diff options
Diffstat (limited to 'kevlar/2026-08-02/iocs/c2-paths.txt')
| -rw-r--r-- | kevlar/2026-08-02/iocs/c2-paths.txt | 37 |
1 files changed, 22 insertions, 15 deletions
diff --git a/kevlar/2026-08-02/iocs/c2-paths.txt b/kevlar/2026-08-02/iocs/c2-paths.txt index 2b9aae3..0432430 100644 --- a/kevlar/2026-08-02/iocs/c2-paths.txt +++ b/kevlar/2026-08-02/iocs/c2-paths.txt @@ -1,15 +1,22 @@ -# HTTP URL Paths Observed (from prior week Honeylabs data) - -/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- PHPUnit RCE probe -/dana-na/auth/url_default/welcome.cgi -- Pulse Secure VPN enumeration -/global-protect/login.esp -- Palo Alto GlobalProtect enumeration -/sslvpnLogin.html -- SSL VPN portal enumeration -/guacamole/ -- Apache Guacamole RDP gateway probing -/remote/login -- Generic remote access login probe -/auth/login -- Authentication endpoint probing -/login -- Login page enumeration - -# Note: No URL paths were observed in Honeylabs events from monitored ASNs -# this week. All non-PFCLOUD ASNs registered zero honeypot events. -# PFCLOUD Honeylabs events were proxy-checking (HTTP CONNECT tunnels, SOCKS5) -# rather than HTTP path-based exploitation. +# C2 and Exploitation Paths Observed + +# PLI-AS (AS51852) +/api/trpc/setup.setup -- tRPC setup endpoint targeting, POST with JSON body, port 3000 +/wp-login.php -- WordPress credential enumeration, TLS, Go-http-client/1.1 + +# HOSTKEY (AS57043) +/ISAPI/Streaming/channels/10101 -- Hikvision camera streaming, RTSP DESCRIBE, Basic auth credential stuffing +/Streaming/Channels/10201 -- Hikvision camera streaming (alternate path) + +# KPRONET (AS214940) +/.git/HEAD -- Git repository discovery, secret harvesting +/.git/index -- Git index file enumeration +/.git/config -- Git remote configuration extraction +/.env -- Environment file exfiltration (database creds, API keys, secrets) + +# From prior week, still relevant: +/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- PHPUnit RCE +/dana-na/auth/url_default/welcome.cgi -- Pulse Secure VPN +/global-protect/login.esp -- Palo Alto GlobalProtect +/sslvpnLogin.html -- SSL VPN portal enumeration +/guacamole/ -- Apache Guacamole RDP gateway probing |