diff options
| author | hrbrmstr <bob@rud.is> | 2026-07-27 07:51:00 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-07-27 07:51:00 -0400 |
| commit | 4c5956acd240953aec538d8a25e2724a608ce9be (patch) | |
| tree | 148d1de8c95f369a48a7290302bfb791e5344918 /kevlar/2026-07-27/iocs/c2-paths.txt | |
| parent | 805ce54d6b181cdaab453e7e50cfac14cc371b6a (diff) | |
chore: weekly BPH update
Diffstat (limited to 'kevlar/2026-07-27/iocs/c2-paths.txt')
| -rw-r--r-- | kevlar/2026-07-27/iocs/c2-paths.txt | 25 |
1 files changed, 25 insertions, 0 deletions
diff --git a/kevlar/2026-07-27/iocs/c2-paths.txt b/kevlar/2026-07-27/iocs/c2-paths.txt new file mode 100644 index 0000000..f95bece --- /dev/null +++ b/kevlar/2026-07-27/iocs/c2-paths.txt @@ -0,0 +1,25 @@ +# Notable HTTP URL Paths Observed (Honeylabs) + +# VPN/Remote Access Portal Probing +/dana-na/auth/url_default/welcome.cgi -- Pulse Secure VPN (AEZA, 138.124.51.186) +/sslvpnLogin.html -- SSL VPN portal (AEZA, 138.124.51.186) +/global-protect/login.esp -- Palo Alto GlobalProtect (AEZA, 138.124.51.186) +/remote/login -- Remote access portal (AEZA, 138.124.51.186) +/+CSCOE+/logon.html -- Cisco VPN (AEZA, 138.124.51.186) +/RDWeb/Pages/ -- Microsoft RD Web Access (AEZA, 138.124.51.186) + +# General Login Probing +/login -- Generic login page (AEZA) +/Login/Login -- Generic login page variant (AEZA) +/cgi/login -- CGI login (AEZA) +/my.policy -- Policy page probe (AEZA) + +# Remote Desktop / Guacamole +/guacamole/ -- Apache Guacamole (AEZA, 138.124.51.186) + +# WinRM +/wsman?PSVersion=5.1.19041.1 -- WinRM probing (KAOPU-HK, 154.90.37.55) + +# 3x-ui Proxy Panel +/assets/login-J3fs_cbU.js -- 3x-ui panel assets (AEZA, 138.124.51.186:2053) +/assets/vendor-antd-B5BXDqMa.css -- 3x-ui UI framework (AEZA) |