diff options
| author | hrbrmstr <bob@rud.is> | 2026-08-03 06:52:30 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-08-03 06:52:30 -0400 |
| commit | 89a294a0e93277e5f27fc96710f638a5ac85ab35 (patch) | |
| tree | 92a53bcae9c10f02877e60e9a6393d9f4ae167c3 /kevlar/2026-08-02/iocs/c2-paths.txt | |
| parent | 4c5956acd240953aec538d8a25e2724a608ce9be (diff) | |
chore: weekly BPH update
Diffstat (limited to 'kevlar/2026-08-02/iocs/c2-paths.txt')
| -rw-r--r-- | kevlar/2026-08-02/iocs/c2-paths.txt | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/kevlar/2026-08-02/iocs/c2-paths.txt b/kevlar/2026-08-02/iocs/c2-paths.txt new file mode 100644 index 0000000..2b9aae3 --- /dev/null +++ b/kevlar/2026-08-02/iocs/c2-paths.txt @@ -0,0 +1,15 @@ +# HTTP URL Paths Observed (from prior week Honeylabs data) + +/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- PHPUnit RCE probe +/dana-na/auth/url_default/welcome.cgi -- Pulse Secure VPN enumeration +/global-protect/login.esp -- Palo Alto GlobalProtect enumeration +/sslvpnLogin.html -- SSL VPN portal enumeration +/guacamole/ -- Apache Guacamole RDP gateway probing +/remote/login -- Generic remote access login probe +/auth/login -- Authentication endpoint probing +/login -- Login page enumeration + +# Note: No URL paths were observed in Honeylabs events from monitored ASNs +# this week. All non-PFCLOUD ASNs registered zero honeypot events. +# PFCLOUD Honeylabs events were proxy-checking (HTTP CONNECT tunnels, SOCKS5) +# rather than HTTP path-based exploitation. |