From 4c5956acd240953aec538d8a25e2724a608ce9be Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 27 Jul 2026 07:51:00 -0400 Subject: chore: weekly BPH update --- kevlar/2026-07-27/iocs/c2-paths.txt | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 kevlar/2026-07-27/iocs/c2-paths.txt (limited to 'kevlar/2026-07-27/iocs/c2-paths.txt') diff --git a/kevlar/2026-07-27/iocs/c2-paths.txt b/kevlar/2026-07-27/iocs/c2-paths.txt new file mode 100644 index 0000000..f95bece --- /dev/null +++ b/kevlar/2026-07-27/iocs/c2-paths.txt @@ -0,0 +1,25 @@ +# Notable HTTP URL Paths Observed (Honeylabs) + +# VPN/Remote Access Portal Probing +/dana-na/auth/url_default/welcome.cgi -- Pulse Secure VPN (AEZA, 138.124.51.186) +/sslvpnLogin.html -- SSL VPN portal (AEZA, 138.124.51.186) +/global-protect/login.esp -- Palo Alto GlobalProtect (AEZA, 138.124.51.186) +/remote/login -- Remote access portal (AEZA, 138.124.51.186) +/+CSCOE+/logon.html -- Cisco VPN (AEZA, 138.124.51.186) +/RDWeb/Pages/ -- Microsoft RD Web Access (AEZA, 138.124.51.186) + +# General Login Probing +/login -- Generic login page (AEZA) +/Login/Login -- Generic login page variant (AEZA) +/cgi/login -- CGI login (AEZA) +/my.policy -- Policy page probe (AEZA) + +# Remote Desktop / Guacamole +/guacamole/ -- Apache Guacamole (AEZA, 138.124.51.186) + +# WinRM +/wsman?PSVersion=5.1.19041.1 -- WinRM probing (KAOPU-HK, 154.90.37.55) + +# 3x-ui Proxy Panel +/assets/login-J3fs_cbU.js -- 3x-ui panel assets (AEZA, 138.124.51.186:2053) +/assets/vendor-antd-B5BXDqMa.css -- 3x-ui UI framework (AEZA) -- cgit v1.2.3