XFEDI

#DFIR

ActivityPub

Public posts with this hashtag.

2026-10-19 RDP #Honeypot IOCs - 8964 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
154.36.174.33 - 7245
45.154.96.17 - 1566
136.244.100.79 - 18

Top ASNs:
AS979 - 7245
AS212815 - 1566
AS396982 - 36

Top Accounts:
hello - 7278
administrator - 108
Administrator - 90

Top ISPs:
NetLab Global - 7245
Dyjix SAS - 1566
Google LLC - 36

Top Clients:
Unknown - 8964

Top Software:
Unknown - 8964

Top Keyboards:
Unknown - 8964

Top IP Classification:
Unknown - 7263
hosting - 1695
mobile - 3

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original

RDP Snitch@[email protected]

2026-10-19 RDP #Honeypot IOCs - 5976 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
154.36.174.33 - 4830
45.154.96.17 - 1044
136.244.100.79 - 12

Top ASNs:
AS979 - 4830
AS212815 - 1044
AS396982 - 24

Top Accounts:
hello - 4852
administrator - 72
Administrator - 60

Top ISPs:
NetLab Global - 4830
Dyjix SAS - 1044
Google LLC - 24

Top Clients:
Unknown - 5976

Top Software:
Unknown - 5976

Top Keyboards:
Unknown - 5976

Top IP Classification:
Unknown - 4842
hosting - 1130
mobile - 2

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original

RDP Snitch@[email protected]

2026-10-19 RDP #Honeypot IOCs - 2988 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
154.36.174.33 - 2415
45.154.96.17 - 522
136.244.100.79 - 6

Top ASNs:
AS979 - 2415
AS212815 - 522
AS396982 - 12

Top Accounts:
hello - 2426
administrator - 36
Administrator - 30

Top ISPs:
NetLab Global - 2415
Dyjix SAS - 522
Google LLC - 12

Top Clients:
Unknown - 2988

Top Software:
Unknown - 2988

Top Keyboards:
Unknown - 2988

Top IP Classification:
Unknown - 2421
hosting - 565
mobile - 1

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key

#CyberSec #SOC #Blueteam #SecOps #Security

↩ Reply ♡ 0 · ↻ 0 ↗ Original

josehelps@[email protected]

↳ In reply to a post

Easy hunts: RuntimeBroker.exe running from %LOCALAPPDATA%\Microsoft\RuntimeBrokers, or a vshost*.exe with a .config next to it on a box that is not a dev machine. And if your users do not build code, MSBuild does not need to run there.

https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/

Prevent MSBuild from running where it is not needed with app control, free with https://MagicSword.io: https://magicsword.io

#ThreatHunting #LOLBAS #DFIR

Unit 42Blinder Tunnel Campaign Targets Iraqi InfrastructureAnalysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure.

↩ Reply ♡ 0 · ↻ 0 ↗ Original