192.168.4.27:443·SHA256:a4b2c9d8·SYN_RECV·10.0.0.1:8080·TLS1.3·CERT_VALID·SCAN:PORT·443·THREAT:AMBER·IDS:ALERT·7429·CERT:47d·FIREWALL:ACTIVE·RULE:7842·DROP:SYN·FROM:103.42.18.0/24·NMAP·-sS·-sV·HOST:10.0.0.0/8·PORTS:22,80,443·STATE:OPEN·SERVICE:SSH·VERSION:8.9 192.168.4.27:443·SHA256:a4b2c9d8·SYN_RECV·10.0.0.1:8080·TLS1.3·CERT_VALID·SCAN:PORT·443·THREAT:AMBER·IDS:ALERT·7429·CERT:47d·FIREWALL:ACTIVE·RULE:7842·DROP:SYN·FROM:103.42.18.0/24·NMAP·-sS·-sV·HOST:10.0.0.0/8·PORTS:22,80,443·STATE:OPEN·SERVICE:SSH·VERSION:8.9
CVE-2026-4271·CVSS:9.1·VECTOR:NETWORK·COMPLEXITY:LOW·PRIVILEGE:NONE·SCOPE:CHANGED·IMPACT:HIGH·PATCH:AVAILABLE·STATUS:REMEDIATED·HASH:e7f1a2b3c4d5·SIGNATURE:UPDATED·192.168.1.0/24·SCAN:COMPLETE·HOSTS:247·OPEN:1247·FILTERED:89·CLOSED:42871 CVE-2026-4271·CVSS:9.1·VECTOR:NETWORK·COMPLEXITY:LOW·PRIVILEGE:NONE·SCOPE:CHANGED·IMPACT:HIGH·PATCH:AVAILABLE·STATUS:REMEDIATED·HASH:e7f1a2b3c4d5·SIGNATURE:UPDATED·192.168.1.0/24·SCAN:COMPLETE·HOSTS:247·OPEN:1247·FILTERED:89·CLOSED:42871
NMAP·-sS·-sV·-O·-T4·HOST:10.0.0.0/8·PORTS:22,80,443,8080,3306·STATE:OPEN·SERVICE:SSH·VERSION:8.9·OS:LINUX·5.15·TTL:64·HOP:3·LATENCY:2.4ms·CERT:RSA-4096·SYN_ACK·192.168.4.27·TLS1.3·HANDSHAKE:OK·CIPHER:AES256-GCM NMAP·-sS·-sV·-O·-T4·HOST:10.0.0.0/8·PORTS:22,80,443,8080,3306·STATE:OPEN·SERVICE:SSH·VERSION:8.9·OS:LINUX·5.15·TTL:64·HOP:3·LATENCY:2.4ms·CERT:RSA-4096·SYN_ACK·192.168.4.27·TLS1.3·HANDSHAKE:OK·CIPHER:AES256-GCM
YARA:MATCH·RULE:APT41_LOADER·FILE:svchost.dll·MD5:7a3c4b·SIGMA:T1059.001·MITRE:TA0002·SEVERITY:CRITICAL·ACTION:QUARANTINE·SANDBOX:DETONATED·C2:45.77.12.0·PROTOCOL:HTTPS·BEACON:30s·EXFIL:DNS·TUNNEL:ACTIVE·BLOCK:APPLIED YARA:MATCH·RULE:APT41_LOADER·FILE:svchost.dll·MD5:7a3c4b·SIGMA:T1059.001·MITRE:TA0002·SEVERITY:CRITICAL·ACTION:QUARANTINE·SANDBOX:DETONATED·C2:45.77.12.0·PROTOCOL:HTTPS·BEACON:30s·EXFIL:DNS·TUNNEL:ACTIVE·BLOCK:APPLIED
PCAP:ANALYZE·PACKETS:1.2M·TCP:847K·UDP:312K·ICMP:41K·DNS:89K·HTTP:234K·TLS:512K·ANOMALY:17·BASELINE:UPDATED·ENTROPY:7.2·SIGNATURE:MATCH·ALERT:IDS-7429·PRIORITY:HIGH·ACTION:INVESTIGATE PCAP:ANALYZE·PACKETS:1.2M·TCP:847K·UDP:312K·ICMP:41K·DNS:89K·HTTP:234K·TLS:512K·ANOMALY:17·BASELINE:UPDATED·ENTROPY:7.2·SIGNATURE:MATCH·ALERT:IDS-7429·PRIORITY:HIGH·ACTION:INVESTIGATE
OSINT:COLLECT·SOURCES:47·DOMAINS:1.2K·IPS:4.8K·EMAILS:234·HASHES:89·URLS:1.4K·CERTIFICATES:67·WHOIS:42·PASSIVE.DNS:890·THREAT.INTEL:UPDATED·IOC:ENRICHED·CONFIDENCE:HIGH·ATTRIBUTION:APT41 OSINT:COLLECT·SOURCES:47·DOMAINS:1.2K·IPS:4.8K·EMAILS:234·HASHES:89·URLS:1.4K·CERTIFICATES:67·WHOIS:42·PASSIVE.DNS:890·THREAT.INTEL:UPDATED·IOC:ENRICHED·CONFIDENCE:HIGH·ATTRIBUTION:APT41
THREAT:AMBER IDS:7429 CVE-2026-4271 CVSS:9.1 FIREWALL:ACTIVE RULE:7842 BLOCK:103.42.18.0/24 SCAN:COMPLETE HOSTS:247 OPEN:1247 FILTERED:89 SHA256:a4b2c9d8 THREAT:AMBER IDS:7429 CVE-2026-4271 CVSS:9.1 FIREWALL:ACTIVE RULE:7842 BLOCK:103.42.18.0/24 SCAN:COMPLETE HOSTS:247 OPEN:1247 FILTERED:89 SHA256:a4b2c9d8 THREAT:AMBER IDS:7429 CVE-2026-4271 CVSS:9.1 FIREWALL:ACTIVE RULE:7842 BLOCK:103.42.18.0/24 SCAN:COMPLETE HOSTS:247 OPEN:1247 FILTERED:89 SHA256:a4b2c9d8
PCAP:1.2M TCP:847K ANOMALY:17 ENTROPY:7.2 SIGNATURE:MATCH ALERT:HIGH YARA:APT41 MITRE:TA0002 C2:45.77.12.0 BEACON:30s EXFIL:DNS SANDBOX:DETONATED PCAP:1.2M TCP:847K ANOMALY:17 ENTROPY:7.2 SIGNATURE:MATCH ALERT:HIGH YARA:APT41 MITRE:TA0002 C2:45.77.12.0 BEACON:30s EXFIL:DNS SANDBOX:DETONATED PCAP:1.2M TCP:847K ANOMALY:17 ENTROPY:7.2 SIGNATURE:MATCH ALERT:HIGH YARA:APT41 MITRE:TA0002 C2:45.77.12.0 BEACON:30s EXFIL:DNS SANDBOX:DETONATED
THREAT.LVL: AMBER CONN: 4.2K ACTIVE SHA256: a4b2c9d8 SCAN: PORT 443 CVE:9.1 IDS:7429 TLS1.3 FIREWALL SHA256:a4b2 YARA:MATCHSCAN:443PCAP 4A 6B 7A 3C B8 90
D4 A5 2F 17 8C 41
E6 D2 5B 98 31 AF
CVE:9.1
FIREWALL
THREAT
FIREWALL
94
