diff options
Diffstat (limited to 'kevlar/2026-07-27/iocs/c2-paths.txt')
| -rw-r--r-- | kevlar/2026-07-27/iocs/c2-paths.txt | 25 |
1 files changed, 25 insertions, 0 deletions
diff --git a/kevlar/2026-07-27/iocs/c2-paths.txt b/kevlar/2026-07-27/iocs/c2-paths.txt new file mode 100644 index 0000000..f95bece --- /dev/null +++ b/kevlar/2026-07-27/iocs/c2-paths.txt @@ -0,0 +1,25 @@ +# Notable HTTP URL Paths Observed (Honeylabs) + +# VPN/Remote Access Portal Probing +/dana-na/auth/url_default/welcome.cgi -- Pulse Secure VPN (AEZA, 138.124.51.186) +/sslvpnLogin.html -- SSL VPN portal (AEZA, 138.124.51.186) +/global-protect/login.esp -- Palo Alto GlobalProtect (AEZA, 138.124.51.186) +/remote/login -- Remote access portal (AEZA, 138.124.51.186) +/+CSCOE+/logon.html -- Cisco VPN (AEZA, 138.124.51.186) +/RDWeb/Pages/ -- Microsoft RD Web Access (AEZA, 138.124.51.186) + +# General Login Probing +/login -- Generic login page (AEZA) +/Login/Login -- Generic login page variant (AEZA) +/cgi/login -- CGI login (AEZA) +/my.policy -- Policy page probe (AEZA) + +# Remote Desktop / Guacamole +/guacamole/ -- Apache Guacamole (AEZA, 138.124.51.186) + +# WinRM +/wsman?PSVersion=5.1.19041.1 -- WinRM probing (KAOPU-HK, 154.90.37.55) + +# 3x-ui Proxy Panel +/assets/login-J3fs_cbU.js -- 3x-ui panel assets (AEZA, 138.124.51.186:2053) +/assets/vendor-antd-B5BXDqMa.css -- 3x-ui UI framework (AEZA) |