401trg Detections Save
This repository contains all public indicators identified by 401trg during the course of our investigations. It also includes relevant yara rules and ids signatures to detect these indicators.
Detections
This repository contains all public indicators identified by 401trg during the course of our investigations. It also includes relevant yara rules and IDS signatures to detect these indicators.
Our public PGP Key can be found here.
Reports
IDS
This directory contains IDS signatures to detect the indicators located in the IOC directory. These signatures are compatible with Suricata v4.0.4.
IOC
This directory contains IOCs from posts at 401trg.com. The csv files follow the unified format described below. These indicators are not defanged and should be considered malicious.
PCAPS
This directory contains example pcaps from "knowledge" posts at 401trg.com.
This directory contains PDFs of 401TRG long-form posts.
Unified Format
All IOC files are in CSV and have the following format:
Indicator,Type,Description,Reference
There are several types of indicators:
-
COOKIE -
CERT SHA1 -
CODE SIGN CERT SERIAL -
DOMAIN -
EMAIL -
FILE MD5 -
IP -
PHONE -
URL
Example:
Indicator,Type,Description,Reference
asdf.asdf.com,DOMAIN,This is a malicious domain,https://401trg.com/this-post-does-not-exist
The description field is left blank when there is no context to add to the indicator. The reference field will contain a link to the 401TRG post that disclosed the indicator.
License
All data is provided under Apache License, Version 2.0 which can be found here.
Open Source Agenda Badge
