{
  "Event": {
    "uuid": "d9ad5815-06a6-5ce7-a342-cd0019412f73",
    "info": "AdvancedRouterScanner",
    "date": "2025-10-20",
    "threat_level_id": 2,
    "analysis": 2,
    "timestamp": 1791690190,
    "publish_timestamp": 1791690190,
    "published": true,
    "Orgc": {
      "name": "The Hunters Ledger",
      "uuid": "8bc8284b-deb5-546c-a233-57ea34b2ea0d"
    },
    "Tag": [
      {
        "name": "tlp:clear",
        "colour": "#ffffff"
      },
      {
        "name": "hunters-ledger:topic=\"Scanner\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:topic=\"Python\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:topic=\"Exploitation\"",
        "colour": "#58a6ff"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Password Guessing - T1110.001\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
        "colour": "#0088cc"
      }
    ],
    "Attribute": [
      {
        "uuid": "3804759a-4f27-5dfa-9fd3-90a02851d005",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/hunting-detections/AdvancedRouterScanner-detections/",
        "to_ids": false,
        "comment": "Detection rules, The Hunters Ledger",
        "timestamp": 1791690190
      },
      {
        "uuid": "e7d7efdf-e431-5905-8097-7afc481ce17b",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/ioc-feeds/AdvancedRouterScanner.json",
        "to_ids": false,
        "comment": "IOC feed (JSON), The Hunters Ledger",
        "timestamp": 1791690190
      },
      {
        "uuid": "9bc28047-8857-5271-a088-0c1daac45b35",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/reports/AdvancedRouterScanner/",
        "to_ids": false,
        "comment": "Report, The Hunters Ledger",
        "timestamp": 1791690190
      },
      {
        "uuid": "4a975d66-ea3b-5bb5-a6e8-04ee4f99fd4b",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/stix/AdvancedRouterScanner.json",
        "to_ids": false,
        "comment": "STIX 2.1 bundle, The Hunters Ledger",
        "timestamp": 1791690190
      },
      {
        "uuid": "5d1c8245-a235-54af-b1ca-709c823f4350",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Authentication Attempt with Default-Style Username and Password Substrings\nid: b88fd219-6352-4cdb-9406-be4acdc7dfe8\nstatus: experimental\ndescription: >-\n    Detects a single authentication event whose username contains one of\n    admin, root, guest or operator and whose password contains one of admin,\n    password, 1234 or changeme, against router and IoT management interfaces.\n    Both tests are substring matches, so \"myadmin\" with \"notpassword9\" also\n    fires; it is not an exact default-credential pair. The rule counts nothing, so repeated attempts from one source,\n    which is what automated credential brute-forcing looks like, show up as\n    many hits and need to be aggregated per source in the SIEM.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/AdvancedRouterScanner-detections/\nauthor: The Hunters Ledger\ndate: '2025-10-25'\nmodified: '2026-10-10'\ntags:\n    - attack.credential-access\n    - attack.t1110.001\n    - detection.emerging-threats\nlogsource:\n    category: authentication\ndetection:\n    selection:\n        user|contains:\n            - \"admin\"\n            - \"root\"\n            - \"guest\"\n            - \"operator\"\n        password|contains:\n            - \"admin\"\n            - \"password\"\n            - \"1234\"\n            - \"changeme\"\n    condition: selection\nfalsepositives:\n    - Legitimate administrators using default credentials before hardening a new device\nlevel: medium",
        "to_ids": false,
        "comment": "Authentication Attempt with Default-Style Username and Password Substrings | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1110.001 | rule hash 88d8e36a | https://the-hunters-ledger.com/hunting-detections/AdvancedRouterScanner-detections/",
        "timestamp": 1791690190,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "6e988432-9cec-55f5-a8e2-ae6e5e36a940",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Suspicious Router CGI Access\nid: e5afdda0-43fc-42b1-b429-05cb0e0bd34e\nstatus: experimental\ndescription: >-\n    Detects HTTP requests to CGI endpoints and paths commonly exploited by\n    router/IoT scanning and exploitation tools to achieve command execution\n    or credential harvesting on embedded web management interfaces.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/AdvancedRouterScanner-detections/\nauthor: The Hunters Ledger\ndate: '2025-10-25'\nmodified: '2026-10-10'\ntags:\n    - attack.initial-access\n    - attack.t1190\n    - detection.emerging-threats\nlogsource:\n    category: webserver\ndetection:\n    selection_stem:\n        cs-uri-stem|contains:\n            - \"/web_shell_cmd.gch\"\n            - \"/apply.cgi\"\n            - \"/boaform/admin/formLogin\"\n            - \"/cgi-bin/config.cgi\"\n            - \"/login.cgi\"\n            - \"/setup.cgi\"\n            - \"/system.cmd\"\n    selection_shell_command:\n        cs-uri-stem|endswith: \"/shell\"\n        cs-uri-query|contains: \"command=\"\n    condition: 1 of selection_*\nfalsepositives:\n    - Legitimate administrative access to router/IoT management interfaces\nlevel: medium",
        "to_ids": false,
        "comment": "Suspicious Router CGI Access | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1190 | rule hash 236afd6a | https://the-hunters-ledger.com/hunting-detections/AdvancedRouterScanner-detections/",
        "timestamp": 1791690190,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      }
    ],
    "Object": []
  }
}