From e93e7f67d4f70177c3ab5a34e8cc5b24fa2dde6d Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 31 Aug 2026 07:56:38 -0400 Subject: add: bph report iocs --- kevlar/2026-08-31/honeylabs/events-AS138915.ndjson | 1 + 1 file changed, 1 insertion(+) create mode 100644 kevlar/2026-08-31/honeylabs/events-AS138915.ndjson (limited to 'kevlar/2026-08-31/honeylabs/events-AS138915.ndjson') diff --git a/kevlar/2026-08-31/honeylabs/events-AS138915.ndjson b/kevlar/2026-08-31/honeylabs/events-AS138915.ndjson new file mode 100644 index 0000000..a22aeb5 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS138915.ndjson @@ -0,0 +1 @@ +{"timestamp": "2026-08-27T07:59:32", "event_id": "dbbe5212-e3ec-4649-a753-7e8ad3b2bfd6", "source_ip": "154.90.37.55", "source_port": 55537, "source_domain": "", "country_code": "PH", "country_name": "Philippines", "city_name": "Manila", "asn_number": 138915, "asn_org": "Kaopu Cloud HK Limited", "dest_port": 5986, "network_protocol": "tls", "application_protocol": "http", "http_method": "POST", "user_agent": "Microsoft WinRM Client", "url_path": "/wsman?PSVersion=5.1.19041.1", "url_domain": "", "http_request_headers": "{\"authorization\":\"Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\",\"content-length\":\"0\",\"host\":\":5986\",\"user-agent\":\"Microsoft WinRM Client\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i220900_231e334592e8_29829a46703f", "tls_client_ja3": "622a7fd6adbafa3736c1a3468db8a8e0", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "po11nn0400_52fce913cf3b", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 211, "dest_bytes": 77, "network_bytes": 288, "event_summary": ""} -- cgit v1.2.3