Regin Analysis

IOB - Indicator of Behavior (113)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en112
zh2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

us50
gb48
cn6
bd4
fr2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

PHP12
Apache HTTP Server4
PRTG Network Monitor2
QEMU2
GitHub Actions Runner2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemCTIEPSSCVE
1Host Discard Service privileges management7.37.1$0-$5k$0-$5kHighWorkaround0.130.00885CVE-1999-0636
2PHP Filename DirectoryIterator null termination5.55.3$5k-$25k$0-$5kNot DefinedOfficial Fix0.030.02686CVE-2019-11045
3nginx request smuggling6.96.9$0-$5k$0-$5kNot DefinedNot Defined10.000.00000CVE-2020-12440
4Sonatype Nexus Repository Manager injection4.94.9$0-$5k$0-$5kNot DefinedNot Defined0.000.00885CVE-2021-43961
5HP Enterprise LaserJet buffer overflow7.67.6$5k-$25k$5k-$25kNot DefinedNot Defined0.010.00885CVE-2021-39238
6CKeditor Dialogs Plugin incorrect regex6.46.1$0-$5kCalculatingNot DefinedOfficial Fix0.030.01018CVE-2021-26271
7TYPO3 User Session cleartext storage5.65.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.040.00954CVE-2021-21339
8VMware vCenter Server Heartbeat Message input validation5.34.6$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.030.01136CVE-2015-1047
9PAM unix_chkpwd information disclosure5.35.0$5k-$25kCalculatingProof-of-ConceptOfficial Fix0.040.01282CVE-2005-2977
10st Module passwd path traversal6.46.1$0-$5kCalculatingProof-of-ConceptOfficial Fix0.010.01213CVE-2014-3744
11Vastal phpVID browse_videos.php cross site scripting4.34.1$0-$5k$0-$5kProof-of-ConceptNot Defined0.060.01213CVE-2013-5312
12GitHub Actions Runner os command injection8.38.2$0-$5k$0-$5kNot DefinedOfficial Fix0.020.00890CVE-2022-39321
13Oracle Database Server RDBMS Security/SQL*Plus information disclosure2.62.5$5k-$25kCalculatingNot DefinedOfficial Fix0.020.00890CVE-2016-3562
14Oracle Solaris Common Desktop Environment format string8.37.9$5k-$25k$0-$5kProof-of-ConceptNot Defined0.020.00885CVE-2022-43752
15Dragon Path Bharti Airtel Routers Hardware BDT-121 Admin Page cross site scripting3.53.5$0-$5k$0-$5kNot DefinedNot Defined0.390.00885CVE-2022-28507
16HMS Ewon eCatcher permission5.55.3$0-$5kCalculatingNot DefinedOfficial Fix0.050.00950CVE-2021-33214
17Wamp Wamp64 access control7.57.4$0-$5k$0-$5kNot DefinedNot Defined0.020.01086CVE-2022-36565
18NVIDIA CUDA Toolkit SDK cuobjdump buffer overflow6.66.5$0-$5k$0-$5kNot DefinedOfficial Fix0.020.01103CVE-2022-21821
19Siemens SIMATIC S7-400 Session Cookie httponly information disclosure5.35.3$5k-$25k$0-$5kNot DefinedNot Defined0.000.00885CVE-2016-8672
20Cisco Small Business Switches hard-coded credentials7.77.7$5k-$25k$5k-$25kNot DefinedNot Defined0.030.01055CVE-2018-15439

IOC - Indicator of Compromise (7)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

TTP - Tactics, Techniques, Procedures (15)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (57)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/etc/passwdpredictiveMedium
2File/etc/sudoerspredictiveMedium
3File/exponent_constants.phppredictiveHigh
4Fileactions.phppredictiveMedium
5Fileadclick.phppredictiveMedium
6Fileadd_comment.phppredictiveHigh
7Fileadminer.phppredictiveMedium
8Filexxxxxxx.xxx/xxxxxxxxxxxx.xxxpredictiveHigh
9Filexxxxxx_xxxxxx.xxxpredictiveHigh
10Filexxxxxxx.xxxpredictiveMedium
11Filex:\xxxxxxpredictiveMedium
12Filexxxxxx.xxxpredictiveMedium
13Filexxxxxx/xxx/x_xxx_xxx_xxxx_xxxx.xpredictiveHigh
14Filexxxxxxxxxx.xpredictiveMedium
15Filexxx/xxxx/xxx_xxxx.xpredictiveHigh
16Filexxx/xxxx/xxxx.xpredictiveHigh
17Filexxxxx.xxxpredictiveMedium
18Filexxxxxxxxx.xxxxxxxx.xxxxx.xxx.xxxpredictiveHigh
19Filexx_xxx_xx.xpredictiveMedium
20Filexxxxx.xxxpredictiveMedium
21Filexxxxx.xxxpredictiveMedium
22Filexxxxxxx.xxxpredictiveMedium
23Filexxx_xxx_xxxxxx.xpredictiveHigh
24Filexxx/xxxx/xxxxxx.xpredictiveHigh
25Filexxx_xxx.xpredictiveMedium
26Filexxxx/xxx/xxx_xxxx.xpredictiveHigh
27Filexxxx-xxxxxx.xpredictiveHigh
28Filexxxxx/xxxx/xxxxxxxx.xxxpredictiveHigh
29Filexxxx_xxxxxxpredictiveMedium
30Filexx-xxxxxxx/xxxxxxxpredictiveHigh
31File_xxxxxx.xxxpredictiveMedium
32Library/_xxx_xxx/xxxxx.xxxpredictiveHigh
33Argument$_xxxxxx['xxxxx_xxxxxx']predictiveHigh
34Argumentxxx_xxxxpredictiveMedium
35Argumentxxxx_xxxpredictiveMedium
36ArgumentxxxpredictiveLow
37Argumentxxxx_xxxpredictiveMedium
38ArgumentxxxxpredictiveLow
39ArgumentxxxxxpredictiveLow
40ArgumentxxxxpredictiveLow
41ArgumentxxpredictiveLow
42ArgumentxxxxxxxpredictiveLow
43Argumentxxx_xxxxxxxpredictiveMedium
44ArgumentxxxxxxxxxxxxxpredictiveHigh
45ArgumentxxxxxxxpredictiveLow
46Argumentx_xx_x_xpredictiveMedium
47Argumentxxxxxxx_xx_xxxxxxxpredictiveHigh
48ArgumentxxxxpredictiveLow
49Argumentxx_xxxx_xxxxxx_xxxxxxxxxxpredictiveHigh
50Input Value%xx%xxpredictiveLow
51Input Value%x/%xpredictiveLow
52Input Value-xpredictiveLow
53Input Value/../predictiveLow
54Input Valuexxxxxxxx/xxxxxxxx/xxxxxxxxxpredictiveHigh
55Input ValuexxxxxxpredictiveLow
56Network Portxxx/xx (xxx xxxxxxxx)predictiveHigh
57Network Portxxx/xxxxxpredictiveMedium

References (3)

The following list contains external sources which discuss the actor and the associated activities:

Do you know our Splunk app?

Download it now for free!