APT32 Analysis

IOB - Indicator of Behavior (657)

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

Lang

en	537
zh	40
it	39
fr	18
es	7

Country

us	474
cn	106
vn	23
me	14
tr	11

Actors

APT32	16
OceanLotus	9
Cobalt Strike	8
StrikeSuit Gif	5
APT28	4

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

Not Defined	238
Operating System	60
Smartphone Operating System	34
Router Operating System	24
Content Management System	16

Vendor

Not Defined	142
Apple	50
Microsoft	34
Linux	24
Google	24

Product

Linux Kernel	24
Google Android	18
Microsoft Windows	18
Apple macOS	16
Apple iOS	12

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	BD Totalys MultiProcessor hard-coded credentials	8.1	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00044	0.04	CVE-2022-40263
2	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	Calculating	High	Workaround	0.02016	0.00	CVE-2007-1192
3	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.35	CVE-2010-0966
4	Google Chrome V8 Remote Code Execution	6.3	6.0	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.24380	0.02	CVE-2020-16040
5	Watchdog Anti-Virus IoControlCode wsdk-driver.sys 0x80002008 access control	5.3	5.2	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00047	0.03	CVE-2023-1453
6	Apache PDFbox XML Parser xml external entity reference	7.8	7.6	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00091	0.02	CVE-2016-2175
7	Google Android SimpleDecodingSource.cpp doRead privileges management	9.8	9.6	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00120	0.00	CVE-2021-39623
8	D-Link DCS-2530L/DCS-2670L ddns_enc.cgi command injection	7.5	7.5	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00135	0.05	CVE-2020-25079
9	Gempar Script Toko Online shop_display_products.php sql injection	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00100	0.02	CVE-2009-0296
10	Puppet Agent SSL Certificate Valu certificate validation	5.5	5.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00058	0.04	CVE-2018-11751
11	Norton Password Manager origin validation	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00072	0.00	CVE-2019-18381
12	Facebook osquery Configuration extensions.load link following	7.7	7.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00222	0.00	CVE-2019-3567
13	Microsoft Windows HMAC Key Derivation Local Privilege Escalation	8.8	8.1	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.00048	0.00	CVE-2023-36400
14	Microsoft Windows Kernel NtQueryInformationJobObject Kernel Memory information disclosure	5.1	4.6	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00070	0.00	CVE-2017-8478
15	OpenSSH Authentication Username information disclosure	5.3	4.8	$5k-$25k	$0-$5k	High	Official Fix	0.10737	0.12	CVE-2016-6210
16	TP-Link AC1750 NetUSB.ko integer overflow	8.8	8.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00084	0.00	CVE-2022-24354
17	Pallets Werkzeug Windows SharedDataMiddleware path traversal	7.5	7.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.64382	0.00	CVE-2019-14322
18	Peplink Balance Web Admin connector.php information disclosure	5.9	5.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00283	0.02	CVE-2020-24246
19	Tenda AC11 POST Request setmac stack-based overflow	7.6	7.6	$0-$5k	$0-$5k	High	Not Defined	0.96875	0.05	CVE-2021-31755
20	Apple macOS Kernel type confusion	7.8	7.5	$5k-$25k	$0-$5k	High	Official Fix	0.00192	0.00	CVE-2020-27932

Campaigns (2)

These are the campaigns that can be associated with the actor:

Cobalt Kitty
OceanLotus

IOC - Indicator of Compromise (60)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Identified	Type	Confidence
1	23.227.196.126	23-227-196-126.static.hvvc.us	APT32	Cobalt Kitty	12/15/2020	verified	High
2	23.227.196.210	23-227-196-210.static.hvvc.us	APT32		12/15/2020	verified	High
3	23.227.199.121	23-227-199-121.static.hvvc.us	APT32	Cobalt Kitty	12/15/2020	verified	High
4	27.102.70.211		APT32	Cobalt Kitty	12/15/2020	verified	High
5	37.59.198.130		APT32	OceanLotus	12/15/2020	verified	High
6	37.59.198.131		APT32	OceanLotus	12/15/2020	verified	High
7	45.32.100.179	45.32.100.179.vultr.com	APT32	OceanLotus	12/15/2020	verified	Medium
8	45.32.105.45		APT32	OceanLotus	12/15/2020	verified	High
9	45.32.114.49	45.32.114.49.vultr.com	APT32	OceanLotus	12/15/2020	verified	Medium
10	45.76.147.201	45.76.147.201.vultr.com	APT32	OceanLotus	12/15/2020	verified	Medium
11	45.76.179.28	45.76.179.28.vultr.com	APT32	OceanLotus	12/15/2020	verified	Medium
12	45.76.179.151	45.76.179.151.vultr.com	APT32	OceanLotus	12/15/2020	verified	Medium
13	45.77.39.101	45.77.39.101.vultr.com	APT32	OceanLotus	12/15/2020	verified	Medium
14	45.114.117.137		APT32	Cobalt Kitty	12/15/2020	verified	High
15	45.114.117.164	folien.reisnart.com	APT32	OceanLotus	12/15/2020	verified	High
16	64.62.174.9	agent2.jenkins.aoindustries.com	APT32	OceanLotus	12/15/2020	verified	High
17	64.62.174.16	unassigned16.net2.fc.aoindustries.com	APT32	OceanLotus	12/15/2020	verified	High
18	64.62.174.17	unassigned17.net2.fc.aoindustries.com	APT32	OceanLotus	12/15/2020	verified	High
19	64.62.174.21	unassigned21.net2.fc.aoindustries.com	APT32	OceanLotus	12/15/2020	verified	High
20	64.62.174.41	dev1.plant-orbit.com	APT32	OceanLotus	12/15/2020	verified	High
21	64.62.174.99	unassigned99.net2.fc.aoindustries.com	APT32	OceanLotus	12/15/2020	verified	High
22	64.62.174.145	unassigned145.net2.fc.aoindustries.com	APT32	OceanLotus	12/15/2020	verified	High
23	64.62.174.146	unassigned146.net2.fc.aoindustries.com	APT32	OceanLotus	12/15/2020	verified	High
24	79.143.87.174		APT32	OceanLotus	12/15/2020	verified	High
25	80.255.3.87		APT32		12/15/2020	verified	High
26	89.33.64.207		APT32	OceanLotus	12/15/2020	verified	High
27	89.33.64.232	mypicsfromplane.com	APT32	OceanLotus	12/15/2020	verified	High
28	103.28.44.112	103028044112.hkserverdomain.com	APT32	OceanLotus	12/15/2020	verified	High
29	103.28.44.115	103028044115.hkserverdomain.com	APT32	OceanLotus	12/15/2020	verified	High
30	103.41.177.33		APT32	Cobalt Kitty	12/15/2020	verified	High
31	103.53.197.202	sg06.dewaweb.com	APT32		12/15/2020	verified	High
32	104.24.118.185		APT32	Cobalt Kitty	12/15/2020	verified	High
33	104.24.119.185		APT32	Cobalt Kitty	12/15/2020	verified	High
34	104.27.166.79		APT32	Cobalt Kitty	12/15/2020	verified	High
35	104.27.167.79		APT32	Cobalt Kitty	12/15/2020	verified	High
36	104.237.218.67	usgreatly.com	APT32	Cobalt Kitty	12/15/2020	verified	High
37	104.237.218.70	70.utdanne.104.xandien.nl	APT32		12/15/2020	verified	High
38	104.237.218.72	emudd.pointumetwe.com	APT32		12/15/2020	verified	High
39	108.170.31.69		APT32	Cobalt Kitty	12/15/2020	verified	High
40	110.10.179.65		APT32	Cobalt Kitty	12/15/2020	verified	High
41	128.199.90.216		APT32	OceanLotus	12/15/2020	verified	High
42	128.199.227.80	426977.cloudwaysapps.com	APT32	OceanLotus	12/15/2020	verified	High
43	138.197.236.215		APT32	OceanLotus	12/15/2020	verified	High
44	139.59.217.207		APT32	OceanLotus	12/15/2020	verified	High
45	139.59.220.10		APT32	OceanLotus	12/15/2020	verified	High
46	139.59.220.12		APT32	OceanLotus	12/15/2020	verified	High
47	139.59.223.191		APT32	OceanLotus	12/15/2020	verified	High
48	176.107.176.6	176.107.176.6.ptr	APT32	Cobalt Kitty	12/15/2020	verified	High
49	176.107.177.216	176.107.177.216.deltahost-ptr	APT32	Cobalt Kitty	12/15/2020	verified	High
50	176.223.111.116		APT32	Cobalt Kitty	12/15/2020	verified	High
51	184.95.51.179	pen179.penflexhost.com	APT32	Cobalt Kitty	12/15/2020	verified	High
52	184.95.51.181	mx.earthgeneration.org	APT32	Cobalt Kitty	12/15/2020	verified	High
53	184.95.51.190	laudantiumkvgqi.finewonu.club	APT32	Cobalt Kitty	12/15/2020	verified	High
54	185.157.79.3	185.157.79.3.deltahost-ptr	APT32		12/15/2020	verified	High
55	188.166.219.18	696006.cloudwaysapps.com	APT32	OceanLotus	12/15/2020	verified	High
56	192.121.176.148		APT32	Cobalt Kitty	12/15/2020	verified	High
57	193.169.245.78	193.169.245.78.deltahost-ptr	APT32		12/15/2020	verified	High
58	193.169.245.137	n116.deltahost.com.ua	APT32		12/15/2020	verified	High
59	203.114.75.22		APT32	OceanLotus	12/15/2020	verified	High
60	203.114.75.73		APT32	OceanLotus	12/15/2020	verified	High

TTP - Tactics, Techniques, Procedures (23)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-21, CWE-22, CWE-23	Path Traversal	predictive	High
2	T1040	CAPEC-102	CWE-319	Authentication Bypass by Capture-replay	predictive	High
3	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	High
4	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
5	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	predictive	High
6	T1068	CAPEC-122	CWE-264, CWE-269, CWE-284	Execution with Unnecessary Privileges	predictive	High
7	T1110.001	CAPEC-191	CWE-798	Hard-coded Credentials	predictive	High
8	T1202	CAPEC-136	CWE-77, CWE-78	Command Shell in Externally Accessible Directory	predictive	High
9	T1204.001	CAPEC-178	CWE-601	Open Redirect	predictive	High
10	T1211		CWE-254	7PK Security Features	predictive	High
11	T1222	CAPEC-1	CWE-275, CWE-276	Permission Issues	predictive	High
12	T1505	CAPEC-108	CWE-89	SQL Injection	predictive	High
13	T1548.002	CAPEC-1	CWE-285	Improper Authorization	predictive	High
14	T1552	CAPEC-102	CWE-255, CWE-522	Credentials Management	predictive	High
15	T1574	CAPEC-38	CWE-426, CWE-427	Untrusted Search Path	predictive	High
16	T1587.003	CAPEC-459	CWE-295	Improper Certificate Validation	predictive	High
17	T1588.001	CAPEC-133	CWE-912	Backdoor	predictive	High
18	T1592	CAPEC-116	CWE-200, CWE-209, CWE-532	Invocation of Process Using Visible Sensitive Information	predictive	High
19	T1592.004		CWE-16	Configuration	predictive	High
20	T1600	CAPEC-157	CWE-310, CWE-311, CWE-326, CWE-327	Cryptographic Issues	predictive	High
21	T1600.001		CWE-320, CWE-321, CWE-547	Key Management Error	predictive	High
22	T1608.002	CAPEC-1	CWE-434	Incomplete Identification of Uploaded File Variables	predictive	High
23	T1611		CWE-265	Containment Errors	predictive	High

IOA - Indicator of Attack (227)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/admin/	predictive	Low
2	File	/api/	predictive	Low
3	File	/cgi-bin/cgiServer.exx	predictive	High
4	File	/cgi-bin/login_action.cgi	predictive	High
5	File	/cgi-bin/nobody/Search.cgi	predictive	High
6	File	/cgi-bin/webviewer_login_page	predictive	High
7	File	/dev/sg0	predictive	Medium
8	File	/event/runquery.do	predictive	High
9	File	/filemanager/php/connector.php	predictive	High
10	File	/forum/away.php	predictive	High
11	File	/goform/setmac	predictive	High
12	File	/log_download.cgi	predictive	High
13	File	/manager?action=getlogcat	predictive	High
14	File	/mgmt/tm/util/bash	predictive	High
15	File	/pages/systemcall.php?command={COMMAND}	predictive	High
16	File	/password.html	predictive	High
17	File	/system/ws/v11/ss/email	predictive	High
18	File	/uncpath/	predictive	Medium
19	File	/upload	predictive	Low
20	File	add_vhost.php	predictive	High
21	File	admin/gv_mail.php	predictive	High
22	File	admin/images.aspx	predictive	High
23	File	admin/index.php	predictive	High
24	File	adv2.php?action=modify	predictive	High
25	File	agent.cfg	predictive	Medium
26	File	arch/x86/include/asm/fpu/internal.h	predictive	High
27	File	asm/float.c	predictive	Medium
28	File	asm/nasm.c	predictive	Medium
29	File	auth.php	predictive	Medium
30	File	backup.cgi	predictive	Medium
31	File	binder.c	predictive	Medium
32	File	bitfield.c	predictive	Medium
33	File	blob.cpp	predictive	Medium
34	File	books.php	predictive	Medium
35	File	c.php	predictive	Low
36	File	cgi-bin/	predictive	Medium
37	File	cgi-bin/ddns_enc.cgi	predictive	High
38	File	cgi-bin/luci/admin/network/firewall/rules	predictive	High
39	File	cgi-bin/MANGA/admin.cgi	predictive	High
40	File	cli.conf	predictive	Medium
41	File	coders/png.c	predictive	Medium
42	File	coders/tiff.c	predictive	High
43	File	coffgen.c	predictive	Medium
44	File	config.xml	predictive	Medium
45	File	connector.minimal.php	predictive	High
46	File	data/gbconfiguration.dat	predictive	High
47	File	db.php	predictive	Low
48	File	detail.php	predictive	Medium
49	File	devtools.sh	predictive	Medium
50	File	domain/section/markdown/markdown.go	predictive	High
51	File	drivers/gpu/drm/udl/udl_fb.c	predictive	High
52	File	drivers/scsi/sr_ioctl.c	predictive	High
53	File	drivers/usb/misc/iowarrior.c	predictive	High
54	File	ebmlstring.c	predictive	Medium
55	File	elf.c	predictive	Low
56	File	email.php	predictive	Medium
57	File	events-manager.js	predictive	High
58	File	ExceptionHandler.php	predictive	High
59	File	extensions.load	predictive	High
60	File	FlexPaperViewer.swf	predictive	High
61	File	folder_view.php	predictive	High
62	File	FortiClientOnlineInstaller.exe	predictive	High
63	File	framework/core/subsystems/expRouter.php	predictive	High
64	File	fs/userfaultfd.c	predictive	High
65	File	function.c	predictive	Medium
66	File	functions.php	predictive	High
67	File	functions_mod_user.php	predictive	High
68	File	getRemoteImage.php	predictive	High
69	File	get_set.ccp	predictive	Medium
70	File	gki_buffer.cc	predictive	High
71	File	handle_load_config.php	predictive	High
72	File	hh.exe	predictive	Low
73	File	image_upload.php	predictive	High
74	File	imap/lmtp_sieve.c	predictive	High
75	File	inc/config.php	predictive	High
76	File	inc/filebrowser/browser.php	predictive	High
77	File	include/findusers.php	predictive	High
78	File	includes/head.inc.php	predictive	High
79	File	index.php	predictive	Medium
80	File	init.inc.php	predictive	Medium
81	File	intervalCheck.jsp	predictive	High
82	File	iptc.c	predictive	Low
83	File	ItemReview.php	predictive	High
84	File	items.c	predictive	Low
85	File	items.queries.php	predictive	High
86	File	item_show.php	predictive	High
87	File	JBIG2Stream.cc	predictive	High
88	File	jeecgFormDemoController.do?commonUpload	predictive	High
89	File	jfinal_cms/admin/filemanager/list	predictive	High
90	File	jpgraph.php	predictive	Medium
91	File	kbdint.c	predictive	Medium
92	File	kernel/events/core.c	predictive	High
93	File	kernel/exit.c	predictive	High
94	File	kernel/trace/trace_events_filter.c	predictive	High
95	File	launchd	predictive	Low
96	File	libnvmmlite_video.so	predictive	High
97	File	libr/asm/asm.c	predictive	High
98	File	main/scala/authentikat/jwt/JsonWebToken.scala	predictive	High
99	File	misc/apr_rmm.c	predictive	High
100	File	mm/mempolicy.c	predictive	High
101	File	mm/oom_kill.c	predictive	High
102	File	model/__show_info.php	predictive	High
103	File	modules/m_sasl.c	predictive	High
104	File	NativeNfcManager.cpp	predictive	High
105	File	net/ipv4/datagram.c	predictive	High
106	File	net/ipv4/inet_connection_sock.c	predictive	High
107	File	net/packet/af_packet.c	predictive	High
108	File	openjp2/pi.c	predictive	Medium
109	File	pages_system_settings.php	predictive	High
110	File	plugins\meta_engine\libfolder_plugin.dll	predictive	High
111	File	prod.php	predictive	Medium
112	File	prog/htmlviewer.c	predictive	High
113	File	proxy.cgi	predictive	Medium
114	File	public/index.php/home	predictive	High
115	File	public/index.php/home/membersnsfriend/findlist.html	predictive	High
116	File	QueryComponentRendererValue!Default.jspa	predictive	High
117	File	RecentLocationApps.java	predictive	High
118	File	register/check/username?username	predictive	High
119	File	registration_detailed.inc.php	predictive	High
120	File	reports_mta_queue_status.html	predictive	High
121	File	secure_img_render.php	predictive	High
122	File	server_databases.php	predictive	High
123	File	setenv.sh	predictive	Medium
124	File	setup/index.php	predictive	High
125	File	shop.cgi	predictive	Medium
126	File	shop_display_products.php	predictive	High
127	File	showcat.php	predictive	Medium
128	File	SimpleDecodingSource.cpp	predictive	High
129	File	software-description.php	predictive	High
130	File	svox_ssml_parser.cpp	predictive	High
131	File	SystemEvent.jsp	predictive	High
132	File	system_log.cgi	predictive	High
133	File	tls1.c	predictive	Low
134	File	ui/artifact/upload	predictive	High
135	File	upgrade_handle.php	predictive	High
136	File	view/ProductsView.php	predictive	High
137	File	WealthT24/GetImage	predictive	High
138	File	welcome.php	predictive	Medium
139	File	www/content/lessons/"lesson	predictive	High
140	Library	AeXNSPkgDLLib.dll	predictive	High
141	Library	ATIDXX64.DLL	predictive	Medium
142	Library	ENCDEC.DLL	predictive	Medium
143	Library	filmfd.sys	predictive	Medium
144	Library	fs/ncpfs/ncplib_kernel.c	predictive	High
145	Library	igcore19d.dll	predictive	High
146	Library	Lib/DocXMLRPCServer.py	predictive	High
147	Library	lib/MongoLite/Database.php	predictive	High
148	Library	lib/rrd.php	predictive	Medium
149	Library	Monitor_win7_x64.sys	predictive	High
150	Library	Monitor_x86.sys	predictive	High
151	Library	wsdk-driver.sys	predictive	High
152	Argument	$line	predictive	Low
153	Argument	%s	predictive	Low
154	Argument	agentid	predictive	Low
155	Argument	app	predictive	Low
156	Argument	AUTHENTICATE	predictive	Medium
157	Argument	basePath	predictive	Medium
158	Argument	bauth	predictive	Low
159	Argument	bookid	predictive	Low
160	Argument	cat	predictive	Low
161	Argument	catid	predictive	Low
162	Argument	cat_id	predictive	Low
163	Argument	ccp_act	predictive	Low
164	Argument	charset	predictive	Low
165	Argument	code_no	predictive	Low
166	Argument	configFile	predictive	Medium
167	Argument	content	predictive	Low
168	Argument	Content-Length	predictive	High
169	Argument	CPG_M_DIR	predictive	Medium
170	Argument	data3	predictive	Low
171	Argument	docDownloadPath/uploadLocation	predictive	High
172	Argument	err	predictive	Low
173	Argument	file	predictive	Low
174	Argument	filename	predictive	Medium
175	Argument	fromName/message	predictive	High
176	Argument	go	predictive	Low
177	Argument	groups	predictive	Low
178	Argument	hostname	predictive	Medium
179	Argument	id	predictive	Low
180	Argument	ipAddr	predictive	Low
181	Argument	IP address	predictive	Medium
182	Argument	item_id	predictive	Low
183	Argument	l/dl/del	predictive	Medium
184	Argument	layout	predictive	Low
185	Argument	mapTitle	predictive	Medium
186	Argument	mosConfig_absolute_path	predictive	High
187	Argument	name	predictive	Low
188	Argument	page	predictive	Low
189	Argument	password	predictive	Medium
190	Argument	Password	predictive	Medium
191	Argument	phpbb_root_path	predictive	High
192	Argument	priority	predictive	Medium
193	Argument	reason	predictive	Low
194	Argument	redirect	predictive	Medium
195	Argument	redirect_uri	predictive	Medium
196	Argument	Referer	predictive	Low
197	Argument	referrer	predictive	Medium
198	Argument	resourceName	predictive	Medium
199	Argument	rootpath	predictive	Medium
200	Argument	sbp	predictive	Low
201	Argument	search	predictive	Low
202	Argument	searchid	predictive	Medium
203	Argument	sid	predictive	Low
204	Argument	site	predictive	Low
205	Argument	sms_content	predictive	Medium
206	Argument	sort_by	predictive	Low
207	Argument	src	predictive	Low
208	Argument	Swfile	predictive	Low
209	Argument	sys_name	predictive	Medium
210	Argument	tpldir/filename/type/nid	predictive	High
211	Argument	upfile	predictive	Low
212	Argument	uploaddir	predictive	Medium
213	Argument	up_auto_log	predictive	Medium
214	Argument	url	predictive	Low
215	Argument	uselang	predictive	Low
216	Argument	wd	predictive	Low
217	Argument	_receivers	predictive	Medium
218	Input Value	%0a/%0d	predictive	Low
219	Input Value	./../../../	predictive	Medium
220	Input Value	1" onmouseover=prompt(947671) bad="	predictive	High
221	Input Value	</script><script>alert(1)</script>	predictive	High
222	Input Value	<ScRiPt >alert(991)</ScRiPt>	predictive	High
223	Input Value	welc0me	predictive	Low
224	Input Value	\x3D../../../../etc/passwd	predictive	High
225	Network Port	8888	predictive	Low
226	Network Port	tcp/873	predictive	Low
227	Network Port	tcp/6200	predictive	Medium

References (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you know our Splunk app?

Download it now for free!