Detections

This repository contains all public indicators identified by 401trg during the course of our investigations. It also includes relevant yara rules and ids signatures to detect these indicators.

Our public PGP Key can be found here.

Reports

Directory	Link	Published
20180222_Analysis_of_Active_Satori_Botnet_Infections_indicators 20180222_Analysis_of_Active_Satori_Botnet_Infections__ids	Analysis of Active Satori Botnet Infections	Feb 22, 2018
20171220_Introduction_to_SMB_pcaps 20171220_Introduction_to_SMB_pdf	An Introduction to SMB for Network Security Analysts	Dec 20, 2017
20171101_ExposingPhishing_indicators 20171101_ExposingPhishing_ids	Exposing a Phishing Kit	Nov 01, 2017
20171026_LargeScaleIRC_indicators 20171026_LargeScaleIRC_ids	Large Scale IRCbot Infection Attempts	Oct 26, 2017
20171016_UpdateWinnti_indicators 20171016_UpdateWinnti_ids	An Update on Winnti	Oct 16, 2017
20171010_TurlaWateringHole_indicators 20171010_TurlaWateringHole_ids	Turla Watering Hole Campaigns 2016/2017	Oct 10, 2017
20170711_WinntiEvolution_indicators	Winnti (LEAD/APT17) Evolution - Going Open Source	Jul 11, 2017

License

All data is provided under Apache License, Version 2.0 which can be found here.