{ "type": "Domain", "indicator": "cdn-class.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/cdn-class.com", "alexa": "http://www.alexa.com/siteinfo/cdn-class.com", "indicator": "cdn-class.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3296464579, "indicator": "cdn-class.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 30, "pulses": [ { "id": "61f6e8bac08da4c283764e49", "name": "CobaltStrikeC2s_1643571332", "description": "", "modified": "2022-03-01T19:00:48.308000", "created": "2022-01-30T19:36:26.291000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 45, "domain": 9 }, "indicator_count": 54, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1555 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61f59856d90a749b0a13eca8", "name": "CobaltStrikeC2s_1643485217", "description": "", "modified": "2022-02-28T19:05:48.724000", "created": "2022-01-29T19:41:10.914000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 47, "domain": 9 }, "indicator_count": 56, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1556 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61f446c898f91bf0a0119361", "name": "CobaltStrikeC2s_1643398803", "description": "", "modified": "2022-02-27T19:03:36.784000", "created": "2022-01-28T19:40:56.838000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 9, "hostname": 44 }, "indicator_count": 53, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1557 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61f2f598100dae823d1b37e6", "name": "CobaltStrikeC2s_1643312482", "description": "", "modified": "2022-02-26T19:02:33.860000", "created": "2022-01-27T19:42:16.612000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 43, "domain": 10 }, "indicator_count": 53, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1558 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61f1a2da72e525de21152bdd", "name": "CobaltStrikeC2s_1643225764", "description": "", "modified": "2022-02-25T19:04:39.986000", "created": "2022-01-26T19:36:58.816000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 9, "hostname": 39 }, "indicator_count": 48, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1559 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61f05201053de9e4e47a3a46", "name": "CobaltStrikeC2s_1643139531", "description": "", "modified": "2022-02-24T19:05:19.407000", "created": "2022-01-25T19:39:45.667000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 38, "domain": 10 }, "indicator_count": 48, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1560 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61eef7feb4a5d44d542cc870", "name": "CobaltStrikeC2s_1643050953", "description": "", "modified": "2022-02-23T19:00:53.018000", "created": "2022-01-24T19:03:26.940000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 33, "domain": 6 }, "indicator_count": 39, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1561 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61eec72673941be2571f115c", "name": "Cobalt Strike C2 | 01/17/2022", "description": "IronNet Threat Analysts scan the web searching for hosts that are serving Cobalt Strike beacons. We then pull them down and extract the beacon config for analysis. The IPs and domains in this pulse are the C2 hosts extracted from those configs. These servers were scanned the week of 01/17/2022.", "modified": "2022-02-23T00:00:33.803000", "created": "2022-01-24T15:35:02.218000", "tags": [ "Cobalt Strike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Cobalt Strike - S0154", "display_name": "Cobalt Strike - S0154", "target": null } ], "attack_ids": [ { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IronNetTR", "id": "135317", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_135317/resized/80/avatar_3be4d4773d.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 231, "modified_text": "1561 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "61edaf0126340e2671df2b49", "name": "CobaltStrikeC2s_1642966732", "description": "", "modified": "2022-02-22T19:01:47.823000", "created": "2022-01-23T19:39:45.850000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 38, "domain": 8 }, "indicator_count": 46, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1562 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61ec5d9adc8f75a821ce23f0", "name": "CobaltStrikeC2s_1642880356", "description": "", "modified": "2022-02-21T19:00:41.429000", "created": "2022-01-22T19:40:10.685000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 39, "domain": 8 }, "indicator_count": 47, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1563 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61eb0bd8cac7e80955172ad4", "name": "CobaltStrikeC2s_1642793891", "description": "", "modified": "2022-02-20T19:04:12.908000", "created": "2022-01-21T19:39:04.203000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 41, "domain": 9 }, "indicator_count": 50, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1564 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61e9b3a2fcfab9f13d3258a5", "name": "CobaltStrikeC2s_1642705772", "description": "", "modified": "2022-02-19T19:03:00.816000", "created": "2022-01-20T19:10:26.050000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 41, "domain": 5 }, "indicator_count": 46, "is_author": false, "is_subscribing": null, "subscriber_count": 253, "modified_text": "1565 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61e8667b17568f5785da521f", "name": "CobaltStrikeC2s_1642620485", "description": "", "modified": "2022-02-18T19:02:45.688000", "created": "2022-01-19T19:28:59.313000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 9, "hostname": 46 }, "indicator_count": 55, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1566 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61e718860d99ceaf6fade8da", "name": "CobaltStrikeC2s_1642534992", "description": "", "modified": "2022-02-17T19:00:09.566000", "created": "2022-01-18T19:44:06.483000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 45, "domain": 11 }, "indicator_count": 56, "is_author": false, "is_subscribing": null, "subscriber_count": 253, "modified_text": "1567 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61e71d75941cd5bba22e09ca", "name": "Cobalt Strike C2 | 01/10/2022", "description": "IronNet Threat Analysts scan the web searching for hosts that are serving Cobalt Strike beacons. We then pull them down and extract the beacon config for analysis. The IPs and domains in this pulse are the C2 hosts extracted from those configs. These servers were scanned the week of 01/10/2022.", "modified": "2022-02-17T00:02:58.585000", "created": "2022-01-18T20:05:09.146000", "tags": [ "Cobalt Strike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Cobalt Strike - S0154", "display_name": "Cobalt Strike - S0154", "target": null } ], "attack_ids": [ { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IronNetTR", "id": "135317", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_135317/resized/80/avatar_3be4d4773d.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 233, "modified_text": "1567 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "61e4742dded8b4e2a8933260", "name": "CobaltStrikeC2s_1642361848", "description": "", "modified": "2022-02-15T19:03:26.735000", "created": "2022-01-16T19:38:21.793000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 48, "domain": 8 }, "indicator_count": 56, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1569 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61e322f44241adc318810230", "name": "CobaltStrikeC2s_1642275519", "description": "", "modified": "2022-02-14T19:00:58.212000", "created": "2022-01-15T19:39:32.676000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 48, "domain": 8 }, "indicator_count": 56, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1570 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61e1d222a3c1f1c375fab6a4", "name": "CobaltStrikeC2s_1642189279", "description": "", "modified": "2022-02-13T19:03:05.784000", "created": "2022-01-14T19:42:26.716000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 45, "domain": 7 }, "indicator_count": 52, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1571 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61e08010f1ecce93407a6fc5", "name": "CobaltStrikeC2s_1642102731", "description": "", "modified": "2022-02-12T19:01:41.071000", "created": "2022-01-13T19:40:00.025000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 9, "hostname": 46 }, "indicator_count": 55, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1572 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61df3002aa8690918d4bbb99", "name": "CobaltStrikeC2s_1642016702", "description": "", "modified": "2022-02-11T19:00:07.264000", "created": "2022-01-12T19:46:10.502000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 48, "domain": 10 }, "indicator_count": 58, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1573 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61ddde3660bcf1f0741eb141", "name": "CobaltStrikeC2s_1641930241", "description": "", "modified": "2022-02-10T19:02:44.351000", "created": "2022-01-11T19:44:54.942000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 45, "domain": 11 }, "indicator_count": 56, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1574 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61ddaf0cb0cf4a1c8b0234f0", "name": "threatfox", "description": "This is the full text of the report on the cyber-attack on Hario Menkel, which took place on 22 January 2016:. and here is a full summary of all the key points.", "modified": "2022-02-10T00:05:02.163000", "created": "2022-01-11T16:23:40.790000", "tags": [ "virusdeck", "raccoon", "mirai mirai", "lokibot", "loki password", "stealer", "bashlite gafgyt", "ave maria", "cobalt strike", "njrat", "loki", "formbook", "agent tesla", "cobaltstrike", "redline stealer", "redlinestealer", "nanocore rat", "date", "cryptolaemus1", "emotet", "emotet epoch4", "emotet doc", "asyncrat", "smokeloader", "hariomenkel", "ioc malware", "tags reporter" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ElastZris", "id": "176027", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 10, "FileHash-SHA1": 7, "FileHash-SHA256": 167, "URL": 115, "domain": 11, "hostname": 9 }, "indicator_count": 319, "is_author": false, "is_subscribing": null, "subscriber_count": 57, "modified_text": "1574 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61dc8e5ca7db40d9111a1e3d", "name": "CobaltStrikeC2s_1641844263", "description": "", "modified": "2022-02-09T19:02:18.710000", "created": "2022-01-10T19:51:56.886000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 11, "hostname": 53 }, "indicator_count": 64, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1575 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61dc605bbd2de210b53d185d", "name": "Cobalt Strike C2 | 01/03/2022", "description": "IronNet Threat Analysts scan the web searching for hosts that are serving Cobalt Strike beacons. We then pull them down and extract the beacon config for analysis. The IPs and domains in this pulse are the C2 hosts extracted from those configs. These servers were scanned the week of 01/03/2022.", "modified": "2022-02-09T00:00:38.760000", "created": "2022-01-10T16:35:39.805000", "tags": [ "Cobalt Strike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Cobalt Strike - S0154", "display_name": "Cobalt Strike - S0154", "target": null } ], "attack_ids": [ { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IronNetTR", "id": "135317", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_135317/resized/80/avatar_3be4d4773d.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 231, "modified_text": "1575 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "61d5f5e47db7e5904ff67964", "name": "CobaltStrikeC2s_1641412015", "description": "", "modified": "2022-02-04T19:02:13.305000", "created": "2022-01-05T19:47:48.924000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 56, "domain": 11 }, "indicator_count": 67, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1580 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61d4a29f04173e0a871a4641", "name": "CobaltStrikeC2s_1641325161", "description": "", "modified": "2022-02-03T19:01:49.793000", "created": "2022-01-04T19:40:15.102000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 57, "domain": 12 }, "indicator_count": 69, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1581 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61d3546329c34763e179d14d", "name": "CobaltStrikeC2s_1641239598", "description": "", "modified": "2022-02-02T19:01:33.809000", "created": "2022-01-03T19:54:11.649000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 12, "hostname": 55 }, "indicator_count": 67, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1582 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61d3701c2834a8500c90afb3", "name": "Cobalt Strike C2 | 12/27/2021", "description": "IronNet Threat Analysts scan the web searching for hosts that are serving Cobalt Strike beacons. We then pull them down and extract the beacon config for analysis. The IPs and domains in this pulse are the C2 hosts extracted from those configs. These servers were scanned the week of 12/27/2021.", "modified": "2022-02-02T00:03:19.965000", "created": "2022-01-03T21:52:28.345000", "tags": [ "Cobalt Strike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Cobalt Strike - S0154", "display_name": "Cobalt Strike - S0154", "target": null } ], "attack_ids": [ { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IronNetTR", "id": "135317", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_135317/resized/80/avatar_3be4d4773d.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 231, "modified_text": "1582 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "61d20269b8918fa2c9646150", "name": "CobaltStrikeC2s_1641153075", "description": "", "modified": "2022-02-01T19:00:25.896000", "created": "2022-01-02T19:52:09.062000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 56, "domain": 14 }, "indicator_count": 70, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1583 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61d0b096095968523cf75751", "name": "CobaltStrikeC2s_1641066592", "description": "", "modified": "2022-01-31T19:01:23.667000", "created": "2022-01-01T19:50:46.172000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 14, "hostname": 56 }, "indicator_count": 70, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1584 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Cobalt strike - s0154" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 30, "pulses": [ { "id": "61f6e8bac08da4c283764e49", "name": "CobaltStrikeC2s_1643571332", "description": "", "modified": "2022-03-01T19:00:48.308000", "created": "2022-01-30T19:36:26.291000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 45, "domain": 9 }, "indicator_count": 54, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1555 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61f59856d90a749b0a13eca8", "name": "CobaltStrikeC2s_1643485217", "description": "", "modified": "2022-02-28T19:05:48.724000", "created": "2022-01-29T19:41:10.914000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 47, "domain": 9 }, "indicator_count": 56, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1556 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61f446c898f91bf0a0119361", "name": "CobaltStrikeC2s_1643398803", "description": "", "modified": "2022-02-27T19:03:36.784000", "created": "2022-01-28T19:40:56.838000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 9, "hostname": 44 }, "indicator_count": 53, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1557 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61f2f598100dae823d1b37e6", "name": "CobaltStrikeC2s_1643312482", "description": "", "modified": "2022-02-26T19:02:33.860000", "created": "2022-01-27T19:42:16.612000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 43, "domain": 10 }, "indicator_count": 53, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1558 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61f1a2da72e525de21152bdd", "name": "CobaltStrikeC2s_1643225764", "description": "", "modified": "2022-02-25T19:04:39.986000", "created": "2022-01-26T19:36:58.816000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 9, "hostname": 39 }, "indicator_count": 48, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1559 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61f05201053de9e4e47a3a46", "name": "CobaltStrikeC2s_1643139531", "description": "", "modified": "2022-02-24T19:05:19.407000", "created": "2022-01-25T19:39:45.667000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 38, "domain": 10 }, "indicator_count": 48, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1560 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61eef7feb4a5d44d542cc870", "name": "CobaltStrikeC2s_1643050953", "description": "", "modified": "2022-02-23T19:00:53.018000", "created": "2022-01-24T19:03:26.940000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 33, "domain": 6 }, "indicator_count": 39, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1561 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61eec72673941be2571f115c", "name": "Cobalt Strike C2 | 01/17/2022", "description": "IronNet Threat Analysts scan the web searching for hosts that are serving Cobalt Strike beacons. We then pull them down and extract the beacon config for analysis. The IPs and domains in this pulse are the C2 hosts extracted from those configs. These servers were scanned the week of 01/17/2022.", "modified": "2022-02-23T00:00:33.803000", "created": "2022-01-24T15:35:02.218000", "tags": [ "Cobalt Strike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Cobalt Strike - S0154", "display_name": "Cobalt Strike - S0154", "target": null } ], "attack_ids": [ { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IronNetTR", "id": "135317", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_135317/resized/80/avatar_3be4d4773d.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 231, "modified_text": "1561 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "61edaf0126340e2671df2b49", "name": "CobaltStrikeC2s_1642966732", "description": "", "modified": "2022-02-22T19:01:47.823000", "created": "2022-01-23T19:39:45.850000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 38, "domain": 8 }, "indicator_count": 46, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1562 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61ec5d9adc8f75a821ce23f0", "name": "CobaltStrikeC2s_1642880356", "description": "", "modified": "2022-02-21T19:00:41.429000", "created": "2022-01-22T19:40:10.685000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 39, "domain": 8 }, "indicator_count": 47, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1563 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "cdn-class.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "cdn-class.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780529769.7835705 }