diff options
| author | hrbrmstr <bob@rud.is> | 2026-08-31 07:56:38 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-08-31 07:56:38 -0400 |
| commit | e93e7f67d4f70177c3ab5a34e8cc5b24fa2dde6d (patch) | |
| tree | e02486c0af8f5f8bf64600f0a1a2b4904c4c123a /kevlar/2026-08-31/iocs/c2-paths.txt | |
| parent | 1d9b78adfc083d1120c55e403e6b3d6317a1171f (diff) | |
add: bph report iocs
Diffstat (limited to 'kevlar/2026-08-31/iocs/c2-paths.txt')
| -rw-r--r-- | kevlar/2026-08-31/iocs/c2-paths.txt | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/kevlar/2026-08-31/iocs/c2-paths.txt b/kevlar/2026-08-31/iocs/c2-paths.txt new file mode 100644 index 0000000..8503a7b --- /dev/null +++ b/kevlar/2026-08-31/iocs/c2-paths.txt @@ -0,0 +1,24 @@ +# Notable paths, 2026-08-24 to 2026-08-31 + +/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- PHPUnit RCE swarm, 3 days, fleet-wide; NightAgent POST variant carries <?php echo "NightAgent";?> +/v2/_catalog -- Docker Registry catalog enumeration (registry-hunt campaign) +/v2/internal/api-gateway/tags/list -- internal registry enumeration (registry-hunt) +/v2/internal/api-gateway/manifests/latest -- internal registry enumeration (registry-hunt) +/v2/internal/auth-service/tags/list -- internal registry enumeration (registry-hunt) +/console/ -- WebLogic console login probe (registry-hunt journey step) +/login.action -- Confluence login probe (registry-hunt journey step) +/___proxy_subdomain_whm/login, /___proxy_subdomain_cpanel -- WHM/cPanel proxy-subdomain probes +/xmlrpc.php -- 8,146 POST brute in 31 minutes (34.63.40.186, GCP) +/wp-json/batch/v1 -- WordPress batch abuse; forged X-Forwarded-For: 127.0.0.1 on all requests; SQLi multiplex variant carries UNION SELECT with CONCAT(0x7c7c, HEX(...), 0x7c7c) +/fetch, /proxy -- SSRF proxy discovery (metadata-hunt campaign) +/.mcp.json -- MCP endpoint discovery probe +/@fs/etc/passwd, /@fs/proc/self/environ -- Vite dev-server traversal probes +/global-protect/login.esp -- Palo Alto GlobalProtect login brute (176.120.22.43) +/+CSCOE+/logon.html -- Cisco ASA clientless VPN login probe (176.120.22.43) +/api/checkin -- beacon checkin (FLOKINET 185.100.87.136) +/eventmanager -- beacon poll (FLOKINET 185.100.87.136) +/api/client/update?arch=amd64&commit=08059e95dacaf -- beacon update pull (FLOKINET 185.100.87.136) +/v1/getinfo -- high-port agent info request (AEZA 147.45.71.214) +http://azenv.net/ -- proxy validation target (PFCLOUD 204.76.203.7) +/1.bat, /0x83911d24Fx.sh, /.tygahhh/ENCRYPTED.ps1 -- malware dropper dictionary samples (169.150.201.29) +/.env, /.aws/credentials, /.azure/credentials, /tfstate, /firebase.json -- credential harvest sweep paths (CREDSWEEP) |