diff options
| author | hrbrmstr <bob@rud.is> | 2026-08-31 07:56:38 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-08-31 07:56:38 -0400 |
| commit | e93e7f67d4f70177c3ab5a34e8cc5b24fa2dde6d (patch) | |
| tree | e02486c0af8f5f8bf64600f0a1a2b4904c4c123a /kevlar/2026-08-31/honeylabs/events-AS138915.ndjson | |
| parent | 1d9b78adfc083d1120c55e403e6b3d6317a1171f (diff) | |
add: bph report iocs
Diffstat (limited to 'kevlar/2026-08-31/honeylabs/events-AS138915.ndjson')
| -rw-r--r-- | kevlar/2026-08-31/honeylabs/events-AS138915.ndjson | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/kevlar/2026-08-31/honeylabs/events-AS138915.ndjson b/kevlar/2026-08-31/honeylabs/events-AS138915.ndjson new file mode 100644 index 0000000..a22aeb5 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS138915.ndjson @@ -0,0 +1 @@ +{"timestamp": "2026-08-27T07:59:32", "event_id": "dbbe5212-e3ec-4649-a753-7e8ad3b2bfd6", "source_ip": "154.90.37.55", "source_port": 55537, "source_domain": "", "country_code": "PH", "country_name": "Philippines", "city_name": "Manila", "asn_number": 138915, "asn_org": "Kaopu Cloud HK Limited", "dest_port": 5986, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Microsoft WinRM Client", "url_path": "/wsman?PSVersion=5.1.19041.1", "url_domain": "<HONEYPOT>", "http_request_headers": "{\"authorization\":\"Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\",\"content-length\":\"0\",\"host\":\"<HONEYPOT>:5986\",\"user-agent\":\"Microsoft WinRM Client\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i220900_231e334592e8_29829a46703f", "tls_client_ja3": "622a7fd6adbafa3736c1a3468db8a8e0", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "po11nn0400_52fce913cf3b", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 211, "dest_bytes": 77, "network_bytes": 288, "event_summary": ""} |