-b4ee-0710931cdac7",
"indicator--447d890e-3529-486e-b4f8-704b813d745f",
"indicator--7bd70c6d-d345-45f3-a8ac-00e4a2149cea",
"indicator--8f5eaca0-34a1-4e85-b6b3-8082bce62175",
"indicator--4f5204e2-efbe-4200-8f2c-bc6ebbb952da",
"indicator--c73a7441-1444-42a9-974d-3f3e64168bcc",
"indicator--642cf927-5c24-4846-b8a7-5b895c87594f",
"indicator--c7b0b3ec-3c74-4329-abc4-0d4414228f90",
"indicator--76f29c1c-c880-4baa-be5a-cecf57c18d38",
"indicator--12ee2578-f80b-4db9-b7c5-75c5f05215f2",
"indicator--ef28ce31-93a2-48a8-8ed8-b56b8caf60a7",
"indicator--d11dc00d-249a-4b44-a70d-8d1912c6b012",
"indicator--b78852fc-95f7-4ec5-a7ed-e001320e19b4",
"indicator--9df4fc8c-7277-4488-9f3b-ff2a0f51aa66",
"indicator--b79a5423-1769-4be7-a580-909c99a08598",
"indicator--17e7dce5-405d-4cf1-8d2f-9f3de6653c75",
"indicator--95be007c-e7a2-45a6-a1ff-d0f334e662da",
chg: [export] updated
2023-05-19 09:05:37 +00:00
"indicator--40e78b71-1425-4450-aa39-08ecaa30f0df",
"note--82e160db-f47a-433c-865a-fb667f3cff29"
chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"type:OSINT",
"osint:lifetime=\"perpetual\"",
"estimative-language:confidence-in-analytic-judgment=\"high\"",
"estimative-language:likelihood-probability=\"almost-certain\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5b5a9d8a-fd3d-4a40-8158-c00f07b5cf04",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:07:36.000Z",
"modified": "2021-04-21T08:07:36.000Z",
"first_observed": "2021-04-21T08:07:36Z",
"last_observed": "2021-04-21T08:07:36Z",
"number_observed": 1,
"object_refs": [
"url--5b5a9d8a-fd3d-4a40-8158-c00f07b5cf04"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5b5a9d8a-fd3d-4a40-8158-c00f07b5cf04",
"value": "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5cb95524-3fef-4334-9fef-e6d3f00982a4",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:12:08.000Z",
"modified": "2021-04-21T08:12:08.000Z",
"first_observed": "2021-04-21T08:12:08Z",
"last_observed": "2021-04-21T08:12:08Z",
"number_observed": 1,
"object_refs": [
"url--5cb95524-3fef-4334-9fef-e6d3f00982a4"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5cb95524-3fef-4334-9fef-e6d3f00982a4",
"value": "https://www.circl.lu/pub/tr-63"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--d584973b-e85b-431b-a2f2-c3cd33562245",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T09:01:21.000Z",
"modified": "2021-04-21T09:01:21.000Z",
"pattern": "[alert tcp $HOME_NET any -> any $HTTP_PORTS ( msg:\"APT.Webshell.PL.PULSECHECK callback\"; flow:to_server; content:\"POST \"; depth:5; content:\" HTTP/1.1|0d 0a|\"; distance:1; content:\"|0d 0a|X-CMD: \"; nocase; fast_pattern; content:\"|0d 0a|X-CNT: \"; nocase; content:\"|0d 0a|X-KEY: \"; nocase; reference:mal_hash, a1dcdf62aafc36dd8cf64774dea80d79fb4e24ba2a82adf4d944d9186acd1cc1; reference:date_created,2021-04-16; sid:999999999; )]",
"pattern_type": "snort",
"valid_from": "2021-04-21T09:01:21Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"snort\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--55301c17-7b0e-450d-89be-54eb3f096592",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T09:01:21.000Z",
"modified": "2021-04-21T09:01:21.000Z",
"pattern": "[alert tcp any any -> any any ( msg:\"APT.Webshell.HTTP.PULSECHECK.[X-CMD:]\"; content:\"POST \"; depth:5; content:\"|0d 0a|X-CMD: \"; nocase; fast_pattern; content:\"|0d 0a|X-CNT: \"; nocase; content:\"|0d 0a|X-KEY: \"; nocase; content:!\"|0d 0a|Referer: \"; content:!\"fast_pattern\"; threshold:type limit,track by_src,count 1,seconds 3600; sid: 999999999; )]",
"pattern_type": "snort",
"valid_from": "2021-04-21T09:01:21Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"snort\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--e8e292e5-5fab-4e5b-afa0-89df4eb361d6",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T09:01:21.000Z",
"modified": "2021-04-21T09:01:21.000Z",
"pattern": "[alert tcp any $HTTP_PORTS -> any any ( msg:\"APT.Webshell.PL.STEADYPULSE.[<form action=]\"; flow:to_client; content:\"<form action=\\\"\\\" method=\\\"GET\\\">\"; content:\"<input type=\\\"text\\\" name=\\\"cmd\\\" \"; distance:0; content:\"<input type=\\\"text\\\" name=\\\"serverid\\\" \"; distance:0; fast_pattern; content:\"<input type=\\\"submit\\\" value=\\\"Run\\\">\"; distance:0; pcre:\"/<\\/form>\\s{0,512}<pre>/R\"; reference:mal_hash, 168976797d5af7071df257e91fcc31ce1d6e59c72ca9e2f50c8b5b3177ad83cc; reference:date_created,2021-04-16; sid: 999999999; )]",
"pattern_type": "snort",
"valid_from": "2021-04-21T09:01:21Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"snort\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--4ad4982e-87bf-4edc-915b-4ad84f3b13eb",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T09:01:21.000Z",
"modified": "2021-04-21T09:01:21.000Z",
"pattern": "[alert tcp any any -> any any ( msg:\"APT.Webshell.HTTP.STEADYPULSE.[<form action=]\"; content:\"<form action=\\\"\\\" method=\\\"GET\\\">\"; content:\"<input type=\\\"text\\\" name=\\\"cmd\\\" \"; distance:0; fast_pattern; content:\"<input type=\\\"text\\\" name=\\\"serverid\\\" \"; distance:0; content:\"<input type=\\\"submit\\\" value=\\\"Run\\\">\"; distance:0; content:!\"|0d 0a|Referer: \"; content:!\"|0d 0a|User-Agent: \"; content:!\"fast_pattern\"; threshold:type limit,track by_src,count 1,seconds 3600; reference:mal_hash, 168976797d5af7071df257e91fcc31ce1d6e59c72ca9e2f50c8b5b3177ad83cc; sid: 999999999; )]",
"pattern_type": "snort",
"valid_from": "2021-04-21T09:01:21Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"snort\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--2b0bd4a3-3f4a-4e9a-b330-52a196385fc0",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T09:01:21.000Z",
"modified": "2021-04-21T09:01:21.000Z",
"pattern": "[alert tcp any any -> any any ( msg:\"APT.Webshell.HTTP.STEADYPULSE.[Results of]\"; content:\"|0d 0a|Results of '\"; content:\"' execution:|0a 0a|\"; distance:1; within:256; fast_pattern; content:!\"|0d 0a|Referer: \"; content:!\"|0d 0a|User-Agent: \"; content:!\"fast_pattern\"; threshold:type limit,track by_src,count 1,seconds 3600; reference:mal_hash, 168976797d5af7071df257e91fcc31ce1d6e59c72ca9e2f50c8b5b3177ad83cc; sid: 999999999; )]",
"pattern_type": "snort",
"valid_from": "2021-04-21T09:01:21Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"snort\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--baccb07a-3ac5-4a08-89d0-5c02114ad60b",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T09:01:21.000Z",
"modified": "2021-04-21T09:01:21.000Z",
"pattern": "[alert tcp any $HTTP_PORTS -> any any ( msg:\"APT.Webshell.PL.STEADYPULSE. .[Results of]\"; flow:to_client; content:\"Results of '\"; content:\"' execution:|0a 0a|\"; distance:1; within:256; reference:mal_hash, 168976797d5af7071df257e91fcc31ce1d6e59c72ca9e2f50c8b5b3177ad83cc; reference:date_created,2021-04-16; sid: 999999999; fast_pattern; )]",
"pattern_type": "snort",
"valid_from": "2021-04-21T09:01:21Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"snort\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--57ffce5f-60a8-40ae-b11e-624ca218704d",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:08:50.000Z",
"modified": "2021-04-21T08:08:50.000Z",
"labels": [
"misp:name=\"report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "link",
"object_relation": "link",
"value": "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html",
"category": "External analysis",
"uuid": "4fa4a70a-3aff-4432-ac42-9409399e196d"
},
{
"type": "text",
"object_relation": "summary",
"value": "Mandiant recently responded to multiple security incidents involving compromises of Pulse Secure VPN appliances.\r\n This blog post examines multiple, related techniques for bypassing single and multifactor authentication on Pulse Secure VPN devices, persisting across upgrades, and maintaining access through webshells.\r\n The investigation by Pulse Secure has determined that a combination of prior vulnerabilities and a previously unknown vulnerability discovered in April 2021, CVE-2021-22893, are responsible for the initial infection vector.\r\n Pulse Secure\u2019s parent company, Ivanti, released mitigations for a vulnerability exploited in relation to these malware families and the Pulse Connect Secure Integrity Tool for their customers to determine if their systems are impacted. A final patch to address the vulnerability will be available in early May 2021.\r\n Pulse Secure has been working closely with Mandiant, affected customers, government partners, and other forensic experts to address these issues.\r\n There is no indication the identified backdoors were introduced through a supply chain compromise of the company\u2019s network or software deployment process.",
"category": "Other",
"uuid": "eebfc2b8-6467-4cdd-8a31-041708d20a55"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "report"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--6854614c-df9f-4bb5-8de0-857c943be550",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:15:06.000Z",
"modified": "2021-04-21T08:15:06.000Z",
"description": "SLOWPULSE V1 - libdsplibs.so ",
"pattern": "[file:hashes.MD5 = '23ff4df644aa408d6a074eb8fa9f0da3' AND file:hashes.SHA256 = 'cd09ec795a8f4b6ced003500a44d810f49943514e2f92c81ab96c33e1c0fbd68']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:15:06Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--874ca0e5-827e-43f8-99f5-a2a5aa60e672",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:17:02.000Z",
"modified": "2021-04-21T08:17:02.000Z",
"description": "SLOWPULSE V2 \r\nlibdsplibs.so ",
"pattern": "[file:hashes.MD5 = '8bf3ebe60f393f4c2fe0bbeb4976fc46' AND file:hashes.SHA256 = '1ab50b77dd9515f6cd9ed07d1d3176ba4627a292dc4a21b16ac9d211353818bd' AND file:name = 'libdsplibs.so']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:17:02Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--cd13cfd7-f4dc-4864-9009-30baa29551a6",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:17:49.000Z",
"modified": "2021-04-21T08:17:49.000Z",
"description": "SLOWPULSE V3 \r\nlibdsplibs.so ",
"pattern": "[file:hashes.MD5 = '8f5d87592f68d8350656f722f6f21e10' AND file:hashes.SHA256 = 'b1c2368773259fbfef425e0bb716be958faa7e74b3282138059f511011d3afd9']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:17:49Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--1d87313f-7519-4748-bfb1-fc8b60906cf6",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:19:22.000Z",
"modified": "2021-04-21T08:19:22.000Z",
"description": "SLOWPULSE V2 Patcher \r\nunknown ",
"pattern": "[file:hashes.MD5 = '32a9bc24c6670a3cf880a8c0c9e9dfaf' AND file:hashes.SHA256 = 'c9b323b9747659eac25cec078895d75f016e26a8b5858567c7fb945b7321722c']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:19:22Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--0b65ad47-db4b-4f58-a33c-e671746afa05",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:20:00.000Z",
"modified": "2021-04-21T08:20:00.000Z",
"description": "SLOWPULSE V3 Patcher \r\nunknown ",
"pattern": "[file:hashes.MD5 = '6272aa2f8f47e2a63f138d81e69fdba7' AND file:hashes.SHA256 = '06c56bd272b19bf7d7207443693cd1fc774408c4ca56744577b11fee550c23f7']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:20:00Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5c9a0062-ee55-43b0-ad64-3c5f6fdf3d01",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:20:45.000Z",
"modified": "2021-04-21T08:20:45.000Z",
"description": "SLOWPULSE V4 Patcher \r\nunknown ",
"pattern": "[file:hashes.MD5 = 'beff02edb0f6a7c2b341aa780e88a48c' AND file:hashes.SHA256 = 'e63ab6f82c711e4ecc8f5b36046eb7ea216f41eb90158165b82a6c90560ea415']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:20:45Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--efd7b1ec-0fff-498a-ad64-d1d259ebbf82",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:21:24.000Z",
"modified": "2021-04-21T08:21:24.000Z",
"description": "SLOWPULSE V4 UnPatcher \r\nunknown ",
"pattern": "[file:hashes.MD5 = 'ece3e2a6b6e3531b50cc74c7f87cdc8d' AND file:hashes.SHA256 = 'b2350954b9484ae4eac42b95fae6edf7a126169d0b93d79f49d36c5e6497062a']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:21:24Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--35ae369e-4ab2-447c-819c-c366f547ca9c",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:22:02.000Z",
"modified": "2021-04-21T08:22:02.000Z",
"description": "PULSECHECK \r\nsecid_canceltoken.cgi",
"pattern": "[file:hashes.MD5 = '33c4947efe66ce8c175464b4e262fe16' AND file:hashes.SHA256 = 'a1dcdf62aafc36dd8cf64774dea80d79fb4e24ba2a82adf4d944d9186acd1cc1']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:22:02Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5f99e163-f31e-4994-8a56-4b249d894012",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:22:48.000Z",
"modified": "2021-04-21T08:22:48.000Z",
"description": "PULSECHECK \r\nCompcheckjs.cgi ",
"pattern": "[file:hashes.MD5 = '9aa378cbec161ccd168be212c8856749' AND file:hashes.SHA256 = '6f4dec58548f5193b5e511ecc3c63154ae3c93f9345661a774cb69a1ce16c577']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:22:48Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--0690ab34-3ffe-4d37-b6a7-4ce477d4de60",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:23:37.000Z",
"modified": "2021-04-21T08:23:37.000Z",
"description": "RADIALPULSE \r\napac_login.cgiunknown \r\n",
"pattern": "[file:hashes.MD5 = '1cd91b74f8d2d2fe952a97e9040073d8' AND file:hashes.SHA256 = 'd72daafedf41d484f7f9816f7f076a9249a6808f1899649b7daa22c0447bb37b']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:23:37Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--30408119-108d-495f-89ca-cbe1dcf0b68b",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:24:18.000Z",
"modified": "2021-04-21T08:24:18.000Z",
"description": "RADIALPULSE \r\nbasicauth_userpass.cgi ",
"pattern": "[file:hashes.MD5 = '4a2a7cbc1c8855199a27a7a7b51d0117' AND file:hashes.SHA256 = '293cc71af317593e0e5d9f8c6fd7a732977c63174becc8dedadf8f8f4cc9c922']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:24:18Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--c0b88e1a-d76c-4226-bffa-45ca59bc2fa9",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:25:06.000Z",
"modified": "2021-04-21T08:25:06.000Z",
"description": "RADIALPULSE \r\ndswebserver.sh ",
"pattern": "[file:hashes.MD5 = '4d416e551821ccce8bc9c4457d10573b' AND file:hashes.SHA256 = 'b72fdae94e78fe51205966179573693c01eae98ece228af13041855cc4e255b1']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:25:06Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--dbab04b4-1df0-4055-be1a-2ad6d47b15de",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:25:48.000Z",
"modified": "2021-04-21T08:25:48.000Z",
"description": "RADIALPULSE \r\nunknown \r\n",
"pattern": "[file:hashes.MD5 = '558090216cf8199802f11da4f70db897' AND file:hashes.SHA256 = 'dea123cd0a48f01ef9176946f11e4b2b23218018ebcea7ff08d552f88906c52d']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:25:48Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5279454c-137c-4df2-ab40-d4f67be95f40",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:26:26.000Z",
"modified": "2021-04-21T08:26:26.000Z",
"description": "RADIALPULSE \r\nlogin.cgi ",
"pattern": "[file:hashes.MD5 = '56e2a1566c7989612320f4ef1669e7d5' AND file:hashes.SHA256 = 'e9df4e13131c95c75ca41a95e08599b3d480e5e7a7922ff0a3fa00bef3bd6561']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:26:26Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--61f23a4d-8a5f-4a4c-b846-4f87797fbb1a",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:27:19.000Z",
"modified": "2021-04-21T08:27:19.000Z",
"description": "RADIALPULSE \r\nlogin.cgi ",
"pattern": "[file:hashes.MD5 = '6c63b5c747e8e351426777b7de94da7c' AND file:hashes.SHA256 = '61f9f6ae26bd3f4d6632bcc722022079aab1ef1d3ddeb71f0f7db2f14aed4ce4']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:27:19Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--44e27409-7862-42be-bf2b-4d18fa27243f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:29:10.000Z",
"modified": "2021-04-21T08:29:10.000Z",
"description": "RADIALPULSE \r\nrd.cgi ",
"pattern": "[file:hashes.MD5 = '957ca40755de8f1f68602476a62799f9' AND file:hashes.SHA256 = 'b482dc4d07e0c11d047c25af3bd239b9c57eaa8648cebf639369ec143297b96a']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:29:10Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--3347af09-6558-4e07-ac68-c7abe87079b9",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:29:54.000Z",
"modified": "2021-04-21T08:29:54.000Z",
"description": "RADIALPULSE \r\nuserpass.cgi ",
"pattern": "[file:hashes.MD5 = 'd21705be48b4b38a66e731f6d4125708' AND file:hashes.SHA256 = 'd61d98a3a68a5a35d49c5c7a43d11d3e22bdb7d26bffb6f5aded83c07c90633a']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:29:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--ec665abd-0414-4647-b4cd-9fa22e979ab8",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:32:21.000Z",
"modified": "2021-04-21T08:32:21.000Z",
"description": "PACEMAKER \r\nmemread \r\n",
"pattern": "[file:hashes.MD5 = 'd7881c4de4d57828f7e1cab15687274b' AND file:hashes.SHA256 = '68743e17f393d1f85ee937dffacc91e081b5f6f43477111ac96aa9d44826e4d2']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:32:21Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--3e50f8b8-0dbc-4bec-80de-30e325671f95",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:34:27.000Z",
"modified": "2021-04-21T08:34:27.000Z",
"description": "PACEMAKER Launcher Utility \r\nunknown\r\n",
"pattern": "[file:hashes.MD5 = '4cb9bb1cdc1931c738843f7dfe63f5c4' AND file:hashes.SHA256 = '4c5555955b2e6dc55f52b0c1a3326f3d07b325b112060329c503b294208960ec']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:34:27Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--2620c50d-6305-45cb-8aff-e37d50425358",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:35:12.000Z",
"modified": "2021-04-21T08:35:12.000Z",
"description": "THINBLOOD \r\ndsclslog ",
"pattern": "[file:hashes.MD5 = 'f38fe97c2a7419e62ce72439bdbb85b5' AND file:hashes.SHA256 = '88170125598a4fb801102ad56494a773895059ac8550a983fdd2ef429653f079']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:35:12Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--cfaa4938-1778-45cd-b95a-61be8ba0837e",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:36:11.000Z",
"modified": "2021-04-21T08:36:11.000Z",
"description": "THINBLOOD Variant \r\nclear_log.sh ",
"pattern": "[file:hashes.MD5 = 'ecbd062c45d5fd38bb7f58289a8f5c86' AND file:hashes.SHA256 = '1741dc0a491fcc8d078220ac9628152668d3370b92a8eae258e34ba28c6473b9']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:36:11Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--0da707a9-b329-4d30-b907-01fe6c1de17c",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:36:48.000Z",
"modified": "2021-04-21T08:36:48.000Z",
"description": "SLIGHTPULSE \r\nmeeting_testjs.cgi ",
"pattern": "[file:hashes.MD5 = '57df2d9468b66d7585f79b12d4249f22' AND file:hashes.SHA256 = '133631957d41eed9496ac2774793283ce26f8772de226e7f520d26667b51481a']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:36:48Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--df51083d-32e2-4812-89bb-f7036472920e",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:37:33.000Z",
"modified": "2021-04-21T08:37:33.000Z",
"description": "ATRIUM \r\ncompcheckresult.cgi ",
"pattern": "[file:hashes.MD5 = 'ca0175d86049fa7c796ea06b413857a3' AND file:hashes.SHA256 = 'f2b1bd703c3eb05541ff84ec375573cbdc70309ccb82aac04b72db205d718e90']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:37:33Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5151611d-c11d-47cf-9a9c-5ef132b1a303",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:38:13.000Z",
"modified": "2021-04-21T08:38:13.000Z",
"description": "ATRIUM \r\ndo-install ",
"pattern": "[file:hashes.MD5 = 'a631b7a8a11e6df3fccb21f4d34dbd8a' AND file:hashes.SHA256 = '2202234643bcd4807f21fbe4eb9ef3be9a6857ef92fd5979abb2b97b3c113966']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:38:13Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--298449a1-8e86-409c-96fb-0c225d9f98a9",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:39:25.000Z",
"modified": "2021-04-21T08:39:25.000Z",
"description": "Persistence Patcher (ATRIUM)\r\nDSUpgrade.pm ",
"pattern": "[file:hashes.MD5 = 'd2ef3894c6e46453b7d9416ff0d4d6cc' AND file:hashes.SHA256 = '224b7c45cf6fe4547d3ea66a12c30f3cb4c601b0a80744154697094e73dbd450']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:39:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--cf564f32-56e9-4fe0-87ac-5e5df91b0c9f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:40:31.000Z",
"modified": "2021-04-21T08:40:31.000Z",
"description": "Persistence Patcher (ATRIUM)\r\nDSUpgrade.pm ",
"pattern": "[file:hashes.MD5 = 'd855ebd2adeaf2b3c87b28e77e9ce4d4' AND file:hashes.SHA256 = 'a3b60b4bc4a5c7af525491ba37b570f90405aa83e36655da7d91bd68acaedf85']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:40:31Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--bbcc14ea-c7fc-4b15-a020-b619641add7e",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:41:23.000Z",
"modified": "2021-04-21T08:41:23.000Z",
"description": "Persistence Patcher (STEADYPULSE)\r\nDSUpgrade.pm",
"pattern": "[file:hashes.MD5 = '5009b307214abc4ba5e24fa99133b934' AND file:hashes.SHA256 = '64c87520565165ac95b74d6450b3ab8379544933dd3e2f2c4dc9b03a3ec570a7']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:41:23Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--60b5f9a7-ffa3-4d56-a1a7-6642638be3e6",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:42:01.000Z",
"modified": "2021-04-21T08:42:01.000Z",
"description": "Persistence Patcher (PULSECHECK)\r\nDSUpgrade.pm",
"pattern": "[file:hashes.MD5 = 'de9184422b477ca3b6aae536979e8626' AND file:hashes.SHA256 = '705cda7d1ace8f4adeec5502aa311620b8d6c64046a1aed2ae833e2f2835154f']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:42:01Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--04323a10-ee75-43ae-9150-001fe9a27ab7",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:42:56.000Z",
"modified": "2021-04-21T08:42:56.000Z",
"description": "Persistence Patcher (UNKNOWN)\r\nDSUpgrade.pm",
"pattern": "[file:hashes.MD5 = '22cc57df424cac79f5bf78109a443523' AND file:hashes.SHA256 = '78d7c7c9f800f6824f63a99d935a4ad0112f97953d8c100deb29dae24d7da282']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:42:56Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--bbdbb662-a8b1-4c13-85f2-898abde6d3f9",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:43:34.000Z",
"modified": "2021-04-21T08:43:34.000Z",
"description": "LOCKPICK \r\nlibcrypto.so ",
"pattern": "[file:hashes.MD5 = 'e8bfd3f5a2806104316902bbe1195ee8' AND file:hashes.SHA256 = '2610d0372e0e107053bc001d278ef71f08562e5610691f18b978123c499a74d8']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:43:34Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--b4a44973-985c-4058-b968-9cd867f1bef6",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:44:13.000Z",
"modified": "2021-04-21T08:44:13.000Z",
"description": "LOCKPICK Patcher\r\nunknown",
"pattern": "[file:hashes.MD5 = '0ac5571f69a1cb17110d7c5af772a5eb' AND file:hashes.SHA256 = 'b990f79ce80c24625c97810cb8f161eafdcb10f1b8d9d538df4ca9be387c35e4']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:44:13Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--ca389b0d-fbe4-42bc-96e3-56b5f4886c9b",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:44:58.000Z",
"modified": "2021-04-21T08:44:58.000Z",
"description": "HARDPULSE \r\ncompcheckjava.cgi",
"pattern": "[file:hashes.MD5 = '980cba9e82faf194edb6f3cc20dc73ff' AND file:hashes.SHA256 = '1d3ab04e21cfd40aa8d4300a359a09e3b520d39b1496be1e4bc91ae1f6730ecc']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:44:58Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--34384af6-0071-435b-84c1-bf8c3420cd08",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:45:48.000Z",
"modified": "2021-04-21T08:45:48.000Z",
"description": "PULSEJUMP \r\nunknown ",
"pattern": "[file:hashes.MD5 = '91ee23ee24e100ba4a943bb4c15adb4c' AND file:hashes.SHA256 = '7fa71a7f76ef63465cfeacf58217e0b66fc71bc81d37c44380a6f572b8a3ec7a']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:45:48Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--1fc8066f-98aa-4e70-b4ee-0710931cdac7",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:46:29.000Z",
"modified": "2021-04-21T08:46:29.000Z",
"description": "QUIETPULSE \r\ndsserver ",
"pattern": "[file:hashes.MD5 = '00575bec8d74e221ff6248228c509a16' AND file:hashes.SHA256 = '9f6ac39707822d243445e30d27b8404466aa69c61119d5308785bf4a464a9ebd']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:46:29Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--447d890e-3529-486e-b4f8-704b813d745f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:47:44.000Z",
"modified": "2021-04-21T08:47:44.000Z",
"description": "QUIETPULSE \r\ndshelper ",
"pattern": "[file:hashes.MD5 = '82e77d7ad4d39ed71981a3ddca4ff225' AND file:hashes.SHA256 = 'c774eca633136de35c9d2cd339a3b5d29f00f761657ea2aa438de4f33e4bbba4']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:47:44Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--7bd70c6d-d345-45f3-a8ac-00e4a2149cea",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:48:25.000Z",
"modified": "2021-04-21T08:48:25.000Z",
"description": "STEADYPULSE \r\nlicenseserverproto.cgi ",
"pattern": "[file:hashes.MD5 = 'fb21828f490561810c205241b367095e' AND file:hashes.SHA256 = '168976797d5af7071df257e91fcc31ce1d6e59c72ca9e2f50c8b5b3177ad83cc']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2021-04-21T08:48:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--8f5eaca0-34a1-4e85-b6b3-8082bce62175",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:49:54.000Z",
"modified": "2021-04-21T08:49:54.000Z",
"pattern": "// Copyright 2021 by FireEye, Inc.\r\n// You may not use this file except in compliance with the license. The license should have been received with this file.\r\n\r\nrule FE_Webshell_PL_ATRIUM_1\r\n{\r\n meta:\r\n author = \\\\\"Mandiant\\\\\"\r\n date_created = \\\\\"2021-04-16\\\\\"\r\n md5 = \\\\\"ca0175d86049fa7c796ea06b413857a3\\\\\"\r\n reference_url = \\\\\"https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html\\\\\"\r\n strings:\r\n $s1 = \\\\\"CGI::param(\\\\\"\r\n $s2 = \\\\\"system(\\\\\"\r\n $s3 = /if[\\\\x09\\\\x20]{0,32}\\\\(CGI::param\\\\([\\\\x22\\\\x27]\\\\w{1,64}[\\\\x22\\\\x27]\\\\)\\\\)\\\\s{0,128}\\\\{[\\\\x09\\\\x20]{0,32}print [\\\\x22\\\\x27]Cache-Control: no-cache\\\\\\\\n[\\\\x22\\\\x27][\\\\x09\\\\x20]{0,32};\\\\s{0,128}print [\\\\x22\\\\x27]Content-type: text\\\\/html\\\\\\\\n\\\\\\\\n[\\\\x22\\\\x27][\\\\x09\\\\x20]{0,32};\\\\s{0,128}my \\\\$\\\\w{1,64}[\\\\x09\\\\x20]{0,32}=[\\\\x09\\\\x20]{0,32}CGI::param\\\\([\\\\x22\\\\x27]\\\\w{1,64}[\\\\x22\\\\x27]\\\\)[\\\\x09\\\\x20]{0,32};\\\\s{0,128}system\\\\([\\\\x22\\\\x27]\\\\$/\r\n condition:\r\n all of them\r\n}",
"pattern_type": "yara",
"valid_from": "2021-04-21T08:49:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "misc"
}
],
"labels": [
"misp:name=\"yara\"",
"misp:meta-category=\"misc\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--4f5204e2-efbe-4200-8f2c-bc6ebbb952da",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:50:30.000Z",
"modified": "2021-04-21T08:50:30.000Z",
"pattern": "// Copyright 2021 by FireEye, Inc.\r\n// You may not use this file except in compliance with the license. The license should have been received with this file.\r\n\r\nrule FE_Trojan_SH_ATRIUM_1\r\n{\r\n meta:\r\n author = \\\\\"Mandiant\\\\\"\r\n date_created = \\\\\"2021-04-16\\\\\"\r\n md5 = \\\\\"a631b7a8a11e6df3fccb21f4d34dbd8a\\\\\"\r\n reference_url = \\\\\"https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html\\\\\"\r\n strings:\r\n $s1 = \\\\\"CGI::param(\\\\\"\r\n $s2 = \\\\\"Cache-Control: no-cache\\\\\"\r\n $s3 = \\\\\"system(\\\\\"\r\n $s4 = /sed -i [^\\\\r\\\\n]{1,128}CGI::param\\\\([^\\\\r\\\\n]{1,128}print[\\\\x20\\\\x09]{1,32}[^\\\\r\\\\n]{1,128}Cache-Control: no-cache[^\\\\r\\\\n]{1,128}print[\\\\x20\\\\x09]{1,32}[^\\\\r\\\\n]{1,128}Content-type: text\\\\/html[^\\\\r\\\\n]{1,128}my [^\\\\r\\\\n]{1,128}=[\\\\x09\\\\x20]{0,32}CGI::param\\\\([^\\\\r\\\\n]{1,128}system\\\\(/\r\n condition:\r\n all of them\r\n}",
"pattern_type": "yara",
"valid_from": "2021-04-21T08:50:30Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "misc"
}
],
"labels": [
"misp:name=\"yara\"",
"misp:meta-category=\"misc\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--c73a7441-1444-42a9-974d-3f3e64168bcc",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:51:03.000Z",
"modified": "2021-04-21T08:51:03.000Z",
"pattern": "// Copyright 2021 by FireEye, Inc.\r\n// You may not use this file except in compliance with the license. The license should have been received with this file.\r\n\r\nrule FE_APT_Webshell_PL_HARDPULSE \r\n{ \r\n meta: \r\n author = \\\\\"Mandiant\\\\\" \r\n date_created = \\\\\"2021-04-16\\\\\" \r\n md5 = \\\\\"980cba9e82faf194edb6f3cc20dc73ff\\\\\"\r\n reference_url = \\\\\"https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html\\\\\"\r\n strings: \r\n $r1 = /if[\\\\x09\\\\x20]{0,32}\\\\(\\\\$\\\\w{1,64}[\\\\x09\\\\x20]{1,32}eq[\\\\x09\\\\x20]{1,32}[\\\\x22\\\\x27]\\\\w{1,64}[\\\\x22\\\\x27]\\\\)\\\\s{0,128}\\\\{\\\\s{1,128}my[\\\\x09\\\\x20]{1,32}\\\\$\\\\w{1,64}[\\\\x09\\\\x20]{0,32}\\\\x3b\\\\s{1,128}unless[\\\\x09\\\\x20]{0,32}\\\\(open\\\\(\\\\$\\\\w{1,64},[\\\\x09\\\\x20]{0,32}\\\\$\\\\w{1,64}\\\\)\\\\)\\\\s{0,128}\\\\{\\\\s{1,128}goto[\\\\x09\\\\x20]{1,32}\\\\w{1,64}[\\\\x09\\\\x20]{0,32}\\\\x3b\\\\s{1,128}return[\\\\x09\\\\x20]{1,32}0[\\\\x09\\\\x20]{0,32}\\\\x3b\\\\s{0,128}\\\\}/ \r\n $r2 = /open[\\\\x09\\\\x20]{0,32}\\\\(\\\\*\\\\w{1,64}[\\\\x09\\\\x20]{0,32},[\\\\x09\\\\x20]{0,32}[\\\\x22\\\\x27]>/ \r\n $r3 = /if[\\\\x09\\\\x20]{0,32}\\\\(\\\\$\\\\w{1,64}[\\\\x09\\\\x20]{1,32}eq[\\\\x09\\\\x20]{1,32}[\\\\x22\\\\x27]\\\\w{1,64}[\\\\x22\\\\x27]\\\\)\\\\s{0,128}\\\\{\\\\s{1,128}print[\\\\x09\\\\x20]{0,32}[\\\\x22\\\\x27]Content-type/ \r\n $s1 = \\\\\"CGI::request_method()\\\\\" \r\n $s2 = \\\\\"CGI::param(\\\\\" \r\n $s3 = \\\\\"syswrite(\\\\\" \r\n $s4 = \\\\\"print $_\\\\\" \r\n condition: \r\n all of them \r\n}",
"pattern_type": "yara",
"valid_from": "2021-04-21T08:51:03Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "misc"
}
],
"labels": [
"misp:name=\"yara\"",
"misp:meta-category=\"misc\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--642cf927-5c24-4846-b8a7-5b895c87594f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:51:36.000Z",
"modified": "2021-04-21T08:51:36.000Z",
"pattern": "// Copyright 2021 by FireEye, Inc.\r\n// You may not use this file except in compliance with the license. The license should have been received with this file.\r\n\r\nrule FE_APT_Trojan_Linux32_LOCKPICK_1\r\n{\r\n meta:\r\n author = \\\\\"Mandiant\\\\\"\r\n date_created = \\\\\"2021-04-16\\\\\"\r\n md5 = \\\\\"e8bfd3f5a2806104316902bbe1195ee8\\\\\"\r\n reference_url = \\\\\"https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html\\\\\"\r\n strings:\r\n $sb1 = { 83 ?? 63 0F 84 [4] 8B 45 ?? 83 ?? 01 89 ?? 24 89 44 24 04 E8 [4] 85 C0 }\r\n $sb2 = { 83 [2] 63 74 ?? 89 ?? 24 04 89 ?? 24 E8 [4] 83 [2] 01 85 C0 0F [5] EB 00 8B ?? 04 83 F8 02 7? ?? 83 E8 01 C1 E0 02 83 C0 00 89 44 24 08 8D 83 [4] 89 44 24 04 8B ?? 89 04 24 E8 }\r\n condition:\r\n ((uint32(0) == 0x464c457f) and (uint8(4) == 1)) and (@sb1[1] < @sb2[1])\r\n}",
"pattern_type": "yara",
"valid_from": "2021-04-21T08:51:36Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "misc"
}
],
"labels": [
"misp:name=\"yara\"",
"misp:meta-category=\"misc\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--c7b0b3ec-3c74-4329-abc4-0d4414228f90",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:52:09.000Z",
"modified": "2021-04-21T08:52:09.000Z",
"pattern": "// Copyright 2021 by FireEye, Inc.\r\n// You may not use this file except in compliance with the license. The license should have been received with this file.\r\n\r\nrule FE_APT_Trojan_Linux32_PACEMAKER \r\n{ \r\n meta: \r\n author = \\\\\"Mandiant\\\\\" \r\n date_created = \\\\\"2021-04-16\\\\\" \r\n md5 = \\\\\"d7881c4de4d57828f7e1cab15687274b\\\\\"\r\n reference_url = \\\\\"https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html\\\\\"\r\n strings: \r\n $s1 = \\\\\"\\\\x00/proc/\\\\%d/mem\\\\x00\\\\\" \r\n $s2 = \\\\\"\\\\x00/proc/\\\\%s/maps\\\\x00\\\\\" \r\n $s3 = \\\\\"\\\\x00/proc/\\\\%s/cmdline\\\\x00\\\\\" \r\n $sb1 = { C7 44 24 08 10 00 00 00 C7 44 24 04 00 00 00 00 8D 45 E0 89 04 24 E8 [4] 8B 45 F4 83 C0 0B C7 44 24 08 10 00 00 00 89 44 24 04 8D 45 E0 89 04 24 E8 [4] 8D 45 E0 89 04 24 E8 [4] 85 C0 74 ?? 8D 45 E0 89 04 24 E8 [4] 85 C0 74 ?? 8D 45 E0 89 04 24 E8 [4] EB } \r\n $sb2 = { 8B 95 [4] B8 [4] 8D 8D [4] 89 4C 24 10 8D 8D [4] 89 4C 24 0C 89 54 24 08 89 44 24 04 8D 85 [4] 89 04 24 E8 [4] C7 44 24 08 02 00 00 00 C7 44 24 04 00 00 00 00 8B 45 ?? 89 04 24 E8 [4] 89 45 ?? 8D 85 [4] 89 04 24 E8 [4] 89 44 24 08 8D 85 [4] 89 44 24 04 8B 45 ?? 89 04 24 E8 [4] 8B 45 ?? 89 45 ?? C7 45 ?? 00 00 00 00 [0-16] 83 45 ?? 01 8B 45 ?? 3B 45 0C } \r\n condition: \r\n ((uint32(0) == 0x464c457f) and (uint8(4) == 1)) and all of them \r\n}",
"pattern_type": "yara",
"valid_from": "2021-04-21T08:52:09Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "misc"
}
],
"labels": [
"misp:name=\"yara\"",
"misp:meta-category=\"misc\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--76f29c1c-c880-4baa-be5a-cecf57c18d38",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:52:37.000Z",
"modified": "2021-04-21T08:52:37.000Z",
"pattern": "// Copyright 2021 by FireEye, Inc.\r\n// You may not use this file except in compliance with the license. The license should have been received with this file.\r\n\r\nrule FE_APT_Trojan_Linux_PACEMAKER \r\n{ \r\n meta: \r\n author = \\\\\"Mandiant\\\\\" \r\n date_created = \\\\\"2021-04-16\\\\\" \r\n md5 = \\\\\"d7881c4de4d57828f7e1cab15687274b\\\\\"\r\n reference_url = \\\\\"https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html\\\\\"\r\n strings: \r\n $s1 = \\\\\"\\\\x00Name:\\\\%s || Pwd:\\\\%s || AuthNum:\\\\%s\\\\x0a\\\\x00\\\\\" \r\n $s2 = \\\\\"\\\\x00/proc/\\\\%d/mem\\\\x00\\\\\" \r\n $s3 = \\\\\"\\\\x00/proc/\\\\%s/maps\\\\x00\\\\\" \r\n $s4 = \\\\\"\\\\x00/proc/\\\\%s/cmdline\\\\x00\\\\\" \r\n condition: \r\n (uint32(0) == 0x464c457f) and all of them \r\n}",
"pattern_type": "yara",
"valid_from": "2021-04-21T08:52:37Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "misc"
}
],
"labels": [
"misp:name=\"yara\"",
"misp:meta-category=\"misc\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--12ee2578-f80b-4db9-b7c5-75c5f05215f2",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:53:06.000Z",
"modified": "2021-04-21T08:53:06.000Z",
"pattern": "// Copyright 2021 by FireEye, Inc.\r\n// You may not use this file except in compliance with the license. The license should have been received with this file.\r\n\r\nrule FE_APT_Webshell_PL_PULSECHECK_1 \r\n{ \r\n meta: \r\n author = \\\\\"Mandiant\\\\\" \r\n date_created = \\\\\"2021-04-16\\\\\" \r\n sha256 = \\\\\"a1dcdf62aafc36dd8cf64774dea80d79fb4e24ba2a82adf4d944d9186acd1cc1\\\\\"\r\n reference_url = \\\\\"https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html\\\\\"\r\n strings: \r\n $r1 = /while[\\\\x09\\\\x20]{0,32}\\\\(<\\\\w{1,64}>\\\\)[\\\\x09\\\\x20]{0,32}\\\\{\\\\s{1,256}\\\\$\\\\w{1,64}[\\\\x09\\\\x20]{0,32}\\\\.=[\\\\x09\\\\x20]{0,32}\\\\$_;\\\\s{0,256}\\\\}/ \r\n $s1 = \\\\\"use Crypt::RC4;\\\\\" \r\n $s2 = \\\\\"use MIME::Base64\\\\\" \r\n $s3 = \\\\\"MIME::Base64::decode(\\\\\" \r\n $s4 = \\\\\"popen(\\\\\" \r\n $s5 = \\\\\" .= $_;\\\\\" \r\n $s6 = \\\\\"print MIME::Base64::encode(RC4(\\\\\" \r\n $s7 = \\\\\"HTTP_X_\\\\\" \r\n condition: \r\n $s1 and $s2 and (@s3[1] < @s4[1]) and (@s4[1] < @s5[1]) and (@s5[1] < @s6[1]) and (#s7 > 2) and $r1 \r\n}",
"pattern_type": "yara",
"valid_from": "2021-04-21T08:53:06Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "misc"
}
],
"labels": [
"misp:name=\"yara\"",
"misp:meta-category=\"misc\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--ef28ce31-93a2-48a8-8ed8-b56b8caf60a7",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:53:49.000Z",
"modified": "2021-04-21T08:53:49.000Z",
"pattern": "// Copyright 2021 by FireEye, Inc.\r\n// You may not use this file except in compliance with the license. The license should have been received with this file.\r\n\r\nrule FE_APT_Trojan_PL_PULSEJUMP_1\r\n{\r\n meta:\r\n author = \\\\\"Mandiant\\\\\"\r\n date_created = \\\\\"2021-04-16\\\\\"\r\n md5 = \\\\\"91ee23ee24e100ba4a943bb4c15adb4c\\\\\"\r\n reference_url = \\\\\"https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html\\\\\"\r\n strings:\r\n $s1 = \\\\\"open(\\\\\"\r\n $s2 = \\\\\">>/tmp/\\\\\"\r\n $s3 = \\\\\"syswrite(\\\\\"\r\n $s4 = /\\\\}[\\\\x09\\\\x20]{0,32}elsif[\\\\x09\\\\x20]{0,32}\\\\([\\\\x09\\\\x20]{0,32}\\\\$\\\\w{1,64}[\\\\x09\\\\x20]{1,32}eq[\\\\x09\\\\x20]{1,32}[\\\\x22\\\\x27](Radius|Samba|AD)[\\\\x22\\\\x27][\\\\x09\\\\x20]{0,32}\\\\)\\\\s{0,128}\\\\{\\\\s{0,128}@\\\\w{1,64}[\\\\x09\\\\x20]{0,32}=[\\\\x09\\\\x20]{0,32}&/\r\n condition:\r\n all of them\r\n}",
"pattern_type": "yara",
"valid_from": "2021-04-21T08:53:49Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "misc"
}
],
"labels": [
"misp:name=\"yara\"",
"misp:meta-category=\"misc\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--d11dc00d-249a-4b44-a70d-8d1912c6b012",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:54:19.000Z",
"modified": "2021-04-21T08:54:19.000Z",
"pattern": "// Copyright 2021 by FireEye, Inc.\r\n// You may not use this file except in compliance with the license. The license should have been received with this file.\r\n\r\nrule FE_APT_Trojan_PL_QUIETPULSE \r\n{\r\n meta: \r\n author = \\\\\"Mandiant\\\\\" \r\n date_created = \\\\\"2021-04-16\\\\\" \r\n md5 = \\\\\"00575bec8d74e221ff6248228c509a16\\\\\"\r\n reference_url = \\\\\"https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html\\\\\"\r\n strings: \r\n $s1 = /open[\\\\x09\\\\x20]{0,32}\\\\(\\\\*STDOUT[\\\\x09\\\\x20]{0,32},[\\\\x09\\\\x20]{0,32}[\\\\x22\\\\x27]>&CLIENT[\\\\x22\\\\x27]\\\\)/ \r\n $s2 = /open[\\\\x09\\\\x20]{0,32}\\\\(\\\\*STDERR[\\\\x09\\\\x20]{0,32},[\\\\x09\\\\x20]{0,32}[\\\\x22\\\\x27]>&CLIENT[\\\\x22\\\\x27]\\\\)/ \r\n $s3 = /socket[\\\\x09\\\\x20]{0,32}\\\\(SERVER[\\\\x09\\\\x20]{0,32},[\\\\x09\\\\x20]{0,32}PF_UNIX[\\\\x09\\\\x20]{0,32},[\\\\x09\\\\x20]{0,32}SOCK_STREAM[\\\\x09\\\\x20]{0,32},[\\\\x09\\\\x20]{0,32}0[\\\\x09\\\\x20]{0,32}\\\\)[\\\\x09\\\\x20]{0,32};\\\\s{0,128}unlink/ \r\n $s4 = /bind[\\\\x09\\\\x20]{0,32}\\\\([\\\\x09\\\\x20]{0,32}SERVER[\\\\x09\\\\x20]{0,32},[\\\\x09\\\\x20]{0,32}sockaddr_un\\\\(/ \r\n $s5 = /listen[\\\\x09\\\\x20]{0,32}\\\\([\\\\x09\\\\x20]{0,32}SERVER[\\\\x09\\\\x20]{0,32},[\\\\x09\\\\x20]{0,32}SOMAXCONN[\\\\x09\\\\x20]{0,32}\\\\)[\\\\x09\\\\x20]{0,32};/ \r\n $s6 = /my[\\\\x09\\\\x20]{1,32}\\\\$\\\\w{1,64}[\\\\x09\\\\x20]{0,32}=[\\\\x09\\\\x20]{0,32}fork\\\\([\\\\x09\\\\x20]{0,32}\\\\)[\\\\x09\\\\x20]{0,32};\\\\s{1,128}if[\\\\x09\\\\x20]{0,32}\\\\([\\\\x09\\\\x20]{0,32}\\\\$\\\\w{1,64}[\\\\x09\\\\x20]{0,32}==[\\\\x09\\\\x20]{0,32}0[\\\\x09\\\\x20]{0,32}\\\\)[\\\\x09\\\\x20]{0,32}\\\\{\\\\s{1,128}exec\\\\(/ \r\n condition: \r\n all of them \r\n}",
"pattern_type": "yara",
"valid_from": "2021-04-21T08:54:19Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "misc"
}
],
"labels": [
"misp:name=\"yara\"",
"misp:meta-category=\"misc\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--b78852fc-95f7-4ec5-a7ed-e001320e19b4",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:54:52.000Z",
"modified": "2021-04-21T08:54:52.000Z",
"pattern": "// Copyright 2021 by FireEye, Inc.\r\n// You may not use this file except in compliance with the license. The license should have been received with this file.\r\n\r\nrule FE_APT_Trojan_PL_RADIALPULSE_1 \r\n{\r\n meta: \r\n author = \\\\\"Mandiant\\\\\" \r\n date_created = \\\\\"2021-04-16\\\\\" \r\n sha256 = \\\\\"d72daafedf41d484f7f9816f7f076a9249a6808f1899649b7daa22c0447bb37b\\\\\"\r\n reference_url = \\\\\"https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html\\\\\" \r\n strings: \r\n $s1 = \\\\\"->getRealmInfo()->{name}\\\\\" \r\n $s2 = /open\\\\(\\\\*fd,[\\\\x09\\\\x20]{0,32}[\\\\x22\\\\x27]>>/ \r\n $s3 = /syswrite\\\\(\\\\*fd,[\\\\x09\\\\x20]{0,32}[\\\\x22\\\\x27]realm=\\\\$/ \r\n $s4 = /syswrite\\\\(\\\\*fd,[\\\\x09\\\\x20]{0,32}[\\\\x22\\\\x27]username=\\\\$/ \r\n $s5 = /syswrite\\\\(\\\\*fd,[\\\\x09\\\\x20]{0,32}[\\\\x22\\\\x27]password=\\\\$/ \r\n condition: \r\n (@s1[1] < @s2[1]) and (@s2[1] < @s3[1]) and $s4 and $s5 \r\n}",
"pattern_type": "yara",
"valid_from": "2021-04-21T08:54:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "misc"
}
],
"labels": [
"misp:name=\"yara\"",
"misp:meta-category=\"misc\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--9df4fc8c-7277-4488-9f3b-ff2a0f51aa66",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:55:20.000Z",
"modified": "2021-04-21T08:55:20.000Z",
"pattern": "// Copyright 2021 by FireEye, Inc.\r\n// You may not use this file except in compliance with the license. The license should have been received with this file.\r\n\r\nrule FE_APT_Trojan_PL_RADIALPULSE_2 \r\n{ \r\n meta: \r\n author = \\\\\"Mandiant\\\\\" \r\n date_created = \\\\\"2021-04-16\\\\\" \r\n md5 = \\\\\"4a2a7cbc1c8855199a27a7a7b51d0117\\\\\"\r\n reference_url = \\\\\"https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html\\\\\"\r\n strings: \r\n $s1 = \\\\\"open(*fd,\\\\\" \r\n $s2 = \\\\\"syswrite(*fd,\\\\\" \r\n $s3 = \\\\\"close(*fd);\\\\\" \r\n $s4 = /open\\\\(\\\\*fd,[\\\\x09\\\\x20]{0,32}[\\\\x22\\\\x27]>>\\\\/tmp\\\\/[\\\\w.]{1,128}[\\\\x22\\\\x27]\\\\);[\\\\x09\\\\x20]{0,32}syswrite\\\\(\\\\*fd,[\\\\x09\\\\x20]{0,32}/ \r\n $s5 = /syswrite\\\\(\\\\*fd,[\\\\x09\\\\x20]{0,32}[\\\\x22\\\\x27][\\\\w]{1,128}=\\\\$\\\\w{1,128} ?[\\\\x22\\\\x27],[\\\\x09\\\\x20]{0,32}5000\\\\)/ \r\n condition: \r\n all of them \r\n}",
"pattern_type": "yara",
"valid_from": "2021-04-21T08:55:20Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "misc"
}
],
"labels": [
"misp:name=\"yara\"",
"misp:meta-category=\"misc\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--b79a5423-1769-4be7-a580-909c99a08598",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:55:55.000Z",
"modified": "2021-04-21T08:55:55.000Z",
"pattern": "// Copyright 2021 by FireEye, Inc.\r\n// You may not use this file except in compliance with the license. The license should have been received with this file.\r\n\r\nrule FE_APT_Trojan_PL_RADIALPULSE_3 \r\n{ \r\n meta: \r\n author = \\\\\"Mandiant\\\\\" \r\n date_created = \\\\\"2021-04-16\\\\\" \r\n md5 = \\\\\"4a2a7cbc1c8855199a27a7a7b51d0117\\\\\"\r\n reference_url = \\\\\"https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html\\\\\"\r\n strings: \r\n $s1 = \\\\\"open(*fd,\\\\\" \r\n $s2 = \\\\\"syswrite(*fd,\\\\\" \r\n $s3 = \\\\\"close(*fd);\\\\\" \r\n $s4 = /open\\\\(\\\\*fd,[\\\\x09\\\\x20]{0,32}[\\\\x22\\\\x27]>>\\\\/tmp\\\\/dsstartssh\\\\.statementcounters[\\\\x22\\\\x27]\\\\);[\\\\x09\\\\x20]{0,32}syswrite\\\\(\\\\*fd,[\\\\x09\\\\x20]{0,32}/ \r\n $s5 = /syswrite\\\\(\\\\*fd,[\\\\x09\\\\x20]{0,32}[\\\\x22\\\\x27][\\\\w]{1,128}=\\\\$username ?[\\\\x22\\\\x27],[\\\\x09\\\\x20]{0,32}\\\\d{4}\\\\)/ \r\n condition: \r\n all of them \r\n}",
"pattern_type": "yara",
"valid_from": "2021-04-21T08:55:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "misc"
}
],
"labels": [
"misp:name=\"yara\"",
"misp:meta-category=\"misc\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--17e7dce5-405d-4cf1-8d2f-9f3de6653c75",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:56:27.000Z",
"modified": "2021-04-21T08:56:27.000Z",
"pattern": "// Copyright 2021 by FireEye, Inc.\r\n// You may not use this file except in compliance with the license. The license should have been received with this file.\r\n\r\nrule FE_APT_Backdoor_Linux32_SLOWPULSE_1 \r\n{ \r\n meta: \r\n author = \\\\\"Mandiant\\\\\" \r\n date_created = \\\\\"2021-04-16\\\\\"\r\n sha256 = \\\\\"cd09ec795a8f4b6ced003500a44d810f49943514e2f92c81ab96c33e1c0fbd68\\\\\"\r\n reference_url = \\\\\"https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html\\\\\" \r\n strings: \r\n $sb1 = {FC b9 [4] e8 00 00 00 00 5? 8d b? [4] 8b} \r\n $sb2 = {f3 a6 0f 85 [4] b8 03 00 00 00 5? 5? 5?} \r\n $sb3 = {9c 60 e8 00 00 00 00 5? 8d [5] 85 ?? 0f 8?} \r\n $sb4 = {89 13 8b 51 04 89 53 04 8b 51 08 89 53 08} \r\n $sb5 = {8d [5] b9 [4] f3 a6 0f 8?} \r\n condition: \r\n ((uint32(0) == 0x464c457f) and (uint8(4) == 1)) and all of them \r\n}",
"pattern_type": "yara",
"valid_from": "2021-04-21T08:56:27Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "misc"
}
],
"labels": [
"misp:name=\"yara\"",
"misp:meta-category=\"misc\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--95be007c-e7a2-45a6-a1ff-d0f334e662da",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:56:57.000Z",
"modified": "2021-04-21T08:56:57.000Z",
"pattern": "rule FE_APT_Backdoor_Linux32_SLOWPULSE_2\r\n{ \r\n meta: \r\n author = \\\\\"Strozfriedberg\\\\\" \r\n date_created = \\\\\"2021-04-16\\\\\"\r\n sha256 = \\\\\"cd09ec795a8f4b6ced003500a44d810f49943514e2f92c81ab96c33e1c0fbd68\\\\\"\r\n reference_url = \\\\\"https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html\\\\\" \r\n strings: \r\n $sig = /[\\\\x20-\\\\x7F]{16}([\\\\x20-\\\\x7F\\\\x00]+)\\\\x00.{1,32}\\\\xE9.{3}\\\\xFF\\\\x00+[\\\\x20-\\\\x7F][\\\\x20-\\\\x7F\\\\x00]{16}/ \r\n\r\n // TOI_MAGIC_STRING \r\n $exc1 = /\\\\xED\\\\xC3\\\\x02\\\\xE9\\\\x98\\\\x56\\\\xE5\\\\x0C/ \r\n condition:\r\n uint32(0) == 0x464C457F and (1 of ($sig*)) and (not (1 of ($exc*)))\r\n}",
"pattern_type": "yara",
"valid_from": "2021-04-21T08:56:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "misc"
}
],
"labels": [
"misp:name=\"yara\"",
"misp:meta-category=\"misc\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--40e78b71-1425-4450-aa39-08ecaa30f0df",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:57:27.000Z",
"modified": "2021-04-21T08:57:27.000Z",
"pattern": "// Copyright 2021 by FireEye, Inc.\r\n// You may not use this file except in compliance with the license. The license should have been received with this file.\r\n\r\nrule FE_APT_Webshell_PL_STEADYPULSE_1\r\n{ \r\n meta: \r\n author = \\\\\"Mandiant\\\\\" \r\n date_created = \\\\\"2021-04-16\\\\\" \r\n sha256 = \\\\\"168976797d5af7071df257e91fcc31ce1d6e59c72ca9e2f50c8b5b3177ad83cc\\\\\"\r\n reference_url = \\\\\"https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html\\\\\" \r\n strings: \r\n $s1 = \\\\\"parse_parameters\\\\\" \r\n $s2 = \\\\\"s/\\\\\\\\+/ /g\\\\\" \r\n $s3 = \\\\\"s/\\\\%(..)/pack(\\\\\" \r\n $s4 = \\\\\"MIME::Base64::encode($\\\\\" \r\n $s5 = \\\\\"$|=1;\\\\\" \r\n $s6 = \\\\\"RC4(\\\\\" \r\n $s7 = \\\\\"$FORM{\\'cmd\\'}\\\\\" \r\n condition: \r\n all of them \r\n}",
"pattern_type": "yara",
"valid_from": "2021-04-21T08:57:27Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "misc"
}
],
"labels": [
"misp:name=\"yara\"",
"misp:meta-category=\"misc\"",
"misp:to_ids=\"True\""
]
},
chg: [export] updated
2023-05-19 09:05:37 +00:00
{
"type": "note",
"spec_version": "2.1",
"id": "note--82e160db-f47a-433c-865a-fb667f3cff29",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2021-04-21T08:10:03.000Z",
"modified": "2021-04-21T08:10:03.000Z",
"abstract": "Report from - https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html (1618992558)",
"content": "# Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day\r\n\r\n April 20, 2021 | by Dan Perez, Sarah Jones, Greg Wood, Stephen Eckels vulnerabilities \r\n Malware \r\n TTPs \r\n persistence \r\n bypass \r\n \r\n #### Executive Summary\r\n\r\n \r\n * Mandiant recently responded to multiple security incidents involving compromises of Pulse Secure VPN appliances.\r\n * This blog post examines multiple, related techniques for bypassing single and multifactor authentication on Pulse Secure VPN devices, persisting across upgrades, and maintaining access through webshells.\r\n * The investigation by Pulse Secure has determined that a combination of prior vulnerabilities and a previously unknown vulnerability discovered in April 2021, CVE-2021-22893, are responsible for the initial infection vector.\r\n * Pulse Secure\u2019s parent company, Ivanti, released mitigations for a vulnerability exploited in relation to these malware families and the Pulse Connect Secure Integrity Tool for their customers to determine if their systems are impacted. A final patch to address the vulnerability will be available in early May 2021.\r\n * Pulse Secure has been working closely with Mandiant, affected customers, government partners, and other forensic experts to address these issues.\r\n * There is no indication the identified backdoors were introduced through a supply chain compromise of the company\u2019s network or software deployment process.\r\n \r\n #### Introduction\r\n\r\n Mandiant is currently tracking 12 malware families associated with the exploitation of Pulse Secure VPN devices. These families are related to the circumvention of authentication and backdoor access to these devices, but they are not necessarily related to each other and have been observed in separate investigations. It is likely that multiple actors are responsible for the creation and deployment of these various code families.\r\n\r\n The focus of this report is on the activities of UNC2630 against U.S. Defense Industrial base (DIB) networks, but detailed malware analysis and detection methods for all samples observed at U.S. and European victim organizations are provided in the technical annex to assist network defenders in identifying a large range of malicious activity on affected appliances. Analysis is ongoing to determine the extent of the activity.\r\n\r\n Mandiant continues to collaborate with the Ivanti and Pulse Secure teams, Microsoft Threat Intelligence Center (MSTIC), and relevant government and law enforcement agencies to investigate the threat, as well as develop recommendations and mitigations for affected Pulse Secure VPN appliance owners.\r\n\r\n As part of their investigation, Ivanti has released mitigations for a vulnerability exploited in relation to this campaign as well as the Pulse Connect Secure Integrity Tool to assist with determining if systems have been impacted.\r\n\r\n #### Details\r\n\r\n Early this year, Mandiant investigated multiple intrusions at defense, government, and financial organizations around the world. In each intrusion, the earliest evidence of attacker activity traced back to DHCP IP address ranges belonging to Pulse Secure VPN appliances in the affected environment.\r\n\r\n In many cases, we were not able to determine how actors obtained administrator-level access to the appliances. However, based on analysis by Ivanti, we suspect some intrusions were due to the exploitation of previously disclosed Pulse Secure vulnerabilities from 2019 and 2020 while other intrusions were due to the exploitation of CVE-2021-22893.\r\n\r\n We observed UNC2630 harvesting credentials from various Pulse Secure VPN login flows, which ultimately allowed the actor to use legitimate account credentials to move laterally into the affected environments. In order to maintain persistence to the compromised networks, the actor utilized legitimate, but modified, Pulse Secure binaries and scripts on the VPN appliance. This was done to accomplish the foll
"object_refs": [
"report--b7f8805b-fec8-4491-b866-83a457212437"
]
},
chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue Copy permalink