diff options
Diffstat (limited to 'kevlar/2026-08-17/iocs/c2-paths.txt')
| -rw-r--r-- | kevlar/2026-08-17/iocs/c2-paths.txt | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/kevlar/2026-08-17/iocs/c2-paths.txt b/kevlar/2026-08-17/iocs/c2-paths.txt new file mode 100644 index 0000000..65c2a54 --- /dev/null +++ b/kevlar/2026-08-17/iocs/c2-paths.txt @@ -0,0 +1,11 @@ +/api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows -- SPARK C2 beacon POST, 185.100.87.136 FLOKINET, 1 hit this week +/eventmanager -- SPARK C2 channel, 185.100.87.136 +/ajax -- SPARK C2 polling, 185.100.87.136 +/api/v1/update -- SPARK C2 update check, 185.100.87.136 +/FD873AC4-CF86-4FED-84EC-4BD59C6F17A7 -- SPARK agent UUID path, 185.100.87.136 +/images/transparentpix.gif -- beaconing pixel, 185.100.87.136 +/.env -- env file exfil, 77.83.39.6 KPRONET/PFCLOUD, 25+ hits high-confidence malicious +/.git/HEAD -- git metadata exfil, 77.83.39.94 +/wsman -- WinRM brute POST, 154.93.53.239 KAOPU + 179.43.185.147 PLI +/api/trpc/setup.setup -- tRPC setup probe, 179.43.150.26 PLI +/version -- Docker API probe, 179.43.175.56 PLI |