STIX2 json for 2026-07-05

Jul 05, 2026 STIX2

STIX2 json for all bruteforce attempts for 2026-07-05

Last Updated: 11:07 UTC

Download STIX2 json File

']", "pattern_type": "stix", "valid_from": "2026-07-05T00:00:00.000Z", "valid_until": "2026-08-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-07-05-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:ssh", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-07-06T11:00:01.555Z", "modified": "2026-07-06T11:00:01.555Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5fab966-f20d-45f2-9c1f-d90c5de3b86b", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, SSH, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '']", "pattern_type": "stix", "valid_from": "2026-07-05T00:00:00.000Z", "valid_until": "2026-08-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-07-05-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:ssh", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-07-06T11:00:01.555Z", "modified": "2026-07-06T11:00:01.555Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17094c24-7119-4746-8f2e-43ef28dd3b85", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, SSH, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '']", "pattern_type": "stix", "valid_from": "2026-07-05T00:00:00.000Z", "valid_until": "2026-08-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-07-05-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:ssh", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-07-06T11:00:01.555Z", "modified": "2026-07-06T11:00:01.555Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48bc2f55-dae1-4d14-a0fe-c3a5c3ac3688", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, SSH, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '']", "pattern_type": "stix", "valid_from": "2026-07-05T00:00:00.000Z", "valid_until": "2026-08-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-07-05-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:ssh", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-07-06T11:00:01.555Z", "modified": "2026-07-06T11:00:01.555Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6da800cf-b61e-4cd7-abc5-7503859a1589", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, SSH, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = ';

Share on: