Skip to content

Instantly share code, notes, and snippets.

ioc_value ioc_kind description
5d824ef872dc86206134370e090825136624d972551d8c454677798ccfb7ba19 hash_sha256 Cedula_588797.zip
24b3d6372a9e880420879f920ab832360d31e32dea3e0ae89dd22b72497d0320 hash_sha256 Cedula_200638.zip
76e5b88757e2f4e7b935b557352bccf35f76e2e9f3fb284af7778a1005109c6e hash_sha256 Cedula_362904.zip
9489a2052c95fa1f90ece58a28d971fa977bdab756712939b99e368ca83b9cc9 hash_sha256 RFC_55684.zip
45c6427a6e8d81bd1b22271a92f0ddbf57be0aa20a2001ff73c8914ab9f769fd hash_sha256 RFC_436159.zip
c6ff9ac191a2cbe5696615b740b73838ec423d27e1af0609fb054288a4fd549b hash_sha256 RFC_410101.zip
499691170eb68986b401a0650464e4ac4e83ce8b4642f3437d825d8ce862c895 hash_sha256 RFC_671618.zip
cddc846f86445ec1fef1f165e53bf123b766d357e87df92c9b3080249d27e95b hash_sha256 CURP_Conexion_Segura_v01.zip
16b22b331ceea0eb2c0e769b0fe6ab373f8a42faffc17be1459623a03d5d4ee6 hash_sha256 SAT_Instalar_Complemento.zip
-- Cloudflare threat hunting query
SELECT EDGE_START_TIMESTAMP EVENT_TIME,
CLIENT_REQUEST_HOST CLIENT_REQUEST_HOST,
CLIENT_REQUEST_PATH CLIENT_REQUEST_PATH,
CLIENT_REQUEST_URI CLIENT_REQUEST_URI,
CLIENT_REQUEST_REFERER CLIENT_REQUEST_REFERER,
CLIENT_REQUEST_METHOD CLIENT_REQUEST_METHOD,
ORIGIN_IP ORIGIN_IP,
@axon-git
axon-git / th_CVE-2022-1388.sql
Last active May 10, 2022 08:31
Threat hunting queries for CVE-2022-1388
Scanning activity:
-- Cloudflare: Suspected command execution using F5 BIG-IP iControl Rest API (CVE-2022-1388)
SELECT EDGE_START_TIMESTAMP,
CLIENT_REQUEST_HOST,
CLIENT_REQUEST_PATH,
CLIENT_REQUEST_REFERER,
CLIENT_REQUEST_METHOD,
ORIGIN_IP,
CLIENT_REQUEST_USER_AGENT,
@axon-git
axon-git / CVE-2022-1388_scanner.py
Last active May 9, 2022 16:48
CVE-2022-1388_scanner.py
import requests
import sys
class DupStdout(object):
def __init__(self, log_path):
self.terminal = sys.stdout
self.log_file = open(log_path, "w")
def write(self, message: str):