{
    "type": "bundle",
    "id": "bundle--ffcbe6f6-629e-4583-b9df-5f496da1f88c",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.698892Z",
            "modified": "2026-09-19T20:28:04.698892Z",
            "name": "The Hunters Ledger",
            "identity_class": "organization"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--673b2f0b-f30b-537c-b79b-a49d06291d17",
            "value": "45.94.31.220"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--f0d906fd-c2d0-5c67-becb-f48377b0a012",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.69948Z",
            "modified": "2026-09-19T20:28:04.69948Z",
            "name": "ipv4: 45.94.31.220",
            "description": "Open directory indexed at 21:45 UTC on 2026-02-14 (6.75 hours post-build). Infrastructure may have been re-established with new IOCs if operator became aware of exposure. Monitor for similar hosting patterns.",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[ipv4-addr:value = '45.94.31.220']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2026-03-01T00:00:00Z",
            "confidence": 80,
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ],
            "x_opencti_detection": false,
            "x_opencti_score": 80
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5ffaaf92-63a9-50c7-9a71-b1a264c6aa19",
            "value": "http://45.94.31.220:8000/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--cbcf22a2-8de8-55a5-b24e-ff0e8ac1eef0",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.700495Z",
            "modified": "2026-09-19T20:28:04.700495Z",
            "name": "url: http://45.94.31.220:8000/",
            "description": "Directory exposure is the event that enabled recovery of full attacker toolkit. Third-party scanner at port 8080 had already applied malware/exploit tags to multiple artifacts before our analysis.",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[url:value = 'http://45.94.31.220:8000/']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2026-03-01T00:00:00Z",
            "confidence": 80,
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ],
            "x_opencti_detection": false,
            "x_opencti_score": 80
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--dab8b8af-d785-5e19-90ee-a2fb5f300a1a",
            "value": "http://45.94.31.220:8000/OneDriveSync.exe"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--8b6efd7b-c37c-59a1-bd8c-2f66ca147b27",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.701126Z",
            "modified": "2026-09-19T20:28:04.701126Z",
            "name": "url: http://45.94.31.220:8000/OneDriveSync.exe",
            "description": "HTTP (not HTTPS) indicates payload delivery prioritizes availability over encryption. Wireshark/network sensors will capture full payload during download.",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[url:value = 'http://45.94.31.220:8000/OneDriveSync.exe']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2026-03-01T00:00:00Z",
            "confidence": 95,
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ],
            "x_opencti_detection": false,
            "x_opencti_score": 95
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--91ac696f-abc4-58d4-adbe-2d75863d521e",
            "value": "mailmassange.duckdns.org"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--65a57841-bd46-566e-8bc1-6e004a89ca94",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.701662Z",
            "modified": "2026-09-19T20:28:04.701662Z",
            "name": "domain: mailmassange.duckdns.org",
            "description": "DuckDNS subdomains can be rapidly re-assigned to new attacker infrastructure. Detect by behavioral pattern (Sliver beacon heartbeat) rather than domain alone.",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[domain-name:value = 'mailmassange.duckdns.org']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2026-03-01T00:00:00Z",
            "confidence": 80,
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ],
            "x_opencti_detection": false,
            "x_opencti_score": 80
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--bb25d0ae-ea44-5bee-b808-1c0ed9cffa79",
            "value": "mailuxe.net"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--7b313cb4-961c-54b0-9d04-6af34ceb7cd8",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.702208Z",
            "modified": "2026-09-19T20:28:04.702208Z",
            "name": "domain: mailuxe.net",
            "description": "If domain is sinkholed by defensive parties, check for fallback to mailmassange.duckdns.org",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[domain-name:value = 'mailuxe.net']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2026-03-01T00:00:00Z",
            "confidence": 80,
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ],
            "x_opencti_detection": false,
            "x_opencti_score": 80
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c932c7a5-0341-51be-b94d-785aafc18ed9",
            "hashes": {
                "SHA-256": "d94c74a6cd6629be66898eaab03ce0446f655689e28e08f0c166eaf4af9d04ea"
            }
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--25c4bb20-6142-5af8-beaf-643b9f7918c3",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.702784Z",
            "modified": "2026-09-19T20:28:04.702784Z",
            "name": "sha256: d94c74a6cd6629be66898eaab03ce0446f655689e28e08f0c166eaf4af9d04ea",
            "description": "Same C2 configuration as OneDriveSync.exe. Compression ratio indicates 50% size reduction; use for bandwidth-constrained delivery scenarios.",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[file:hashes.'SHA-256' = 'd94c74a6cd6629be66898eaab03ce0446f655689e28e08f0c166eaf4af9d04ea']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2026-03-01T00:00:00Z",
            "confidence": 95,
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ],
            "x_opencti_detection": false,
            "x_opencti_score": 95
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--05f7f599-786d-5edc-9479-c751201517e6",
            "hashes": {
                "SHA-256": "e2ad6f8202994058cc987cc971698238c2dc63a951dd1e43063cc9b8b138713b"
            }
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--3c1e1859-a04a-5217-be9a-df5e8cd36145",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.703384Z",
            "modified": "2026-09-19T20:28:04.703384Z",
            "name": "sha256: e2ad6f8202994058cc987cc971698238c2dc63a951dd1e43063cc9b8b138713b",
            "description": "Polymorphic builds may produce different hashes; use certificate serial (659EEB5AA4A489FB238993AF259D23F057F6D6D6) as more durable indicator. File can be executed to trigger full kill chain but requires elevated privileges for some evasion techniques.",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[file:hashes.'SHA-256' = 'e2ad6f8202994058cc987cc971698238c2dc63a951dd1e43063cc9b8b138713b']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2026-03-01T00:00:00Z",
            "confidence": 95,
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ],
            "x_opencti_detection": false,
            "x_opencti_score": 95
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--3dedd536-8d59-50c2-aa81-dbe8352df81b",
            "value": "intezer.com"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--2a6a61e7-a345-5cad-837e-2698f25a6f00",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.712399Z",
            "modified": "2026-10-11T14:08:49.856321Z",
            "name": "MALW_Fraudulent_VMware_CodeSign_Cert_PE",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "rule MALW_Fraudulent_VMware_CodeSign_Cert_PE {\n   meta:\n      description = \"Detects PE files that contain certificate strings of the fraudulent VMware, Inc. Code Signing identity used in the WebServer-Compromise-Kit-45.94.31.220 campaign: the CN VMware, Inc. Code Signing with Redmond, or the known certificate serial bytes with either the CN or Redmond. A string-level lead, not a certificate parse: it does not test who signed or issued the file.\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/sliver-open-directory-detections/\"\n      date = \"2026-02-28\"\n      hash1 = \"e2ad6f8202994058cc987cc971698238c2dc63a951dd1e43063cc9b8b138713b\"\n      family = \"Sliver\"\n      malware_type = \"C2 Beacon / Code-Signing Fraud\"\n      campaign = \"WebServer-Compromise-Kit-45.94.31.220\"\n      id = \"751f1fad-4d99-5c21-a1a1-c04dae743f81\"\n   strings:\n      $cert_serial = { 65 9E EB 5A A4 A4 89 FB 23 89 93 AF 25 9D 23 F0 57 F6 D6 D6 }\n      $subject_cn  = \"VMware, Inc. Code Signing\" ascii\n      $subject_l   = \"Redmond\" ascii\n   condition:\n      uint16(0) == 0x5A4D\n      and filesize < 100MB\n      and (\n         ($cert_serial and ($subject_cn or $subject_l))\n         or ($subject_cn and $subject_l)\n      )\n}",
            "pattern_type": "yara",
            "valid_from": "2026-03-01T00:00:00Z",
            "labels": [
                "detection-rule"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--4db5d131-8153-57af-8f1c-857a9fb38169",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.712525Z",
            "modified": "2026-09-19T20:28:04.712525Z",
            "name": "MALW_Fraudulent_VMware_CodeSign_Cert_PEM",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "rule MALW_Fraudulent_VMware_CodeSign_Cert_PEM {\n   meta:\n      description = \"Detects the raw PEM-format fraudulent VMware code-signing certificate and private key artifacts from the WebServer-Compromise-Kit-45.94.31.220 campaign, recovered unencrypted from the attacker's open directory alongside the signed binaries\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/sliver-open-directory-detections/\"\n      date = \"2026-02-28\"\n      family = \"Sliver\"\n      malware_type = \"Code-Signing Fraud Artifact\"\n      campaign = \"WebServer-Compromise-Kit-45.94.31.220\"\n      id = \"69d3d214-5285-5614-8f41-e1a05f369d22\"\n   strings:\n      $pem_header     = \"-----BEGIN CERTIFICATE-----\" ascii\n      $subject_cn     = \"VMware, Inc. Code Signing\" ascii\n      $subject_l      = \"Redmond\" ascii\n      $privkey_header = \"-----BEGIN PRIVATE KEY-----\" ascii\n   condition:\n      filesize < 10KB\n      and (\n         ($pem_header and $subject_cn and $subject_l)\n         or ($privkey_header and ($subject_cn or $subject_l))\n      )\n}",
            "pattern_type": "yara",
            "valid_from": "2026-03-01T00:00:00Z",
            "labels": [
                "detection-rule"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--83186ded-626d-5227-8a8d-296195e14af9",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.712201Z",
            "modified": "2026-10-11T14:08:49.85668Z",
            "name": "MALW_ScareCrow_Go_Loader_OneDriveSync",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "/*\n   Yara Rule Set\n   Identifier: Sliver C2 / ScareCrow Loader Open Directory Kit\n   Author: The Hunters Ledger\n   Source: https://the-hunters-ledger.com/\n   License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\n*/\n\nrule MALW_ScareCrow_Go_Loader_OneDriveSync {\n   meta:\n      description = \"Detects the ScareCrow-wrapped Go loader used in the WebServer-Compromise-Kit-45.94.31.220 campaign: a PE32+ file of 25 to 40 MB carrying three Go build-flag strings plus at least one of the SysWhispers3 HalosGate hash seed, the XZ stream header pattern of the ScareCrow injection mode dispatcher, or the hardcoded PEB command-line spoof string.\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/sliver-open-directory-detections/\"\n      date = \"2026-02-28\"\n      hash1 = \"e2ad6f8202994058cc987cc971698238c2dc63a951dd1e43063cc9b8b138713b\"\n      hash2 = \"67bb390c2dad7ebd9e9f706a6f2ba42e4cbcbee7\"\n      hash3 = \"9559366a6f6874ad914e308a34903c77\"\n      family = \"Sliver\"\n      malware_type = \"C2 Beacon / Loader\"\n      campaign = \"WebServer-Compromise-Kit-45.94.31.220\"\n      id = \"97119e1c-a746-54b7-b127-9ef332b9246f\"\n   strings:\n      $go_build_meta_1 = \"-buildmode=exe\" ascii wide\n      $go_build_meta_2 = \"-compiler=gc\" ascii wide\n      $go_build_meta_3 = \"-trimpath=true\" ascii wide\n\n      $sw3_seed = { 94 8D EA 9D }\n\n      $xz_hollowing_header = { FD 37 7A 58 5A 00 00 04 E6 D6 B4 46 }\n\n      $peb_spoof_string = \"MicrosoftEdgeUpdate.exe --update-check --silent\" wide\n\n   condition:\n      uint16(0) == 0x5A4D\n      and uint32(uint32(0x3C)) == 0x00004550\n      and uint16(uint32(0x3C) + 24) == 0x020B // PE32+ optional header magic\n      and filesize > 25MB\n      and filesize < 40MB\n      and all of ($go_build_meta_*)\n      and (\n         $sw3_seed\n         or $xz_hollowing_header\n         or $peb_spoof_string\n      )\n}",
            "pattern_type": "yara",
            "valid_from": "2026-03-01T00:00:00Z",
            "labels": [
                "detection-rule"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--bd268db2-dc48-5911-a277-15fd7b927d78",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.712653Z",
            "modified": "2026-10-11T14:08:49.856823Z",
            "name": "MALW_UPX_Packed_Sliver_Variant",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "rule MALW_UPX_Packed_Sliver_Variant {\n   meta:\n      description = \"Detects a UPX-packed Go binary of 13-18MB, the shape of the UPX 5.0.2-packed Sliver C2 beacon variant (compressed.exe) recovered from the WebServer-Compromise-Kit-45.94.31.220 campaign. Matches on the literals UPX0 and UPX1, the Go build-flag strings -buildmode=exe and -compiler=gc, the packed file size band, and either the UPX 5.0.2 version string or a two-byte value that almost any high-entropy file of this size contains. Not specific to Sliver; UPX packing is common in legitimate software so this is a hunting-tier lead, not an alerting rule\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/sliver-open-directory-detections/\"\n      date = \"2026-02-28\"\n      hash1 = \"d94c74a6cd6629be66898eaab03ce0446f655689e28e08f0c166eaf4af9d04ea\"\n      hash2 = \"8f27695dfd4f29e872c1661cdf225120182dd05b\"\n      hash3 = \"f587753c0a46688af2ffea00573192e2\"\n      family = \"Sliver\"\n      malware_type = \"C2 Beacon (UPX-packed variant)\"\n      campaign = \"WebServer-Compromise-Kit-45.94.31.220\"\n      id = \"45a1d524-05ea-5875-9ad3-609a4fe78278\"\n   strings:\n      $upx0 = \"UPX0\" ascii\n      $upx1 = \"UPX1\" ascii\n      $upx_ver = \"UPX 5.0.2\" ascii\n      $go_build_1 = \"-buildmode=exe\" ascii wide\n      $go_build_2 = \"-compiler=gc\" ascii wide\n      $upx_lzma_marker = { 03 05 }\n   condition:\n      uint16(0) == 0x5A4D\n      and filesize > 13MB\n      and filesize < 18MB\n      and $upx0\n      and $upx1\n      and ($upx_ver or $upx_lzma_marker)\n      and all of ($go_build_*)\n}",
            "pattern_type": "yara",
            "valid_from": "2026-03-01T00:00:00Z",
            "labels": [
                "detection-rule"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--62697b30-6a22-51f5-b4ec-d86663005c3e",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.712795Z",
            "modified": "2026-10-11T14:08:49.856935Z",
            "name": "TOOLKIT_ScareCrow_Build_Pipeline_Source_Artifacts",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "rule TOOLKIT_ScareCrow_Build_Pipeline_Source_Artifacts {\n   meta:\n      description = \"Hunt rule detecting source code and pre-assembled stub artifacts from the ScareCrow/SysWhispers3 build pipeline used in the WebServer-Compromise-Kit-45.94.31.220 campaign: the XOR_KEY 0x42 define paired with the SysWhispers3 SW3_SEED hash constant from string_obf.C/syscalls.C, or a standalone file of under 100 bytes holding the compiled 10-byte Heaven's Gate far-return stub (the heavens_gate.bin artifact); a stub embedded in a larger file does not match. A source-file hit indicates the build pipeline source is present on the scanned host; the stub alternative matches only a tiny standalone shellcode file\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/sliver-open-directory-detections/\"\n      date = \"2026-02-28\"\n      family = \"ScareCrow Build Pipeline\"\n      malware_type = \"Offensive Toolchain Source Artifacts\"\n      campaign = \"WebServer-Compromise-Kit-45.94.31.220\"\n      id = \"e38d897c-a2bf-5731-b1e0-1e00d4eecb75\"\n   strings:\n      $xor_key_define = \"#define XOR_KEY 0x42\" ascii\n      $sw3_seed_define = \"0x9DEA8D94\" ascii\n      $sw3_seed_name   = \"SW3_SEED\" ascii\n      $heavens_gate_stub = { E8 00 00 00 00 83 04 24 05 CB }\n   condition:\n      filesize < 5MB\n      and (\n         ($xor_key_define and $sw3_seed_define and $sw3_seed_name)\n         or ($heavens_gate_stub and filesize < 100)\n      )\n}",
            "pattern_type": "yara",
            "valid_from": "2026-03-01T00:00:00Z",
            "labels": [
                "detection-rule"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--73c42c46-457b-5f25-ad05-863eda205c21",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-10-11T14:08:49.85704Z",
            "modified": "2026-10-11T14:08:49.85704Z",
            "name": "PowerShell AMSI Bypass via amsiInitFailed Reflection",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "title: PowerShell AMSI Bypass via amsiInitFailed Reflection\nid: 3a7f2c91-5e4b-4d8a-b1c9-6f2e1a3d8b07\nstatus: experimental\ndescription: >-\n  Detects a PowerShell script block whose text contains amsiInitFailed,\n  NonPublic,Static and SetValue, the text pattern of the reflection-based\n  AMSI bypass used by the stager component of the\n  WebServer-Compromise-Kit-45.94.31.220 Sliver C2 campaign. The three strings\n  are tested independently, so the rule does not prove the field is set or\n  set to true, and a script block that also contains\n  WindowsDefenderApplicationGuard is excluded. The selection is\n  technique-level: nothing in it is specific to that campaign or to Sliver.\n  PowerShell Script Block Logging (Event ID 4104) captures the full\n  stager content even though the bypass fires after the script block is\n  logged.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/sliver-open-directory-detections/\nauthor: The Hunters Ledger\ndate: 2026-02-28\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.defense-impairment\n    - attack.t1685\n    - detection.emerging-threats\nlogsource:\n    product: windows\n    service: powershell\n    definition: >-\n      Requires PowerShell Script Block Logging (Event ID 4104). Enable via\n      GPO Computer Configuration, Administrative Templates, Windows\n      Components, Windows PowerShell, Turn on PowerShell Script Block\n      Logging.\ndetection:\n    selection_amsi_bypass:\n        EventID: 4104\n        ScriptBlockText|contains|all:\n            - 'amsiInitFailed'\n            - 'NonPublic,Static'\n            - 'SetValue'\n    filter_legitimate:\n        ScriptBlockText|contains:\n            - 'WindowsDefenderApplicationGuard'\n    condition: selection_amsi_bypass and not filter_legitimate\nfalsepositives:\n    - >-\n      Security research or authorized offensive-security assessment\n      scripts using reflection-based AMSI bypass in authorized\n      environments\n    - Red team exercises where PowerShell stagers are simulated\nlevel: high",
            "pattern_type": "sigma",
            "valid_from": "2026-03-01T00:00:00Z",
            "labels": [
                "detection-rule"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--af50ac5d-be15-5568-a501-6bddcfd36694",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.713106Z",
            "modified": "2026-10-11T14:08:49.857156Z",
            "name": "sihost.exe Initiating Anomalous Outbound Network Connection",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "title: sihost.exe Initiating Anomalous Outbound Network Connection\nid: 6f1d4b8e-3c2a-4f7b-9e5d-8a1c3f6b9e2d\nstatus: experimental\ndescription: >-\n  Detects sihost.exe (Shell Infrastructure Host) initiating a network\n  connection on port 443 or 8443 to a destination whose hostname does not\n  end in .microsoft.com, .windows.com, .windowsupdate.com or\n  .msftconnecttest.com (a connection with no logged hostname is not\n  excluded). That is the pattern expected from a C2 beacon injected into\n  sihost.exe by process hollowing. The\n  WebServer-Compromise-Kit-45.94.31.220 build pipeline explicitly targets\n  sihost.exe for process hollowing and the beacon is configured to call out\n  over HTTPS/mTLS, but the C2 was offline and no external connection was\n  observed, so this is an anomaly lead and not a recorded campaign event.\n  Legitimate sihost.exe is not\n  known to connect to arbitrary external addresses, so this rule\n  generalizes to any injected beacon using the same injection target, not\n  only this campaign's specific C2 domains.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/sliver-open-directory-detections/\nauthor: The Hunters Ledger\ndate: 2026-02-28\ntags:\n    - attack.stealth\n    - attack.t1055.012\n    - attack.privilege-escalation\n    - attack.command-and-control\n    - attack.t1071.001\n    - detection.emerging-threats\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection_sihost_network:\n        Image|endswith: '\\sihost.exe'\n        Initiated: 'true'\n        DestinationPort:\n            - 443\n            - 8443\n    filter_microsoft_infra:\n        DestinationHostname|endswith:\n            - '.microsoft.com'\n            - '.windows.com'\n            - '.windowsupdate.com'\n            - '.msftconnecttest.com'\n    condition: selection_sihost_network and not filter_microsoft_infra\nfalsepositives:\n    - >-\n      Custom enterprise environments where sihost.exe behavior has been\n      modified by legitimate software\n    - >-\n      Proxy or network security software that injects monitoring DLLs\n      into sihost.exe, causing unusual network calls\nlevel: high",
            "pattern_type": "sigma",
            "valid_from": "2026-03-01T00:00:00Z",
            "labels": [
                "detection-rule"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--23892274-db8d-5f23-b803-d47955951620",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.713007Z",
            "modified": "2026-10-11T14:08:49.857268Z",
            "name": "Windows Defender Real-Time Protection Disabled",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "title: Windows Defender Real-Time Protection Disabled\nid: 8b4e1f72-9c3a-4e7d-a5b8-2d6f9c1e4a83\nstatus: experimental\ndescription: >-\n  Detects Windows Defender real-time protection being disabled (Event ID\n  5001), matching the defense-impairment step used by the stager\n  component of the WebServer-Compromise-Kit-45.94.31.220 Sliver C2\n  campaign, which calls Set-MpPreference -DisableRealtimeMonitoring $true\n  from PowerShell. Event ID 5001 carries no initiator, so the rule fires\n  regardless of which process or person disabled protection and covers the\n  technique generally rather than only the PowerShell vector observed in\n  this campaign. Administrative and management-platform disables also\n  fire, so use it for hunting and triage, not alerting.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/sliver-open-directory-detections/\nauthor: The Hunters Ledger\ndate: 2026-02-28\nmodified: 2026-10-11\ntags:\n    - attack.defense-impairment\n    - attack.t1685\n    - detection.emerging-threats\nlogsource:\n    product: windows\n    service: windefend\ndetection:\n    selection_defender_disabled:\n        EventID: 5001\n    condition: selection_defender_disabled\nfalsepositives:\n    - >-\n      Legitimate administrative scripts disabling Defender as part of\n      authorized software installation\n    - >-\n      Enterprise management platforms (SCCM, Intune) disabling Defender\n      via PowerShell during provisioning\n    - Security testing in authorized environments\nlevel: medium",
            "pattern_type": "sigma",
            "valid_from": "2026-03-01T00:00:00Z",
            "labels": [
                "detection-rule"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--2a9c6993-9b67-5fec-9e1b-ff75e25b0bef",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.7132Z",
            "modified": "2026-09-19T20:28:04.7132Z",
            "name": "PowerShell WebClient DownloadFile Execution (Sliver Stager Download Pattern)",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "title: PowerShell WebClient DownloadFile Execution (Sliver Stager Download Pattern)\nid: 7d3f9a52-1c6e-4b8d-9a3f-5e8c2d4b7f91\nstatus: experimental\ndescription: >-\n  Detects PowerShell using Net.WebClient.DownloadFile, matching the\n  payload retrieval technique used by the stager component of the\n  WebServer-Compromise-Kit-45.94.31.220 Sliver C2 campaign. Split out\n  from the campaign's original combined AMSI-bypass-or-download rule\n  because the download pattern alone is common to many legitimate\n  PowerShell deployment and automation scripts; use for hunting and\n  triage, not alerting.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/sliver-open-directory-detections/\nauthor: The Hunters Ledger\ndate: 2026-02-28\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.command-and-control\n    - attack.t1105\n    - detection.emerging-threats\nlogsource:\n    product: windows\n    service: powershell\n    definition: 'Requires PowerShell Script Block Logging (Event ID 4104).'\ndetection:\n    selection_download:\n        EventID: 4104\n        ScriptBlockText|contains|all:\n            - 'DownloadFile'\n            - 'Net.WebClient'\n    filter_legitimate:\n        ScriptBlockText|contains:\n            - 'WindowsDefenderApplicationGuard'\n    condition: selection_download and not filter_legitimate\nfalsepositives:\n    - >-\n      Automated patching, deployment, or CI/CD scripts that use\n      Net.WebClient.DownloadFile to retrieve legitimate installers or\n      updates\n    - >-\n      IT automation frameworks that stage files via PowerShell WebClient\nlevel: medium",
            "pattern_type": "sigma",
            "valid_from": "2026-03-01T00:00:00Z",
            "labels": [
                "detection-rule"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--9cd77d59-329c-5012-a181-694761d1f1b8",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.713287Z",
            "modified": "2026-09-19T20:28:04.713287Z",
            "name": "PowerShell Drops Executable to TEMP Directory",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "title: PowerShell Drops Executable to TEMP Directory\nid: c2e5a8f3-7b1d-4c9e-8a4f-3e7b2d9c5f16\nstatus: experimental\ndescription: >-\n  Detects PowerShell creating an executable file in the user TEMP\n  directory, matching the payload-staging behavior of the stager\n  component in the WebServer-Compromise-Kit-45.94.31.220 Sliver C2\n  campaign — the stager writes OneDriveSync.exe to %TEMP%\\update.exe\n  before execution. This rule implements only the file-write event; the\n  campaign's stager also opens a network connection immediately\n  beforehand and launches the dropped file with a hidden window, but\n  neither of those events is correlated here, so this selector alone is\n  broader than the full three-event chain and is scoped as a hunting\n  lead rather than an alerting rule.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/sliver-open-directory-detections/\nauthor: The Hunters Ledger\ndate: 2026-02-28\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.command-and-control\n    - attack.t1105\n    - detection.emerging-threats\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection_ps_exe_drop:\n        Image|endswith: '\\powershell.exe'\n        TargetFilename|contains: '\\AppData\\Local\\Temp\\'\n        TargetFilename|endswith: '.exe'\n    filter_known_installers:\n        TargetFilename|contains:\n            - '\\AppData\\Local\\Temp\\chocolatey'\n            - '\\AppData\\Local\\Temp\\scoop'\n            - '\\AppData\\Local\\Temp\\winget'\n    condition: selection_ps_exe_drop and not filter_known_installers\nfalsepositives:\n    - >-\n      Legitimate software deployment scripts that use PowerShell to\n      download and stage installers to TEMP\n    - >-\n      Package manager scripts (Chocolatey, Scoop, winget) that stage\n      executables during installation\n    - >-\n      IT automation frameworks (Ansible, Salt, Puppet) that deploy via\n      PowerShell to TEMP paths\nlevel: medium",
            "pattern_type": "sigma",
            "valid_from": "2026-03-01T00:00:00Z",
            "labels": [
                "detection-rule"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--1d52ae5a-d1a2-528d-a1c3-ad86302eefc5",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.713377Z",
            "modified": "2026-10-11T14:08:49.857594Z",
            "name": "Process Claims MicrosoftEdgeUpdate Identity from Non-Standard Location",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "title: Process Claims MicrosoftEdgeUpdate Identity from Non-Standard Location\nid: 9d3e7a1f-4b8c-4e2a-b6d9-5c1f8e3a7b4d\nstatus: experimental\ndescription: >-\n  Detects a process whose reported CommandLine references\n  MicrosoftEdgeUpdate.exe while its Image path does not start with one of\n  the machine-wide Microsoft Edge update installation directories under\n  C:\\Program Files (x86) or C:\\Program Files. The\n  arg_spoof.C module in the WebServer-Compromise-Kit-45.94.31.220\n  toolkit overwrites the PEB CommandLine buffer with the hardcoded\n  string 'MicrosoftEdgeUpdate.exe --update-check --silent' to spoof\n  process-tree viewers and EDR rules that inspect CommandLine without\n  cross-referencing the true binary path. Generalized from the\n  campaign's exact hardcoded argument string to the broader\n  CommandLine-vs-Image mismatch pattern so the rule also covers a\n  rebuild that keeps the masquerade but changes the arguments; this\n  trades some campaign specificity for durability, so it is scoped as a\n  hunting lead rather than an alerting rule.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/sliver-open-directory-detections/\nauthor: The Hunters Ledger\ndate: 2026-02-28\nmodified: 2026-10-11\ntags:\n    - attack.stealth\n    - attack.t1036\n    - attack.t1036.005\n    - detection.emerging-threats\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_spoof_cmdline:\n        CommandLine|contains: 'MicrosoftEdgeUpdate.exe'\n    filter_legitimate_edge_update:\n        Image|startswith:\n            # sourced: documented platform default, machine-wide Edge and EdgeUpdate install roots\n            - 'C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\'\n            - 'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\'\n            - 'C:\\Program Files\\Microsoft\\EdgeUpdate\\'\n            - 'C:\\Program Files\\Microsoft\\Edge\\Application\\'\n            # sourced: Edge updater self-staging path described in the false-positive note above\n            - 'C:\\Program Files (x86)\\Microsoft\\Temp\\EU'\n    condition: selection_spoof_cmdline and not filter_legitimate_edge_update\nfalsepositives:\n    - >-\n      Legitimate Microsoft Edge update processes running from\n      non-standard installation paths, including a per-user install under\n      a profile directory or Windows installed on a drive other than C:\n      (uncommon but possible in enterprise repackaging scenarios)\n    - >-\n      Security tooling that simulates Edge update processes for testing\n      purposes\n    - >-\n      Any process whose command-line arguments happen to reference\n      MicrosoftEdgeUpdate.exe as a string without impersonating it\n      (rare)\nlevel: medium",
            "pattern_type": "sigma",
            "valid_from": "2026-03-01T00:00:00Z",
            "labels": [
                "detection-rule"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--a35e0671-c5e3-5dda-bfb8-c4e56e84f28e",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.713537Z",
            "modified": "2026-09-19T20:28:04.713537Z",
            "name": "compressed.exe",
            "description": "Same C2 configuration as OneDriveSync.exe. Compression ratio indicates 50% size reduction; use for bandwidth-constrained delivery scenarios.",
            "malware_types": [
                "backdoor"
            ],
            "is_family": false,
            "confidence": 95,
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--5b94c9e8-a0f7-51bc-b1b4-aee24f8a47fa",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.713666Z",
            "modified": "2026-09-19T20:28:04.713666Z",
            "name": "OneDriveSync.exe",
            "description": "Polymorphic builds may produce different hashes; use certificate serial (659EEB5AA4A489FB238993AF259D23F057F6D6D6) as more durable indicator. File can be executed to trigger full kill chain but requires elevated privileges for some evasion techniques.",
            "malware_types": [
                "backdoor"
            ],
            "is_family": false,
            "confidence": 95,
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "infrastructure",
            "spec_version": "2.1",
            "id": "infrastructure--45293914-4086-5703-9eab-784355ce3204",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.713758Z",
            "modified": "2026-09-19T20:28:04.713758Z",
            "name": "sliver-open-directory infrastructure",
            "infrastructure_types": [
                "command-and-control",
                "hosting"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e51b3637-9d19-5168-9021-d0f218e6c1ba",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.714266Z",
            "modified": "2026-09-19T20:28:04.714266Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--f0d906fd-c2d0-5c67-becb-f48377b0a012",
            "target_ref": "malware--a35e0671-c5e3-5dda-bfb8-c4e56e84f28e",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a3f13512-a633-5db5-a2d5-97f9d5a98a6c",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.71439Z",
            "modified": "2026-09-19T20:28:04.71439Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--cbcf22a2-8de8-55a5-b24e-ff0e8ac1eef0",
            "target_ref": "malware--a35e0671-c5e3-5dda-bfb8-c4e56e84f28e",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--31bebe49-dca7-589d-992a-08d27c775aee",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.714478Z",
            "modified": "2026-09-19T20:28:04.714478Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--8b6efd7b-c37c-59a1-bd8c-2f66ca147b27",
            "target_ref": "malware--a35e0671-c5e3-5dda-bfb8-c4e56e84f28e",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d38f8bee-be45-5d83-bbd5-99f07eb5600c",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.714554Z",
            "modified": "2026-09-19T20:28:04.714554Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--65a57841-bd46-566e-8bc1-6e004a89ca94",
            "target_ref": "malware--a35e0671-c5e3-5dda-bfb8-c4e56e84f28e",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--01d3cc48-74f0-55d9-9ae6-1fc60e28c70b",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.714645Z",
            "modified": "2026-09-19T20:28:04.714645Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--7b313cb4-961c-54b0-9d04-6af34ceb7cd8",
            "target_ref": "malware--a35e0671-c5e3-5dda-bfb8-c4e56e84f28e",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--01fc0e55-dceb-548c-9fb3-a38f851a1994",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.71472Z",
            "modified": "2026-09-19T20:28:04.71472Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--25c4bb20-6142-5af8-beaf-643b9f7918c3",
            "target_ref": "malware--a35e0671-c5e3-5dda-bfb8-c4e56e84f28e",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bd1f6143-4f8e-551e-b4af-47975b9c208a",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.714793Z",
            "modified": "2026-09-19T20:28:04.714793Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--3c1e1859-a04a-5217-be9a-df5e8cd36145",
            "target_ref": "malware--a35e0671-c5e3-5dda-bfb8-c4e56e84f28e",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--aef57850-b056-5d85-bb68-f642f4458c2d",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.714939Z",
            "modified": "2026-09-19T20:28:04.714939Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--2a6a61e7-a345-5cad-837e-2698f25a6f00",
            "target_ref": "malware--a35e0671-c5e3-5dda-bfb8-c4e56e84f28e",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f9195732-7f6f-54a2-a3ca-4511e96d6c20",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.715011Z",
            "modified": "2026-09-19T20:28:04.715011Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--4db5d131-8153-57af-8f1c-857a9fb38169",
            "target_ref": "malware--a35e0671-c5e3-5dda-bfb8-c4e56e84f28e",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--aa2c714f-cabb-5b57-b90a-c22fb239834a",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.714867Z",
            "modified": "2026-09-19T20:28:04.714867Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--83186ded-626d-5227-8a8d-296195e14af9",
            "target_ref": "malware--a35e0671-c5e3-5dda-bfb8-c4e56e84f28e",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8bd4b2f2-67dc-5eb5-bc9d-5cde2323a990",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.715084Z",
            "modified": "2026-09-19T20:28:04.715084Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--bd268db2-dc48-5911-a277-15fd7b927d78",
            "target_ref": "malware--a35e0671-c5e3-5dda-bfb8-c4e56e84f28e",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--73e717de-b65d-5373-a1c1-25750c5ff588",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.715157Z",
            "modified": "2026-09-19T20:28:04.715157Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--62697b30-6a22-51f5-b4ec-d86663005c3e",
            "target_ref": "malware--a35e0671-c5e3-5dda-bfb8-c4e56e84f28e",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e84d2b9b-dd00-5c60-bc43-742278a59e3f",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-10-11T14:08:49.859762Z",
            "modified": "2026-10-11T14:08:49.859762Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--73c42c46-457b-5f25-ad05-863eda205c21",
            "target_ref": "malware--a35e0671-c5e3-5dda-bfb8-c4e56e84f28e",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--06037815-9ad2-54fe-b042-294e9a16d704",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.71537Z",
            "modified": "2026-09-19T20:28:04.71537Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--af50ac5d-be15-5568-a501-6bddcfd36694",
            "target_ref": "malware--a35e0671-c5e3-5dda-bfb8-c4e56e84f28e",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2d32db40-987c-58ba-9ccc-489391aa61bf",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.715299Z",
            "modified": "2026-09-19T20:28:04.715299Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--23892274-db8d-5f23-b803-d47955951620",
            "target_ref": "malware--a35e0671-c5e3-5dda-bfb8-c4e56e84f28e",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8d84bd02-3746-50d9-9cf2-2bf8fb6a3143",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.715447Z",
            "modified": "2026-09-19T20:28:04.715447Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--2a9c6993-9b67-5fec-9e1b-ff75e25b0bef",
            "target_ref": "malware--a35e0671-c5e3-5dda-bfb8-c4e56e84f28e",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bec6ebf2-8340-53b0-8de1-7dac5873b159",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.715543Z",
            "modified": "2026-09-19T20:28:04.715543Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--9cd77d59-329c-5012-a181-694761d1f1b8",
            "target_ref": "malware--a35e0671-c5e3-5dda-bfb8-c4e56e84f28e",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b5fea4b1-7d6a-5184-8a4e-1081af0ba57e",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.715659Z",
            "modified": "2026-09-19T20:28:04.715659Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--1d52ae5a-d1a2-528d-a1c3-ad86302eefc5",
            "target_ref": "malware--a35e0671-c5e3-5dda-bfb8-c4e56e84f28e",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d920d856-8459-5acc-a218-8c6441e02eae",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.715758Z",
            "modified": "2026-09-19T20:28:04.715758Z",
            "relationship_type": "uses",
            "source_ref": "malware--a35e0671-c5e3-5dda-bfb8-c4e56e84f28e",
            "target_ref": "infrastructure--45293914-4086-5703-9eab-784355ce3204",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ca4dd57b-24a9-57ba-92c8-7655515cb90b",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.715863Z",
            "modified": "2026-09-19T20:28:04.715863Z",
            "relationship_type": "uses",
            "source_ref": "malware--5b94c9e8-a0f7-51bc-b1b4-aee24f8a47fa",
            "target_ref": "infrastructure--45293914-4086-5703-9eab-784355ce3204",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--ca5a5217-efd5-53a5-921f-c00641d56de7",
            "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d",
            "created": "2026-09-19T20:28:04.715996Z",
            "modified": "2026-10-11T14:08:49.860632Z",
            "name": "Open Directory Exposure: Sliver with ScareCrow Loader (45.94.31.220)",
            "report_types": [
                "threat-report"
            ],
            "published": "2026-03-01T00:00:00Z",
            "object_refs": [
                "ipv4-addr--673b2f0b-f30b-537c-b79b-a49d06291d17",
                "indicator--f0d906fd-c2d0-5c67-becb-f48377b0a012",
                "url--5ffaaf92-63a9-50c7-9a71-b1a264c6aa19",
                "indicator--cbcf22a2-8de8-55a5-b24e-ff0e8ac1eef0",
                "url--dab8b8af-d785-5e19-90ee-a2fb5f300a1a",
                "indicator--8b6efd7b-c37c-59a1-bd8c-2f66ca147b27",
                "domain-name--91ac696f-abc4-58d4-adbe-2d75863d521e",
                "indicator--65a57841-bd46-566e-8bc1-6e004a89ca94",
                "domain-name--bb25d0ae-ea44-5bee-b808-1c0ed9cffa79",
                "indicator--7b313cb4-961c-54b0-9d04-6af34ceb7cd8",
                "file--c932c7a5-0341-51be-b94d-785aafc18ed9",
                "indicator--25c4bb20-6142-5af8-beaf-643b9f7918c3",
                "file--05f7f599-786d-5edc-9479-c751201517e6",
                "indicator--3c1e1859-a04a-5217-be9a-df5e8cd36145",
                "domain-name--3dedd536-8d59-50c2-aa81-dbe8352df81b",
                "indicator--2a6a61e7-a345-5cad-837e-2698f25a6f00",
                "indicator--4db5d131-8153-57af-8f1c-857a9fb38169",
                "indicator--83186ded-626d-5227-8a8d-296195e14af9",
                "indicator--bd268db2-dc48-5911-a277-15fd7b927d78",
                "indicator--62697b30-6a22-51f5-b4ec-d86663005c3e",
                "indicator--73c42c46-457b-5f25-ad05-863eda205c21",
                "indicator--af50ac5d-be15-5568-a501-6bddcfd36694",
                "indicator--23892274-db8d-5f23-b803-d47955951620",
                "indicator--2a9c6993-9b67-5fec-9e1b-ff75e25b0bef",
                "indicator--9cd77d59-329c-5012-a181-694761d1f1b8",
                "indicator--1d52ae5a-d1a2-528d-a1c3-ad86302eefc5",
                "malware--a35e0671-c5e3-5dda-bfb8-c4e56e84f28e",
                "malware--5b94c9e8-a0f7-51bc-b1b4-aee24f8a47fa",
                "infrastructure--45293914-4086-5703-9eab-784355ce3204",
                "relationship--e51b3637-9d19-5168-9021-d0f218e6c1ba",
                "relationship--a3f13512-a633-5db5-a2d5-97f9d5a98a6c",
                "relationship--31bebe49-dca7-589d-992a-08d27c775aee",
                "relationship--d38f8bee-be45-5d83-bbd5-99f07eb5600c",
                "relationship--01d3cc48-74f0-55d9-9ae6-1fc60e28c70b",
                "relationship--01fc0e55-dceb-548c-9fb3-a38f851a1994",
                "relationship--bd1f6143-4f8e-551e-b4af-47975b9c208a",
                "relationship--aef57850-b056-5d85-bb68-f642f4458c2d",
                "relationship--f9195732-7f6f-54a2-a3ca-4511e96d6c20",
                "relationship--aa2c714f-cabb-5b57-b90a-c22fb239834a",
                "relationship--8bd4b2f2-67dc-5eb5-bc9d-5cde2323a990",
                "relationship--73e717de-b65d-5373-a1c1-25750c5ff588",
                "relationship--e84d2b9b-dd00-5c60-bc43-742278a59e3f",
                "relationship--06037815-9ad2-54fe-b042-294e9a16d704",
                "relationship--2d32db40-987c-58ba-9ccc-489391aa61bf",
                "relationship--8d84bd02-3746-50d9-9cf2-2bf8fb6a3143",
                "relationship--bec6ebf2-8340-53b0-8de1-7dac5873b159",
                "relationship--b5fea4b1-7d6a-5184-8a4e-1081af0ba57e",
                "relationship--d920d856-8459-5acc-a218-8c6441e02eae",
                "relationship--ca4dd57b-24a9-57ba-92c8-7655515cb90b"
            ],
            "labels": [
                "C2",
                "Loader",
                "Go",
                "Evasion"
            ],
            "external_references": [
                {
                    "source_name": "The Hunters Ledger",
                    "url": "https://the-hunters-ledger.com/reports/sliver-open-directory/"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        }
    ]
}